3 ms·

Paragraphs 3, 4 & 5 of TFA speak directly to the benefits of a module proxy and mirror w.r.t. module availability & performance.

donatj 7y ago
Which is what I’m attempting to refute the need for. These are solved and non-problems respectively.
- lokar 7y ago
  The point about go.mod only protecting you from changes after you first use it is valid.
- skybrian 7y ago
  You're saying things work fine for you, but it doesn't follow that they work fine for everyone else. Maybe there are larger Go modules out there than the largest one you've personally built? Or people with slower network access to Github? (Consider China and Australia.) Or maybe they're anticipating that there will be larger Go projects in the future?
  - aloknnikhil 7y ago
    Most Go projects are hosted on Github. Github is backed by a global CDN and can handle significantly large projects. I don't think the focus of this project was to address slow network access. It was primarily driven by the need to analyze dependency usage and perhaps add redundancy to some extent.
    - FiloSottile 7y ago
      Fetching a module from GitHub often requires cloning the repository, when all you needed was the contents of a specific version, or even just the go.mod to do version resolution. The proxy protocol provides the artifacts you need, for sometimes a 10x bandwidth saving. (Also, lots of security issues in "go get" came from using git to fetch untrusted repositories.)
      - aloknnikhil 7y ago
        Ok that makes sense. Thanks! Also, this sounds like a perfectly neat use case for svn sparse check-out.
- ownagefool 7y ago
  Another reason is what if upstream deletes the package? What if github goes down? Still, maybe we are better off vendoring packages. At least that would make us consider our use of deps.
FiloSottile 7y ago
And the Checksum Database section of the post explains how it provides security above and beyond a go.sum file. For example, it enables untrusted proxies, guarantees that targeted attacks are not possible, and provides accountability for the operator. The talk is also an excellent explanation of why proxy and sumdb are valuable. (EDIT: direct link to the recording https://youtu.be/KqTySYYhPUE https://youtu.be/KqTySYYhPUE)

donatj 7y ago

Which is what I’m attempting to refute the need for. These are solved and non-problems respectively.

lokar 7y ago
The point about go.mod only protecting you from changes after you first use it is valid.
skybrian 7y ago
You're saying things work fine for you, but it doesn't follow that they work fine for everyone else. Maybe there are larger Go modules out there than the largest one you've personally built? Or people with slower network access to Github? (Consider China and Australia.) Or maybe they're anticipating that there will be larger Go projects in the future?
- aloknnikhil 7y ago
  Most Go projects are hosted on Github. Github is backed by a global CDN and can handle significantly large projects. I don't think the focus of this project was to address slow network access. It was primarily driven by the need to analyze dependency usage and perhaps add redundancy to some extent.
  - FiloSottile 7y ago
    Fetching a module from GitHub often requires cloning the repository, when all you needed was the contents of a specific version, or even just the go.mod to do version resolution. The proxy protocol provides the artifacts you need, for sometimes a 10x bandwidth saving. (Also, lots of security issues in "go get" came from using git to fetch untrusted repositories.)
    - aloknnikhil 7y ago
      Ok that makes sense. Thanks! Also, this sounds like a perfectly neat use case for svn sparse check-out.
ownagefool 7y ago
Another reason is what if upstream deletes the package? What if github goes down? Still, maybe we are better off vendoring packages. At least that would make us consider our use of deps.

FiloSottile 7y ago

And the Checksum Database section of the post explains how it provides security above and beyond a go.sum file. For example, it enables untrusted proxies, guarantees that targeted attacks are not possible, and provides accountability for the operator. The talk is also an excellent explanation of why proxy and sumdb are valuable. (EDIT: direct link to the recording https://youtu.be/KqTySYYhPUE https://youtu.be/KqTySYYhPUE)