Yes, and I think the OP would've been better served by linking to the proxy page rather than its privacy policy. I can understand why, however. Privacy, proxies

Yes, and I think the OP would've been better served by linking to the proxy page rather than its privacy policy. I can understand why, however. Privacy, proxies, and private repos are all inter-related but it might not be obvious to people who don't use Go regularly or haven't followed the introduction of proxies. The problem is that if you don't set up your environment, set it up partially, or set it up incorrectly, some information about private repositories will be sent to Google[1]. One solution is to use the envvar GONOSUMDB (either set from your shell's rc file or, preferably, from `go env`), thus instructing Go which domains it should not validate against the checksum database. Some individuals may not see this as an issue since private repos will fail to download via the default GOPROXY (`go get` should revert to "direct" mode) and nothing gets stored in the sumdb. However, Google does apparently log this information internally, and that's where the privacy issue arises. For additional protection, you can set GOPROXY to your own self-hosted server, such as Athens, and configure it similarly so it'll reject such sumdb requests with a 403 to catch clients using only GOPROXY. But, you still have to remember to set GOPROXY (at a minimum), which means that if you or anyone in your organization forgets this bit, you're back where you started and you're probably sending information about your private repos to Google. Again. Since this relies on envvars or the Go env stored in ~/.config/go/env (as an example) to set the behavior globally, you have to assume developers will correctly configuring every system they use. The GitHub issue is mostly centered on having a way to do this per-repository, and I honestly think that would have been a better solution, even combined with the `go env` settings. Personally, it doesn't bother me too much, because an external immutable append-only log of commits in upstream packages will catch nefarious changes, so I think the benefits probably outweigh the privacy concerns until I see an adequate argument countering this. Regardless, I still have my `go env` set up to ignore my private repositories. [1] The documentation says Google only logs the paths and doesn't publish them for private repositories their proxy fails to download. I thought I read somewhere that you can still use the sumdb for private repos, but it would instead send something like a SHA256 sum of the path for additional privacy. It might've been a proposal, and I can't find it now.