5 ms·

The fact that a programming language calls home to by Google by default should make it a non-starter for most sane developers. The fact that it calls home so it

The fact that a programming language calls home to by Google by default should make it a non-starter for most sane developers. The fact that it calls home so it can DDoS other sites is low-key hilarious. And you'd think Google would know how to like... operate an efficient CDN, perhaps? Like, if this was managed by a competent company, you'd think this service would be akin to putting Cloudflare in front of your servers: It should minimize the heck out of your traffic because Google is able to cache it and serve it to the masses more efficiently. But it's Google, so it Googles. Being blocked from the issue tracker for not being okay with being DDoS'd is peak Google. I am sure you were accused of a Code of Conduct violation, because declaring a CoC violation is much, much cheaper than fixing their infrastructure.

sascha_sl 4y ago
Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?
- ocdtrekkie 4y ago
  I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.
  - pretext-1 4y ago
    No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY). If you look at it, it's pretty similar. The part before the first slash is invisible: npmjs.com/org/package proxy.golang.org/org.com/package The difference with Go is that you can actually change the first part if you want, or even disable it.
- bsder 4y ago
  Yes. I find all of the modern "always connected, always call home" behaviors quite annoying in my programming tools. But, to be fair, Node was a dumpster fire long before being bought by Microsoft.
  - deleted 4y ago
    [deleted]
- ezfe 4y ago
  How could node not do that? NPM hosts all the packages so of course it does.
  - pretext-1 4y ago
    They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".
    - ezfe 4y ago
      Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't
  - my69thaccount 4y ago
    IPFS/bittorrent for P2P
- jaywalk 4y ago
  If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.
  - sangnoir 4y ago
    Same for Go, only thsy Go has an opt-out "registry" rather than opt-in.
- dgb23 4y ago
  The problems with npm are completely orthogonal to what the author is describing here.
- my69thaccount 4y ago
  I mean, yes, it would be valid to complain about that as well
tptacek 4y ago
You can phone anywhere you want; the proxy is configurable, and there are (from what I can see) several independent implementations of the proxy itself. Go defaults to Google's proxy; few people change the default because Google's proxy is very good.
- yjftsjthsd-h 4y ago
  > Go defaults to Google's proxy; few people change the default because Google's proxy is very good. What percentage of users do you think actually know that the proxy is even there?
- ocdtrekkie 4y ago
  This article strongly suggests Google's proxy is not "good", even if it "works". It sounds atrociously inefficient.
  - verdverm 4y ago
    It brings a lot of security to the Golang dependency system. It is more than just a dumb proxy or cache
    - ajford 4y ago
      Smarter than your average proxy, but apparently dumb enough it doesn't actually cache at all, according to the reports.
      - tptacek 4y ago
        Obviously it does cache, because the simplest solution offered by the Go team is to exclude sr.ht from the cache refresh that DeVault is complaining about, and he hasn't taken them up on that.
        RealStickman_ 4y ago
        If it's such a widespread problem that there is a process to exclude domains from the cache refresh, doesn't that point to it being an issue that should be fixed by the party responsible instead of everybody else separately?
Beltalowda 4y ago
> The fact that a programming language calls home to by Google by default should make it a non-starter for most sane developers. How is it any different from Rubygems, NPM, PyPi, or any other package repository? In most you can bypass it by using git repos, but almost no one does that. And the GOPROXY does offer real benefits, such as preventing left-pad problems. As others have said, if you really think this is a huge problem for you then it's easy to disable, which is actually easier than what most other package managers offer, but I don't really see the harm in the first place.
tete 4y ago
Go was originally advertised as Google "sponsoring" Rob Pike & Co. to create a programming language. For a while it even sounded like the Java, Python, C++ devs at Google didn't even like it. The website focused on the programming language, was basically in Plan 9 style, no nonsense, the programming language sane and very cross-platform. Things changed. Now one has to scroll through big company brands and marketing blabla to even get a glimpse of the language, there's big Google logos, everything is JavaScript heavy, really well written[1] tutorials got hidden and there is now tutorials with mistakes and bad code that got pointed out[2], but are "won't fix", a programming language where people used to admit that new() is kind of redundant and maybe wasn't the idea tries to pull in random programming language features[3]. On top of that it was a programming language starting out to embrace the fact that there are many different operating systems officially supporting even Plan 9, DragonFly, etc., but after already having started to hollow that out creating tiers it seems they now completely want to shift away from that[4]. And then of course there's things like the module proxy causing issues. People got their hopes up, but it almost feels like Google is pulling an embrace, extend, extinguish on Go - or at least its original design. But I still hope that I am just seeing things that aren't there. [1] https://go.dev/doc/effective_go https://go.dev/doc/effective_go [2] https://groups.google.com/g/golang-dev/c/kC7YZsHTw4Y/m/u0_d9lQoAwAJ https://groups.google.com/g/golang-dev/c/kC7YZsHTw4Y/m/u0_d9... [3] https://github.com/golang/go/issues/21498#issuecomment-1132271548 https://github.com/golang/go/issues/21498#issuecomment-11322... [4] https://github.com/golang/go/discussions/53060 https://github.com/golang/go/discussions/53060

sascha_sl 4y ago

Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?

ocdtrekkie 4y ago
I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.
- pretext-1 4y ago
  No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY). If you look at it, it's pretty similar. The part before the first slash is invisible: npmjs.com/org/package proxy.golang.org/org.com/package The difference with Go is that you can actually change the first part if you want, or even disable it.
bsder 4y ago
Yes. I find all of the modern "always connected, always call home" behaviors quite annoying in my programming tools. But, to be fair, Node was a dumpster fire long before being bought by Microsoft.
- deleted 4y ago
  [deleted]
ezfe 4y ago
How could node not do that? NPM hosts all the packages so of course it does.
- pretext-1 4y ago
  They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".
  - ezfe 4y ago
    Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't
- my69thaccount 4y ago
  IPFS/bittorrent for P2P
jaywalk 4y ago
If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.
- sangnoir 4y ago
  Same for Go, only thsy Go has an opt-out "registry" rather than opt-in.
dgb23 4y ago
The problems with npm are completely orthogonal to what the author is describing here.
my69thaccount 4y ago
I mean, yes, it would be valid to complain about that as well

tptacek 4y ago

You can phone anywhere you want; the proxy is configurable, and there are (from what I can see) several independent implementations of the proxy itself. Go defaults to Google's proxy; few people change the default because Google's proxy is very good.

yjftsjthsd-h 4y ago
> Go defaults to Google's proxy; few people change the default because Google's proxy is very good. What percentage of users do you think actually know that the proxy is even there?
ocdtrekkie 4y ago
This article strongly suggests Google's proxy is not "good", even if it "works". It sounds atrociously inefficient.
- verdverm 4y ago
  It brings a lot of security to the Golang dependency system. It is more than just a dumb proxy or cache
  - ajford 4y ago
    Smarter than your average proxy, but apparently dumb enough it doesn't actually cache at all, according to the reports.
    - tptacek 4y ago
      Obviously it does cache, because the simplest solution offered by the Go team is to exclude sr.ht from the cache refresh that DeVault is complaining about, and he hasn't taken them up on that.
      - RealStickman_ 4y ago
        If it's such a widespread problem that there is a process to exclude domains from the cache refresh, doesn't that point to it being an issue that should be fixed by the party responsible instead of everybody else separately?

Beltalowda 4y ago

> The fact that a programming language calls home to by Google by default should make it a non-starter for most sane developers. How is it any different from Rubygems, NPM, PyPi, or any other package repository? In most you can bypass it by using git repos, but almost no one does that. And the GOPROXY does offer real benefits, such as preventing left-pad problems. As others have said, if you really think this is a huge problem for you then it's easy to disable, which is actually easier than what most other package managers offer, but I don't really see the harm in the first place.

tete 4y ago

Go was originally advertised as Google "sponsoring" Rob Pike & Co. to create a programming language. For a while it even sounded like the Java, Python, C++ devs at Google didn't even like it. The website focused on the programming language, was basically in Plan 9 style, no nonsense, the programming language sane and very cross-platform. Things changed. Now one has to scroll through big company brands and marketing blabla to even get a glimpse of the language, there's big Google logos, everything is JavaScript heavy, really well written[1] tutorials got hidden and there is now tutorials with mistakes and bad code that got pointed out[2], but are "won't fix", a programming language where people used to admit that new() is kind of redundant and maybe wasn't the idea tries to pull in random programming language features[3]. On top of that it was a programming language starting out to embrace the fact that there are many different operating systems officially supporting even Plan 9, DragonFly, etc., but after already having started to hollow that out creating tiers it seems they now completely want to shift away from that[4]. And then of course there's things like the module proxy causing issues. People got their hopes up, but it almost feels like Google is pulling an embrace, extend, extinguish on Go - or at least its original design. But I still hope that I am just seeing things that aren't there. [1] https://go.dev/doc/effective_go https://go.dev/doc/effective_go [2] https://groups.google.com/g/golang-dev/c/kC7YZsHTw4Y/m/u0_d9lQoAwAJ https://groups.google.com/g/golang-dev/c/kC7YZsHTw4Y/m/u0_d9... [3] https://github.com/golang/go/issues/21498#issuecomment-1132271548 https://github.com/golang/go/issues/21498#issuecomment-11322... [4] https://github.com/golang/go/discussions/53060 https://github.com/golang/go/discussions/53060