5 ms·

Well, it allows you to track which packages are used how much and gather ip addresses of your users. IP addresses being the only "personal" data the new teleme

Well, it allows you to track which packages are used how much and gather ip addresses of your users. IP addresses being the only "personal" data the new telemetry proposal would plausibly be able to gather as well, which a lot of folks are complaining about. Just to be clear, I don't think the Go module proxy is a bad thing, just saying that we've already crossed that "threshold" of potential personal data collection long ago.

Thaxll 4y ago
Are you saying that package mgmt solution should not use network to download actual packages?
- cube2222 4y ago
  Nope, I think the go module proxy is just fine. See my other response[0] for an explanation of what I meant. [0]: https://news.ycombinator.com/item?id=34773848 https://news.ycombinator.com/item?id=34773848
- bmacho 4y ago
  It definitely only should use network when I invoke the download package command.
- nishs 4y ago
  No, but the go tool/package manager doesn’t necessarily, by default, have to proxy each requested module through Google run servers. It can fetch modules directly from the source. That said, I don’t think that the go tool’s current behavior in regards to the module proxy server can be considered as phoning home. The proposed metrics collection however absolutely would be bad phoning home behavior.
arp242 4y ago
> Well, it allows you to track which packages are used how much and gather ip addresses of your users. So does Rubygems, PyPI, npm, or any other package tool. If you want to have a broader discussion about package tools: be my guest. But people misrepresenting and banging on about the Go proxy specifically got boring a long time ago.
- cube2222 4y ago
  I haven't misrepresented anything. I have also mentioned I don't think the Go module proxy is a bad thing. I think it's a good thing. I understand why it's there. We share the same opinion I think, in general. What I am arguing is that the people who are saying "this new telemetry design could allow them to gather ip addresses - which are 'personal' data" are arguing over a ship that has sailed years ago. Apologies if I wasn't being clear enough.
  - arp242 4y ago
    You're right; I probably read too much in your comments while they're more nuanced than I took them for. My apologies. I think we actually mostly agree. It's just that people bring up Go proxy every time anything is discussed about Go (and some distros like Debian even disable it) with what I can only describe as unfair accusations that are levelled against Go uniquely and not against any other system with similar behaviour.

Thaxll 4y ago

Are you saying that package mgmt solution should not use network to download actual packages?

cube2222 4y ago
Nope, I think the go module proxy is just fine. See my other response[0] for an explanation of what I meant. [0]: https://news.ycombinator.com/item?id=34773848 https://news.ycombinator.com/item?id=34773848
bmacho 4y ago
It definitely only should use network when I invoke the download package command.
nishs 4y ago
No, but the go tool/package manager doesn’t necessarily, by default, have to proxy each requested module through Google run servers. It can fetch modules directly from the source. That said, I don’t think that the go tool’s current behavior in regards to the module proxy server can be considered as phoning home. The proposed metrics collection however absolutely would be bad phoning home behavior.

arp242 4y ago

> Well, it allows you to track which packages are used how much and gather ip addresses of your users. So does Rubygems, PyPI, npm, or any other package tool. If you want to have a broader discussion about package tools: be my guest. But people misrepresenting and banging on about the Go proxy specifically got boring a long time ago.

cube2222 4y ago
I haven't misrepresented anything. I have also mentioned I don't think the Go module proxy is a bad thing. I think it's a good thing. I understand why it's there. We share the same opinion I think, in general. What I am arguing is that the people who are saying "this new telemetry design could allow them to gather ip addresses - which are 'personal' data" are arguing over a ship that has sailed years ago. Apologies if I wasn't being clear enough.
- arp242 4y ago
  You're right; I probably read too much in your comments while they're more nuanced than I took them for. My apologies. I think we actually mostly agree. It's just that people bring up Go proxy every time anything is discussed about Go (and some distros like Debian even disable it) with what I can only describe as unfair accusations that are levelled against Go uniquely and not against any other system with similar behaviour.