3 ms·

> IP addresses exposed by the HTTP session that uploads the report are not recorded with the reports. Like pinky promise, trust me bro. This whole thing looks

> IP addresses exposed by the HTTP session that uploads the report are not recorded with the reports. Like pinky promise, trust me bro. This whole thing looks delusional. I hope someone is going to create a fork as Golang team has lost their marbles.

tgv 3y ago
There aren't many orgs and people I would trust over this, but the go team gets the benefit of the doubt. They've proven that they're serious.
ericpauley 3y ago
What is the point of a fork? Just don't opt in.
- varispeed 3y ago
  That answer it akin to "just use VPN" every time there is announcement of some kind of censorship of the web. The point is, this is just introducing another security threat to worry about. You now have to be aware that the toolchain can call home and ensure it doesn't happen. Someone might misconfigure it or you don't know if a release comes that has a "bug" and it sends telemetry regardless of settings. This is just completely wrong and should be nipped in the bud. The mere fact that they are pressing ahead with this is sinister. These things are never about "oh just don't opt in". If someone really feels the need to send telemetry to Google and be spied on, they should use a completely separate tool that is not included in the toolchain.
  - remram 3y ago
    Every program can call home, if it doesn't do what its author says it does. This is not specific to compiler toolchains, or this toolchain, and is not new.
    - varispeed 3y ago
      aka "everything can happen" straw man. There is a difference between anything might happen in the future vs something specific is going to happen.
      - remram 3y ago
        That's exactly my point. The Go developers promise that it doesn't call home (unless you opt in), just like every other developer promise that their program doesn't call home. If you don't trust developers' promises, why is one of those worse?

tgv 3y ago

There aren't many orgs and people I would trust over this, but the go team gets the benefit of the doubt. They've proven that they're serious.

ericpauley 3y ago

What is the point of a fork? Just don't opt in.

varispeed 3y ago
That answer it akin to "just use VPN" every time there is announcement of some kind of censorship of the web. The point is, this is just introducing another security threat to worry about. You now have to be aware that the toolchain can call home and ensure it doesn't happen. Someone might misconfigure it or you don't know if a release comes that has a "bug" and it sends telemetry regardless of settings. This is just completely wrong and should be nipped in the bud. The mere fact that they are pressing ahead with this is sinister. These things are never about "oh just don't opt in". If someone really feels the need to send telemetry to Google and be spied on, they should use a completely separate tool that is not included in the toolchain.
- remram 3y ago
  Every program can call home, if it doesn't do what its author says it does. This is not specific to compiler toolchains, or this toolchain, and is not new.
  - varispeed 3y ago
    aka "everything can happen" straw man. There is a difference between anything might happen in the future vs something specific is going to happen.
    - remram 3y ago
      That's exactly my point. The Go developers promise that it doesn't call home (unless you opt in), just like every other developer promise that their program doesn't call home. If you don't trust developers' promises, why is one of those worse?