12 ms·
It's worth noting that the proxy and pinning behavior actually help with scope a fair bit. The threat is still there for new versions, but both visibility and e
by raggi 3y ago
It's worth noting that the proxy and pinning behavior actually help with scope a fair bit. The threat is still there for new versions, but both visibility and external controls can still help.
- rollcat 3y agoI wish GOPROXY was a little more... obvious? The way it's working feels like it's trying to hide something, for whatever reason. For a long time I did not even realize that all of my Go package installations were going through Google-controlled infrastructure by default; something I'd object to had I known sooner. The cache also tends to serve the last working release, rather than the one that's actually the latest, so you sometimes don't even realize that the tip is broken. I can forgive most things, but not hiding errors, especially as I bash my head against the keyboard. On top of that, proxy.golang.org has historically not been playing nice with upstream repository servers[1]. I tend to keep GOPROXY=direct in my environment for these reasons. [1]: https://sourcehut.org/blog/2023-01-09-gomodulemirror/ https://sourcehut.org/blog/2023-01-09-gomodulemirror/