3 ms·
Sometimes barrier to entry is good. For example, both npm and cargo struggle with package name squatting and malicious packages that are miss spellings of commo
by vips7L 2y ago
Sometimes barrier to entry is good. For example, both npm and cargo struggle with package name squatting and malicious packages that are miss spellings of common packages.
- iamcalledrob 2y agoThis isn't an issue in the Go ecosystem, because the package name is the GitHub repo. I don't think a high barrier to entry is overall good, in fact I think it encourages larger more complex packages to justify the maintenance burden
- mdaniel 2y agoPedantically, that's only one way to resolve a go package - and for sure the more obvious[1] - but the most famous one I know of is gopkg.in/yaml.whatever that uses a <meta> tag to redirect to its actual GH repo, which only the deepest golang ninja would know how to use: compare view-source:https://gopkg.in/yaml.v3 https://gopkg.in/yaml.v3 with view-source:https://gopkg.in/yaml.v3?go-get=1 https://gopkg.in/yaml.v3?go-get=1 1: err, modulo that go.mod stuff that secretly adds a version slug to an otherwise normal github URL -- I'm looking at you, Pulumi: https://github.com/pulumi/pulumi/blob/v3.137.0/sdk/go.mod#L1 https://github.com/pulumi/pulumi/blob/v3.137.0/sdk/go.mod#L1