Thread

Don't couple your Go code to GitHub

323 points · 177 comments · birdculture

Loading the complete thread in the background. This saved snapshot is available now. Refresh

prasadvara · 1790528434 · focus · HN ↗
Isn't this going to introduce the dependency of domain management? I understand the positive side of it, but put some infra level manamgment layer to individual Open Source devs, just a thought. But yeah, positives vs negatives weigh and pick.
SenHeng · 1790532378 · focus · HN ↗
GitHub is almost forever. Your custom domain disappears when you stop paying the bills, which if you’re an open source developer has a higher likelihood than GitHub disappearing.
One day, we’re all going back to vendoring dependencies.
1. otterley · 1790533405 · focus · HN ↗
  Why did we stop vendoring dependencies in the first place?
  1. metaltyphoon · 1790538759 · focus · HN ↗
    Because its not as convenient
    otterley · 1790541594 · focus · HN ↗
    Can you elaborate?
    thayne · 1790544442 · focus · HN ↗
    Updates mean you have to copy over all the code into your repo, which creates a large diff, and hope you aren't overwriting any local changes someone might have made.
    It bloats your repo, both with the actual code, and the large diffs when you update it.
    You have to manually track new versions, without something to tell you if new versions are available, or if your version has known security vulnerabilities.
    If the dependency has it's own dependencies, you have to vendor those too recursively. And if multiple dependencies have the same transitive dependency, it is up to you to deduplicate them, and make sure you have a version compatible with all dependents.
    Etc.
    otterley · 1790550178 · focus · HN ↗
    Disk is cheap.
    Recursive dependencies have the same issues whether you vend them or not.
    Ensuring that diffs to updated dependencies remain within a vendor folder is trivial.
    So, what’s left?
    thayne · 1790554064 · focus · HN ↗
    > Disk is cheap
    The biggest problem isn't (usually) disk space, or network bandwidth, it is that git operations slow down as the size of the repo grows. And it means that cloning or pulling the repo takes longer, which can be especially problematic for CI.
    > Recursive dependencies have the same issues whether you vend them or not.
    otterley · 1790554919 · focus · HN ↗
    These are all solvable problems IME. But it does mean you need people who are experienced at solving them or who care enough to learn.
    thayne · 1790559113 · focus · HN ↗
    > But it does mean you need people who are experienced at solving them or who care enough to learn.
    That sounds like it's inconvenient to me.
    otterley · 1790559311 · focus · HN ↗
    The price of security and business continuity is the occasional inconvenience.
    thayne · 1790570508 · focus · HN ↗
    Vendoring isn't a clear win for security. It may provide some protection against "supply chain" attacks, but makes it more difficult for you to respond to vulnerabilities discovered in the version you vendored. And for business continuity, in many cases depending on an external registry is an acceptable risk.
    And both of those concerns can be addressed by using an internal/private registry that mirrors the packages you need.
    But in any event, your original question was to elaborate on why vendoring is inconvenient. Whether or not the benefits are worth the inconvenience is a different question, to which IMHO the answer is "it depends". Sometimes it is, and sometimes it isn't.
    otterley · 1790571265 · focus · HN ↗
    > Vendoring isn't a clear win for security. It may provide some protection against "supply chain" attacks, but makes it more difficult for you to respond to vulnerabilities discovered in the version you vendored.
    How so? Whether a dependency is vendored or not, you still have to update it to integrate a security update to that dependency, don't you?
    throwaway894345 · 1790557272 · focus · HN ↗
    > Disk is cheap
    If I want to upgrade the disk on my MacBook Pro, I need to buy a new MacBook Pro with a larger disk. If I want to upgrade the disk on my work laptop, I’m SOL.
    > Ensuring that diffs to updated dependencies remain within a vendor folder is trivial.
    It’s not obvious to me how putting the dependencies in a vendor folder solves the diff problem. Does every code host allow you to hide diffs to certain directories?
    And what’s the advantageous scenario for vendored dependencies? Is it just when the mod proxy and the upstream code host go down at the same time?
    otterley · 1790557965 · focus · HN ↗
    > If I want to upgrade the disk on my MacBook Pro, I need to buy a new MacBook Pro with a larger disk
    Is this an actual problem or are you just hypothesizing? MBPs today come with a minimum of 512 GB of storage. Even 5 years ago I think the minimum was 256 GB. Let’s talk about actual problems, shall we?
    > And what’s the advantageous scenario for vendored dependencies? Is it just when the mod proxy and the upstream code host go down at the same time?
    I’ll let you do this research. The use case has been well understood for decades. Ask your favorite LLM or consult some respected release engineering books.
    throwaway894345 · 1790604249 · focus · HN ↗
    > This is more than large enough for all but the most massive repositories
    Consider the possibility that the drive needs to accommodate more than just a single repository?
    I have lots of software, entire language toolchains, AI models, Docker images, application volumes, VMs, etc.
    And this isn’t a theoretical concern; I have to free up space every few months.
    > This is a useful homework assignment. Ask your favorite LLM or consult some respected release engineering books. Also consult your local AppSec and infosec teams.
    So there is no advantage scenario that you’re aware of?
    otterley · 1790617652 · focus · HN ↗
    You didn’t do your homework. Go do that.
    throwaway894345 · 1790623140 · focus · HN ↗
    Lol this seems like a very believable and normal thing for a Knowledgeable Person (TM) to say
  2. collabs · 1790538929 · focus · HN ↗
    Because it sucks. But maybe it should suck? It would make us think twice before adding dependencies.
    I use dotnet and I never liked seeing dlls and binary files in my diffs. I would argue if we are adding vendor code to our projects, we should demand the FULL source code instead of dlls. Maybe it is already possible with things like x unit. I have never given it much thought... But then that vendoree code has to come from somewhere as well, right? I mean there is something to be said about provenance or something here?
    Sorry if this feels like a stream of consciousness because it is ↔
    otterley · 1790541619 · focus · HN ↗
    Vendoring dependencies doesn’t necessarily mean you have to include binary objects in your repo. They could be content-addressable artifacts in your org’s private blob store.
    someonebaggy · 1790554923 · focus · HN ↗
    i.e. they could be NIH git-lfs.
  3. jeremyjh · 1790543483 · focus · HN ↗
    I think its a good question. The short answer is: because tooling doesn't default to this or make it easy.
    The answer to the question of why THAT is the case - is not so easy to answer. The main benefit I can see with using lock files instead of vendoring is that it saves a lot of storage and diff history from entering your repository. So clones are much faster, backups smaller etc.
    I think Go used to work this way (automated vendoring) but it’s the only language I can think of that ever did in terms of standard tooling. It would be instructive to learn why that changed.
  4. stackedinserter · 1790543760 · focus · HN ↗
    We didn't!
  5. st3fan · 1790552294 · focus · HN ↗
    I vendor all my Go dependencies all the time for every project. It is the way.
    throwaway894345 · 1790556895 · focus · HN ↗
    Has this ever been necessary/useful? Genuinely curious because I’ve been using Go since 2012 and can’t recall a time when vendoring solved a problem better than “regular” modules. Like have there been times when the source went down and the module proxy went down (or didn’t have your dependency cached)?
2. deniska · 1790545292 · focus · HN ↗
  In the case of a typical software enterprise having your domain gone means that you probably don't care about the code anymore anyway.
3. mkj · 1790568325 · focus · HN ↗
  Unless the field of software development somehow totally stagnates, I'm confident that at some point I will move to a different hosting service, as github goes the way of sourceforge, travis-ci, and myspace. So my personal domain will continue to be relevant (it's lasted fine 23 years).
  Maybe at that point it won't be using git either, or maybe it will - who knows.
  1. sleepybrett · 1790611982 · focus · HN ↗
    Mine has lasted over 25 at this point, but one day I will die, my domain name will lapse because what I do as a career might as well be witchcraft to anyone in my family and then my modules will be lost forever. Sucks any way you cut it. Hopefully someone who found my modules useful will fork whatever they find and keep them going.
4. JodieBenitez · 1790570139 · focus · HN ↗
  go mod vendor... works for me. Also it makes sense for an ecosystem like Go with strong standard lib and strong backward compatibility commitment.
andreashaerter · 1790532867 · focus · HN ↗
There are also a few Hugo templates for vanity import paths.
Here's mine: <a href="https://github.com/foundata/hugo-theme-govanity" rel="nofollow">https://github.com/foundata/hugo-theme-govanity (e.g. used at <a href="https://golang.foundata.com/" rel="nofollow">https://golang.foundata.com/ )
And yes I'm aware of the irony of hosting this on GitHub... still figuring out a good workflow for maintaining our OSS on Codeberg and GitHub in parallel fed from the internal forge. The dependency on our own domain is real but we favor it.
thih9 · 1790538464 · focus · HN ↗
> In my opinion, every commerical software development team using Go should be using custom domains for namespacing their internal libraries and packages.
I’d remove “go” from the above, i.e. I think same applies to other stacks.
Even using GitHub domain links in code comments gets problematic long term. Ie when a migration happens and those links start pointing nowhere.
1. handoflixue · 1790539243 · focus · HN ↗
  I'm confused by the article, and this comment, treating these URLs as difficult to replace.
  Why can't you just search-and-replace? Presumably all of them refer to "GitHub.com" and not much else code will, so I'd think this was an exceptionally easy case.
  Even easier for comments, since them being obsolete for a few hours during a migration doesn't exactly break anything.
  1. gravypod · 1790539349 · focus · HN ↗
    It's harder to replace in history.
  2. mort96 · 1790539926 · focus · HN ↗
    I've gone through such a migration. Huge Go code base distributed across a lot of git repositories had to be moved to a different git host.
    It was horrible. A team of people spent weeks. Different projects depended on different versions of the same internal libraries, we had to create a branch for each depended-on commit and make a version of that commit with the new URLs. The expressed goal was to end up with a system that's "exactly the same" as the old, just on a new host. Changing which version of libraries projects depends on would introduce unnecessary risk.
    And the result is a code base where bisects are broken and where it's impossible to build an old version of any of the code without a ton of work.
    dmoy · 1790548402 · focus · HN ↗
    > Different projects depended on different versions of the same internal libraries, we had to...
    This is one of the main motivations for using a monorepo with all third party dependencies imported all the way in, and only one version for everything.
    Of course it causes a whole bunch of other problems and is kinda expensive to scale, so most places won't do it.
    dlisboa · 1790548424 · focus · HN ↗
    Isn’t this exactly why the Go team recommended versioning deps for years before go modules came up?
    0cf8612b2e1e · 1790576856 · focus · HN ↗
    Google runs a monorepo which makes that kind of organization possible. Most companies are going to have a mismatch of teams using incompatible library versions.
    Pick your poison. Each approach has some seriously negative trade offs in the extremes.
    mort96 · 1790584096 · focus · HN ↗
    Well vendoring is a technical solution of the same caliber as adding module aliases to the go.mod. By that I mean, sure, it keeps the code compiling right now, but all your source files still contain references to abandoned infrastructure. It changes when you have to do the work, but unless you want your code to reference abandoned infrastructure forever, you still need to do the work.
    oefrha · 1790558676 · focus · HN ↗
    > And the result is a code base where bisects are broken and where it's impossible to build an old version of any of the code without a ton of work.
    That makes no sense? As long as you’re using go modules, you can just host an internal go proxy for internal modules similar to proxy.golang.org to archive the old versions, and they won’t depend on the old git host.
    sjbzbeiks · 1790569033 · focus · HN ↗
    I think is usually a symptom of how hard it is for the organization to do things, the technical side of this is not actually that hard.
    I say this because I’ve gone through a few of these, some with monorepos (the easiest, search and replace and you’re done), some not (yes the hardest but you can just vendor).
    At least in the situations I’ve faced this was genuinely not horrible beyond just the organization itself being complicated about the solution.
    mort96 · 1790595116 · focus · HN ↗
    How do you propose it's solved in an easier way, given the constraints that 1) you don't want references to old infrastructure in your code and 2) you want to do the move without changing how the code works? Is there some secret trick we missed which would've made this much easier?
    handoflixue · 1790611963 · focus · HN ↗
    Everything is on A. All code refers to A.
    Clone Server A -> Server B. All code still refers to A.
    Update code to refer to B
    You can now EOL Server A, and B becomes the new canonical reference.
    I think the key is simply that you can keep both A + B running during the migration, so you just need to be able to do a code freeze for the duration of the migration. And a single person can easily do this migration with a few python scripts and an hour.
    Bonus points: code freeze guarantees your #2 - no changes to how the code works.
    Of course, I'd assume that most complaints come from situations where this "secret trick" isn't viable
    mort96 · 1790613327 · focus · HN ↗
    The "update code to refer to B" step is a massive undertaking. My whole original comment was about that one step.
    handoflixue · 1790630063 · focus · HN ↗
    I don't understand. If B already exists and is working, isn't this just Ctrl+F, compile, push? I'm utterly unfamiliar with the "Go" language
    [deleted] · 1790658673 · focus · HN ↗
    [deleted]
    mort96 · 1790658740 · focus · HN ↗
    No, it's not. Here's a comment where I described a concrete hypothetical scenario: <a href="https://news.ycombinator.com/item?id=49871032">https://news.ycombinator.com/item?id=49871032
    sjbzbeiks · 1790775979 · focus · HN ↗
    You vendor the deps
    gnaman · 1790574156 · focus · HN ↗
    I don't know enough about git but shouldn't you be able to take all your git data (refs, blobs etc) and import it to your destination host and have this work without issues? It might be a lot of data sure but the infra is surely cheaper than multiple weeks of engineering effort
    mort96 · 1790579957 · focus · HN ↗
    Moving the repositories over was no problem at all! But once all the data is on the new hosts, all the Go source files still reference the old git host, since imports in Go are URLs to a git host.
    dolmen · 1790591326 · focus · HN ↗
    Similar pain as upgrading a module to a new major version (eg: v1 -> v2) [1], but at scale, because of modules dependencies: every module in the domain are affected at once as they must change namespace, like if everyone changed its major version.
    <a href="https://go.dev/doc/modules/major-version" rel="nofollow">https://go.dev/doc/modules/major-version
  3. lelandbatey · 1790540174 · focus · HN ↗
    Even easier than that, you can use the 'replace' statement in your go mod to change where the Go build system will try to pull the dependencies from; you can point to a folder on disk or to another forge, and if you want total control you can indirect everything to your own artifact cache via GOPROXY (which can be something as simple as a static folder of source code).
    The "module name is network path" is a convenient convention but not at all some "limitation" of the tooling.
    mort96 · 1790540290 · focus · HN ↗
    And now all your source files contain URLs to abandoned infrastructure. Is that what you'd want long term?
    someonebaggy · 1790595198 · focus · HN ↗
    How's that any different from java code using package names starting with com.sun?
    mort96 · 1790595882 · focus · HN ↗
    com.sun is an identifier, nothing more. No tooling sees com.sun and assumes, "oh that means I can make an HTTP request to the IP address which sun.com resolves to".
    In Go, the package identifiers are literally URLs. Go's own tooling assumes that it can make an HTTP request to the URL and that the response will be HTML with particular tags which Go's tooling will parse and use to resolve a git repository which can be 'git clone'd. Leaving them as-is when you abandon the infrastructure they reference literally means leaving dead links in your source code.
    someonebaggy · 1790596697 · focus · HN ↗
    If it's not fetching from the URL then it's not really a URL, just an identifier that looks like a URL.
    mort96 · 1790598670 · focus · HN ↗
    What do you mean? Go's tooling definitely tries to fetch from that URL.
    someonebaggy · 1790632356 · focus · HN ↗
    Not if you tell it a different URL though
    foldr · 1790596776 · focus · HN ↗
    That's just the default, which you can easily override if you need to. IMO there is nothing wrong with treating Go package names as arbitrary identifiers like com.sun. If you're running around trying to update package names because the underlying repo has moved from it's original URL, then just don't do that. It's unnecessary.
    mort96 · 1790598694 · focus · HN ↗
    And leave URLs to abandoned infrastructure all over the place? No thank you.
    foldr · 1790599603 · focus · HN ↗
    Sounds like classic developer OCD to me. Old URLs used as Go package identifiers are completely harmless.
    mort96 · 1790601811 · focus · HN ↗
    Until your tooling automatically makes a request to a now-untrusted server and trusts its response...
    foldr · 1790603826 · focus · HN ↗
    The Go tooling won't do that if you configure it properly (e.g. via <a href="https://go.dev/ref/mod#goproxy-protocol" rel="nofollow">https://go.dev/ref/mod#goproxy-protocol)
    Any tool that automatically assumes that a URL in a Go module import is 'trusted' is just a broken tool.
    mort96 · 1790607063 · focus · HN ↗
    And if any tooling ever gets executed without the proper replace directive...
    foldr · 1790609423 · focus · HN ↗
    Any tooling that looks at Go module imports should respect the contents of go.mod.
    If you haven't added a replace directive to your go.mod, then you certainly haven't replaced all instances of the old URLs with updated ones.
    someonebaggy · 1790632389 · focus · HN ↗
    Go mandates lockfiles, called go.sum
    sleepybrett · 1790611771 · focus · HN ↗
    It's a solution that keeps you working now and you can do the actual search and replace when scheduling allows.
    mort96 · 1790613264 · focus · HN ↗
    AKA it solves nothing, just kicks the problem down the road.
    sleepybrett · 1790629329 · focus · HN ↗
    welcome to fast moving companies.
    quectophoton · 1790562146 · focus · HN ↗
    > you can use the 'replace' statement in your go mod to change where the Go build system will try to pull the dependencies from
    Heads up for anyone who doesn't know: this only works at the "top level". Any replace directives in your dependencies will be ignored[1].
    So for example if you have a dependency tree like [main -> thirdpartyframework -> golang.org/x/net/http2], and thirdpartyframework uses a vulnerable version of `golang.org/x/net/http2`, you can't just fix it by patching the thirdpartyframework repository with a replace directive; no, because that would be too convenient. Instead, the replace directive needs to be at the main module, where it doesn't make sense and is inconvenient.
    Even though I like Go, it really seems like they don't care about anything other than monorepos. As soon as you need to work with forks, mirrors, or even just private modules[2][3], the tooling actively works against you. Also using your custom module proxy is a pain.
    [1] See: <a href="https://go.dev/ref/mod#go-mod-file-replace:~:text=replace%20directives%20only" rel="nofollow">https://go.dev/ref/mod#go-mod-file-replace:~:text=replace%20...
    [2]: If you've only used private modules hosted on GitHub you might not have noticed too much pain because the Go tooling has hardcoded behavior specifically for GitHub and a few mainstream forges. You don't find out about this until you try to self-host something like Forgejo on your own domain thinking it would Just Work(tm), but it doesn't, and now you're left wondering why tf it works with GitHub but not with your own forge instance.
    [3]: I think there's no hardcoded code for SourceHut, so you might be able to experience the inconvenience by hosting private modules in there.
    Joker_vD · 1790572630 · focus · HN ↗
    > Instead, the replace directive needs to be at the main module, where it doesn't make sense and is inconvenient.
    Wait, what? If you decide, in your own application, to force all your dependencies to use a specific version of golang.org/x/net/http2, then obviously you'd want to be able to put this directive into your own application's source instead of going around patching 3rd-party repositories (that's just rude).
  4. mbreese · 1790542172 · focus · HN ↗
    What about anyone else using your code? You can find and replace your own code, but do you have access to all of the code relying on your go library? Is it all yours? Customers? Other developers?
    Even in the case where it’s an internal only Lu array, it can be complicated to refactor a library name.
    handoflixue · 1790609600 · focus · HN ↗
    Thank you for the concise explanation! :)
    I did not realize it ran that deep - I'm used to distributing EXE files, not anything that would need to know internal dependencies like that.
2. mort96 · 1790539790 · focus · HN ↗
  I mean yeah, but other languages don't make it quite so easy to make this mistake. Once your Go project gets to a size where it makes sense for different files to live in different folders (which, given Go's folder-based module system, often happens at just a couple hundred lines of code), the most straightforward way which the tooling nudges you towards means putting GitHub URLs (or URLs to whatever git host website you happen to use) in your source code.
  1. someonebaggy · 1790554667 · focus · HN ↗
    Or example.com/yourname if your module is never going to be imported from another project.
    someonebaggy · 1790578821 · focus · HN ↗
    to clarify: I mean literally "example.com", not your own domain name
    mort96 · 1790584314 · focus · HN ↗
    I do something like this in all my projects now. Except that I don't use example.com, I just use the name of the project. So if I'm working on a program called Frobnicator, I'll just have `module Frobnicator;` in my go.mod and do things like `import "Frobnicator/lib/blah"` in my source files. It works really well to be honest for non-library software.
    But it's something you have to do as an active choice; the tooling will nudge you towards using URLs to your primary git host's web front-end. And it naturally doesn't work for libraries.
    dolmen · 1790590867 · focus · HN ↗
    If the first part of the module path is without dot, it is assumed to be stdlib.
    Many tools will fail if you break this contract.
    mort96 · 1790595156 · focus · HN ↗
    Oh that's horrible. I've somehow never encountered it but damn.
    dolmen · 1790590768 · focus · HN ↗
    yourname.internal/mymodule is even better. But don't expect to Go toolchain (especially "go get" or "go mod download") to work.
    <a href="https://datatracker.ietf.org/doc/draft-davies-internal-tld/" rel="nofollow">https://datatracker.ietf.org/doc/draft-davies-internal-tld/
  2. ljm · 1790607121 · focus · HN ↗
    I think this is one of the biggest missteps made in Go and in all honesty I don't think it was any more intuitive than going through a package manager. Probably less, looking back.
    Everything else is fine. Generics, errors, whatever...
3. zahlman · 1790548217 · focus · HN ↗
  I think TFA is specifically targeted at Go because of how their package system works.
4. Joker_vD · 1790573020 · focus · HN ↗
  Yeah, the only problem is when your whole company decides to move to a different custom domain entirely, e.g. from contoso.com to xtools.cn (which doesn't even resolves if you're not on the corporate VPN), and half of your friendly teams, whose libraries you depend on, drag out their own migration by fiddling with their local /etc/hosts and .gitconfig and .ssh/config (yes, they also wrote bespoke scripts that do those changes to their CI machines; no, trying to run those same scripts on your CI machines breaks your own shims) instead of updating their source code.
  1. sleepybrett · 1790611602 · focus · HN ↗
    oh man deep cut contoso ref (contoso being the fake company used widely in microsoft demos/documentation/examples)
5. throwawayffffas · 1790597428 · focus · HN ↗
  I don't love that either, having all of your stack point to your own domains for how it can be accessed is nice. But in my opinion, it's desirable to be able to build your whole stack from source code. Of course you download external dependencies, but for code you own you should be able to build it from source.
  I have seen too many cases of requirements on internal projects that prohibit devs from working because oops the vpn is down now or oops gitlab is under load and the pipeline for your dependency won't finish for the next hour.
  1. bayindirh · 1790597713 · focus · HN ↗
    I also think that vendoring or at least caching your dependency tree somewhere local, so you can build everything from ground up to a known state.
    It's not only an issue of availability or depending on circumstances you can't control, but a matter of reproducibility hence dependability.
    I want to be able to compile critical software when a zombie apocalypse hits, and I have a growing discomfort about trusting outside parties for their availability and benevolence.
  2. ljm · 1790606574 · focus · HN ↗
    In the new world of AI and all the supply chain attacks on centralised package managers, I think circling back to vendoring probably makes more sense than depending on the network in your build step. Which in some ways is always great, as you mention, in terms of working offline.
    Even if you don't want to go as far as vendoring (which can get a bit out of hand with, say, NPM), a middle ground is using Artifactory or whatever as a proxy.
    Then be more deliberate about when you update. AI may even help here where static analysis doesn't, because you might be able to use inference to see if a dep upgrade is even needed. Unless it has a severe vuln you probably don't need to track latest.
gumby · 1790538670 · focus · HN ↗
Seems like an error to use a URL. This is perfect for a URN or some other form of URI.
It could be a URN that used the DNS as a back end (though that’s a lot like a URL) so better would be something more abstract with multiple possible resolvers and a signature.
1. someonebaggy · 1790555024 · focus · HN ↗
  The only useful alternative you're talking about would be a content-addressed one. A "URN" that relies on some kind of mutable registry lookup is actually a URL (both are URIs).
skybrian · 1790539758 · focus · HN ↗
Not really convinced. I'd rather it stayed on Github so it doesn't disappear. Particular for businesses whose priorities might change.
1. racingmars · 1790539990 · focus · HN ↗
  > I'd rather it stayed on Github so it doesn't disappear. Particular for businesses whose priorities might change.
  People can delete projects from GitHub. Businesses whose priorities might change may not keep an old project set to public up on GitHub because they won't want people to continue contacting them for support, or they don't want to be responsible for updating security vulnerabilities for projects they are abandoning so they'd rather just pull it offline, etc.
  Whether the library you're importing is hosted on GitHub or not, never assume it will be there tomorrow. *Always vendor your dependencies.*
  1. skybrian · 1790541574 · focus · HN ↗
    [delayed]
    kbolino · 1790550083 · focus · HN ↗
    Reclaiming a dead organization's namespace won't allow you to replace the old artifacts, but it may allow you to publish new versions, which Dependabot/Renovate/Dependi/etc. may recommend you upgrade to, at least until the squatting gets caught.
bionsystem · 1790539865 · focus · HN ↗
braid has been a treat for us to manage external dependencies. Much cleaner than submodules.
0xbadcafebee · 1790539982 · focus · HN ↗
[delayed]
1. prasadvara · 1790541791 · focus · HN ↗
  You don't need an SBOM or anything fancy to get started
  -- Curious how this avoids SBOM need?
  1. 0xbadcafebee · 1790572351 · focus · HN ↗
    An SBOM is an inventory; you don't need to make an inventory to pull files through a proxy.
    prasadvara · 1790612907 · focus · HN ↗
    Correct, that is what confused me, how SBOM came into the picture, now got it, thanks!
dewey · 1790540400 · focus · HN ↗
> That is, if you move your git hosting to GitLab then you have to change your code!
You can also just use "replace github.com/example/example => gitlab.com/example/example" in your go.mod file and everything will keep working. That seems like a very pre-mature optimization for something that doesn't really matter.
1. mort96 · 1790540974 · focus · HN ↗
  And you'll just leave references to abandoned infrastructure in your code forever?
  1. cyberpunk · 1790542709 · focus · HN ↗
    cmd+shift+r in goland, push to a branch, open a PR, ask devops to make the old location archived and prevent further writes. After a couple months remove access to the old one and see what breaks.
    You know, normal development task, small amount of story points..
    mort96 · 1790543053 · focus · HN ↗
    You're now arguing that it's easy, which is a completely different argument. The comment I responded to argued that it's unnecessary.
    For my thoughts about why it's not easy, see this comment: <a href="https://news.ycombinator.com/item?id=49870363">https://news.ycombinator.com/item?id=49870363
    cyberpunk · 1790543430 · focus · HN ↗
    Yep that sounds pretty bad. Personally, we'd just eat not being able to build old versions, we archive previous builds, and in the case of a hotfix or whatever we'd use the go.mod rewrite trick. Not sure why you needed the commit/branch setup, did you change the history?
    mort96 · 1790544449 · focus · HN ↗
    Have libfoo with a bunch of different versions. Authservice depends on libfoo 1.2.0. APIservice depends on libfoo 1.3.0.
    Now you want to move from github.com to git.example.org. You change libfoo, authservice and apiservice to use git.example.org/whatever/libfoo, that part is just tedious work. But the v1.2.0 tag and v1.3.0 tags of libfoo are old commits from before the move, so they still reference github.com! Now you need to branch off of the v1.2.0 and v1.3.0 tags of libfoo and do the same change there.
    So we have only 3 repositories with only 2 dependencies and we already have to do the search/replace 5 times.
    Imagine now that apiservice depends on authservice v2.3.7 just to include some type definitions. Authservice is currently on version 2.4.0 but the types haven't changed so apiservice hasn't been upgraded. Now you need to branch off of authservice v2.3.7 too and do the job there. Oh and authservice v2.3.7 depends on libfoo v1.2.5, so now you need to make a branch off of libfoo v1.2.5 with the search/replace.
    3 repositories with a straightforward dependency relationship, 7 search/replace jobs.
    The numbers get terrifying as you scale this up.
2. kelnos · 1790545656 · focus · HN ↗
  [delayed]
  1. jayd16 · 1790546038 · focus · HN ↗
    By this logic, those folks should be pointing to their own hosted mirrors of the project, no?
  2. quacker · 1790564357 · focus · HN ↗
    I think the migration can be made pretty easy for users by with deprecation notices and the `go fix` tool. Better explained in [1] (I have not tried it myself).
    The idea is: the package maintainer pushes a final version of the old package that is a shim, and which has a deprecation notice. The shim imports the new package, and forwards all calls to the new package (and I suppose type aliases and variable aliases as well). The shim includes `//go:fix inline` annotations on all exported symbols, so that when users run `go fix` it rewrites their code to use the new package, by inlining their usages of the old package (which is now simply a shim that references the new package).
    Not perfect. There is still a bit of a discoverability problem. Not all tooling warns on deprecated packages/functions (go toolchain doesn't, but gopls and staticcheck do). And users need to know to run `go fix`. But the tooling is there.
    1: <a href="https://go.dev/blog/inliner#example-renaming-ioutilreadfile" rel="nofollow">https://go.dev/blog/inliner#example-renaming-ioutilreadfile
  3. Cthulhu_ · 1790603832 · focus · HN ↗
    [delayed]
3. peesem · 1790546342 · focus · HN ↗
  why not just use replacements to begin with if you don't want to bother with setting up domains?
  "replace example => github.com/example/example" at first, then change to "replace example => gitlab.com/example/example" or similar when there's a migration
  (i don't use go, but i hope this is possible and i am confused if it's not)
4. furyofantares · 1790546462 · focus · HN ↗
  [delayed]
awinter-py · 1790540952 · focus · HN ↗
don't do (thing that is extremely standard and yes has some drawbacks). Solution (nginx.conf)
mosselman · 1790543075 · focus · HN ↗
I have not worked with Go, so I thought I'd ask: why wouldn't simple find and replace be able to fix this? And why wouldn't a coding agent be able to do this for you quickly?
1. mort96 · 1790543171 · focus · HN ↗
  See: <a href="https://news.ycombinator.com/item?id=49870363">https://news.ycombinator.com/item?id=49870363
gchamonlive · 1790543221 · focus · HN ↗
Thanks for answering my question! So yes, if I intend to use go and study the packages I'd have to rely on beforehand, if they're all hosted on GitHub should make me steer away from Golang. Or at least plan to cache the packages I need locally so CI always have something to work with when building.
Alternatively, could we ourselves build an automatic mirror so there's a redundant supply provider that doesn't depend on a maintainer's choice of git forge
<a href="https://news.ycombinator.com/item?id=49434625">https://news.ycombinator.com/item?id=49434625
1. Mawr · 1790578309 · focus · HN ↗
  <a href="https://proxy.golang.org/" rel="nofollow">https://proxy.golang.org/
  1. gchamonlive · 1790589499 · focus · HN ↗
    [delayed]
Meneth · 1790544303 · focus · HN ↗
You shouldn't be using fully qualified domains at all. Use relative paths instead, like sibling-hosted git submodules.
1. someonebaggy · 1790555074 · focus · HN ↗
  I don't think Go allows relative imports.
nizarmah · 1790545022 · focus · HN ↗
That's a beautiful solution. I love it! The alternative work went with was to just build everything ourselves.
0xCMP · 1790545639 · focus · HN ↗
[delayed]
p4bl0 · 1790547608 · focus · HN ↗
True, but beware of the domain name you're using. Because VeriSign may unilaterally decide to delete your domain name along with thousands of others [1] and you're back to square one…
[1] <a href="https://neil.fraser.name/news/2026/09/03/" rel="nofollow">https://neil.fraser.name/news/2026/09/03/
1. Groxx · 1790553842 · focus · HN ↗
  [delayed]
  1. throwaway894345 · 1790556334 · focus · HN ↗
    > It's sorta a shame that Go keeps doing such a good job at a minimum-viable wheel-rewrite, but then lets it linger for so long without catching up to the rest of the programming world.
    How many mainstream languages have content addressed imports? I can’t think of any, so I assume I’m misunderstanding your meaning of the term because you seem to be suggesting that it is common and Go is the outlier for lacking it?
    Groxx · 1790567985 · focus · HN ↗
    Go is not really an outlier for not having signed packages (there are a fair number that have it, but far from most)... but definitely stuck behind common accepted practice. By decades, if comparing against some (e.g. Java).
    Which keeps happening with stuff they rebuild from scratch - an excellent and somewhat unique first showing, far beyond what most first attempts manage, but followed by near-complete stagnation while issues that everyone familiar with the field predicted from miles away pile up.
    vips7L · 1790600272 · focus · HN ↗
    Coming from the Java side this is typical of Google libraries. They start off impressive and gain wide adoption but then they stop supporting changes the community wants, missing basic features.
    Groxx · 1790619477 · focus · HN ↗
    [delayed]
    Groxx · 1790619636 · focus · HN ↗
    [delayed]
  2. hnlmorg · 1790587271 · focus · HN ↗
    > I really do wish they baked a SHA into the go.mod (not just go.sum) so you could find a library and get a known-good download from any proxy with any name.
    You already can use SHA in go.mod in exactly the same way you would use a version string.
    I don’t know about using multiple proxies in go mod though.
    Groxx · 1790631292 · focus · HN ↗
    Kinda. If there's a versioned release at the same SHA, the next `go mod tidy` will replace it with the version.
2. ablob · 1790557071 · focus · HN ↗
  At least the fallout will be less if you have to resolve your custom domain differently in the intranet due to something like this.
  If github is "taken down" you can't just resolve the whole domain differently, you need to only resolve the packages differently. If your "Golang domain" is taken down, it should be a lot easier to hotfix until something proper is implemented (the quickest and dirtiest would be a hostfile-entry).
3. alavilli · 1790557998 · focus · HN ↗
  [dead]
4. cyh555 · 1790570495 · focus · HN ↗
  reading the article confuses me though I don't want to do the context switching by googling what 3rd level domain is about
  1. hnarn · 1790592966 · focus · HN ↗
    All you need to know is that for some reason you could buy foo.bar.com without owning bar.com directly from the registrar.
    It is being retired because very few people use it. It kind of sucks but this is how domains work, it’s not real estate.
5. dolmen · 1790578369 · focus · HN ↗
  Or if your goal is to open source code, think about the lifetime of the entity owning the domain: the source code might be of interest to users beyond the control of the domain name. Domain controled by an individual or a company? What if the domain is not renewed, or taken over by an hostile entity?
  Deepcopy [1] is a Go package that is still heavily used despite its creator has disappeared 9 years ago. At least GitHub is a stable and trusted host as a distribution point and communication point for users.
  [1]: <a href="https://pkg.go.dev/github.com/mohae/deepcopy" rel="nofollow">https://pkg.go.dev/github.com/mohae/deepcopy
6. [deleted] · 1790593579 · focus · HN ↗
  [deleted]
unscaled · 1790548274 · focus · HN ↗
> One of the good features of Go is that you namespace your code with the location to fetch the code.
Then the rest of the article explains why this is NOT a good feature in practice.
I don't think it's unworkable either, but this is one of these little thing that Go decided to do different and convinced its fans that this is a great idea and all the other languages where doing it wrong. After a couple of road bumps appeared, instead of admitting there are some advantages to having official package names, we're now told that everybody should just set up their own custom domain with an nginx server or a Go Vanity URLs forwarder to serve traffic for their GitHub-hosted packages.
1. 12_throw_away · 1790558175 · focus · HN ↗
  tbh, combine these domain aliases with the caching proxy you're supposed to use, and they're well on their way to reinventing a traditional package index from first principles
ambicapter · 1790548462 · focus · HN ↗
Hah, usually these things don't work for me but I just tried to google it and got the exact same thing
> It sounds like you are dealing with a really disappointing or frustrating situation right now. Did Dario cancel plans on you, or is there a bigger context to what's going on?If you want to vent or figure out what to do next, tell me a bit more about:Whether this is a frequent pattern with himHow long you've been waiting or planning thisWhat kind of relationship you have (friend, partner, etc.)
bigwhite · 1790548603 · focus · HN ↗
[dead]
serbuvlad · 1790549913 · focus · HN ↗
> That is, if you move your git hosting to GitLab then you have to change your code!
Not to be cynical about this but I fail to see how running sed s///g after a very rare event qualifies as a serious problem.
Now, sure, given that the solution is so simple, it's a nice recommendation, but still...
cyberax · 1790550993 · focus · HN ↗
I'm not sure that custom domains are a good idea. It's way too easy to end up with broken links once vanity domains go away.
However, Golang saves the hashes of all the modules in `go.sum` files, so we just need to add a way to do content-addressable fetches. This solves the issue of reproducibility for old builds. As long as you can find the module in some repository somewhere, you'll be able to build it.
The next step is supporting module _evolution_. We need a way to declare: "From this point onward, `github.com/company/someproject` is now `company.com/someproject`", so that all the references are to these packages are identical. This is possible on a per-package basis with `replace` directives, but this doesn't scale.
And this is not easy to solve in general (especially in the age of supply-chain attacks). If the initial project cooperates (or if Github can be convinced to help), perhaps at least a part of this can be solved by adding special "redirecting module" support to Go.
st3fan · 1790552224 · focus · HN ↗
Great when a company goes out of business and the domains are dangling. Next one to scoop it up takes over source code that others new depend on. We've seen this many times already in other ecosystems. It is a very bad situation.
It is bad advice to move your packages under your own domain. You will never be as good as Microsoft to keep paying for the domain. There are no guarantees in life but I do guarantee you that when you go out of business, that domain is the last thing you will think about.
1. epwr · 1790554168 · focus · HN ↗
  Thinking this through, using my domain might actually be much less risky than using a host's. If Gitlab closes down, and someone else buys the domain, then I'm forced to make a massive refactor with little notice.
  If I own the domain, I'm likely to continue to owning it until I shut down my company. At which point, no one is likely to be running my code.
  Possibly different if I was developing an open source library or something, but either way there's risk and need to be thoughtful of the risk versus impact.
2. someonebaggy · 1790554832 · focus · HN ↗
  Well, actually you don't download from GitHub - you download from the central mirror proxy operated by Google, and that will always return the same package given the same versioned reference, even if the original source differs from it.
MadVikingGod · 1790553043 · focus · HN ↗
Here's the primer for those who thing find a replace is the answer. Pretend you have a project with A 1.2.3 depends on B 2.4.6 which depends on C 0.1.1. If you are in github you get module github.com/example/A requires ( github.com/example/B 2.4.6 github.com/example/C 0.1.1 )
You now have many choices on how to proceed, but none of them will include A) being able to build old releases, or B) doing so without making changes to all dependencies.
One choice is go to the leaves, C in our example, and make a release on gitlab. Then go to B, and have B depend on the gitlab C. This is fine for rolling forward, but if you want to roll back you would have to rewrite all of C to use the gitlab url, and find all of the equivalent tags and repush all of them. Also tell your users that any binaries you've released now have new hashes. Then repeat this for every repo. It's not a small task.
drunken_thor · 1790553769 · focus · HN ↗
Honestly google should have always had a package index even if it points tooling to the repo, but it would maintain the package name with the ability to change where the repo is.
popcornricecake · 1790554338 · focus · HN ↗
I fear one of these days someone will copy a legit package and make it onto your search results, and then the Go tools pull in something extra.
hk1337 · 1790555046 · focus · HN ↗
It's a rather internet focused language. Even if you don't point it to github, some other packages will and you still have to point it to something (i.e. gitlab, codeberg, or your personal git server). Then what happens if those servers are no longer available?
1. throwaway894345 · 1790556716 · focus · HN ↗
  Go defaults to using a caching proxy, but you can use your own too.
okanat · 1790556212 · focus · HN ↗
Just like [^1] says:
> After spending years doing those FFI dances in both directions, I’ve reached the conclusion that the only good boundary with Go is a network boundary.
It looks like this extends into the package manager too. The only good boundary with Go programs is a socket. The only good boundary with the Go package manager (? if we can say it is one) is a domain and a DNS server (your own or somebody else's in the case of gopkg.in).
[^1]: <a href="https://fasterthanli.me/articles/lies-we-tell-ourselves-to-keep-using-golang#go-is-an-island" rel="nofollow">https://fasterthanli.me/articles/lies-we-tell-ourselves-to-k...
grumpy_coder · 1790560858 · focus · HN ↗
How many other people have hit the pain of injecting ssh keys for gitlab into a docker container building your code in CI?
Compiling code shouldn't hit network by default.
1. okoddcat · 1790570778 · focus · HN ↗
  why you need ssh key for CI? The CI_JOB_TOKEN or scoped PAT also works via http to pull/push the code.
verdverm · 1790565061 · focus · HN ↗
fun fact, in the process of designing CUE modules, the Go team said they would use a registry if they could do it over, CUE uses OCI registries
MVS + OCI is the gold standard imo
blackjpi · 1790569558 · focus · HN ↗
I don’t think I would use a 301 permanent redirect for this sort of thing. If you later want to switch from GitHub to some other provider, software that aggressively caches permanent redirects (like browsers) will remember the old redirect to GitHub, especially since you don’t have any cache control headers set. Maybe not as large a concern will CLI tools, but something to be aware of as this has bit me in the past.
globular-toast · 1790575554 · focus · HN ↗
So you need a domain and an nginx server running somewhere? That seems like more of a liability than just controlling a domain. Isn't there a way to configure this this just using DNS and no web server?
ArgumentMoney81 · 1790579023 · focus · HN ↗
[dead]
nirui · 1790579699 · focus · HN ↗
A GitHub URL at least is still an credible identifier, your custom domains is not, and likely will never be given how the system is accustomed to. Domain is for branding, not identification.
Unless of course, it's special domains such as .onion, which is generated in such way (cryptographic keys) no other people can easily obtain control even after the domain is no longer maintained.
If you really don't want to use GitHub, an alternative is just use .internal suffix (i.e. yourproject.internal/project) in combination with `replace` directives in go.mod.
1. nicce · 1790580132 · focus · HN ↗
  > A GitHub URL at least is still an credible identifier, your custom domains is not, and likely will never be given how the system is accustomed to. Domain is for branding, not identification.
  The post is about commercial software. If enterprise’s domain is not credible enough, then there are bigger problems.
  1. nirui · 1790703550 · focus · HN ↗
    I'm guessing by commercial software, you mean GitHub etc.
    Well, I too dislikes their enterprise tune, "Changing is consistent, GitHub give you advantage (over other companies)" blahblahblah. Many developers I know are on GitHub because it was/is the place for individual developers to share code, not because the "company advantages".
    HOWEVER, I can't ignore the fact that individual developers just can't pay enough to keep the machine running, so it's reasonable for GitHub to pivot towards commercial market. On the other side, GitHub is still benevolent enough to provide some enterprise-class service back to freetier users. This arrangement checks out for me so far.
    I do self-host some of my projects too with Gitea. But I never dare to use my domain in my Go packages, due to long-term security concerns.
    When I initialize my projects, I just use .internal domain, then if I decided to upload the project to GitHub, I'll change the URL to GitHub to make it more convenient to the users. Otherwise, manual download and `replace` directive like I suggested.
imhoguy · 1790580467 · focus · HN ↗
I think we need better handle to the original location/author/project than a domain. Any of such "go" proxy is yet another SPOF.
We should lean towards IPNS (Name Seever part of IPFS) or some distribited ledger.
lewo · 1790581462 · focus · HN ↗
Another way to fix this kind of issues would be to fallback on the Software Heritage which archives the whole GitHub.
This is something Nix and Guix are trying to achieve: by default, they fetch source code from the original endpoint, but if it doesn't respond anymore, they would query the Software Heritage archive [1].
Because go mod doesn't use SHA, it makes things a bit more complicated but Nix/Guix encountered the same issue and there are some mechanisms to workaround this issue.
[1] <a href="https://www.softwareheritage.org/2025/05/21/software-heritage-guix-deployment/" rel="nofollow">https://www.softwareheritage.org/2025/05/21/software-heritag...
silverwind · 1790584007 · focus · HN ↗
I disagree, prefer to see which forge a module is hosted on and have a clickable link that always works.
GnosiWorks · 1790584365 · focus · HN ↗
[dead]
tugback · 1790585461 · focus · HN ↗
Definitely had a private GitHub dependency disappear once. Vendoring saved us a massive headache downstream.
pidgeon_lover · 1790589135 · focus · HN ↗
"Package manager"-like behaviour like this is evil. Importing software/code at runtime from the internet (like Apt, Go, Pacman, Pip, NPM, etc.) is the equivalent of those dreadful online stub installer packages, and it's impressive it's as trusted a mechanism as it is.
Leave the Go code or Linux distro to link-rot for a couple decades and all imports like this will be dead or serving malware, leaving the software unusable.
PunchyHamster · 1790590791 · focus · HN ↗
Now you coupled it to 2 services you don't own, congratulations on making it worse
alexfortin · 1790596181 · focus · HN ↗
Thanks for the article, it inspired me to come up with my own solution (and blog post):
<a href="https://a.l3x.in/blog/vanity-go-import/" rel="nofollow">https://a.l3x.in/blog/vanity-go-import/
deanc · 1790596688 · focus · HN ↗
That's all well and good, but what happens if you drop off the face of the earth due to personal issues, health issues or worse and your domain expires?
dirkc · 1790598566 · focus · HN ↗
I've been saved by the commit hash in the dependency when reviving an old Python project. I could locate a fork of the repo and use the same version to get the code going again. I ended up vendoring the dep.
motbus3 · 1790598965 · focus · HN ↗
Holy cow. When I was learning go I thought I was the only one crazy to think that is not a good default
shieldagent · 1790598983 · focus · HN ↗
We hit this after an org rename. replace covered our modules; transitive imports of the old github.com path still broke builds.
farthest · 1790601528 · focus · HN ↗
So what happens when the domain provider gets bought and the domain in your OSS project gets auctioned and compromised? This is turtles all the way down it seems..
rot256 · 1790601727 · focus · HN ↗
Package management in Go always felt pretty hacky. Among the issues is the confusion between "what something is" and "where something is". At the beginning there wasn't even a way to have different versions of a package, with the justification that you should just fix an interface and keep it stable till the end of time, there was also no way to "lock dependencies". It has gotten better since, but still some jankyness as a result of "growing" a package system.
jerf · 1790602154 · focus · HN ↗
This is hiding in the obfuscation of being overly specific. The problem is general. To name a package, one must be in a namespace of some sort. As the universe does not provide any sort of abstract ambient "namespace" we can all appeal to, all namespaces are human constructs. As human constructs, they may fail.
In this terminology, the article basically amounts to saying "This namespace can fail! The solution is, use another!"
But that doesn't get you anywhere, because the new namespace can fail too. In fact it is almost certain that it will fail sooner than "github.com's DNS and hosting" as a namespace.
There is no solution where you tie your software release to a namespace that can't fail because there is no namespace that can't fail. It doesn't matter if your favorite language uses DNS or has a centrally blessed repository or if it distributes a blessed list of package names with the language itself or anything else. The namespace can fail.
Therefore, the only thing you can really do is be resilient against failures, and in a lot of ways, the only practical solution to resilience is just to assume that if, in the future, someone has problems getting a package due to a namespace failure, they will not helplessly disintegrate into a puddle of tears while your code is lost forever, but that the future person will instead solve this perfectly solvable problem.
1. mfro · 1790604927 · focus · HN ↗
  The article doesn’t mention any of these namespaces failing as the major issue… he is referring to the challenge of transferring hosting providers, which could be done for various reasons.
  1. jerf · 1790605459 · focus · HN ↗
    That is a failure; the old namespace no longer meets your needs. My point is abstracted over all of that. There is no namespace solution where that can't possibly happen.
    mfro · 1790605675 · focus · HN ↗
    Yes, but the solution differs. As the author says — updating DNS entries can be considerably less complicated than migrating libraries and their references
    bloppe · 1790610042 · focus · HN ↗
    In this example, the old namespace is perfectly fine. The issue is the hosting provider. The point is that you can (and probably should) decouple the namespace from the hosting provider.
2. dcreager · 1790605005 · focus · HN ↗
  There are any number of other reasons besides resilience that you might want to change hosting providers. I do this, and I'm not worried about the resilience of GitHub at all. For me, it's a question of branding: I want to be in control of this code's identity, and don't want that to coupled with or coopted by the hosting provider I'm using.
3. LoganDark · 1790605800 · focus · HN ↗
  No, the article basically amounts to saying, this namespace is owned by someone else, you can't do anything when it fails. Own it yourself, so you can make sure it doesn't fail.
4. sanskritical · 1790607083 · focus · HN ↗
  There's actually a solution, it's NostrGit, decentralized git. No single point of failure, and your identity is a public key. You can also just host your git via http on a Tor onion or i2p eepsite to get a public key identity namespace that is also resilient to single points of failure.
  1. throwawayffffas · 1790612135 · focus · HN ↗
    Git is decentralized all on it's own. A relation that will not be named had a complete infrastructure failure that destroyed their version control server as well. Everything was up in a few days pushed from developer laptops.
5. cjs_ac · 1790607930 · focus · HN ↗
  It's not a matter of whether or not something can fail; it's a matter of whether or not you can fix it when it fails. As we've learnt recently, Microsoft is finding it increasingly difficult to keep GitHub running.
6. bloppe · 1790609717 · focus · HN ↗
  Clearly it's not about trying to have a "better" namespace. It's about decoupling the namespace from the hosting provider, so you can switch hosting providers if you need to.
7. sleepybrett · 1790611534 · focus · HN ↗
  This is the most useless critique of a problem you clearly don't have a handle on I have read today. good job!
8. throwawayffffas · 1790612032 · focus · HN ↗
  It says the solution is use a namespace you control.
  > it will fail sooner than "github.com's DNS and hosting"
  When it does fail you can fix it. When github fails all you can do is stare at their status page.
Cthulhu_ · 1790603654 · focus · HN ↗
[delayed]
pulkitbanta · 1790606587 · focus · HN ↗
I always wondered when I moved from NodeJS to Golang on why do I need to import everything from github. It would have been simpler to have a central registery to host your packages and import from there I think with secrets to read the private ones
abhirajabhi312 · 1790608261 · focus · HN ↗
i would like to talk about the article's main point of not tying things to github only , so it’s basically distribution vs theoretical decoupling. Sure, tying the module path to GitHub creates some lock-in, but GitHub is where the community and visibility already are.
"This namespace can fail! The solution is, use another!" while i agree with this but setting up different namespace just because you want to avoid vendor-lock , we need to think from maintainer's perspective as thi would introduces frictions and so are of the most open-source maintainers willing to take it or not?
maxdo · 1790610549 · focus · HN ↗
migration concerns is a task of any coding agent for 2hours with testings, a cheap one for such an easy task, grok, gpt 6 luna can easily do it with almost no tokens cost.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.