I am all confused about your description.
Do you propose we install Go into %USERPROFILE%\go instead of c:\go by default?
If yes, then why you are talking about GOPATH and PATH?

Alex

want the installer to add the default
GOPATH/bin to %PATH%.

I see now. But Go installer does not change users GOPATH at this moment. I am not sure I would be happy, if Go installer changed my current GOPATH to %USERPROFILE%\go\bin.

Alex

It is not going to set the GOPATH. It is going to add the default GOPATH's bin folder to the PATH.

1. User installs go via the MSI installer
2. Opens new command prompt
3. Runs go get github.com/google/gops on the command prompt
4. Runs gops on the command prompt

It might be a good to add this folder to PATH for the convenience of the user. Then, the majority of the users don't have to deal with environment variables at all unless they want to override anything. If they want to set a custom GOPATH, they are probably good enough to fix the PATH.

It is going to add the default GOPATH's bin folder to the PATH.

I can see now what you are proposing.

Do you propose Go install program removes it from the PATH when user clicks "Uninstall" button? Imaging that user might be "upgrading" their installation by doing "uninstall" followed by "install" of new version. If you decide to leave it as is during "uninstall", you would end up with multiple of %USERPROFILE%\go\bin in user's PATH.

I am also concerned that this

go get github.com/hacker/ping

might install some random program on my computer. And I might not even notice that I am running it.

Alex

might install some random program on my computer. And I might not even
notice that I am running it.

This problem exists all times if the bin is in PATH. What's our broader best practice? Asking users to add GOPATH\bin to PATH every time they open a command prompt?

I can only speak about Unix, but other build tools and package managers often support only installing to (/usr/bin, /usr/local/bin and variants) which requires sudo but Go fails with this concern as it recommends adding GOPATH/bin to PATH as the initial step after the installation.

What's our broader best practice?

I do not know.

Asking users to add GOPATH\bin to PATH every time they open a command prompt?

I am not average Go Windows user - I use Linux to develop. But on Windows I rarely change my "global" environment. When I develop with Go, I have a.bat file (or many) stored on my desktop:

set MYDEV=c:\users\alex\dev
set GOROOT=%MYDEV%\go
set GOROOT_BOOTSTRAP=%MYDEV%\go1.4
set GOPATH=%MYDEV%
set MINGW=%MYDEV%\tdm_gcc_64_5.1.0
rem set MINGW=%MYDEV%\tdm_gcc_32_5.1.0
set PATH=%PATH%;%MINGW%\bin;%GOROOT%\bin
cd %GOROOT%\src
cmd

that I double click. That starts command shell with everything setup to my liking.

This allows me to quickly change everything I want (copy batch file and edit).

I can also run different versions of Go (or everything else) at the same time.

Mind you, I only use command prompt. But, I guess, you could start your IDE instead of cmd, if you like.

Alex

Due to the security concerns, we are not fixing this.