Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: the GOPROXY should have no default value #31757

Closed
aofei opened this issue Apr 30, 2019 · 7 comments
Closed

cmd/go: the GOPROXY should have no default value #31757

aofei opened this issue Apr 30, 2019 · 7 comments
Labels
FrozenDueToAge modules NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made.
Milestone
Go1.13

Comments

@aofei
Copy link
Contributor

aofei commented Apr 30, 2019 •
edited

Hi Go team, I'm the author of goproxy/goproxy.cn. I started this project with China's well-trusted cloud service provider Qiniu Cloud mainly to solve the problem that we can't go get modules like golang.org/x/... through Go modules in the mainland of China. But now I'm starting to have some concerns that it makes no sense to develop this project.

Note that I'm here not talking about proxy.goalng.org shouldn't be blocked in China (of course it shouldn't be), so if anyone wants to talk/argue about it, please head to #31755. I'm here talking about a dangerous thing that @rsc mentioned in Go Modules in 2019:

...
We are aiming to have the Google-run module mirror ready to be used by default in the go command starting in Go 1.13. Using an alternate mirror, or no mirror at all, will be trivial to configure.
...

If I have understood correctly, starting with Go 1.13 the proxy.goalng.org will become the default value for the GOPROXY. Is that really a right thing to do?

As @davecheney mentioned in #25530 (comment), now the proxy.golang.org is definitely not only blocked in the mainland of China. So when the proxy.golang.org becomes the default, does it mean that Go beginners in these countries will not be able to use their brand new Go 1.13 to run ANY project that imports third-party packages? Of course, if they don't know how to break through the network blockade, and don't know that there is a GOPROXY needs to be manually modified by them (after all, they are beginners, how can they know).

blocked-proxy golang org

Moreover, as you mentioned in FAQ:

...
In order to improve our services caching and serving latencies, new versions may not show up immediately. Try again in an hour or two, and if it still isn't showing up, file an issue.
...

I think one or two hours is not good enough at all. I mean, if a module has just fixed a vulnerability and released a new version, we will not be able to get this new version immediately with the default GOPROXY, right?

In summary, due to the above two problems, I think it is dangerous to make the proxy.golang.org the default value of the GOPROXY. So, have you really decided to do this?
@ALTree ALTree added the modules label Apr 30, 2019
@ALTree ALTree added this to the Go1.13 milestone Apr 30, 2019
@ALTree ALTree added the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label Apr 30, 2019
@bradfitz
Copy link
Contributor

bradfitz commented May 1, 2019

This is a duplicate of #31755. Let's consolidate discussion on that earlier bug.

@bradfitz bradfitz closed this as completed May 1, 2019
@aofei
Copy link
Contributor Author

aofei commented May 1, 2019 •
edited

Hi @bradfitz, I don't think this one is a duplicate of #31755. I'm talking about there should be no default GOPROXY.

And, I added that diagram just to show you how dangerous it is after proxy.golang.org becomes the default. But this will not happen only in China.

@aofei
Copy link
Contributor Author

aofei commented May 1, 2019

Do I make myself clear? The most dangerous thing I mentioned was to have a Go beginner use a service they would never reach without any knowledge of it and without making any changes...

Imagine how disappointing they would be if they couldn't run a simple "hello, world" with the gin framework or something else. Please don't think that this is a minority problem (in fact it is not) and ignore it.

@aofei aofei changed the title cmd/go: will the proxy.golang.org be the default value for the GOPROXY? cmd/go: the GOPROXY should have no default value May 1, 2019
@oiooj
Copy link
Member

oiooj commented May 1, 2019

@aofei If you are finding a proxy, try goproxy.io.

image

The Go Team can't help you across the wall. Just find your own way.

@aofei aofei mentioned this issue May 1, 2019
Closed
@aofei
Copy link
Contributor Author

aofei commented May 1, 2019

@oiooj I'm not finding a proxy... have you ever read what I wrote? And I never asked the Go team to help me across anything.

@bradfitz
Copy link
Contributor

bradfitz commented May 1, 2019

Feel free to repeat any missing concerns or information on #31755. They're related enough that it's not worth having two open.

@golang golang locked and limited conversation to collaborators Apr 30, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge modules NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made.
Projects
None yet
Milestone
Go1.13
Development

No branches or pull requests
6 participants
@bradfitz @oiooj @ALTree @aofei @gopherbot and others