Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: the GOPROXY should have no default value #31757

Closed
aofei opened this issue Apr 30, 2019 · 7 comments
Closed

cmd/go: the GOPROXY should have no default value #31757

aofei opened this issue Apr 30, 2019 · 7 comments
Milestone

Comments

@aofei
Copy link
Contributor

@aofei aofei commented Apr 30, 2019

Hi Go team, I'm the author of goproxy/goproxy.cn. I started this project with China's well-trusted cloud service provider Qiniu Cloud mainly to solve the problem that we can't go get modules like golang.org/x/... through Go modules in the mainland of China. But now I'm starting to have some concerns that it makes no sense to develop this project.

Note that I'm here not talking about proxy.goalng.org shouldn't be blocked in China (of course it shouldn't be), so if anyone wants to talk/argue about it, please head to #31755. I'm here talking about a dangerous thing that @rsc mentioned in Go Modules in 2019:

...
We are aiming to have the Google-run module mirror ready to be used by default in the go command starting in Go 1.13. Using an alternate mirror, or no mirror at all, will be trivial to configure.
...

If I have understood correctly, starting with Go 1.13 the proxy.goalng.org will become the default value for the GOPROXY. Is that really a right thing to do?

As @davecheney mentioned in #25530 (comment), now the proxy.golang.org is definitely not only blocked in the mainland of China. So when the proxy.golang.org becomes the default, does it mean that Go beginners in these countries will not be able to use their brand new Go 1.13 to run ANY project that imports third-party packages? Of course, if they don't know how to break through the network blockade, and don't know that there is a GOPROXY needs to be manually modified by them (after all, they are beginners, how can they know).

blocked-proxy golang org

Moreover, as you mentioned in FAQ:

...
In order to improve our services caching and serving latencies, new versions may not show up immediately. Try again in an hour or two, and if it still isn't showing up, file an issue.
...

I think one or two hours is not good enough at all. I mean, if a module has just fixed a vulnerability and released a new version, we will not be able to get this new version immediately with the default GOPROXY, right?

In summary, due to the above two problems, I think it is dangerous to make the proxy.golang.org the default value of the GOPROXY. So, have you really decided to do this?

@ALTree ALTree added the modules label Apr 30, 2019
@ALTree ALTree added this to the Go1.13 milestone Apr 30, 2019
@yuefeng1996

This comment has been minimized.

Copy link

@yuefeng1996 yuefeng1996 commented Apr 30, 2019

You should never do that. Think about our Chinese college students. Many of us are Go beginners (even programming beginners) and don't even know anything like the GOPROXY at first. If we can't use Go smoothly in the first place, why should we learn Go instead of learning Python/Ruby/C/C++?

@bradfitz

This comment has been minimized.

Copy link
Member

@bradfitz bradfitz commented May 1, 2019

This is a duplicate of #31755. Let's consolidate discussion on that earlier bug.

@bradfitz bradfitz closed this May 1, 2019
@aofei

This comment has been minimized.

Copy link
Contributor Author

@aofei aofei commented May 1, 2019

Hi @bradfitz, I don't think this one is a duplicate of #31755. I'm talking about there should be no default GOPROXY.

And, I added that diagram just to show you how dangerous it is after proxy.golang.org becomes the default. But this will not happen only in China.

@aofei

This comment has been minimized.

Copy link
Contributor Author

@aofei aofei commented May 1, 2019

Do I make myself clear? The most dangerous thing I mentioned was to have a Go beginner use a service they would never reach without any knowledge of it and without making any changes...

Imagine how disappointing they would be if they couldn't run a simple "hello, world" with the gin framework or something else. Please don't think that this is a minority problem (in fact it is not) and ignore it.

@aofei aofei changed the title cmd/go: will the proxy.golang.org be the default value for the GOPROXY? cmd/go: the GOPROXY should have no default value May 1, 2019
@oiooj

This comment has been minimized.

Copy link
Member

@oiooj oiooj commented May 1, 2019

@aofei If you are finding a proxy, try goproxy.io.

image

The Go Team can't help you across the wall. Just find your own way.

@aofei

This comment has been minimized.

Copy link
Contributor Author

@aofei aofei commented May 1, 2019

@oiooj I'm not finding a proxy... have you ever read what I wrote? And I never asked the Go team to help me across anything.

@bradfitz

This comment has been minimized.

Copy link
Member

@bradfitz bradfitz commented May 1, 2019

Feel free to repeat any missing concerns or information on #31755. They're related enough that it's not worth having two open.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.