Hacker News new | ask | show | jobs
by nijave 26 days ago
Not sure relying on a bunch of various VCS to stay online is necessarily a great approach either.

I think go is also a little more amenable to source library distribution since there's a pretty broad pure go ecosystem. For interpreted languages, a lot of performance sensitive stuff tends to be offloaded to arbitrary compiled languages so you end up needing a bunch of different toolchains to get everything working. A statically linked binary library is a useful abstraction layer.
1 comments
theamk 26 days ago
2nd paragraph of blogpost:

> A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to prevent repos from being left-pad’d.

there is no need for 3rd party hosts to stay online. It's the best combination of de-centralized and centralized approaches.

Re pre-buiild packages: Python makes a difference between source and binary wheels. This approach is obviously for source wheels only.

link
nijave 24 days ago
Proxies are still 3rd party hosts.

I've ran into issues in my very limited go experience with them missing things and having hash mismatches (maybe someone changed a tag and it was working as intended? I don't remember the exact chain of events but I ended up with a hash that could no longer be found anywhere)

link