GitHub shouldn't allow username reuse

Re:GitHub shouldn't allow username reuse by Demiurge on Friday February 09, 2018 @04:52PM (#16344164)

I tried to debug Go project once, and the moment I saw that, I was completely shocked that it was importing from github urls, without even tags, or versions as far as I could tell. It seems dangerous to rely on a for-profit host and individual users. If 'network' dependencies are part of the language, it should at least be non-profit, or better Go project managed host. There are many examples, like PyPi, or PECL.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by ovao on Friday February 09, 2018 @05:16PM (#16344333)

Go doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository.

Anyone can actually 'reflect' dependencies hosted with various VCS with this method, and gopkg.in does essentially this (while adding version pinning).

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by ioddly on Friday February 09, 2018 @06:08PM (#16344625)

> Go doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository.

Is there somewhere I can read more about this tag? Opened up the source of one of my repos and I couldn't find it.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by detaro on Friday February 09, 2018 @06:37PM (#16344785)

https://golang.org/cmd/go/#hdr-Remote_import_paths

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by ioddly on Friday February 09, 2018 @06:47PM (#16344839)

Thank you! I didn't think to check the Go docs.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by strkek on Friday February 09, 2018 @05:24PM (#16344388)

The only drawback I see to this approach is that adding a new method is not trivial, and requires recompiling the `go` executable.

Makes it more difficult to implement a handler for the BitTorrent protocol to `go get` from a DHT, just for the sake of mad science.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by Klathmon on Friday February 09, 2018 @07:48PM (#16345136)

That sounds like an incredible idea!

Has anyone tried to do something like this before? I would absolutely run a torrent server to serve up my own and others' open source packages.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by ovao on Friday February 09, 2018 @09:21PM (#16345472)

To my knowledge it hasn’t been tried. It shouldn’t be too difficult to author a tool to do so, which could itself be made go-gettable. With this you’d avoid the mess of shipping an alternate build of the go tool and all that entails.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by comex on Saturday February 10, 2018 @12:03AM (#16345983)

This project was fairly close to that idea:

https://github.com/cjb/GitTorrent

I think it’s abandoned though.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by Klathmon on Friday February 09, 2018 @11:11PM (#16345826)

Yeah, the more I think about it the easier it seems.

You could probably write "plugins" or shims/wrappers for most package managers out there pretty easily.

And a great MVP would just be the ability to install from a magnet link.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by strkek on Friday February 09, 2018 @09:23PM (#16345475)

I read somewhere that big companies use BitTorrent internally to update their codebase.

But yeah, I'd really like for someone to develop a VCS like that (even more if it's in Go, with no Cgo, and under BSD, MIT or Apache license). It'd make distribution, immutability and mirroring so much easier.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by detaro on Saturday February 10, 2018 @06:38AM (#16346895)

There is https://github.com/whyrusleeping/gx (based on IPFS instead of torrents, but they work extremely similarly for this use case)

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by dewey on Friday February 09, 2018 @04:54PM (#16344177)

That's what vendoring and dependency tools are for.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by crdoconnor on Friday February 09, 2018 @05:02PM (#16344232)

That was the first wtf I hit when learning go that made me think that it possibly wasn't all it was cracked up to be.

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by sannee on Saturday February 10, 2018 @06:38AM (#16346894)

> It seems dangerous to rely on a for-profit host

Unfortunately, "non-profit" hosts are somewhat in a short supply.

[ Parent | on HN ]