Don't couple your Go code to GitHub
8 points by olex
8 points by olex
There is an implicit trust issue though. I know that I can verify what code is being served from github because I trust the integrity of github's hosted service. I don't have the same trust towards domains I don't recognize. What if a malicious domain shows one thing when I visit it with a browser and serves something different when go fetches dependencies?
The Go module proxy detects these kind of attacks. If the server doesn't deliver the exact same bytes every time then you'll get an error.