cmd/go: the GOPROXY should have no default value

[aofei]

Hi Go team, I'm the author of goproxy/goproxy.cn. I started this project with China's well-trusted cloud service provider Qiniu Cloud mainly to solve the problem that we can't go get modules like golang.org/x/... through Go modules in the mainland of China. But now I'm starting to have some concerns that it makes no sense to develop this project.

Note that I'm here not talking about proxy.goalng.org shouldn't be blocked in China (of course it shouldn't be), so if anyone wants to talk/argue about it, please head to #31755. I'm here talking about a dangerous thing that @rsc mentioned in Go Modules in 2019:

...
We are aiming to have the Google-run module mirror ready to be used by default in the go command starting in Go 1.13. Using an alternate mirror, or no mirror at all, will be trivial to configure.
...

If I have understood correctly, starting with Go 1.13 the proxy.goalng.org will become the default value for the GOPROXY. Is that really a right thing to do?

As @davecheney mentioned in #25530 (comment), now the proxy.golang.org is definitely not only blocked in the mainland of China. So when the proxy.golang.org becomes the default, does it mean that Go beginners in these countries will not be able to use their brand new Go 1.13 to run ANY project that imports third-party packages? Of course, if they don't know how to break through the network blockade, and don't know that there is a GOPROXY needs to be manually modified by them (after all, they are beginners, how can they know).

Moreover, as you mentioned in FAQ:

...
In order to improve our services caching and serving latencies, new versions may not show up immediately. Try again in an hour or two, and if it still isn't showing up, file an issue.
...

I think one or two hours is not good enough at all. I mean, if a module has just fixed a vulnerability and released a new version, we will not be able to get this new version immediately with the default GOPROXY, right?

In summary, due to the above two problems, I think it is dangerous to make the proxy.golang.org the default value of the GOPROXY. So, have you really decided to do this?

[bradfitz]

This is a duplicate of #31755. Let's consolidate discussion on that earlier bug.

[aofei]

Hi @bradfitz, I don't think this one is a duplicate of #31755. I'm talking about there should be no default GOPROXY.

And, I added that diagram just to show you how dangerous it is after proxy.golang.org becomes the default. But this will not happen only in China.

[aofei]

Do I make myself clear? The most dangerous thing I mentioned was to have a Go beginner use a service they would never reach without any knowledge of it and without making any changes...

Imagine how disappointing they would be if they couldn't run a simple "hello, world" with the gin framework or something else. Please don't think that this is a minority problem (in fact it is not) and ignore it.

[oiooj]

@aofei If you are finding a proxy, try goproxy.io.

The Go Team can't help you across the wall. Just find your own way.

[aofei]

@oiooj I'm not finding a proxy... have you ever read what I wrote? And I never asked the Go team to help me across anything.

[bradfitz]

Feel free to repeat any missing concerns or information on #31755. They're related enough that it's not worth having two open.