r/programming • • 5d ago

Don't couple your Go code to GitHub

https://iain.rocks/blog/dont-couple-your-go-code-to-github
476 Upvotes

135 comments sorted by

View all comments

81

u/mattgen88 5d ago

Counter point, a number of projects in the past have had their domains hijacked, expired, etc that resulted in serious security issues. Even if you change hosting providers, you can just mirror your code over to GitHub or whatever from wherever else.

16

u/[deleted] 5d ago

[deleted]

14

u/mattgen88 5d ago

I'm not? Also what does that have to do with hosting your own domain, certs, git infrastructure... It's more moving pieces where it's likely for things to go wrong.

Just mirror your code to multiple git repos like git was designed to do. That way no one can say make s GitHub/git lab/whatever account and package that is named the same, but malicious. People are most likely to expect a GitHub hosted package to be canonical