{"slug": "go-module-proxy", "name": "Go module proxy", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 5, "warners": 0, "score": 3.159, "rising": 0.35, "first": "2025-11-28", "latest": "2026-09-28", "why": "Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted)", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 0}, "spark": [1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted)", "kind": "", "icon": true, "domain": "golang.org", "github_repo": null, "official_url": "https://proxy.golang.org/", "pricing": "", "aliases": ["Go module proxy"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 797991328, "item_id": 49874458, "url": "https://news.ycombinator.com/item?id=49874458", "by": "Mawr", "date": "2026-09-28", "version": null, "stance": "recommend", "quote": "https://proxy.golang.org/", "excerpt": "https://proxy.golang.org/", "context": "", "use_case": "Go module mirror", "switched_from": "", "story": "Don't couple your Go code to GitHub"}, {"id": 737234512, "item_id": 46077157, "url": "https://news.ycombinator.com/item?id=46077157", "by": "oefrha", "date": "2025-11-28", "version": null, "stance": "recommend", "quote": "Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted)", "excerpt": "Golang builds pulling a github.com/foo/bar/baz module don't rely on any GitHub \"build workflow\", so unless you mean they're going to start restricting or charging for git clones for public repos (before you mention Docker Hub, yes I know), nothing's gonna change. And even if they're crazy enough to do that, Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted) and ", "context": "", "use_case": "", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["go module mirror", "go module checksum storage"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49868404", "title": "Don't couple your Go code to GitHub", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46537095", "title": "go.sum Is Not a Lockfile", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46070203", "title": "GitLab discovers widespread NPM supply chain attack", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {"neutral": 1, "recommend": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1, "neutral": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 798011088, "item_id": 49875693, "url": "https://news.ycombinator.com/item?id=49875693", "by": "gchamonlive", "date": "2026-09-28", "version": null, "stance": "neutral", "quote": "", "excerpt": "This should be the first thing to learn when starting with Golang. Let's take a project I worked on for a couple of years some time ago, it has this go.mod file: https://gitlab.com/nunet/device-management-service/-/blob/main/go.mod?ref_type=heads Is it just changing all instances of `github.com` to `proxy.golang.org`? Shouldn't `go build` warn about using third party proxies for dependencies? Should `go get` offer a ", "context": "", "use_case": "", "switched_from": "", "story": "Don't couple your Go code to GitHub"}, {"id": 797991328, "item_id": 49874458, "url": "https://news.ycombinator.com/item?id=49874458", "by": "Mawr", "date": "2026-09-28", "version": null, "stance": "recommend", "quote": "https://proxy.golang.org/", "excerpt": "https://proxy.golang.org/", "context": "", "use_case": "Go module mirror", "switched_from": "", "story": "Don't couple your Go code to GitHub"}, {"id": 744691936, "item_id": 46543246, "url": "https://news.ycombinator.com/item?id=46543246", "by": "kbolino", "date": "2026-01-08", "version": null, "stance": "recommend", "quote": "", "excerpt": "Here's another person auditing the checksum database: https://raphting.dev/posts/gosumdb-live-again/", "context": "", "use_case": "Go module checksum storage", "switched_from": "", "story": "go.sum Is Not a Lockfile"}, {"id": 744664784, "item_id": 46541549, "url": "https://news.ycombinator.com/item?id=46541549", "by": "agwa", "date": "2026-01-08", "version": null, "stance": "neutral", "quote": "Checksums are stored forever, in a Merkle Tree", "excerpt": "> The Go module proxy doesn't make any guarantee that it will permanently store the checksum for any given module Incorrect. Checksums are stored forever, in a Merkle Tree, meaning if the proxy were to ever delete a checksum, it would be detected (and yes, people like me are checking - https://sourcespotter.com/sumdb). Like any code host, the proxy does not guarantee that the code for a module will be available forev", "context": "", "use_case": "", "switched_from": "", "story": "go.sum Is Not a Lockfile"}, {"id": 737234512, "item_id": 46077157, "url": "https://news.ycombinator.com/item?id=46077157", "by": "oefrha", "date": "2025-11-28", "version": null, "stance": "recommend", "quote": "Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted)", "excerpt": "Golang builds pulling a github.com/foo/bar/baz module don't rely on any GitHub \"build workflow\", so unless you mean they're going to start restricting or charging for git clones for public repos (before you mention Docker Hub, yes I know), nothing's gonna change. And even if they're crazy enough to do that, Go module downloads default to a proxy (proxy.golang.org by default, can be configured and/or self-hosted) and ", "context": "", "use_case": "", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}]}