Comment by ForHackernews

2 months ago

Github is a centralized repository where the overwhelming majority of Go libraries are hosted.

So GitHub is every single programming language's centralized package repository?

Then what's the difference between git and npm, cargo, pypi, mvn et al?

  • Git != Github.

    In practice, little difference between Go's use of Github and Python's use of PyPI. Someone at Microsoft with root access could compromise everyone.

    • > Git != Github

      That's why I'm putting emphasis on it, because to Go it is.

      And to languages that actually have centralized package repositories it isn't. There is a difference between code and packages and Go simply does not have the latter (in the traditional sense - what Go calls a package is a collection of source files in the same directory that are compiled together within a module (a module is a collection of packages (again, code) that are released, versioned, and distributed together. Modules may be downloaded directly from version control repositories or via proxy servers)).

      To the other languages mentioned above, packages may have binaries, metadata and special script hooks. There is a package manager like pip , cargo or npm and if you want to install one, you won't have to specify a URL because there is a canonical domain to go to.

      Go just knows code and it'll use git, hg or even svn. And if you want to claim that lots of open-source code being on GitHub makes it special, then

      > GitHub is every single programming language's centralized package repository

      and

      > Someone at Microsoft with root access could compromise every user of every single programming language

      8 replies →