Your Go Modules Don't Need GitHub

Go resolves imports over HTTPS using one HTML meta tag — not by cloning GitHub. Own your import path, move hosts, and keep builds alive.

One of this weekend's bigger threads — "Don't couple your Go code to GitHub" — sounds like style advice. It's really about a mechanism most Go developers never see: the go tool doesn't resolve imports by talking to GitHub. It resolves them over plain HTTPS, using an HTML meta tag that can point anywhere.

Which means the github.com/you/pkg in your users' go.mod files is a name, not an address. The address gets decided at request time — and you can own the DNS that decides it.

Why this matters

Code hosts churn: renames, acquisitions, suspended accounts, outages. If your import path is your GitHub path, every one of those events breaks downstream builds at once. And the "fix" is a path bump that changes no code.

Here's the part most people miss: with the default GOPROXY=https://proxy.golang.org,direct, builds barely touch your git host anyway. The proxy fetches each version once, zips it, and caches

Python Killed Its JIT. What Makes Python Fast Now?

CPython is dropping its experimental copy-and-patch JIT — it never beat the interpreter by much, and it made you build with LLVM.

Why Your vLLM Tool Calls Break at Random

Open models don't emit tool calls; they emit text that gets regexed into JSON. Constrained decoding makes bad arguments impossible.

Freeze Your Prompt Prefix, Cut Your LLM Bill

Context engineering is all over HN today. Its cheapest lesson: order prompts static-first and let prefix caching pay your LLM bill.

HTTP2Shell: The Response Is the Payload

A new CVE shows how HTTP responses can end up executed by a shell. Here's how to find every remote-string-to-shell path in your code.

Why this matters

Read more

Python Killed Its JIT. What Makes Python Fast Now?

Why Your vLLM Tool Calls Break at Random

Freeze Your Prompt Prefix, Cut Your LLM Bill

HTTP2Shell: The Response Is the Payload