add warning about Go's past and future data collection

Based on https://github.com/golang/go/discussions/58409, the Go compiler
already defaults to using a google proxy server, which would allow
Google to collect information about what dependencies users are
installing. (Of course they claim they won't.) Two separate environment
settings are needed to turn that off, and users in that thread were
surprised to learn about one of them.

So this warning is already appropriate to some extent.

Also based on the minimisation of user concerns by the golang developers
on that issue and elsewhere, it seems best to assume that they are not
going to be dissuaded from increasing data collection efforts in the future,
even if the blowback prevents this particular attempt.

So this warning should not be removed unless the Go community somehow
extricates itself from Google's control. Or unless ipfs is rewritten in
another language.

Some distros do have ipfs. Unfortunately, Debian appears to be structurally
incapable of packaging it. (8 years and counting;
https://bugs.debian.org/779893). So lots of users will be stuck
installing it from source or having to trust its official binaries.
This commit is contained in:
Joey Hess 2023-02-11 14:17:13 -04:00
parent 6889fe5325
commit 5b504b78d9
No known key found for this signature in database
GPG key ID: DB12DB0FF05F8F38

View file

@ -1,8 +1,12 @@
This special remote stores file contents in [ipfs](http://ipfs.io/).
Warning: ipfs is written in Go, a language controlled by Google, which
collects user's data with its compiler. If installing ipfs from source
you should consider investigating how to disable Go's data collection.
Or install precompiled ipfs from a software distributor you trust.
## prerequisites
* git-annex version 5.20150305 or newer.
* Install [[external/git-annex-remote-ipfs]] somewhere in PATH
and `chmod +x` the script.
* Install [go-ipfs](https://github.com/jbenet/go-ipfs) somewhere in PATH.