<p dir="auto"><code class="notranslate">go get</code> is frequently used by users and developers on hostile networks (eg, the internet) to fetch and run code. Incredibly, when HTTPS connections fail (for instance because an attacker is denying access to HTTPS), <code class="notranslate">go get</code> falls back to HTTP.</p>
<p dir="auto">Please remove support for plain HTTP, or refuse to use it without the user specifying explicitly that they want to make HTTP connections!</p>
<p dir="auto">Currently it is impossible to securely fetch a package via <code class="notranslate">go get</code>, because it downloads via an insecure protocol if secure protocols fail or are not available. It is possible for an attacker to block secure ports (443 for HTTPS and 22 for git+ssh) and serve malicious packages via plain-text HTTP or git protocols.</p>
<p dir="auto">I propose making it an explicit option to enable insecure protocols, e.g. <code class="notranslate">-allow-insecure</code>.</p>
<p dir="auto">As a compromise (e.g. for backwards compatibility), <code class="notranslate">-secure</code> option may be implemented instead, making insecure behavior the default, but allowing users to add the flag to disable plain-text protocols.</p>