The OP is in part a reflection on the sunset of the Go Gorilla package. The blog post about that which it links to at the end is very much worth a read (I didn't know about it, or the fate of the Gorilla package, before getting linked to it here), and I'd actually love to see an HN thread about THAT one!

https://onengineering.substack.com/p/there-is-no-secure-soft...

Looks like that's been submitted to HN, but never got traction.

It has the somewhat misleading title "There is no secure software supply-chain," which probably didn't help it's HN votes on previous submissions. It's really about the maintainers deciding to sunset Gorilla, in the context of that being a good idea to prevent it from becoming an insecure untrustworthy dependency, but more than that too. I found it a very thought-provoking read, and would love to hear others responses to it, including folks from Go community but also on the general issues.