* you could hash the URLs (the only problem is that they will be non-readable)
* if the source is version-controlled you can figure out the URL using git/bzr/svn/whatever

Actually, this also made me realise one more potential problem: if you ever clone a master of something, then unless you manually do `rebar update-deps` or remove the shared deps dir, the version of master you retrieved the first time will remain the one being used forever, which can also cause confusion, because you would expect, e.g. `git clean -ffdx && rebar get-deps` to get the *current* master of the dependency always and not the one you cloned three months ago.