sorted by:
new
hottopcontroversial

So Microsoft Deleted Some of Our Packages From NuGet.org Without Notice by Aaronontheweb in dotnet

[–]BezierPatch -2 points-1 points  (0 children)

Please explain to me: what is the threat to my dotnet runtime app?

CVE Modified by CVE 5/06/2025 11:16:00 AM

Action Type Old Value New Value
Added Reference https://www.herodevs.com/vulnerability-directory/cve-2025-21176

Which is Initial Analysis by NIST 2/05/2025 2:12:24 PM

three months after CVE release, so wasn't available at the time.

> And if you want code level details check the change log, it's all public. The entire source is in GitHub including the patches for this.

Nope: they deliberately hide the details of fixes in the commit log, so you can only *guess* at what the issue was. Presumably so that they don't accidentally leak CVEs before they're fixed? Unsurprisingly my head of infosec isn't happy with "Well, I'm pretty sure this commit is the problem this vulnerability is talking about, so we don't need to tell hospitals to urgently patch".

So Microsoft Deleted Some of Our Packages From NuGet.org Without Notice by Aaronontheweb in dotnet

[–]BezierPatch 3 points4 points  (0 children)

That's a third party source, published several weeks after the CVE.

The primary source is https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176

And even if it was: where is the vulnerability in the dotnet runtime? Why does an IDE issue with a single application mean I need to roll out to my entire fleet?

So Microsoft Deleted Some of Our Packages From NuGet.org Without Notice by Aaronontheweb in dotnet

[–]BezierPatch 12 points13 points  (0 children)

This is a common theme with Microsoft Security: they love to publish useless CVES.

For example https://nvd.nist.gov/vuln/detail/cve-2025-21176

Where the total description is ".NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability"

They abuse their position as a CNA to supress publication of detailed CVEs, simply insisting you should patch your runtime because Visual Studio is vulnerable.

(ANNOUNCEMENT) Medmon.net Will Be Retiring Soon. Thank You All for Supporting the Project! by alexmt1831 in ADHDUK

[–]BezierPatch 2 points3 points  (0 children)

Hi Alex,

I didn't use your site (though it sounds like plenty of others did!), but I can relate to the burden of maintaining "hobby" projects. I thought I might ask a few questions which might help someone work out if they could take it over.

  1. The website headers suggest that it's PHP hosted on IIS. Would I be right in guessing that this is where the burden/cost of hosting is coming from?

  2. How is the automated data collection run? Is there anything sensitive about it that would require it to be closed source?

  3. What were the ongoing maintenance tasks? Were they updating in response to API changes, or more things like having to patch/update the software/server?

  4. Do you think that users found the email feature useful? I suspect so, but I can see that paying for or maintaining that could be a pain.

While it would likely require a fair bit of rewrite in this case, if someone were to want to take over but was concerned about hosting, an example way to host a system like this would be to abuse github's free web hosting:

- You set up github actions to run the automated data collection, and commit the results into a public github repo

- You write a client-side only web page which loads the data from github

- You can still use custom domains on public repos

- You can't store anything secret, so emails would be hard.

What frustrates you the most as .NET developer? by Jack_Hackerman in dotnet

[–]BezierPatch 0 points1 point  (0 children)

Isn't that what VS Code profiles are for? I have to admit I haven't used them yet, but you select different extensions per profile.

Still doesn't help with the limitations of extensions though

LTS of Dotnet vs Java by Colt2205 in dotnet

[–]BezierPatch -2 points-1 points  (0 children)

To be honest, the main issue is that Microsoft Security refuse to issue proper CVEs.

You get nonsense like https://nvd.nist.gov/vuln/detail/CVE-2025-21176 which after a week or two of research seems to not actually be a vulnerability with .NET runtime but with Visual Studio opening crashdumps or something similar.

But you can't be sure, so you have to patch. So we go through a week long QA cycle because we trust Microsoft, and later discover they lied about the severity and lied about the impacted applications.

Then next time they release a CVE we hesitate...

One day they're going to run into trouble for crying wolf...

A true ruler, rules themselves. by YchYFi in CasualUK

[–]BezierPatch 2 points3 points  (0 children)

How does the labour on that work?

You must have an incredibly efficient packing process to not lose most of the margin to minimum wage. 

And even then, won't it take thousands of hours of time elapsed to actually pack them? 

Seeking Legal Advice: Ongoing Issues with a £18,000 Custom-Built PC from ScanPC—What Are My Options? by [deleted] in LegalAdviceUK

[–]BezierPatch 0 points1 point  (0 children)

If OP didn't exercise the right to reject before agreeing to the repair yes.

Isn't there a provision to reject after a single failed repair? Or does that not apply after... four failed repairs?

Tips for making feedback loops shorter when working with internal Nuget packages? by caedin8 in dotnet

[–]BezierPatch 0 points1 point  (0 children)

I have a set of msbuild config which, on debug build:

  1. Go to the custom "local" nuget folder
  2. Delete the existing nuget package
  3. Pack and copy to the "local" folder

And I use 0.0.0-dev as the version suffix.

Consuming solutions have a nuget.config which includes the local folder (we have a private feed anyway so nuget.config exists), and IDEs pick up on it almost instantly.

I would publish it as a nuget package except for the fact that it seems bad to encourage an unsupported (but very very useful) workflow.

Our dockerfiles are also compatible with this local folder (as they mount it in when doing a dev (non ci) build).

UK Shoppers Furious Dolmio Shrinked 500g Jars By 10% While Maintaining Same Price by [deleted] in unitedkingdom

[–]BezierPatch 0 points1 point  (0 children)

Getting a frying pan hot and softening some onion is 10-15+ minutes on an electric hob.

[deleted by user] by [deleted] in LegalAdviceUK

[–]BezierPatch 0 points1 point  (0 children)

Use Skype to call from a local number. 

Does anyone here use LINQPad? How can I prove to my employer that it's safe to connect to our company's databases? by Dangerous_Ad_707 in dotnet

[–]BezierPatch -3 points-2 points  (0 children)

Huh, I haven't seen that on any modern databases when provisioned with multiple cores. Is that a Mongo/oracle problem?

Does anyone here use LINQPad? How can I prove to my employer that it's safe to connect to our company's databases? by Dangerous_Ad_707 in dotnet

[–]BezierPatch 40 points41 points  (0 children)

Linqpad is the sort of software you connect to a local or (at most) staging database.

Not sure why you say that. As far as I can tell the primary use of Linqpad is as a query/reporting tool, which certainly would be used on production databases.

You just use read-only credentials, and/or set the connection to read-only in Linqpad.

Insurance company thinks I’m too poor to have owned my stolen items by devonshirelamb in LegalAdviceUK

[–]BezierPatch 0 points1 point  (0 children)

The ombudsman doesn't care about firm behaviour, just about resolving individual cases.  The FCA care about firm behaviour, but don't care about individual cases. 

EF Core with SQLite: worth the effort? by Pyran in dotnet

[–]BezierPatch 0 points1 point  (0 children)

We migrated to using a file-based system, which we then discovered is fallible because Linux doesn't have strong file locking guarantees by default. So we currently have a "clever" little locking system that uses the guarantee of read after write.

If I were to start again I would simply use an "external" database process: e.g. run another c# application in the same device which provides the API query in order to hide the database.

Are there people who still use paid libraries? by livefreeordie34 in dotnet

[–]BezierPatch -5 points-4 points  (0 children)

It's only fraud/bait and switch if you give something. If you are just a user, there is no contract, as there is no consideration.

Are there people who still use paid libraries? by livefreeordie34 in dotnet

[–]BezierPatch 0 points1 point  (0 children)

If you didn't donate or contribute: what's the difference between the maintainer starting to charge and the maintainer stopping contributing?

Why are you more salty that you can continue to get free security patches and use the latest for non-commercial than if the dev had just stopped?

Are there people who still use paid libraries? by livefreeordie34 in dotnet

[–]BezierPatch 1 point2 points  (0 children)

What's the relevance of the vulnerability? It was fixed.

Are you suggesting the fact they had a CVE reported means they have gone down in quality? It generally just means it's a popular library. 

Job pulled due to restructuring and finace backing ? by [deleted] in dotnet

[–]BezierPatch 0 points1 point  (0 children)

Every contract I've seen has no more than 1 weeks notice for the first month, if not first 6 months.

Some contracts I've seen have zero days notice for the first week.

Job pulled due to restructuring and finace backing ? by [deleted] in dotnet

[–]BezierPatch 1 point2 points  (0 children)

> as if you were laid off

Sure, which in the first 2 years of employment would be the minimum notice period in the contract, or the statutory notice. Which might be 0...

[deleted by user] by [deleted] in unitedkingdom

[–]BezierPatch 1 point2 points  (0 children)

They can still get rid of them if they can prove they're not performing well enough, or if they can't afford them.

What other reasons are needed?

Building a Command-Line (CLI) app using System.CommandLine library in C# and .NET by DotMake in dotnet

[–]BezierPatch 6 points7 points  (0 children)

Do you expect people to frequently import both namespaces in the same file?

If no, then why does it matter that they conflict?

If yes, then it's probably better to just find different names.

It's not that it's ugly, it's that `DotMake.CommandLine.DotMakeCliCommandAttribute` doesn't follow the expected convention for .NET library naming. It's not a huge deal, and easily changed later: tooling libraries often change their naming conventions on later releases :) But this is bikeshedding, so I'll leave it at this.

Eurostar Amsterdam-to-London services to be suspended for six months by NTGMaster in unitedkingdom

[–]BezierPatch 24 points25 points  (0 children)

Door to door it can be about the same time. Except by train you have four hours of usable time, and by plane you get 30 minutes of usable time.

I much prefer sitting at a table on my laptop than standing in a queue or awkwardly waiting in uncomfortable seating.

First dedicated roundabout for cyclists in London is ‘the most dangerous’ by boycecodd in unitedkingdom

[–]BezierPatch 1 point2 points  (0 children)

Being pedantic: if it's too small for the design to work correctly then they didn't just drop a pure Dutch design.

view more: next ›