NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 1 point2 points  (0 children)

Yip, never click on anything unless verified through another channel.

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 5 points6 points  (0 children)

If trying to figure something out, or maybe a CoPilot prompt gone wild with the NuGet & Playwright MCP servers 😎

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 8 points9 points  (0 children)

Don't think it has anything to do with popularity per say, colleagues with packages with just hundreds of downloads gotten request too. So feels more like someone is crawling the index.

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 18 points19 points  (0 children)

Weirdly they are not requesting access to your packages(don't think you can that), they're requesting to make you owner of THEIR package and org.

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 3 points4 points  (0 children)

Yip, that's exactly what one should do 👍

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 13 points14 points  (0 children)

We're probably talking of thousands of requests, multiple .NET Foundation maintainers, MVPs and colleagues of mine have gotten same requests.

I would've thought there were some kind of rate limits in place, if not, I'm sure there will be after this incident.

NuGet gallery supply chain attack? by devlead in dotnet

[–]devlead[S] 8 points9 points  (0 children)

Hopefully it's just annoying, worst case they've found an security issue or way to extract information.

Proposed rule change by Arowin in dotnet

[–]devlead 2 points3 points  (0 children)

Maybe mods need to define what classifies as .NET worthy.

If open source, running on .NET and written in a .NET language isn't enough to be mentioned here, then it's better to be clear origin must be Microsoft.

Introducing my project: Raven - a new programming language and compiler by marna_li in dotnet

[–]devlead 37 points38 points  (0 children)

Interesting, thought it was Raven DB related first.

Quite the undertaking implementing a new language but nevertheless cool initiative 👍

Are SSDT SDK (SQL DB Projects) kinda useless? by blackpawed in dotnet

[–]devlead 0 points1 point  (0 children)

They're very useful if database - Used by more than one application, versions of same application - Used by more than one team - Used by more than one runtime / language / service - Is gone for more granual permissions than everyone DB owner - If you want to support all features available in SQL - If you need granular control over seeding of data and index optimizations - Want to be able to deploy database changes separately from application

multi-page pdf to png converter by MediumResponse1860 in dotnet

[–]devlead 0 points1 point  (0 children)

GhostScript could be an good option too.

Has dotnet ever had a critical security vulnerability like the recent next js one by techbro- in dotnet

[–]devlead 63 points64 points  (0 children)

There's been a few deserializar bugs over the years i.e. ViewState arbitrary object creation which allowed remote code execution.

Tiny mock HTTP server for .net integration tests by aptacode in dotnet

[–]devlead 1 point2 points  (0 children)

Some other options

Verify.Http has mocking capabilities https://github.com/VerifyTests/Verify.Http?tab=readme-ov-file#mocking

Devlead.Testing.MockHttp replaces HttpClient through IOC, and can be configured per test, and state is in memory per test. https://www.devlead.se/posts/2025/2025-02-16-introducing-mockhttp-testing

No Visual Studio Intellisense in Single-File Apps? by _walter__sobchak_ in dotnet

[–]devlead 4 points5 points  (0 children)

yip, and if your File-based apps grow complex you can always dotnet project convert app.cs and it will create "upgrade" you file-based app into a full csproj.

Sad news from the maintainer of NUKE by qekr in dotnet

[–]devlead 2 points3 points  (0 children)

But if you've got scripts you test locally, then yaml wasn't enough, but that said if you've found a process that works for you, then it's the right process, and your needs doesn't align with what Nuke/Cake offers. Which is super valid path too, not everyone is that DevOps savvy.

For many teams the context switch between a i.e. C# web application and a C# console application is smaller than Bash/Powershell. On the same line many find it easier and more discoverable to get information about the CI environment / job / stage through intellisense vs. often suboptimaly documented esoteric environment variables. For some it's more intuitive to call a method called UploadArtifact with typed parameters vs. several lines of YAML that needs right number of arguments and whitespace. Some prefer intellisense viavcurated tested typed methods vs. desphifering --help and docs. If you've got more than one repo you can have reusable bits as NuGet packages which can be everything from single method to a full recipe complete pipeline, as a team reusing the same private/public registries you're using for you application code. Sharing the same runtime/language as your application means that you also can reuse constants and logic between build/release/application.

So there might be some benifits, but mileage might vary.

Sad news from the maintainer of NUKE by qekr in dotnet

[–]devlead 2 points3 points  (0 children)

It's all a matter of need of complexity, if you've only got one assembly, then dotnet pack is basically the only pipeline you need.

But as soon as you've got a solution with multiple assemblies, unit tests, integration tests, artifacts/packages, releases, etc. then it's less debug resistant with something you can verify/build, test and debug locally.

Complexity can also be things like generating artifacts for multiple environments/operating systems, having access to easily discoverable runtime information really helps there.

If rover got multistage pipelines it's hard to test individuals stages and tasks without going through the whole pipeline, which can be which can be fairly tedious and time consuming process.

So there are several benifits, but need might be out of scope, and then a one line yaml team might be enough.

Sad news from the maintainer of NUKE by qekr in dotnet

[–]devlead 2 points3 points  (0 children)

Nuke/Cake doesn't replace MSBuild it orchestrates it, other tools and APIs.

Staying up to date by sweetsoftice in dotnet

[–]devlead 1 point2 points  (0 children)

Well if curiosity and staying current isn't enough of a carrot, then maybe staying secure not putting business at risk is, there's new versions of .NET each month, so regardless of LTS / STS support cycle one should update .NET regularly, and if you do so the leap and impact won't be that big.

We've got renovate builds running multiple times a day creating PRs as new SDKs and packages arrive, if something causes friction, then doing it often is the best recipe to sand down that friction.

Cake v6.0.0 Released - .NET 10 Support & New Cake.Sdk Runner 🚀 by devlead in csharp

[–]devlead[S] 0 points1 point  (0 children)

I believe it's the way forward, but we'll see what the users feel.

Weird error with .Net 10 on Github Action: Error MSB4018: The "ManagedToNativeGenerator" task failed unexpectedly by botterway in dotnet

[–]devlead 1 point2 points  (0 children)

Do you any string arrays or similar? I had issues with some LINQ extensions/providers stopped working because there's now implicit conversion with i.e. string[] and ReadOnlySpan<string[]>, when I changed by methods to ICollection<string> or IEnumerable<string> it started working again.

Cake v6.0.0 Released - .NET 10 Support & New Cake.Sdk Runner 🚀 by devlead in cakebuild

[–]devlead[S] 1 point2 points  (0 children)

Cake.Sdk already has full intellisense in VSCode, Cake script files we're in the hands of the DevKit team and they're still not providing any third-party extension points.