5 ms·

This looks like something that would be nice to have integrated in nuget.org, showing the report output for every package/version (and maybe highlighting deltas

This looks like something that would be nice to have integrated in nuget.org, showing the report output for every package/version (and maybe highlighting deltas across versions). If you're running this across your own project output, especially for a big code base, it's definitely not going to be as useful as across each dependency. For example your app having "analytics services" and "outbound http connections" might be totally normal, but if a library you're using for encryption adds those, that would be a concern.

woohoo7676 7y ago
This is a great idea - would love to have this info integrated into nuget. Most likely people aren't going bother to run this on dependencies themselves (not to mention every version update), so having the info surfaced at the point of decision would be very useful and reach a ton more folks.
- joelverhagen 7y ago
  Hey folks, I'm on the NuGet team and I noticed this thread this morning. This is the first I've heard of Application Inspector (Microsoft is a big place!) but the tool looks awesome and the output is easy to understand for a variety of experience levels. The idea of integrating with NuGet sounds very promising! Caveats need to be investigated, i.e. my guess is the report is not exhaustive since code could perhaps call scary APIs in esoteric ways but perhaps there is value even if it covers just MOST of the cases. I've tracked a feature request on GitHub here attempting to represent what was suggested here: https://github.com/NuGet/NuGetGallery/issues/7824 https://github.com/NuGet/NuGetGallery/issues/7824 Add additional comments if you have thoughts on how it should work or anything else. Our backlog is pretty full right now but we'll update this GitHub issue if there is movement.
  - 1wd 7y ago
    In addition / instead of showing the results in the web UI, it would be valuable to make Nuget enforce user selected criteria. When referencing a package I would like to annotate that reference with some criteria that are currently met (e.g. the referenced package makes no network calls) and then later for a package upgrade Nuget would automatically check if these criteria are still met, or fail the upgrade.
    - joelverhagen 7y ago
      This sounds like a request for the NuGet client experience and less for browsing nuget.org. My expertise is more on the nuget.org side and less on the client side (like .NET CLI or Visual Studio). Could you file an issue for the NuGet client suggestion here? https://github.com/NuGet/Home/issues/new https://github.com/NuGet/Home/issues/new If you have some ideas in the space of how specifically it could work, maybe mention where/how (e.g. what file) you'd like to declare these "rules".
nickspag 7y ago
In regards to the first line of your comment, check out https://www.fuget.org https://www.fuget.org. It does exactly that.
- azinman2 7y ago
  Sorry, where's the app inspector output in this? https://www.fuget.org/packages/System.Net.Http https://www.fuget.org/packages/System.Net.Http for example doesn't show me all of that.

woohoo7676 7y ago

This is a great idea - would love to have this info integrated into nuget. Most likely people aren't going bother to run this on dependencies themselves (not to mention every version update), so having the info surfaced at the point of decision would be very useful and reach a ton more folks.

joelverhagen 7y ago
Hey folks, I'm on the NuGet team and I noticed this thread this morning. This is the first I've heard of Application Inspector (Microsoft is a big place!) but the tool looks awesome and the output is easy to understand for a variety of experience levels. The idea of integrating with NuGet sounds very promising! Caveats need to be investigated, i.e. my guess is the report is not exhaustive since code could perhaps call scary APIs in esoteric ways but perhaps there is value even if it covers just MOST of the cases. I've tracked a feature request on GitHub here attempting to represent what was suggested here: https://github.com/NuGet/NuGetGallery/issues/7824 https://github.com/NuGet/NuGetGallery/issues/7824 Add additional comments if you have thoughts on how it should work or anything else. Our backlog is pretty full right now but we'll update this GitHub issue if there is movement.
- 1wd 7y ago
  In addition / instead of showing the results in the web UI, it would be valuable to make Nuget enforce user selected criteria. When referencing a package I would like to annotate that reference with some criteria that are currently met (e.g. the referenced package makes no network calls) and then later for a package upgrade Nuget would automatically check if these criteria are still met, or fail the upgrade.
  - joelverhagen 7y ago
    This sounds like a request for the NuGet client experience and less for browsing nuget.org. My expertise is more on the nuget.org side and less on the client side (like .NET CLI or Visual Studio). Could you file an issue for the NuGet client suggestion here? https://github.com/NuGet/Home/issues/new https://github.com/NuGet/Home/issues/new If you have some ideas in the space of how specifically it could work, maybe mention where/how (e.g. what file) you'd like to declare these "rules".

nickspag 7y ago

In regards to the first line of your comment, check out https://www.fuget.org https://www.fuget.org. It does exactly that.

azinman2 7y ago
Sorry, where's the app inspector output in this? https://www.fuget.org/packages/System.Net.Http https://www.fuget.org/packages/System.Net.Http for example doesn't show me all of that.