4 ms·

Curl has been delisted from Microsoft NuGet

• sbelskie 4y ago
  Some relevant context: https://mobile.twitter.com/bagder/status/1630704007445372928 https://mobile.twitter.com/bagder/status/1630704007445372928
  • flurdy 4y ago
    That is the actual news. Lack of channels for the real owners to contact nuget/microsoft.
    • flurdy 4y ago
      Though it was handled in the end https://twitter.com/joelverhagen/status/1630706389147418629 https://twitter.com/joelverhagen/status/1630706389147418629
• ripley12 4y ago
  NuGet has always been a bit of a Wild West. Looks like curl was uploaded to NuGet by some rando and not maintained. In a past life where I had to deal with a lot of .NET libraries from awful enterprisey vendors, it was often easier to pull down versions uploaded to NuGet by 3rd parties than use the official installers. In retrospect this was pretty dumb of me from a security perspective...
  • ziml77 4y ago
    The better solution is to host an internal package repository. It's pretty easy to package up a vendor library and publish it there.
    • pjmlp 4y ago
      And relatively easy to impose when the CI/CD pipeline can only access that repo, not the external Internet.
• happymellon 4y ago
  > This was a miss on my part not to notify you when we noticed this exceptional circumstance and engaged the owner. Was the exceptional circumstance that someone uploaded packages that didn't belong to them, was it that it wasn't maintained, or was the exceptional circumstance that it was a high profile application with a large twitter following. I can't imagine that Microsoft would do that for me, if I had a third party upload and abandon a library and I could not contact them.