5 ms·

NuGet has always been a bit of a Wild West. Looks like curl was uploaded to NuGet by some rando and not maintained. In a past life where I had to deal with a l

NuGet has always been a bit of a Wild West. Looks like curl was uploaded to NuGet by some rando and not maintained. In a past life where I had to deal with a lot of .NET libraries from awful enterprisey vendors, it was often easier to pull down versions uploaded to NuGet by 3rd parties than use the official installers. In retrospect this was pretty dumb of me from a security perspective...

ziml77 4y ago
The better solution is to host an internal package repository. It's pretty easy to package up a vendor library and publish it there.
- pjmlp 4y ago
  And relatively easy to impose when the CI/CD pipeline can only access that repo, not the external Internet.