4 ms·

Welp, guess it can't be trusted anymore, since it contains a third-party proprietary and non-auditable package that will purposefully read a file from your syst

• SideburnsOfDoom 3y ago
  > and contact a third-party internet server with a personal identifier such as an email address. As has been pointed out. It is not sending the email address as plaintext, but it is sending a hash of that email address. Unfortunately this is almost as bad, is not enough to prevent the actual email address being identified - de-anonymisation is feasible in a constrained search space such as "standard email address formats such as first.last@company.com". It is not GDPR compliant: > Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. https://www.privacy-regulation.eu/en/recital-26-GDPR.htm https://www.privacy-regulation.eu/en/recital-26-GDPR.htm Then there's a "known unknown" of running some closed source, obfuscated binary on your build server. The SolarwWinds supply-chain hack got in via TeamCity so this is a Hard No from a security point of view. > it can't be trusted anymore We're going to wait and see and not apply the Moq 4.20 update. In a week the picture should be clearer. But today it looks like it's going up in flames. This is sad to see, there could have been other ways to keep everyone happy. There should be a way to accommodate the Moq dev who did something remarkable as OSS, and wants to pay the rent thereby; without this drama.