6 ms·

Popular open source project Moq criticized for quietly collecting data

66 points by mikece 3y ago

veave 3y ago
https://raw.githubusercontent.com/devlooped/SponsorLink/main/assets/img/VS-SL03.png https://raw.githubusercontent.com/devlooped/SponsorLink/main... That's really assholish
rubatuga 3y ago
Hashed emails are not one way functions because the number of possible emails is so low and are trivially bruteforced, this is definitely a privacy leak.
- theshrike79 3y ago
  And privacy leaks nowadays trigger CCPA and GDPR, neither of which are optional to adhere to in any way.
johnea 3y ago
[flagged]
- rvdginste 3y ago
  What do you mean? What does this have to do with Windows?
- politelemon 3y ago
  Please see the guidelines on comment etiquette. This is in poor taste and further, unrelated to OSes.
- theshrike79 3y ago
  I use C# and Moq on macO$ (or whatever is the cool way to write it), as does about 3/4 of our dev team.
kjok 3y ago
I truly believe that all this awareness around "supply chain" security is a fantastic opportunity for FOSS maintainers to gain financial independence.
- rjbwork 3y ago
  I doubt it. I think more likely it will actually have people being more choosey in their dependencies and looking at the governance structures of projects so that one guy can't go off the rails and create hundreds of hours of unplanned work.
  - kjok 3y ago
    And "governance structures" is exactly what FOSS maintainers can sell.
rvdginste 3y ago
In short: author of Moq adds the dependency SponsorLink, which is an obfuscated closed source library that collects and uploads data from the developer's machine when the developer builds a project that includes a dependency on Moq. The collected data happens to be the hash of the globally configured git email address of the user at this point in time. I simply cannot understand why someone, especially the author, would think this is a good idea. How can you not predict this will create a backlash and push users away?
- theshrike79 3y ago
  But he asked his friends and they thought it was a good idea: https://www.cazzulino.com/sponsorlink.html https://www.cazzulino.com/sponsorlink.html > I discussed this approach with fellow developers and it sounded unanimously reasonable. Who would think that entering a GDPR/CCPA hellhole of PII collection is "reasonable"?
  - kjs3 3y ago
    "I asked this one guy who's just as ignorant as me and he thought it was totally cool, so no way you should have a problem with it".
- tinus_hn 3y ago
  The reason is the same reason developers include Bonzi Buddy and similar malware with their software: Because it earns money. Money talks and bs walks.
csmattryder 3y ago
We talked about this at $WORK today, it's already on the board to be pulled out and replaced with an alternative. The guy's got a valid point, especially as many Big Tech companies are using it, but this is a massively fucked up way to go about it. If you're going to do this, what else are you going to exfiltrate under the guise of open source sponsorship? Pin to 4.18 until you've got a migration plan.
- hightrix 3y ago
  This is the only possible response many of us are able to give to this issue. Trust has been completely destroyed. What if the next malware attempt isn’t discovered immediately? Anyone continuing to use Moq is opening their company up to possible litigation. Anyone know of a good drop in replacement? Internally we’ve gotten the ok for our next release to continue with this software pegged to a pre 4.20 release, but we’ve also been given the directive to “dump this guy” as soon as possible.
  - brewmarche 3y ago
    There’s NSubstitute. Haven’t used it personally but I’ve read good things about. I will have to look into at work as well since we’re also using Moq.
    - shade 3y ago
      NSubstitute is good, I used it at a previous job. I've favored Moq in the past because I think there are a couple of things it makes a bit easier or is a bit less opinionated about, but NSub is perfectly cromulent as well. Someone posted a quick guide to migrating a bunch of it easily in one of the issues in the Moq repo discussing this whole mess: https://github.com/moq/moq/issues/1374#issuecomment-1671241122 https://github.com/moq/moq/issues/1374#issuecomment-16712411...
nonbirithm 3y ago
Some related Github issues. https://github.com/devlooped/SponsorLink/issues/9 https://github.com/devlooped/SponsorLink/issues/9 https://github.com/devlooped/SponsorLink/issues/13 https://github.com/devlooped/SponsorLink/issues/13 https://github.com/devlooped/SponsorLink/issues/16 https://github.com/devlooped/SponsorLink/issues/16 And the original blog post. https://www.cazzulino.com/sponsorlink.html https://www.cazzulino.com/sponsorlink.html His opinions make me feel a bit worse that I went for Moq for work-related projects.
theshrike79 3y ago
The author already removed SponsorLink from Moq: https://github.com/moq/moq/commit/a7dcd43c3ca192ad3dcc813f4ddedae96914fe26 https://github.com/moq/moq/commit/a7dcd43c3ca192ad3dcc813f4d... ...because it completely broke builds on macOS and Linux [0] [0] https://github.com/moq/moq/issues/1371 https://github.com/moq/moq/issues/1371

66 points by mikece 3y ago

https://raw.githubusercontent.com/devlooped/SponsorLink/main/assets/img/VS-SL03.png https://raw.githubusercontent.com/devlooped/SponsorLink/main... That's really assholish

rubatuga 3y ago

Hashed emails are not one way functions because the number of possible emails is so low and are trivially bruteforced, this is definitely a privacy leak.

theshrike79 3y ago
And privacy leaks nowadays trigger CCPA and GDPR, neither of which are optional to adhere to in any way.

johnea 3y ago

[flagged]

rvdginste 3y ago
What do you mean? What does this have to do with Windows?
politelemon 3y ago
Please see the guidelines on comment etiquette. This is in poor taste and further, unrelated to OSes.
theshrike79 3y ago
I use C# and Moq on macO$ (or whatever is the cool way to write it), as does about 3/4 of our dev team.

kjok 3y ago

I truly believe that all this awareness around "supply chain" security is a fantastic opportunity for FOSS maintainers to gain financial independence.

rjbwork 3y ago
I doubt it. I think more likely it will actually have people being more choosey in their dependencies and looking at the governance structures of projects so that one guy can't go off the rails and create hundreds of hours of unplanned work.
- kjok 3y ago
  And "governance structures" is exactly what FOSS maintainers can sell.

rvdginste 3y ago

In short: author of Moq adds the dependency SponsorLink, which is an obfuscated closed source library that collects and uploads data from the developer's machine when the developer builds a project that includes a dependency on Moq. The collected data happens to be the hash of the globally configured git email address of the user at this point in time. I simply cannot understand why someone, especially the author, would think this is a good idea. How can you not predict this will create a backlash and push users away?

theshrike79 3y ago
But he asked his friends and they thought it was a good idea: https://www.cazzulino.com/sponsorlink.html https://www.cazzulino.com/sponsorlink.html > I discussed this approach with fellow developers and it sounded unanimously reasonable. Who would think that entering a GDPR/CCPA hellhole of PII collection is "reasonable"?
- kjs3 3y ago
  "I asked this one guy who's just as ignorant as me and he thought it was totally cool, so no way you should have a problem with it".
tinus_hn 3y ago
The reason is the same reason developers include Bonzi Buddy and similar malware with their software: Because it earns money. Money talks and bs walks.

csmattryder 3y ago

We talked about this at $WORK today, it's already on the board to be pulled out and replaced with an alternative. The guy's got a valid point, especially as many Big Tech companies are using it, but this is a massively fucked up way to go about it. If you're going to do this, what else are you going to exfiltrate under the guise of open source sponsorship? Pin to 4.18 until you've got a migration plan.

hightrix 3y ago
This is the only possible response many of us are able to give to this issue. Trust has been completely destroyed. What if the next malware attempt isn’t discovered immediately? Anyone continuing to use Moq is opening their company up to possible litigation. Anyone know of a good drop in replacement? Internally we’ve gotten the ok for our next release to continue with this software pegged to a pre 4.20 release, but we’ve also been given the directive to “dump this guy” as soon as possible.
- brewmarche 3y ago
  There’s NSubstitute. Haven’t used it personally but I’ve read good things about. I will have to look into at work as well since we’re also using Moq.
  - shade 3y ago
    NSubstitute is good, I used it at a previous job. I've favored Moq in the past because I think there are a couple of things it makes a bit easier or is a bit less opinionated about, but NSub is perfectly cromulent as well. Someone posted a quick guide to migrating a bunch of it easily in one of the issues in the Moq repo discussing this whole mess: https://github.com/moq/moq/issues/1374#issuecomment-1671241122 https://github.com/moq/moq/issues/1374#issuecomment-16712411...

nonbirithm 3y ago

Some related Github issues. https://github.com/devlooped/SponsorLink/issues/9 https://github.com/devlooped/SponsorLink/issues/9 https://github.com/devlooped/SponsorLink/issues/13 https://github.com/devlooped/SponsorLink/issues/13 https://github.com/devlooped/SponsorLink/issues/16 https://github.com/devlooped/SponsorLink/issues/16 And the original blog post. https://www.cazzulino.com/sponsorlink.html https://www.cazzulino.com/sponsorlink.html His opinions make me feel a bit worse that I went for Moq for work-related projects.

theshrike79 3y ago

The author already removed SponsorLink from Moq: https://github.com/moq/moq/commit/a7dcd43c3ca192ad3dcc813f4ddedae96914fe26 https://github.com/moq/moq/commit/a7dcd43c3ca192ad3dcc813f4d... ...because it completely broke builds on macOS and Linux [0] [0] https://github.com/moq/moq/issues/1371 https://github.com/moq/moq/issues/1371