Curl has been delisted from Microsoft NuGet

twitter.com

29 points·raybb··7 comments

NuGet has always been a bit of a Wild West. Looks like curl was uploaded to NuGet by some rando and not maintained.

In a past life where I had to deal with a lot of .NET libraries from awful enterprisey vendors, it was often easier to pull down versions uploaded to NuGet by 3rd parties than use the official installers. In retrospect this was pretty dumb of me from a security perspective...

The better solution is to host an internal package repository. It's pretty easy to package up a vendor library and publish it there.

And relatively easy to impose when the CI/CD pipeline can only access that repo, not the external Internet.

Some relevant context: https://mobile.twitter.com/bagder/status/1630704007445372928

That is the actual news. Lack of channels for the real owners to contact nuget/microsoft.

Though it was handled in the end https://twitter.com/joelverhagen/status/1630706389147418629

> This was a miss on my part not to notify you when we noticed this exceptional circumstance and engaged the owner.

Was the exceptional circumstance that someone uploaded packages that didn't belong to them, was it that it wasn't maintained, or was the exceptional circumstance that it was a high profile application with a large twitter following.

I can't imagine that Microsoft would do that for me, if I had a third party upload and abandon a library and I could not contact them.

Reply on news.ycombinator.com