Home

>> In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair. > … the classic "no way to avoid this" The Onion article But isn't point of The Onion article that A) the US has >50x as many incidents as the rest of the developed world combined [1], and yet B) acts like there is "no way to avoid this". Does NPM have >50x as many incidents as the rest of established languages combined? Is NPM claiming there is "no way to avoid this" or are they putting in place things like automatic install delays? While all the major js package managers already support install delays, none of the big local C#/dotnet/nuget apps do (Visual Studio/Rider/nuget/dotnet/VS Code). https://github.com/NuGet/Home/issues/14657 [1] https://ed

Yep, a bummer. The devs don't even consider it a priority, too busy designing the feature: https://github.com/NuGet/Home/issues/14657#issuecomment-3573...

It could be worse... you could be like the NuGet team and fail to identify "prevent cache from growing without bound" as a necessary feature. ;) Last I checked, it was going-on 7+ years of adding/updating last-used metadata to cached packages (because MS disabled them by default at the Windows fs level in Vista+ for performance reasons), to support automated pruning. https://github.com/NuGet/Home/issues/4980 (Admittedly, most of that spent waiting for the glacially slow default versions of things to ship through the dotnet ecosystem)

How do you currently feel about attaching the experience to install or when restoring packages? Various ecosystems do this and some get flak for it because of how many transitive dependencies and known vulnerabilities in comparison to others. I'm mostly curious because I'm working on a similar proposal here: https://github.com/NuGet/Home/pull/11549 There's definitely a fine balance of noise, but how do you feel about it?

… huh? Visual Studio is extremely not dead, they are literally about to release a 64-bit version after a massive rework. VS Code is a text editor which you can extend into being an IDE. Visual Studio is an IDE. There are many reasons why one might be unable to upgrade to the latest version of any given thing. For an example close to my heart of why one might be unable to upgrade to .NET 6 (or indeed to later versions of the .NET 5 SDK), there's the showstopping https://github.com/NuGet/Home/issues/10389.

For NuGet, consider using centralized package references: https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-... You get one file defining the set of all packages used in your repo (or some subset of your repo, etc.) and Dependabot will update this file directly. Individual projects can choose to use a package but won't specify the version. It requires that your projects are all in sync with package versions but (1) that sounds like what you want (2) it's usually the best thing.

Example app: NuGet for .NET on Linux and MacOS, from Microsoft: https://github.com/NuGet/Announcements/issues/56 It used SSL/TLS and S/MIME roots to verify code signing and timestamping responses. When Symantec, which was removed for TLS trust, was also removed for S/MIME, NuGet broke, because it was no longer able to verify the TSA signature. As covered in https://github.com/NuGet/Home/issues/10504 , this then led some Linux distros, notably Debian/Ubuntu, to re-add Symantec. Any application using the ca-certificates package thus end up trusting CAs that Mozilla does not trust, despite being derived from the Mozilla Root Store. So the news is already out there, this was just a reminder to folks to not do silly things like Microsoft did.

This is the workaround my place is using for now: https://github.com/NuGet/Home/issues/10491#issuecomment-7684...

This sounds like a request for the NuGet client experience and less for browsing nuget.org. My expertise is more on the nuget.org side and less on the client side (like .NET CLI or Visual Studio). Could you file an issue for the NuGet client suggestion here? https://github.com/NuGet/Home/issues/new If you have some ideas in the space of how specifically it could work, maybe mention where/how (e.g. what file) you'd like to declare these "rules".

i have a running f#/mono environment on this computer. on my other computer i cannot get it to work. things like this https://stackoverflow.com/a/41578645/6767912 and this https://github.com/NuGet/Home/issues/2880 tells me it's not production ready (yes i've even tried compiling mono from source).

most of the nuget operations (restore, pack, push) can be performed using dotnet.exe that ships as part of .NET Core Tools 1.0 on any platform. If you are facing any specific issue or need any nuget related help, please file an issue on https://github.com/nuget/home/issues and will do our best to respond asap!

"Chocolatey is based on v2 NuGet which is a) terrible and" I laughed at that point because I completely agree that NuGet v2 isn't great at all. Also you forgot to mention that NuGet v3 is brand new and there isn't yet published documentation on how to get from one format to the next - https://github.com/NuGet/Home/issues/1870. Not sure how fast you expect Chocolatey to adopt NuGet v3, but it's a bit much to throw this argument in here as a reason NOT to use Chocolatey.