this post was submitted on 09 Aug 2023
198 points (99.5% liked)

.NET

1486 readers
9 users here now

Getting started

Useful resources

IDEs and code editors

Tools

Rules

Related communities

Wikipedia pages

founded 1 year ago
MODERATORS
 

Also some fun takeaways: it also makes external calls to azure to load configuration and stays silent after updating for 2 weeks before showing warnings.

Moq is unusable. Needs to be forked or repoaced. Time to switch to NSubstitute.

all 31 comments
sorted by: hot top controversial new old
[–] [email protected] 19 points 1 year ago* (last edited 1 year ago)

Sounds like the dev was unsatisfied with the low sponsorship numbers on his project, which when you consider how many devs only ever interact with Moq via the package manager or command line might be a fair complaint...but the decision to just start harvesting user data like a lowlife as an alternative source of income is some galaxy brain shit.

It's not like this would even be sustainable. What did he think was going to happen, devs would just blindly accept a new shady looking package appearing in their dependency stack with no further investigation?

As a result of this stupidity Moq will now be on the shit-list of every corporation using .NET, especially those based in Europe due to GDPR implications.

[–] starman 19 points 1 year ago

So it's basically a malware

[–] [email protected] 18 points 1 year ago

Man fuck that

[–] [email protected] 16 points 1 year ago (1 children)

Holy shit. This is so bad. That's my entire September gone... I actually fought internally for my company to donate to this and a couple of other projects, but I guess this one is off the donation list at this point.

[–] asyncrosaurus 14 points 1 year ago* (last edited 1 year ago)

Update: https://github.com/moq/moq/issues/1374#issuecomment-1671166436

Dev is still defending his action and apparently believes he's done nothing wrong. Harvesting developers email and extorting them by sabotaging builds is no big deal.

Absolute clown. OSS needs a better solution to funding devs hard work, but it is not a vehicle for an egomaniac to get rich.

I'm still pro-not mocking. Maybe this is a good opportunity to stop using so many mocks in our tests, and write validation on the actual behavior of your code.

[–] Hector_McG 12 points 1 year ago* (last edited 1 year ago)

I knew that software supply chain dependency poisoning was increasing becoming a problem with open source, I just didn’t expect it to be from the original creator.

[–] [email protected] 8 points 1 year ago

I have many issues with this, but I don't know why you would assume I'd rather pay a few bucks of my own money vs much more of my companies. Paying for useful software in a revenue generating business is more common than not.

[–] [email protected] 7 points 1 year ago

FFS why does this need telemetry????? why can't we have nice things for more than 5 minutes

[–] [email protected] 7 points 1 year ago

No need to rush out and replace Moq, you're fine if you're on a lower version. We are using 4.16 or something at work, and I don't see any need to take any action there. Didn't have a reason to upgrade anyway.

If the SponsorLink package comes back, and kzu is determined to push forward with it (which is absolutely his right to do) then long term I guess we'll move to something else. My preference would be to stop using mocks altogether.

[–] TheTrueLinuxDev 5 points 1 year ago* (last edited 1 year ago) (1 children)

This is not the first time it happens with Dotnet Open Source packages, there are some pretty funky things going on namely:

Imagesharp (They re-license from Apache 2 to something like Community/Commercial licenses and threw a huge fit over it)

Fody (It expects the software contributors of Fody to be a patron.)

[–] [email protected] 4 points 1 year ago

Damn ... There goes the rest of the week replacing it ... Thank for the warning

[–] QuadriLiteral 3 points 1 year ago

I wonder if it would be possible to force people to pay for usage with licensing instead of what was tried here?