this post was submitted on 18 Jul 2023
5 points (100.0% liked)

C Sharp

1532 readers
2 users here now

A community about the C# programming language

Getting started

Useful resources

IDEs and code editors

Tools

Rules

Related communities

founded 1 year ago
MODERATORS
Ategon
nibblebit
Spyros
5
Any way to validate Nuget packets/public repos? (lemm.ee)
submitted 1 year ago by [email protected] to c/csharp
4 comments fedilink hide all child comments
 

How do you all go about validating that there's nothing malicious in your nuget packages?

Is there a best practice for this?

It's easy if the package is from a known source like Microsoft but I'm curious what you do for lesser know people?

I will usually see how many others are using it, probably scan the code in the GITHUB repo. Sometimes if it's a lesser known dev I'll just pull from GITHub rather than using NuGet.

Today however, I was looking at a package and the nuget package itself looks fine but it contains some C++ code that is compiled elsewhere...fine I'll go get that and see. But that code requires CMake and some other 3rd party add-ons which I also have to review.

I'm not aware of any audits on NuGet that would prevent bad people from uploading code. What do you all do to protect the integrity of your software?

top 4 comments
sorted by: hot top controversial new old
[–] [email protected] 4 points 1 year ago (1 children)

A classic: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

[–] [email protected] 3 points 1 year ago

Well he's right, that's why I rarely trust code from Nuget. I will bring down the repo, examine the code myself. I get that I may miss something but, then, that's on me.

My boss isn't going to blame me for trusting Microsoft. My boss will blame me for trusting Mike Nobody who is a developer in CountryZ who has built this really wicked shortcut I need.

[–] jvisick 2 points 1 year ago* (last edited 1 year ago) (1 children)

I only use packages that are from a reputable source and/or have a huge amount of downloads. It’s not a perfect system, but I’ve never had a problem so far.

If the downloads are low and I’ve never heard of the author, either a) I don’t need it and can build a solution myself or b) it’s a niche package that’s small enough that I can audit it by skimming the GitHub repo.

The normal common sense rules still apply - check for typos and any attempts to look like they’re a package or author that they’re not

[–] bugsmith 1 points 1 year ago

Absolutely the same for me.

I have never, to my recollection, needed a large but niche packet that isn't either clearly reputable (wisdom of the masses) or verified by someone who's reputation is crucial (e.g. Microsoft).

I have on on many occasions used a small niche package though that was just a time saver. Something where I could either invest significant time in rolling my own solution out, or spend considerably less time checking out a small repo.