Hey team, I appreciate the effort, and really like Moq, thank you for creating it! In one project, I just did a dependency update and noticed that I get MOQ101 warnings when building in Visual Stud...
Also some fun takeaways: it also makes external calls to azure to load configuration and stays silent after updating for 2 weeks before showing warnings.
Moq is unusable. Needs to be forked or repoaced. Time to switch to NSubstitute.
You're viewing a single thread.
27 comments
I don't get why the SponsorLink dll has to act so sketchy when they have a write-up on their repo. Just explain and ask for permission, it can't be that hard.
It's in line with their delusional rationalization on their blog:
And I’m a firm believer that supporting your fellow developers is something best done personally. Having your company pay for software surely doesn’t feel quite as rewarding as paying from your own pocket, and it surely feels different for me too. We really don’t need to expense our employers for a couple bucks a month, right??
Just in case you felt that passionate about your enterprise-themed boilerplate work equipment.
I still find it hard to tell if it's malice or ineptitude, though.
There was some concern that SponsorLink might be collecting your email without your explicit consent. This is incorrect [...] The email on your local machine is hashed with SHA256 [before being sent] The resulting opaque string (which can never reveal the originating email) is the only thing used.
It's hard for me to believe someone who spent time implementing such a system would fall for such an obvious fallacy of what hashing can do. It's like hashing phone numbers, completely worthless - if the list of values it could be is limited you can simply brute force it. Take some available lists of known emails, take all known domains or mail servers and try github@domain, try some basic password cracking methods, dictionary attacks and simply append @gmail.com etc., I'd be surprised if you couldn't de"anonymize" 99.9% of mails pretty much instantly.
But right at the start of the projects readme we have "The resulting opaque string (which can never reveal the originating email) is the only thing used". "never" is something you wouln't say about salted passwords hashed with sha512, for unsalted emails it's asenine
The more details I read, the better this gets.
Looks like SponsorLink is written by the same guy who wrote Moq. Feels like he's been planning this for a while.
I'm sympathetic to the cause as I know it can't be easy trying to find open source work, but I think he's gone about this all wrong
Wow, you're right. I didn't spot that. SponsorLink also jumped to v1.0.0 5 days ago, the same time he added it to Moq. Definitely feels like this was the ultimate goal.
