Also some fun takeaways: it also makes external calls to azure to load configuration and stays silent after updating for 2 weeks before showing warnings.

Moq is unusable. Needs to be forked or repoaced. Time to switch to NSubstitute.

    • TheCee@programming.dev
      link
      fedilink
      arrow-up
      18
      ·
      1 year ago

      It’s in line with their delusional rationalization on their blog:

      And I’m a firm believer that supporting your fellow developers is something best done personally. Having your company pay for software surely doesn’t feel quite as rewarding as paying from your own pocket, and it surely feels different for me too. We really don’t need to expense our employers for a couple bucks a month, right??

      Just in case you felt that passionate about your enterprise-themed boilerplate work equipment.

      I still find it hard to tell if it’s malice or ineptitude, though.

      • Redjard@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        13
        ·
        edit-2
        1 year ago

        There was some concern that SponsorLink might be collecting your email without your explicit consent. This is incorrect […] The email on your local machine is hashed with SHA256 [before being sent] The resulting opaque string (which can never reveal the originating email) is the only thing used.

        It’s hard for me to believe someone who spent time implementing such a system would fall for such an obvious fallacy of what hashing can do. It’s like hashing phone numbers, completely worthless - if the list of values it could be is limited you can simply brute force it. Take some available lists of known emails, take all known domains or mail servers and try github@domain, try some basic password cracking methods, dictionary attacks and simply append @gmail.com etc., I’d be surprised if you couldn’t de"anonymize" 99.9% of mails pretty much instantly.

        But right at the start of the projects readme we have “The resulting opaque string (which can never reveal the originating email) is the only thing used”. “never” is something you wouln’t say about salted passwords hashed with sha512, for unsalted emails it’s asenine

    • JonC@programming.dev
      link
      fedilink
      English
      arrow-up
      13
      ·
      1 year ago

      Looks like SponsorLink is written by the same guy who wrote Moq. Feels like he’s been planning this for a while.

      I’m sympathetic to the cause as I know it can’t be easy trying to find open source work, but I think he’s gone about this all wrong

      • FairlyConstantFox@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        1 year ago

        Wow, you’re right. I didn’t spot that. SponsorLink also jumped to v1.0.0 5 days ago, the same time he added it to Moq. Definitely feels like this was the ultimate goal.