3

I've come across a few cases lately where a package on NuGet has a name that starts with "Microsoft" but is actually uploaded by someone else. Take Microsoft.TestApi for example. Ostensibly this is a NuGet wrapper around the TestAPI project on CodePlex. The CodePlex project is from Microsoft as there are blog posts hosted on a Microsoft domain talking in great detail about the project and containing direct links to the CodePlex site. So I'm comfortable that downloading the package from there is safe.

However, the team who made the CodePlex project have not created a NuGet wrapper. Someone else has gone ahead and created one, which has gained some traction - 15k downloads at the time of writing. The owner is a personal account, in contrast to the clearly official Microsoft one used for other Microsoft packages. So far the only evidence I have for the provenance of the TestAPI package is a conversation on CodePlex where the owner of the original package looks like they are an acquaintance of the person who uploaded the NuGet one.

I feel like the above security credential is weak, and I am therefore minded to obtain the source directly from CodePlex. I would rather get it from NuGet though as then it is consistent with all my other packages. Have I missed something in NuGet's validation process? Maybe there is a signing process where it does not matter who uploads it because the package is securely signed and versioned previously?

  • 1
    No, there are no guarantees. Even if it is "genuine," it might still be crap. That's partly why it's open-source; you bear the responsibility of vetting the software yourself, and having access to the source code allows you to do that, among other things. TestAPI looks like a really nice project, BTW. – Robert Harvey Jan 23 '17 at 15:49
  • @RobertHarvey have you read a Microsoft licence? You bear the responsibility with that also. – ctrl-alt-delor Jan 23 '17 at 23:03
  • @richard: I never stated otherwise. – Robert Harvey Jan 23 '17 at 23:20
  • For me it's the worry that the package might be harmful/malicious rather than functionally poor. NuGet is less useful if I have to check the source code of each update manually, especially as it downloads packages rather than source code. – Stephen Hewlett Jan 24 '17 at 7:26
1

I think the key part of the licence for TestApi is this:

(E) The software is licensed "as-is." You bear the risk of using it. The contributors give no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this license cannot change. To the extent permitted under your local laws, the contributors exclude the implied warranties of merchantability, fitness for a particular purpose and non-infringement

Regardless of the publisher, which in this case is probably a Microsoft employee working on a side project. You have no protection if the product does a bad thing.

If you are concerned about dll authorship, you should check its signature : https://blogs.msdn.microsoft.com/shawnfa/2005/12/13/authenticode-and-assemblies/

  • 1
    “Microsoft excludes all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement.” — licence for Microsoft-Windows 10 – ctrl-alt-delor Jan 23 '17 at 23:09
  • I'm really interested in the probability of malicious code being introduced in the first place, rather than who is liable if it happens. If I'm taking on the risk, then I want to be as certain as I can be that there won't be an accidental malicious update to the package in future. I think the probability of that is lower if the code comes from Microsoft - even a side project - and if it does happen the effects are likely to be mitigated more easily. – Stephen Hewlett Jan 24 '17 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.