Remove Moq From Your .NET Projects Right NOW!

[@nickchapsas]

Btw to those saying I shouldn’t be making a video on this, being negative but instead sponsor the project clearly have no idea what they’re talking about. First, I wouldn’t sponsor a project I don’t use and I don’t use Moq, I use NSubstitute. Second, I’ve made a video on Moq and just the exposure it’s gotten from that video (170k views) is worth way more than I could ever sponsor for. Third and most important, I’ve given away the ad revenue I’ve made from showcasing open source projects back to its creators through sponsorships (that I could easily just keep in my pocket), including a call to action to get more people sponsoring projects they like, and unsurprisingly it’s one of my least watched videos because nobody really cares. Its just virtue signalling. Put your money where your mouth is and show me your own receipts. kzbin.info/www/bejne/bKu9fZZ5drB3mNE

[@mumk]

thats wild 😅

[@nickchapsas]

​@@MisterNOmercy That's why I said that they doubled down. Because they didn't say "removed because of community backlash" but "removed because it breaks on mac"

[@angius]

Wasn't even removed, really. All the code is still there, it was just the project reference that was deleted lmao

[@ronsijm]

Kind of scary, Kzu has 317 Nuget packages published, and over half a billion downloads. Might be pretty difficult to scan all packages and see to which of them he added this SponsorLink

[@TheGravyMonster]

Even if the issue is reversed, the trustworthiness and credibility of the author is now zero. Moq can no longer be used or even recommended in any situation, least of all anything enterprise level.

[@ryan-heath]

There's an old saying, "it takes 20 years to build a reputation and 5 minutes to destroy it"

[@wigf173]

Linus Sebastian enters the chat....

[@G41headache]

Collecting private data without consent is one thing, and then obfuscating his code as well so we can't even verify it easily This raises a huge red flag

[@Joe4evr]

"Collecting private data without consent" is a violation of GDPR.

[@Arcade_Archie]

also remember its closed source next to being obfuscated

[@G41headache]

​@@Arcade_Archie indeed, it's so incredibly sneaky and stupid

[@BackwardsDaveTV]

Excuse my ignorance, but if it's hashed, then if a bad actor some how collected the hashes, then it's not like they can be "unhashed" right?

[@qj0n]

@@BackwardsDaveTV You can if you know the set of possible hashes. There are huge databases of e-mails - general or mails of people from particular business, particular company etc. You can just hash all of them and check which hashes match The correct, privacy-oriented way would be to expose a list of hashes of sponsors publicly (list of github sponsors is public anyway) and check it locally. And ofc don't obfuscate it

[@iamdedlok]

Thanks for covering this Nick. Just posted it to our dev team. We are using Moq, luckily we are still on v4.18.4 version, won't upgrade. And will look for an alternative! Cheers!

[@gavinw77]

Better that than support the product, hey!

[@Stettafire]

​@@gavinw77Why would I support a product stealing my data?

[@biberklatsche773]

@Stettafire But for years, the product didn't steal your data. Did you support it? It was only added because he wanted to get paid as well. Would you work for free and let others benefit from it? Probably not.

[@youssefwael8]

NSubstitute's author will be very pleased by the traffic going to him.

[@Omego2K]

I've been using unsubstitute for quite a while now. It's so much simpler and more intuitive

[@Omego2K]

@@Qrzychu92 better job is certainly a possibility. Notoriety as well.

[@RtoipKa]

And then he makes it use SponsorLink app and what do you do?

[@Omego2K]

@@RtoipKa use another mocking library? The funny part about open sources you always have a options. And if you don't somebody will make it because there's a need

[@RtoipKa]

@@Omego2K and you keep spinning in place just changing libraries.

[@NathanStrutz]

Hi Nick, I'm interested in your upcoming video detailing how to move from Moq to NSubstitute. Hope it's comes out soon 😊

[@Andy01010]

It’s just another mocking lib, once you learn it - mocking is easy as breathing. It’s not hard at all.

[@marna_li]

The main problem is that they invade your privacy by scanning your computer for personal information and sending it to a third-party - i.e. without either telling you or asking for your consent. And this is embedded in an open-source library - of which there is a special build. Surely, this is a breach of trust.

[@CXCubeHD]

This is not only a breach of trust this is illegal. They should seriously be sued for that

[@dlhsnbrn1275]

What the video does not mention is that the Moq analyzer tries to bully you into installing the sponsorlink app by generating warnings and intentionally slowing down your build. That is the only reason we noticed this earlier today. We now downgraded to the old Moq version and will likely switch to NSubstitute as soon as we get the chance. Thank you so much for making everyone aware of this.

[@chrischris87309]

I happened to notice that while trying to update, it was wanting to install a new package called SponsorLink. That caught my eye, and made me nope out to investigate what was going on. Glad I noped out of that.

[@solntsuy]

@@chrischris87309They literally add a Thread.Sleep to your build for multiple seconds if you don't install it

[@garcipat]

This is Malware. There is no other expression for it. Its like when popular tools were starting to integrate toolbars in their installers.

[@dimitrietataru8140]

Lesson learned for me. Know more than one library for the same job. Once I replace Moq with NSubstitite I am never going back.

[@ronsijm]

Ksu has removed it in Moq 4.20.2 that released 17 minutes ago - but if you look at the PR it says it's removed because it breaks functionality on Mac and Linux, and it therefor a "blocker"... They don't really acknowledge that it was a bad idea in the first place... so if it's only removed because it doesn't work on Mac an Linux yet, they might add it again later Besides reading the github folder, people are also saying it's creating random stuff in `%TEMP%\1M5Ot/`

[@qniken8770]

We just started to clarify which test and mock library we want to use in our project. I think we can strike one from the mock library list.

[@timseguine2]

Relevant for developers in Europe: Even including this in your repo is probably violating the GPDR.

[@Stettafire]

And rules are even stricter if you work in certain sectors (like gambling)

[@mostinho7]

why do people care so much about gpdr

[@timseguine2]

@@mostinho7 because it is a law... That has to be followed... With penalties if it isn't... Not exactly rocket science...

[@StefanoTempesta]

And that's that death of Moq. Let's remove that crapware. Well done Nick for creating awareness.

[@CobraTrainer]

RIP moq, my company just banned it and any project the same developer has control over. We are scrambling to exchange it asap in every project.

[@RtoipKa]

Ok, you want to tell me that you all quit doing averything else and spend all time removing Moq? Why not update to 4.20.2 or downgrade?

[@ByronScottJones]

​@@RtoipKayes, I know plenty of companies that would do exactly that with a vendor or source project that is no longer trusted.

[@RtoipKa]

@@ByronScottJones you could use older or newer version and migrate over time. He said they are doing it ASAP which makes no sense. I understand doing it over time. Tell your clients or CEO that new features are not coming because you will spend N weeks/months eliminating moq from you big solution. But I'm sure your competition will like it.

[@jboss1073]

Exchange it for real tests, and stop defrauding your clients by letting them believe you're testing their software when you're testing mocks. You're just as much of a liar as the author of Moq.

[@jamienordmeyer4345]

​@@jboss1073 OK, I'll bite. What are "real" tests in your viewpoint? Integration tests? End to end tests? A fully realized testing suite would use all 3. Why aren't unit tests with mocks in them "real" tests in your viewpoint? Unit tests shouldn't be talking to real databases, API's, file systems... thus the use of mocks. Define "real" tests for us.

[@Radictor44]

Now I want to see a NSubstitute video :)

[@ultimatedjX]

Every now and then a gentle reminder comes that programming as an industry is still Wild West :)

[@AmosAAnderson]

If you haven't made it already, maybe a good subject to do a video on is how to pick good open source projects when picking dependencies.

[@marvinbrouwer459]

@nickchapsas I hear you say in the video that you think NSubstitute is a better library. Why is that? A few people tell me they don't like moq, and usually it's because of the .Object part. I personally like the fact that I write extension methods for Mock when I'm doing MOM pattern. Is it also just the .Object thing for you? Or are there more reasons? And if it is just that, I'm rolling my own mocking library, I'd like your opinion on something. How would you like a library very close to moq, but with an implicit conversion next to a .Object or .Instance as I called it?

[@cn-ml]

This is huge. I mean the pure fact that a library starts any process thats not related to the library itself is a huge red flag. But the fact that this process reads private files that may even contain sensitive information is absolutely mindbending. I started working with DI 1-2 years ago and wanted to go more into testing this year, but it seems like moq is now out of the question. Is there any way to protect against supply chain attacks in .NET?

[@qj0n]

unfortunately, C# has now more and more features which enable nuget libraries to mess around - the can not only run arbitrary code during build or development (analyzers), but also inject their code into your product (source code generator). I think tools should work on isolating executed analyzers and also they should require explicit acceptance on every code generation + easy way to review all injected code (I know you can find it in obj dir, but I think tools should promote reviewing it). At the moment, the best way is to minimalize number of nuget packages, especially not popular ones and monitor all of them. There are static analysis tools to do it for you (like dependabot), but in cases like this it's always a bit arbitrary to decide what is acceptable, what is not

[@dahahaka]

Ooof, I'm pretty certain that this was intended to be an ease of use thing and to reduce friction. Not requiring you to enter your email, but the missing communication and the way it was executed, really not good x.x Maybe he should've at least polled first whether to include sponsorlink in moq

[@devincarlson8866]

We need more of these types of videos, not necessarily scandals, but raw takes from Nick. This was hilarious AND informative 😂

[@TheSimonDavidson]

Is there Auto Fixture support for NSubstitute?

[@ChrisMissal]

Yes

[@tea_otomo]

Sadly people on Twitter don't understand that this is a nightmare for EU devs because of GDPR and bureaucracy. We don't actually care if your employer has to pay a license/donate.

[@qj0n]

Other countries have similar regulations as well. But kzu is from Argentina and from my experience, devs from south america often don't understand data privacy policies. I used to work with colombian team and they didn't care about data retention and management at all (you could find logs with users data in source code repo)

[@alessio15]

Hopefully this will not trigger other creators of packages to do someting alike. Let's hope that this will scare off the intention due to all the commotion around it. If you want to scrape data, do it by consent. Thanks Nick for your explanation! :)

[@kocot.]

actually the community backslash is likely to make them think twice before doing so, but it's also a clear indication of an underlying problem that should be solved

[@andreipacurariu2013]

I don't know. Some people immediately jumped in with donations hoping to discourage him I guess?!

[@kocot.]

@@andreipacurariu2013 that was my idea too, but its quite clear when those donations start drying or just the needs increase he'd come up with something similar again

[@gavinw77]

This just adds to the debate on how so many dev's refuse to pay for the work that other people are doing for them.

[@Stettafire]

Depends. I think library owners who rely on customers from large organisations may think twice. Since this will cause them to be dropped due to compliance concerns

[@tchentzo]

So nuget packages I include in my project are allowed to spawn processes during compilation?

[@diaaway]

Yep

[@faaeen]

Thanks. Created a ticket for my team to remove this asap. Will also spread awareness within the organziation. All trust is gone.

[@sikor02]

In today's world full of dependencies of dependencies of dependencies when you build a project, who knows what sits in this chain. You use a library that uses some other libraries and it goes on. You don't know anymore what your code is actually doing. This time community spotted the thing and there was a global alert that spread around in hours. But who knows how much malware runs behind the scenes in the libraries you use for your projects. I don't know. I hope none, but I can never be sure. Do you know?

[@georgepagotelis]

Should be fun day at work tomorrow with keeping work emails private.

[@sivatronics]

Thanks for explaining it Nick. I been wonder whats going on and now I know. Thanks again.

[@aborum75]

An almost unimaginable clusterf.. by the author of Moq; it's really sad to see a great library crash and burn like this.

[@amirhosseinahmadi3706]

The maintainer seems totally unhinged; this is an excerpt of one of his posts: "And I’m a firm believer that supporting your fellow developers is something best done personally. Having your company pay for software surely doesn’t feel quite as rewarding as paying from your own pocket, and it surely feels different for me too. We really don’t need to expense our employers for a couple bucks a month, right??"

[@TarkasBane]

Does he pay for everything he needs at work out of his own pocket?

[@pffffffffffffffffft]

That is some high level brain rot there. I can't fathom the thought process.

[@kocot.]

yeah, this concept is pretty crazy, I get impression he might not have much experience working in a bigger team/company

[@TarkasBane]

@@kocot. He's worked at Microsoft and Xamarin for a number of years

[@WarrenGarabrandt]

Are we sure somebody isn't trying to unit test that maintainer's brain, but forgot to use Moq, so now all the nonsense input is just spilling out into the world?

How should I know that the SHA256 + Base64encoded String I see is not just a crypto-encoded string that is Base64encoded ... sure it might look that way but there are ways to easily exfiltrate information that way

[@LuaanTi]

It doesn't matter. EU has already ruled that SHA256 is not considered secure for e-mails (even if you ignore that it's still PII). This violates GDPR _badly_ , and is a nightmare even for HR.

[@col_rod]

Thanks for sharing. I was not aware of this until I saw this video.

[@AJax2012]

I love when your "random number" pops up in something you have no control over 🤣 Thanks for sharing this video though, I guess I'll need to switch to NSubstitute for a while... This is nuts.

[@omriliad659]

Is there a way to know packages like this before installing? I mean as a whitelisting instead of blacklisting

[@davideglass]

I honestly thought this video was just click bait, but no. Thanks for bringing this issue into a wider audience Nick.

[@tylernol1566]

Thanks, I'll ensure we are on

[@r3d-soft]

Was anyone able to verify the claims, that on Jenkins it didn’t run and on macOS it didn’t work?

[@bugsincloud]

Tomorrow I’m starting a clean operation. Bye bye Moq, we were friends…

[@artemisDev]

This is a security and legal nightmare. no idea why would someone sabotage their project for minuscule stuff like that. No way I am touching that package or anything from that dev ever.

[@ScorpionJL]

Thank you for the heads up and looking forward to the migration video

[@bulwarkjm2]

Given this is OSS, it seems like the appropriate action is to fork it, not a abandon it completely. (having said that, I haven't yet tried NSubstitute)

[@Marfig]

I generally agree with you. But the problem with forks is the reputation of them. The Moq fork has to come from one of the top contributors, or someone with enough reputation for users to trust the library isn't just going to be abandoned in a couple of months or years. We will see how this moves. But I agree and I'm holding off replacing Moq just yeat until I understand what is going to happen. Of course, this particular repository of Moq is dead for me.

Three things that can happen: 1. The project is dead (even if the code is removed), and everyone stays at pre 4.20 or move to another library. 2. The project gets forked, and someone else is in control. 3. The original project is taken over and managed by a OpenSource foundation. It really seems like option 2 or 3 would be a lot less work than rewriting all the tests out there. And that would be the most OpenSource way of fixing this. Screaming "everyone should change to another framework" does not sound like the OpenSource way to me.

[@SeChelios]

Option 4, only a small part of .Net community notice that and in the next version everything will be deleted and the vast majority of people even will not know about that

@@SeChelios That might be the case. But some tools might flag this, even future version if removed (ex. Whitesource Bolt, SonarQube. Nuget).

[@kocot.]

I'm quite sure some will just fork and potentially keep merging newer features while keeping the malware references out. TBH one doesn't expect any amazing features to be added to an already pretty complete mocking library, and its not included in production code, so even if it's dead people can go on for years using it or fix to v4.18 and don't ever update again. Most will probably not notice, or not yet at least.

[@WarrenGarabrandt]

Option 5: not enough backlash because of either lack of visibility/awareness, or unwillingness to change, and other package maintainers decide to start doing it too, because if Moq survives this, then why not? Shenanigans beget shenanigans.

[@Jared-150]

@@WarrenGarabrandt Option 5 would indeed be problematic. Fortunately, I think this is a high visibility fiasco (it even affects dotnet runtime) that is getting plenty of attention.

[@JesseTemple]

When we were deciding what mocking framework to use, I voted for Moq. I lost that vote in favor of FakeItEasy. I'm glad that happened now.

[@wknight8111]

We saw this issue the other day and luckily we're only using Moq v4.18 in our current projects. So we won't be upgrading. I personally don't like mock-object tools for testing anyway. When I see Mock Objects used, it makes me think that the interface wasn't appropriately designed, and we're trying to cover too much in a single unit test that should probably be changed to an integration test instead. However, we weren't planning to remove Moq from our projects just based on that small preference...until now. Now we're looking to remove Moq from our system completely.

[@Dpaz2009]

ask chat gpt to convert it for you 😉👍

[@failwyn_]

What are your thoughts on NSubstitute vs FakeItEasy?

[@yufgyug3735]

because of this, i havent been able to do any work today. too busy refreshing the various threads on github reddit etc, and making more and more popcorn.

[@Jared-150]

Slow motion train wrecks are sure fascinating. I don't even use Moq but I am fascinated by this kind of senseless tragedy.

[@buriedstpatrick2294]

I was in complete disbelief reading the Reddit thread this morning. I don't know what he expected would happen. I guess just that people wouldn't notice? Even though the whole point of his ... let's just call it malware ... is to be noticed? Absolutely mind-boggling.

[@zeezeewhy]

dude i have no words... I just started using moq in a new project i guess i will have to replace it guess what nsubstitute... (not important) and for what? a slight chance of the email being scraped (more important lol). Who would have guessed the replacement of the library would be the outcome huh... looking forward to the new video btw

[@DarkNivo]

Configutation to the rescue :)

[@mehmetck]

Love this idea man

[@RtoipKa]

Does AutoMoq support NSubstitute?

[@BrianHallmanac]

I don't think so. I was looking at their Github repo. The good news is that they only require a dependency on Moq 4.7.0 or greater so as long as you don't upgrade Moq past 4.18.4 you should be fine. I absolutely love using AutoMoq. Especially in conjunction with Autofac for some tests.

[@carl-henrikkristoffersen2313]

Thanks for giving this issue the attention it deserves!

[@keyboqrd205]

2:47 , so true, the page max out one of my cpu core upon being opened, to make it more sus, once the dev tool opend, it drops to zero.

[@MatthijsWagemakers]

I ran a profiler. It might be a poorly written animation

[@orterves]

As dodgy as this is, I think we take for granted the everyday use of open source libraries - it would be good if this outrage could lead to a conversation on the responsibility of both open source providers and open source consumers in ensuring a healthy and supportive ecosystem. What does this library really owe us, if we're using it for free?

[@arjix8738]

That library is open source, your argument would make more sense if it was closed source and free (as in price)

[@blackenedsprite8542]

It owes us to not gather and potentially risk leaking our email/company email, and to not literally break the law.

[@jboss1073]

"What does this library really owe us" This is what the Software License is for.

[@andreipacurariu2013]

Bad take. If You decide to offer a library for free, do so. I you decide to offer it for a price, do so. Ransomware or other types of malware to extort payment is a no go regardless.

[@orterves]

@@andreipacurariu2013 I don't condone what they did, but it is offered without malware - in the previous version that everyone was using for free; there is nothing requiring the users to upgrade to the latest version. My point is that maybe we take that for granted far too often, both from a security point of view but also just from the responsibilities of a sustainable community

[@dmstrat]

You mentioned earlier in the video that we may need to downgrade, but I don't recall you saying which version this starts so i can avoid it. I'm currently using 4.18.x but your example was 4.20.1 with 4.20.2 live as well. I'm hoping I'm on a version where this isn't a problem while I work on migrating away from Moq. Thank you for the heads up.

[@lasselange1911]

He said it started with 4.20 :)

[@dmstrat]

Thank you, I missed that@@lasselange1911

[@Stettafire]

4.20 to my knowledge

[@GaryFrancis-q3r]

Thanks for sharing. That was absolutely insane.

[@tonholis]

That's scary. I wonder how many other nuget packages/libraries could be doing some funky stuff in background...

[@JorgeLuisMachadoTorres]

Thanks for this video 100% appreciated the info

[@nthonymiller]

OMFGWTF!!!! thanks Nick for the timely video. The lib I loved is now dead to me.

[@TheKsenija123]

Thanks for the video and info. 👍

[@boxacuva]

oh shit gonna go over a lot of unit tests and rewrite them with NSubstitute.

[@codingbloke]

Moq -> NSubstitute yes please!!

[@jboss1073]

NSubstitute -> Real Testing Without Mocks yes please!!

[@JoeIrizarry88]

Wow. 😮 Video about MOQ to NSubstitute is in demand…

[@WouterTV]

I don't get it. Why do you want to link the user that is using your package? They trying to introduce some kind of freemium stuff here?

[@BittermanAndy]

The build is slowed and a warning raised if the user hasn't sponsored the project, which is what the email check is for. So they're extorting money out of people who don't want their builds slowed down and warnings when they build. At least, that's what we know about. Could be doing all sorts more on top of that. We have no idea.

[@mariocamspam72]

Your videos with additional humor are fucking amazing, that bitcoin joke was unexpected 😂

[@Hyp3rSon1X]

All that crap just to thank some people in some log output, that most people would ignore or not notice anyway... If I want my ego stroked that bad, I will happily provide my email manually... there's absolutely no legitimate reason why there should be some weird scraping going on in the background. I'm getting npm flashbacks all over again, where some authors would implement malicious code as a protest against russia, which broke lots of legitimate projects aswell... If it's scraping emails in the background today, who's to say it wont do something else in the future? Wouldn't shock me if it started mining crypto coins at some point... as a way to force everyone to sponsor the project or something xd

[@nathanhedglin931]

Yup. OSS really kills itself with issues like this.

[@andreasmewald2439]

Thx for sharing this!

[@arjunmenon2901]

Which version is this ?

[@nickchapsas]

4.20, it’s mentioned in the video

[@ArmanOssiLoko]

Watch at 3:20

[@mihaikanyaro3460]

@@nickchapsas It should've been timestamped at 4:20

[@rirajojo]

How are you forced to run an ad on your own company?

[@qj0n]

Probably some agreement like "Next X videos have this ad". Which was planned to be put on regular videos and this, "emergency announcement" should be as short as possible

[@noahg2]

I'm so retarded that I didn't even know what MOQ was. Thanks for the introduction.

[@lucianogs]

Thanks for the heads-up

[@desertfish74]

Moq 420 blazin' through your private data

[@DonovanChilders]

This is not good. Definitely looking forward to your video on migrating from Moq to NSubstitute.

[@dziarskihenk8798]

5:43 your expression made me genuinly laugh :D

[@alexshckv]

Already reverted, but for how long?

[@daniilrozputnii4636]

wow, thanks for information!

[@remyb833]

Cant wait for the video to migrate to something else. What is the next best option?

[@F1nalspace]

I never needed any mocking framework, so i never used moq - so i am unaffected by this. However, if i had used moq - then i would definitily replace it with an alternative as well. Scraping personal informations for no reasons in a library is out-of-question and also violates a lot of laws... in germany here we have the DSGVO, which is clearly violated by this!

[@muhammadibnalireza1888]

What is the alternative

[@finickyflame]

​​@@muhammadibnalireza1888NSubtitute or FakeItEasy

[@jboss1073]

@@muhammadibnalireza1888 The alternative is to ACTUALLY TEST your application WITHOUT MOCKING and WITHOUT DEFRAUDING YOUR CLIENTS by making them believe you're testing their application that they paid for you to do, instead of testing mocks which have nothing to do with their application.

[@qj0n]

@@muhammadibnalireza1888 NSubstitute is very different and in my opinion - better. But if you want sth. more similar to moq, go for FakeItEasy

[@LuaanTi]

He added it to all the projects he contributes to, not just Moq. This includes some that are in the dependency chain of some MS packages even. There's a rush to remove everything he touched ASAP. And yeah, I think mocking is a code smell. It's weird how it was accepted as the standard solution to "make tests" for untestable code.

[@shreyasjejurkar1233]

Even intresting thing is that nuget and not even visual studio found this behavior that package is making! Serious security flaw tbh!

[@Rein______]

Handwritten Test Doubles / Fakes. Any mocking library just overcomplicates things.

[@TheSilent333]

Thanks for the heads up! Glad I don't use Moq

[@cdnkarasu]

Thanks for exposing this to us Nick...luckily we don't use Moq at all.

[@someguy3176]

What do you use as an alternative?

[@IsaacArnall]

They JUST released version 4.20.2 which removes the reference to the package. However, it's been removed ONLY because it broke restore on mac.

[@stevepettifer4896]

And AFAIK only the package ref was removed: All the ancillary code is still there suggesting an imminent return as soon as the dev sorts out their blocker to trying to get paid off.

[@IsaacArnall]

@@stevepettifer4896 This is correct.

[@88spaces]

I'm deciding which framework to use for mocking a new project. I've used Moq before and I like it, but considering this controversy, I'm not going to use it. Anytime there are serious doubts about the integrity of a piece of software, I'll choose an alternative just to be safe.

[@TheMAZZTer]

Yeah SponsorLink would definitely be a violation of my employer's policies on working with the company's data if I installed it by accident while installing a separate nuget package. Clearly explicit permission is not being given here. If I install this on my work PC which has work data (and I am certainly installing it into a project I am doing for work, so it is not mine, it and all the code in it written by me and other employees belongs to my employer), my employer has not given their consent to having those email addresses uploaded. Even if you argue the person installing has given their consent, that means nothing if they are not authorized to do so. These guys are playing with fire, wouldn't be surprised if they get legal letters from a large corp and change their tune quickly.

[@TheOceanLoader]

This happens because of egos when experienced developers are not objective enough to become solution architects. They want to become rich off their (popular) framework (perhaps deservedly) but instead of running it past peers, they would rather just implement it. After all, aren't they geniuses? The rock-star developer attitude causes a LOT of issues.

[@kiquenet]

alternatives to moq ?

[@nickchapsas]

NSubstitute or FakeItEasy

[@stephajn]

Moq….thy name is Mud. I will be ensuring I don’t have version 4.20 installed, and if so, downgrading until I can remove it. Looking forward to seeing the migration to NSubstitute video!

[@user-iu1xg6jv6e]

He should be in jail. This was not an innocent mistake.

[@temp50]

You are overreacting... If you think he must be in jail for this, politicians must precede him...

[@AlFasGD]

This is a good reason to re-evaluate how much mocking you need in your project Of course it's more serious than that, but that's also something to consider

[@Marfig]

Now, that would be an interesting discussion. Starting at the need to split data validation logic from data processing, and going all the way to the excessive use of DI in our code, we could have well over one hour of really useful content that challenges a lot of the bad coding practices that we ignore exist under all the Clean Architecture and DDD overly prescriptive gospel.

[@Chris-zb5nm]

This is a popular package. Why the hell did the dev make such stupid decision to send private data to 3th parties! What was he thinking! He just ruined his own package.

[@local9]

The fact that its done without the consent of the user, its a GDPR breach. Won't even touch Moq now.

[@michaelconrad2690]

Yeah, this sucks. pretty much need to have zero tolerance for libraries exfiltrating data like this.

[@yuGesreveR]

It looks like the end of my usage of Moq. The author of this library is eitger insane or not smart enough to understand, that such a "feature" is one of the worst possible ones. Some third party code scans my git folder for a personal data. WTH?! Anyway, I don't trust Moq after this and will remove it from my every project

[@geomorillo]

and are you sure he is only scanning that?

[@HollandHiking]

I think this is violating GDPR regulations. This guy risks a tremendous fine for this.

[@qj0n]

which he doesn't care living in Argentina

[@vezixig1195]

Thank you for this info!

[@tehsimo]

removed Moq this morning

[@quicktastic]

Sadly, the personal data has already been collected.

[@Marfig]

Wow! What an insane way to kill forever a tens-of-million-users decade-old library. And Fiddler is not the answer, I can't believe the maintainer is actually telling me to use it. What would he propose? That we run Fiddler as a background process from here on to the end of time simply because we would be using Moq and have no idea what the obfuscated code is actually doing?