this post was submitted on 09 Aug 2023
197 points (99.5% liked)

.NET

1469 readers
10 users here now

Getting started

Useful resources

IDEs and code editors

Tools

Rules

Related communities

Wikipedia pages

founded 1 year ago
MODERATORS
erlingur@programming.dev
starman@programming.dev
Spyros@programming.dev
197
Moq now ships with a closed-source obfuscated dependency that scrapes your Git email and phones it home (github.com)
submitted 1 year ago by asyncrosaurus@programming.dev to c/dotnet@programming.dev
25 comments fedilink hide all child comments
 

Also some fun takeaways: it also makes external calls to azure to load configuration and stays silent after updating for 2 weeks before showing warnings.

Moq is unusable. Needs to be forked or repoaced. Time to switch to NSubstitute.

you are viewing a single comment's thread
view the rest of the comments
[–] kogasa@programming.dev 2 points 1 year ago* (last edited 1 year ago)

You're relying on the fork to remain maintained, or else you risk you run into build/functional issues at some undetermined point in the future when it becomes incompatible with other changes in your environment/project. If you don't trust the fork will be maintained, you should begin decoupling your project from the library anyway. I would be more willing to trust an alternate (or no) mocking framework over a Moq fork to be supported in the long term. That might change in a couple months if one becomes established.

I would personally wait a couple months, or until the original Moq creator reverses course. (If he does that, I think it's unlikely a fork will compete with the original, so I'd start removing the dependency as I can't trust the author anymore.)