Produced | OSC Open Source Community (ID: oschina2013)
This company called Microsoft runs this package manager called NuGet, and they host a cURL package…,… This package has been tricking users into downloading it, it’s outdated, old, full of bugs , should be removed, but I can’t report back on this or get them to do anything about it.
This is an excerpt from a tweet recently released by cURL author Daniel Stenberg, pointing directly at Microsoft’s inaction.
Sorry to speak too fast, now let’s rewind <<<<<<<<< and reorganize the ins and outs of the story.
The author of the cURL project, Daniel Stenberg, is very active in the maintenance of the project. Users who often use cURL should also know its approximate update cycle. cURL will release a version update almost every two months. Currently, the latest version of cURL is 7.88 released in mid-February this year.
But can you imagine how old the cURL version in the current NuGet package manager is? 5, 4, 3, 2, 1, the answer is cURL 7.30, last updated in June 2013.
The version is too old and is not the main reason why Daniel Stenberg tweeted and criticized Microsoft. The main reason is that after Daniel Stenberg gave NuGet feedback, NuGet has not helped him solve this problem.
Daniel Stenberg stated that when he reported this issue to NuGet, NuGet thought that Daniel Stenberg was asking for support, so they said that they did not provide support for individual packages, and asked Daniel Stenberg to contact the package directly using the “Contact” link on the detail page The owner of (the user who uploaded this package, the package on NuGet is built and contributed by volunteers, Daniel Stenberg cannot personally provide updates or “take over” this package).
The owner of cURL on NuGet is called coapp, and Daniel Stenberg tried to contact him, but got no response. So Daniel Stenberg wondered if he could report this issue as a bug (because the version is too old, many bugs are publicly available) and ask them to delete this package from NuGet. But NuGet said that they only accept this kind of report for Microsoft products, and for other non-Microsoft software packages, you need to contact the owner of the package.
NuGet didn’t help, and the owner couldn’t be contacted, so this matter fell into a dead end. In desperation, Daniel Stenberg posted multiple tweets to make the matter public.
The power of netizens is still strong. After several times with the help of netizens @, Joel Verhagen, a Microsoft developer and the leader of the nuget.org engineering team, saw and replied to Daniel Stenberg.
It turned out that after Daniel Stenberg reported this issue, the NuGet team noticed this special situation and got in touch with the owner of this package, who is now involved. It’s just that NuGet didn’t notify Daniel Stenberg during this process, and admitted that this was their mistake, and they will contact them by email later.
At present, NuGet has temporarily removed cURL, and users can no longer search for cURL. Even if you know the detailed link of the project, the page that visits cURL now will display an obvious warning, telling users not to use cURL for the time being.
It is unclear if they will update cURL or when they will re-list NuGet. But cURL is not an exception, there are many other packages in NuGet that are also facing a similar situation, and NuGet also needs to change the existing mechanism, and the real author of every package can’t come to Twitter to complain.
The text and pictures in this article are from the OSC open source community
This article is transferred from https://www.techug.com/post/the-author-of-curl-publicly-accuses-microsoft-of-poor-handling-and-ineffective-communicatia7b0b3cfe3ee29fbef35/
This site is only for collection, and the copyright belongs to the original author.