Hacker News Reader

Comment by gregmac | Hacker News Reader

This looks like something that would be nice to have integrated in nuget.org, showing the report output for every package/version (and maybe highlighting deltas across versions).

If you're running this across your own project output, especially for a big code base, it's definitely not going to be as useful as across each dependency. For example your app having "analytics services" and "outbound http connections" might be totally normal, but if a library you're using for encryption adds those, that would be a concern.

View on HN

In regards to the first line of your comment, check out https://www.fuget.org. It does exactly that.

Sorry, where's the app inspector output in this?

https://www.fuget.org/packages/System.Net.Http for example doesn't show me all of that.

This is a great idea - would love to have this info integrated into nuget.

Most likely people aren't going bother to run this on dependencies themselves (not to mention every version update), so having the info surfaced at the point of decision would be very useful and reach a ton more folks.

Hey folks, I'm on the NuGet team and I noticed this thread this morning. This is the first I've heard of Application Inspector (Microsoft is a big place!) but the tool looks awesome and the output is easy to understand for a variety of experience levels. The idea of integrating with NuGet sounds very promising! Caveats need to be investigated, i.e. my guess is the report is not exhaustive since code could perhaps call scary APIs in esoteric ways but perhaps there is value even if it covers just MOST of the cases.

I've tracked a feature request on GitHub here attempting to represent what was suggested here:

https://github.com/NuGet/NuGetGallery/issues/7824

Add additional comments if you have thoughts on how it should work or anything else. Our backlog is pretty full right now but we'll update this GitHub issue if there is movement.

In addition / instead of showing the results in the web UI, it would be valuable to make Nuget enforce user selected criteria. When referencing a package I would like to annotate that reference with some criteria that are currently met (e.g. the referenced package makes no network calls) and then later for a package upgrade Nuget would automatically check if these criteria are still met, or fail the upgrade.

This sounds like a request for the NuGet client experience and less for browsing nuget.org. My expertise is more on the nuget.org side and less on the client side (like .NET CLI or Visual Studio). Could you file an issue for the NuGet client suggestion here?

https://github.com/NuGet/Home/issues/new

If you have some ideas in the space of how specifically it could work, maybe mention where/how (e.g. what file) you'd like to declare these "rules".

Reply on news.ycombinator.com