NuGetTrends/Lobby

Sami Al Khatib

@alsami

https://pbs.twimg.com/media/DEIV_1XWsAAlY29.jpg

Loïc Sharma

@loic-sharma

I really wanna try running user studies on new developers trying to publish NuGet packages. I have the impression that it's hard to create a package if you're a newbie: you have to go to nuget.org, sign up, create an API key, somehow store that on your computer securely. Something that NPM does really well is they have an exceptionally streamlined publish experience even if it's your first time.

NuGet client has "plugins" you can use to authenticate to private feeds

I wanna try prototyping a plugin for NuGet.org that guides you through an easy login experience (no API keys involved!). I'm hoping that simplifying the first time experience will help more people become package authors!

Bruno Garcia

@bruno-garcia

@loic-sharma You can upload a package with 3 commands:

dotnet new class lib
dotnet pack -c Release
dotnet nuget publish -k $KEY

IIRC anyway, but surely u’d need a key in $KEY

I do like the fact NuGet doesn’t have billions of one liner packages

famous one: https://www.npmjs.com/package/is-odd

so u bring is-even, that depends on is-odd, and does !isOdd

jeez

lol

Loïc Sharma

@loic-sharma

Yeah the one liner packages aren't so good...

Bruno Garcia

@bruno-garcia

@loic-sharma the problem IMHO is not so much uploading the package. but making it properly

Loïc Sharma

@loic-sharma

That being said, NPM has a vibrant ecosystem

Bruno Garcia

@bruno-garcia

there’s a good doc now a days, with Do’s and Don'ts

that’s very true

Loïc Sharma

@loic-sharma

Part of it is because there's such a low bar for me to convert a project into an NPM package

That's not true for NuGet

Bruno Garcia

@bruno-garcia

that I def agree with

Loïc Sharma

@loic-sharma

I have to register to nuget.org, create a new API key (I need to choose the key's name, expiration, and permissions), then I need to understand how to properly store the API key on my system

Passing the key through the CLI is pretty insecure

Once you've figured this all out, you're good to go. But it's a tough nut to crack for newbies

My theory is that we can help the ecosystem grow by making it easier to contribute to the ecosystem :)

Bruno Garcia

@bruno-garcia

I gave a 40~ min talk jsut about that: https://www.youtube.com/watch?v=gPumZi0W4os&feature=youtu.be&t=682

so i don’t think it’s simple at all to do it properly

Loïc Sharma

@loic-sharma

Bruno Garcia

@bruno-garcia

I start saying it’s just 3 commands, so “easy” but then go through the things u need to think about, etc

but the audio is crap the first 10 min :\

Loïc Sharma

@loic-sharma

Watching your video now :)

Bruno Garcia

@bruno-garcia

hehe

Loïc Sharma

@loic-sharma

I definitely agree that we should drive the ecosystem towards higher quality packages

Bruno Garcia

@bruno-garcia

happy to get some feedback btw

Loïc Sharma

@loic-sharma

We're just starting to look at that in the NuGet team

Something I wanna do is prototype something like npms for the NuGet ecosystem: https://npms.io/about

They rate a NPM package's quality using a bunch of heuristics

Bruno Garcia

@bruno-garcia

that’s interesting!

Loïc Sharma

@loic-sharma

Huh. I didn't know about CLS compliant. Liking the talk so far :)

Bruno Garcia

@bruno-garcia

\o/

Martin Björkström

@mholo65

dotnet-foundation/projects#20

Bruno Garcia

@bruno-garcia

Thanks for the tip @mholo65 :)

Martin Björkström

@mholo65

:+1: np, hope the review process wont take too long

Bruno Garcia

@bruno-garcia

Saw an update on omisharp a few days ago. Application was in July hehe

Loïc Sharma

@loic-sharma

Congrats on the application!! I wonder why it takes so long for .NET Foundation to accept new projects

On this part: "The system at this time has no PII data."

FYI, the NuGet.org catalog may have PII information. The catalog leafs contain whatever the user put in their package, which may contain names, email address, etc. So if you store catalog leafs, you may have PII information

Bruno Garcia

@bruno-garcia

That's fair. But at that point it's unknown and it's under the T&C of nuget so not worried. I was more worried about holding user data in the DB like if u log in and give us ur info

Dunno why it takes so long either. Even if they just declined it but to have some hint of what direction this goes.

Bruno Garcia

@bruno-garcia

@mholo65 hey man, in case you want to discuss sometime the reverse dependency, if you’re interested in collaborating to get that done in NGT

oh just realize it’s super late in Finland

Where communities thrive

People

Repo info

Activity