{"slug": "nuget", "name": "NuGet", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 8, "warners": 4, "score": -0.637, "rising": -0.98, "first": "2025-11-12", "latest": "2026-08-27", "why": "All of the following products and services are fantastic in 2026:", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 4}, "spark": [2, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "All of the following products and services are fantastic in 2026:", "kind": "", "icon": true, "domain": "nuget.org", "github_repo": null, "official_url": "https://www.nuget.org/", "pricing": "", "aliases": ["NuGet"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 784449859, "item_id": 49028116, "url": "https://news.ycombinator.com/item?id=49028116", "by": "bob1029", "date": "2026-07-23", "version": null, "stance": "recommend", "quote": "All of the following products and services are fantastic in 2026:", "excerpt": "Microsoft is a big place. I recommend focusing on the parts they do well rather than getting tribal. All of the following products and services are fantastic in 2026: Windows Server SQL Server .NET/C#/F#/Nuget Visual Studio [code] SSMS AAD/EntraID Defender DirectX Excel I agree that Teams still kind of sucks and that Azure is a complete dumpster fire of a cloud, on average. But that doesn't mean we should throw the p", "context": "", "use_case": "", "switched_from": "", "story": "Ask: Why does everything Microsoft create lately feel fragile and half-baked?"}, {"id": 734518016, "item_id": 45907376, "url": "https://news.ycombinator.com/item?id=45907376", "by": "to11mtm", "date": "2025-11-12", "version": null, "stance": "recommend", "quote": "Truth; every time I have to do a thing in JVM dealing with maven feels like I need a goat or chicken to make anything work right.", "excerpt": "> Generics work as you would expect with very few weird corner cases. No boxed types because... everything is an object! Took me a moment to realize you meant that 'Java has corner cases because everything is an object' but yes. Will also add the 'advantage' that for value types (i.e. struct) the generics are 'specialized' for the type, in certain cases you can use that for performance optimizations. (although it can", "context": "", "use_case": "", "switched_from": "", "story": ".NET 10"}, {"id": 734420544, "item_id": 45901284, "url": "https://news.ycombinator.com/item?id=45901284", "by": "electroly", "date": "2025-11-12", "version": null, "stance": "recommend", "quote": "We have a tremendous supply of open source libraries in NuGet", "excerpt": "Easy to avoid depending on the area; I'd urge you not to be discouraged by the presence of commercial libraries. They aren't as vital as it may seem from the outside. I've been a full-time C# developer since the first open beta and I have only one (1) instance where I used a commercial library. That was 2002 and if we were doing it today, we wouldn't have needed that commercial library. I have never used a commercial", "context": "full-time C# developer since the first open beta", "use_case": "Open-source library sourcing", "switched_from": "", "story": ".NET 10"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 773874401, "item_id": 48367150, "url": "https://news.ycombinator.com/item?id=48367150", "by": "no-name-here", "date": "2026-06-02", "version": null, "stance": "warn", "quote": "none of the big local C#/dotnet/nuget apps do (Visual Studio/Rider/nuget/dotnet/VS Code)", "excerpt": ">> In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair. > \u2026 the classic \"no way to avoid this\" The Onion article But isn't point of The Onion article that A) the US has >50x as many incidents as the rest of the developed world combined [1], and yet B) acts like there is \"no way to a", "context": "", "use_case": "", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 773732160, "item_id": 48358260, "url": "https://news.ycombinator.com/item?id=48358260", "by": "orphea", "date": "2026-06-01", "version": null, "stance": "warn", "quote": "The devs don't even consider it a priority", "excerpt": "Yep, a bummer. The devs don't even consider it a priority, too busy designing the feature: https://github.com/NuGet/Home/issues/14657#issuecomment-3573184479", "context": "", "use_case": "", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 751088529, "item_id": 46943033, "url": "https://news.ycombinator.com/item?id=46943033", "by": "martz", "date": "2026-02-09", "version": null, "stance": "warn", "quote": "NuGet.org doesn't distinguish between a hobby project and a professionally maintained library", "excerpt": "Building pkgstore.io, a marketplace for commercial .NET NuGet packages. https://www.pkgstore.io NuGet.org doesn't distinguish between a hobby project and a professionally maintained library with real support. pkgstore is a curated directory and marketplace where publishers can sell NuGet packages directly, with full dotnet push/restore support, Stripe payments, and automated access control. In open beta now, onboardi", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (February 2026)"}, {"id": 734504305, "item_id": 45906519, "url": "https://news.ycombinator.com/item?id=45906519", "by": "zamalek", "date": "2025-11-12", "version": null, "stance": "warn", "quote": "I don't see how adding a nuget config improves anything", "excerpt": "\"Just\" is an incredibly obnoxious word when used in the way that you have. > Just install Not on Debian? Have fun with that. You'll also need the Azure SDK. And what about openssl-dev? Oh no, you installed dotnet on Windows instead of within WSL? Start again. No, you don't \"just install\" the SDK. There is a lot that the IDEs set up for you. > Local nuget.config I don't see how adding a nuget config improves anything.", "context": "", "use_case": "", "switched_from": "", "story": ".NET 10"}]}], "who": [{"by": "electroly", "context": "full-time C# developer since the first open beta", "url": "https://news.ycombinator.com/item?id=45901284", "date": "2025-11-12"}], "tags": [], "use_cases": ["open-source library sourcing"], "compared": [{"slug": "net", "name": ".NET", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "npm", "name": "npm", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45888620", "title": ".NET 10", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48356625", "title": "NPM packages from RedHat have been compromised", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49465340", "title": "Show HN: Bhowra Ink \u2013 C# HTML-to-PDF Under 1 MB, Azure Functions Consumption", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49027955", "title": "Ask: Why does everything Microsoft create lately feel fragile and half-baked?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46937696", "title": "Ask HN: What Are You Working On? (February 2026)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2, "warn": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"warn": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"warn": 2}, "2026-07": {"recommend": 1}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 791446084, "item_id": 49465380, "url": "https://news.ycombinator.com/item?id=49465380", "by": "dillu_spur", "date": "2026-08-27", "version": null, "stance": "neutral", "quote": "zero NuGet dependencies", "excerpt": "Author here. Most .NET HTML-to-PDF options are either a headless-Chromium wrapper (150-400 MB, multi-second cold starts, painful or blocked on Azure Functions Windows Consumption) or an AGPL/commercial library with a dependency tree. Bhowra.Ink is a from-scratch pure-C# engine: one managed .NET 8 DLL of 913 KB, zero NuGet dependencies, no native binaries, no P/Invoke. It renders HTML5 + CSS (Grid, Flexbox, gradients,", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Bhowra Ink \u2013 C# HTML-to-PDF Under 1 MB, Azure Functions Consumption"}, {"id": 784449859, "item_id": 49028116, "url": "https://news.ycombinator.com/item?id=49028116", "by": "bob1029", "date": "2026-07-23", "version": null, "stance": "recommend", "quote": "All of the following products and services are fantastic in 2026:", "excerpt": "Microsoft is a big place. I recommend focusing on the parts they do well rather than getting tribal. All of the following products and services are fantastic in 2026: Windows Server SQL Server .NET/C#/F#/Nuget Visual Studio [code] SSMS AAD/EntraID Defender DirectX Excel I agree that Teams still kind of sucks and that Azure is a complete dumpster fire of a cloud, on average. But that doesn't mean we should throw the p", "context": "", "use_case": "", "switched_from": "", "story": "Ask: Why does everything Microsoft create lately feel fragile and half-baked?"}, {"id": 773874401, "item_id": 48367150, "url": "https://news.ycombinator.com/item?id=48367150", "by": "no-name-here", "date": "2026-06-02", "version": null, "stance": "warn", "quote": "none of the big local C#/dotnet/nuget apps do (Visual Studio/Rider/nuget/dotnet/VS Code)", "excerpt": ">> In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair. > \u2026 the classic \"no way to avoid this\" The Onion article But isn't point of The Onion article that A) the US has >50x as many incidents as the rest of the developed world combined [1], and yet B) acts like there is \"no way to a", "context": "", "use_case": "", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 773732160, "item_id": 48358260, "url": "https://news.ycombinator.com/item?id=48358260", "by": "orphea", "date": "2026-06-01", "version": null, "stance": "warn", "quote": "The devs don't even consider it a priority", "excerpt": "Yep, a bummer. The devs don't even consider it a priority, too busy designing the feature: https://github.com/NuGet/Home/issues/14657#issuecomment-3573184479", "context": "", "use_case": "", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 751088529, "item_id": 46943033, "url": "https://news.ycombinator.com/item?id=46943033", "by": "martz", "date": "2026-02-09", "version": null, "stance": "warn", "quote": "NuGet.org doesn't distinguish between a hobby project and a professionally maintained library", "excerpt": "Building pkgstore.io, a marketplace for commercial .NET NuGet packages. https://www.pkgstore.io NuGet.org doesn't distinguish between a hobby project and a professionally maintained library with real support. pkgstore is a curated directory and marketplace where publishers can sell NuGet packages directly, with full dotnet push/restore support, Stripe payments, and automated access control. In open beta now, onboardi", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (February 2026)"}, {"id": 734518016, "item_id": 45907376, "url": "https://news.ycombinator.com/item?id=45907376", "by": "to11mtm", "date": "2025-11-12", "version": null, "stance": "recommend", "quote": "Truth; every time I have to do a thing in JVM dealing with maven feels like I need a goat or chicken to make anything work right.", "excerpt": "> Generics work as you would expect with very few weird corner cases. No boxed types because... everything is an object! Took me a moment to realize you meant that 'Java has corner cases because everything is an object' but yes. Will also add the 'advantage' that for value types (i.e. struct) the generics are 'specialized' for the type, in certain cases you can use that for performance optimizations. (although it can", "context": "", "use_case": "", "switched_from": "", "story": ".NET 10"}, {"id": 734504305, "item_id": 45906519, "url": "https://news.ycombinator.com/item?id=45906519", "by": "zamalek", "date": "2025-11-12", "version": null, "stance": "warn", "quote": "I don't see how adding a nuget config improves anything", "excerpt": "\"Just\" is an incredibly obnoxious word when used in the way that you have. > Just install Not on Debian? Have fun with that. You'll also need the Azure SDK. And what about openssl-dev? Oh no, you installed dotnet on Windows instead of within WSL? Start again. No, you don't \"just install\" the SDK. There is a lot that the IDEs set up for you. > Local nuget.config I don't see how adding a nuget config improves anything.", "context": "", "use_case": "", "switched_from": "", "story": ".NET 10"}, {"id": 734420544, "item_id": 45901284, "url": "https://news.ycombinator.com/item?id=45901284", "by": "electroly", "date": "2025-11-12", "version": null, "stance": "recommend", "quote": "We have a tremendous supply of open source libraries in NuGet", "excerpt": "Easy to avoid depending on the area; I'd urge you not to be discouraged by the presence of commercial libraries. They aren't as vital as it may seem from the outside. I've been a full-time C# developer since the first open beta and I have only one (1) instance where I used a commercial library. That was 2002 and if we were doing it today, we wouldn't have needed that commercial library. I have never used a commercial", "context": "full-time C# developer since the first open beta", "use_case": "Open-source library sourcing", "switched_from": "", "story": ".NET 10"}]}