Security Archives | The NuGet Blog

NuGet.org will permanently remove support for TLS 1.0 and 1.1 on June 15th

Christopher GillMay 25, 2020May 25, 202005/25/20

Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org in which we stated that the permanent removal of TLS 1.0/1.1 support would occur in April 2020. However, in April, to avoid disrupting customers in the midst of the COVID-19 pandemic, we announced that we would continue to support TLS 1.0/1.1 until further not

NuGet.org will continue to support TLS 1.0 and 1.1 until further notice

Christopher GillApril 22, 2020Apr 22, 202004/22/20

Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org and actions you can take today to ensure your systems use TLS 1.2. In that post, we announced that NuGet.org would remove support for TLS 1.0/1.1 in April 2020. However, since then, our customers have faced a variety of challenges in the wake of the COVID-19 p

Deprecating TLS 1.0 and 1.1 on NuGet.org

Karan NandwaniNovember 15, 2019Nov 15, 201911/15/19

co-authored by Scott Bommarito At Microsoft, using the latest and secure encryption techniques is very important to us to ensure the security and privacy of our customers. TLS 1.0 and TLS 1.1, released in 1999 and 2006 respectively, are known to be vulnerable to a number of attacks including POODLE and BEAST. In the past, we removed support f

Lock down your dependencies using configurable trust policies

RidoDecember 5, 2018Dec 5, 201812/5/18

For the past several months we have focused on various features to improve package security and trust. Around a year back, we had announced our plans on various signing functionalities that we have been implementing at a steady pace. We enabled package author signing and NuGet.org repository signing earlier this year. Continuing on the signing

NuGet.org starts repo-signing packages

RidoAugust 10, 2018Aug 10, 201808/10/18

In May, we implemented Stage 1 and enabled support for any NuGet.org user to submit signed packages to NuGet.org. Today, we are announcing Stage 2 of our NuGet package signing journey - tamper proofing the entire package dependency graph. What is a Repository Signature? A repository signature is a code signing signature produced with an X.50

Introducing signed package submissions to NuGet.org

RidoMay 22, 2018May 22, 201805/22/18

In September 2017, we announced our plans to improve the security of the NuGet ecosystem by introducing the ability for package authors to sign packages. Today, we want to announce support for any NuGet.org user to submit signed packages to NuGet.org. A signed NuGet package is designed to be fully compatible with pre-existing NuGet servers an

NuGet.org will only support MSA/AAD starting June 1st, 2018

Anand GauravMay 15, 2018May 15, 201805/15/18

We had previously announced the deprecation of NuGet.org's home-grown authentication in favor of Microsoft accounts (MSA) that will allow us to add support for additional security systems such as two-factor authentication (2FA). We will be disabling the NuGet.org's home-grown authentication mechanism starting June 1st, 2018. This means that yo

NuGet Package Signing

RidoSeptember 14, 2017Sep 14, 201709/14/17

In our NuGet Fall 2017 Roadmap, we highlighted security as the main area of investment over the next few months. This blog post describes a major part of that roadmap in greater detail – package signing. We started talking about supporting signed packages on NuGet.org a while ago. For example, in 2015 we published a post on Package Signing

NuGet Package Identity and Trust

Daniel JacobsonApril 17, 2017Apr 17, 201704/17/17

Update on 10/16/2017: Package ID Prefix Reservation is now live. The documentation can be found here. We want to start this post with a huge thanks to you, the NuGet community. Over the last several months we have been talking to many of you to get feedback on NuGet package identity and trust. We’ve learned so much from you and we hope that

NuGet – Ending Windows XP support

Karan NandwaniJanuary 19, 2017Jan 19, 201701/19/17

At NuGet, we are constantly improving our security. One of the steps we are taking is to move our HTTPS end points to meet industry standards for algorithms and protocols. This means that connecting to nuget.org services from machines that don’t support modern cipher algorithms will no longer be supported (such as TLS 1.0 support in Windows

The NuGet Blog