Post #4385662
2026-08-04 19:49 UTC
Microsoft will reduce NuGet API keys lifespan from 365 to 30 days
-change enters into effect August 17
-On November 1, Microsoft will invalidate all old NuGet API keys created before August 17.
-shorter lifespan is meant to counter supply chain attacks
https://devblogs.microsoft.com/dotnet/strengthening-nuget-supply-chain-security-reducing-api-key-lifetime/
Replies (1)
-
@womble@infosec.exchange 2026-08-04 23:13
@campuscodi@mastodon.social secret compromise largely happens at or near creation time. If it's still secure after 24 hours, it'll almost certainly still be secure a year later. This is just typical security theatre that will inconvenience many people for practically zero benefit.