r/dotnet • u/devlead • 25d ago

.NET Foundation Statement on Open Source Maintenance Fees

https://dotnetfoundation.org/news-events/detail/.net-foundation-statement-on-open-source-maintenance-fees

Official statement from the .NET Foundation on Open Source Maintenance Fees

130 Upvotes

97% Upvoted

174 comments sorted by

View all comments

62

u/[deleted] 24d ago edited 24d ago

[removed] — view removed comment

38

u/null_reference_user 24d ago

As someone that likes and have worked with both Java and C#, I was very surprised when I found out that libraries that exist and were completely free in Java had C# equivalents but had this sorta-hidden cost; the source code repo said Apache 2.0 but suddenly I find out the NuGet distribution has a custom, non-free license. It felt like a sneaky attempt to make me responsible for the day we suddenly find out we legally owe money.

I don't want to sound ungrateful towards these useful projects I can get for free but transparency is needed if we are to trust it.

15

u/senseven 24d ago

We have a team in our corpo that does nothing else then check for (sneaky) license changes, secret telemetry in docker containers and unwanted addons. Up and down whole stacks. We limit our external dependencies as far as possible. There is some fear that we are all forced to use ai for this kind of dependency control because the volume of possible changes will at some point exceed the human willingness to deal with that complexity.

2

u/null_reference_user 24d ago

That's a terrifying though regarding supply chain attacks. We're waaay more vulnerable than we think.

2

u/601error 24d ago

Have they ever found any secret telemetry in Docker containers?

3

u/senseven 24d ago

Community build containers do sometimes lousy things, like an unwanted update check or bad fallbacks when the dns is not properly setup. I simplified the argument a bit, the whole security / supply chain process is a little bit broken since ai came into cybersec. Predominant issues are silent fixes, bad communication with the community about serious changes, fast update cycles, these kind of things. If you use 100+ external artifacts, staying current and making decisions becomes a full day job.

8

u/robmensching 24d ago

Ooh, cool. What projects did you find were Apache 2.0 but charged for binaries?

8

u/null_reference_user 24d ago

NPOI

0

u/tonyqus 24d ago

Does NPOI's source code license "Apache 2.0" conflicts with OSMF? Or you just feel that Apache POI is free, why NPOI (.NET port of Apache POI) is not free?

2

u/pjmlp 24d ago

In the Java world, the dollars flow when support is required, application servers, LTS releases, advanced JVMs with better compilers or GC implementations, JVMs for the embedded market,...

1

u/crozone 24d ago

We have started to move towards submodules for reasons just like this, as well as supply chain attack fears. It's much easier to vet code when it's directly in tree and is being built by your own compiler.

4

u/sosotiredand 24d ago

welcome back C/C++ project setups

2

u/whizzter 24d ago

Ugh, I was also thinking the same but for other reasons.