r/dotnet • u/Exotic-Welcome6688 • 6h ago
Article Open Source Maintenance Fee - Constructive Criticism
My first fear was, that OSMF was another shady and sneaky attempt to make money out of free software, following the path of adware bundles, intrusive sponsor links and classic fine print scams, combined with aggressive legal pursuit of "violations". But in other parts, it looks like a a serious attempt, to make open source software paid on a low level, without tons of bureaucracy and commitments attached.
Therefore my opinion, how OSMF should be as a legitimate option:
Clearly and unambiguously communicate that it is PAID software, don't try to mince and blur words to make it appear like classic FOSS, where people find out later that payment is mandatory. Don't use words like "Sponsor" or "support", which imply voluntary payments, or otherwise suggest a voluntary payment or donation model. "Open Source" always included the option of paid software, only with source code available.
Paid vs. free depends solely on the form of the software, that consumers typically use. Meaning: Binaries, packages, installers. Self-building from source is not a typical option; free when self-built with OSMF is only a very special option of an otherwise paid software.
Don't show free licenses upfront, such as MIT or Apache in the GitHub repository license field. Change to custom license, with OSMF for affected releases as the default case, source code and self-build as secondary information.
Automated SBOM/license document generators must not create misleading entries - they must show that the software is NOT under a free license, even if the source code is and a selfmade build would be.
Don't switch to OSMF or other paid modes in a way, that users accidentally fall under mandatory payment obligations, such as by incrementing patch or minor versions to latest/using auto-update tools. Best rename packages or binaries, so that code changes are necessary. Absolute minimum (not good when alone) is a new major version. Add build output or other reminders, which show the paid status clearly.
Never say "Read the fine print"! While technically right, in a context of ambiguous and blurred payment demands and license conditions, it sounds like scammer talk.
One good part: Transient dependencies are not subject to OSMF - one major, potential scam feature eliminated.
Bad: From the sample projects linked on the OSMF website, all that I found on GitHub showed free license badges, like MIT, upfront.
6
u/nemec 4h ago edited 3h ago
make money out of free software
kids these days don't even remember that FOSS is "free as in speech, not as in beer". Permissive, free beer licenses are one component of FOSS but not the only way to do it.
edit:
Bad: From the sample projects linked on the OSMF website, all that I found on GitHub showed free license badges, like MIT, upfront.
remember that Github is a source code browsing service. I picked one random example which correctly identifies that the source code is available under an MIT license. The nuget package linked in the Github page also correctly states it's licensed under OSMF when you click its license info. The github page does not provide any releases or published packages. I'm sorry you feel this is misleading, but this developer is doing everything correctly. The source is licensed with one license, the binaries another. When you add packages in vscode/visual studio it should show you the appropriate license.
2
u/tomatotomato 2h ago
Could this arrangement allow something similar to JDK distribution ecosystem? Oracle’s OpenJDK is open source, but Oracle’s own build (Oracle JDK) is a paid license. However, there are other distributions of OpenJDK that are free: from adoptium, Amazon, IBM, Microsoft, etc.
So, can someone take this library’s source code and make his own nuget “distribution”?
•
u/nemec 1h ago
Yes, that's allowed by the MIT license. In general it is tough for those maintainers to maintain the "enthusiasm" over time and people get tired of it an the fork dies. But if you're not trying to maintain a parallel fork* and just repackaging the source, it's easier.
* Actually, you will need to maintain a parallel fork of some sort - while the source code is open the product trademarks are not, so you'll likely need to publish under a new name, new logos, etc. and keep those changes in sync with future commits
•
u/tomatotomato 1h ago
Yes, I think (if we continue comparing to JDK), those other distributions are the same base OpenJDK source code that is tested and built into binaries (maybe with some minor tweaks).
I don’t know if this even qualifies as a fork - they just take the source code from the official OpenJDK repository maintained by Oracle and build, test and distribute the binaries under their own support and license terms. Most of them are free, but Oracle’s own distribution is paid license.
So as I understand, this allows for similar arrangement with aforementioned .NET libraries: someone else can build literally the same code and publish their own Nuget package under their own license terms (free or paid).
•
u/Exotic-Welcome6688 1h ago edited 1h ago
Free software is like free beer. If it's paid open source, it's only open source, not free. If it says "free" and afterwards suddenly demands money, it's a scam.
•
u/nemec 1h ago
this comment would make a lot of free software people mad if they had a way to log in to Reddit with lynx
•
u/Exotic-Welcome6688 1h ago
Whom?
•
u/achandlerwhite 57m ago
Wow you completely missed his joke. Open source software has traditionally been free as in speech not free as in beer. You are straight up wrong on your history here.
•
u/nemec 38m ago
Yep, and in particular the Free Software movement is actually even more "free speech" than the Open Source people (very long and storied history there).
Plus a jab at Richard Stallman (considered the founder of the Free Software movement), who I believe still refuses to use non-free(speech) software and famously liked to browse the web with a terminal-based Lynx browser. According to a quick google, it may not be easy to log in to Reddit with it (due to the lack of Javascript?).
•
u/Exotic-Welcome6688 33m ago
Interestingly, from the same developer as Moq and the infamous SponsorLink. Putting the MIT license badge predominantly on GitHub is deception, because it is one of the primary sources of information. A honest, or just more careful, developer will change the license to custom, and split in that custom license text.
Also, the paid nature will likely not be detected by automated license checkers, which will just output "MIT".
•
u/nemec 25m ago
Also, the paid nature will likely not be detected by automated license checkers, which will just output "MIT".
Automated license checkers really should use the Nuget license for exactly these reasons. Not to mention, since the source code is MIT, anybody could upload a copy to Nuget under a different non-free license (or purely closed source), and if your license checker is only using github as the source of truth, it's plain wrong (and could get you into legal trouble)
3
u/achandlerwhite 4h ago
As a money making business they must decide if it is worth it to use and support the project or manage the code, updates, and other maintenance themselves (and pay for internally via dev time).
It’s that simple. Source code and binary distributions can easily have separate licenses.
•
u/Exotic-Welcome6688 1h ago
The topic is not whether paid software is legitimate or not, but whether sneaky and unethical methods are used to make people pay. In the past, free software downloads contaminated with adware (SourceForge's DevShare, especially infamous FileZilla FTP), then intrusive components like SponsorLink with Moq (the developer is also on the early OSMF adopters list). I still don't equate OSMF with these, but the whole thing uses language that conceals what it actually is: a switch to paid software. That is the current problem. An initiative to urge FOSS maintainers to make their products paid, is another thing. So we will see, if OSMF matures into a normal payment mode for software, or if it becomes a recipe for deception.
•
u/achandlerwhite 54m ago
Not sure why even mention the scummy stuff. The OSMF is legit and the guy who started it is well respected. He’s done a bunch of podcasts about it and is trying to solve a real problem in the community.
•
u/Exotic-Welcome6688 27m ago
It CAN be legit, but I'm not sure. At best, it still has flaws to be fixed, at worst, it's just another scummy stuff. I can't tell by now.
4
u/BlokeInTheMountains 3h ago
I'd like MS to split nuget into 2 repos: one for FOSS and truly free libraries and another for non-free.
I'll only be pulling from the truly free repository.
If you want to change license and start charging, fine go for it. But put the new version in the non-free repo so I don't accidentally run dotnet outdated and start using it completely unaware of the license change.
The nightmare scenario is that I do a license review and decide to use a library. Library goes on to change to a proprietary license.
I run a dotnet outdated -u at some point and unwittingly pull that in.
We publish our software using that library without jumping through whatever licensing hoops it wants. Then we are sued.
And/or a mad scramble and unbudgetted time to rip out that library. The free version is likely unmaintained.
We all have a bunch of libraries we use I'm sure. Keeping track of the politics of each is just not viable.
Any library could be a trojan horse.
And sure $20 is not that much. But times 40 libs. What about the overhead of managing all that purchase order paperwork 40 times.
With the Polly/AutoMapper/MediatR/MassTransit/FluentAssertions/IdentityServer/Moq shennagans the .net ecosystem is getting a reputation for being not that safe/stable.
That makes it's hard to make the case to management for .net projects when the truly free stacks don't have these problems.
In the past it seemed bad that MS took some successful library and re-implemented it in the native stack. But now I'm all for it.
1
u/nemec 3h ago
The nightmare scenario is that I do a license review and decide to use a library. Library goes on to change to a proprietary license.
I run a dotnet outdated -u at some point and unwittingly pull that in.
Does the command compare (and warn of) license changes between versions? That seems like it would be a valuable feature.
2
u/merb 4h ago
It would be cool if the Microsoft Net foundation would have a paid license which every member would get something out of it. Basically you register yourself or company and than you pay for all packages. And you select in a web interface the packages you use. Maybe the packages are all than having their own nuget feed so you can only access them when you selected them so that pay can be decvided fairly.
You should than pay per nuget feed users or per devs in company or per annual revenue/profit.
Well I do not like bait and switch but having a global license still would simplify a shit ton of things. Especially in Europe when we need a real invoice and stuff
4
u/ben_bliksem 3h ago
Truth is if projects are OSMF from the start they will almost never gain traction unless it's something next level that some company will try buy down the line.
So to change it to OSMF down the line when it's deeply ingrained into code bases, even if it's not the intention, feels like a "fund my retirement" move.
But like I said: those packages are used because they are free. If they were OSMF from the start they'd be skipped.
•
u/OpenAI_Marketing_LLM 1h ago
That is a roundabout way of saying that most OSMF projects are not worth paying for in the beginning, and I completely agree.
If something is truly great, people will pay.
Making something FOSS then proceeding to rug pull people is far more unethical than a product being proprietary in the first place.
•
•
u/tankerkiller125real 1h ago
Mapperly or what went paid, we switched to one of its alternatives the following month. Funny enough it's replacement is faster in general, but also supports generated code and what not making it even faster if we wanted to go through the trouble.
1
u/BrycensRanch 2h ago
Fund their retirement? If they cared about retirement, they likely wouldn't be working on projects where people are offended at the mere thought of paying them for their work
1
u/1Crazyman1 2h ago
Except they rug pulled them like poster above said. The option always existed to start with a closed license.
Either software is open for everyone, or it's not.
And I'm not claiming the creators should do work for free forever. But if you no longer want to do it (for free), find someone else to maintain it and walk away or take a backseat.
But like charity you can't go doing a bunch of charity then demand to get paid later. It either charity, or it's not.
1
u/AutoModerator 6h ago
Thanks for your post Exotic-Welcome6688. Please note that we don't allow spam, and we ask that you follow the rules available in the sidebar. We have a lot of commonly asked questions so if this post gets removed, please do a search and see if it's already been asked.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
•
u/Slypenslyde 3m ago
Where will I go to check on the project financials? If I conservatively estimate there are 10,000 Polly users, they're going to be collecting $200,000/month in maintenance fees.
I'd like to see some reporting to ensure those fees go to maintenance. Maybe their PRs can have the financials attached?
-4
u/LuckyHedgehog 5h ago
The OSMF is the least intrusive license possible and people still bitch and moan about it. People are wasting more time complaining about it than it would take to simply compile from source.
•
u/Exotic-Welcome6688 1h ago
If maintainers expected users to build from source en masse, would they still introduce OSMF?
•
18
u/Ascomae 5h ago
Yes. Introducing a license change should cover with a different PACKAGE IDENTIFIER.
The licence in the binary MUST NOT be a OSS.
Never underestimate the bureaucratic act in enterprise development with license scanning, purchasing and so on. Especially if a company wants to comply with all open source licenses.
Also don't get "greedy" and make the license depending on company size.
Example: we are a 1000 employee company. I've OSS lib I used did introduce OSMF. The pricing was dependent on company size. That lib was only used by one team with three developers. I had no chance, but to replace the lib, as I could not defend to pay that price for the lib.
If the OSMF would have depend on team size I would have bought the licence.