4 ms·

I think it's phenomenal that a .NET OSS project was so useful to the world that there was a viable path to commercialization. The .NET Foundation should not exi

I think it's phenomenal that a .NET OSS project was so useful to the world that there was a viable path to commercialization. The .NET Foundation should not exist to force maintainers from monetizing their work.

WorldMaker 5y ago
This is a good point. Having and taking a path to commercialization itself shouldn't be the problem in and of itself. I think the issues with IdentityServer was that it felt like a bait-and-switch in the timing of the commercialization decision more than anything: Microsoft replaced a lot of bespoke OpenID/OpenID Connect/OAuth libraries in ASP.NET with IdentityServer including in out-of-the-box ASP.NET Core templates. Then IdentityServer decided it needed to explore commercialized relicensing. 1. Microsoft could have done better diligence that IdentityServer was financially healthy and in a place to deal with increased maintenance and support needs before baking it into ASP.NET templates. 2. The .NET Foundation could have helped IdentityServer find a commercial licensing regime/path to commercialization that wouldn't have impacted as much all of the users now using it ASP.NET templates. 3. IdentityServer's authors seemed to be in a "take our ball and go home" mood anyway and probably wouldn't have listened to advice from the .NET Foundation had they asked. (And it sounds like they didn't from the article here.) 4. The .NET Foundation sees the root cause problem here that they don't own the projects' copyrights/licenses/CLAs and want to crack down on mandating full ownership now. The article points out this feels almost an unnecessarily rude and authoritarian response. However, as other comments here point out, this is always the harsh learning cycle of Open Source Foundations going back to the OG FSF itself, and including just about everyone (Apache, Software Freedom Conservancy, you name it). Of those, the .NET Foundation is in the hard place of getting most of the blame that they couldn't stop IdentityServer taking their ball and going home and the rock of now trying to do the hard part that they should have done sooner to prevent this mess in the first place just a little bit too late (and making other projects feel like they are being punished even though they did nothing wrong). Between Microsoft and IdentityServer there should have been more ways to commercialize the success of the project without relicensing IdentityServer or dropping the project from open source to spite Microsoft trying to rely on it in templates. I don't know who is to blame more there, but I don't envy how much this seems a PR disaster to the .NET Foundation.
- phillipcarter 5y ago
  The major theme in that event is that there was poor communication all-around. Unfortunately, one of the primary functions of the foundation is to facilitate communication around things like this. It's clearly not done that (and issues highlighted in the article indicate more of the same problem).
- Rapzid 5y ago
  I wonder how much it was ever actually attempted to get more community involvement? At least as of few months back IdentityServer4 was not planning on updating the project for .Net 6. This led to Microsoft updating the ASP.NET templates to point use the new, not-FOSS IdentityServer. Seems like a situation like this, or bug fixes, or etc could have prompted community contribution from companies relying on the project. Frankly, the decision to not update the FOSS project for .Net 6 or accept PRs.. Adds some flavor to the situation: https://github.com/IdentityServer/IdentityServer4/issues/5354 https://github.com/IdentityServer/IdentityServer4/issues/535... .

WorldMaker 5y ago

This is a good point. Having and taking a path to commercialization itself shouldn't be the problem in and of itself. I think the issues with IdentityServer was that it felt like a bait-and-switch in the timing of the commercialization decision more than anything: Microsoft replaced a lot of bespoke OpenID/OpenID Connect/OAuth libraries in ASP.NET with IdentityServer including in out-of-the-box ASP.NET Core templates. Then IdentityServer decided it needed to explore commercialized relicensing. 1. Microsoft could have done better diligence that IdentityServer was financially healthy and in a place to deal with increased maintenance and support needs before baking it into ASP.NET templates. 2. The .NET Foundation could have helped IdentityServer find a commercial licensing regime/path to commercialization that wouldn't have impacted as much all of the users now using it ASP.NET templates. 3. IdentityServer's authors seemed to be in a "take our ball and go home" mood anyway and probably wouldn't have listened to advice from the .NET Foundation had they asked. (And it sounds like they didn't from the article here.) 4. The .NET Foundation sees the root cause problem here that they don't own the projects' copyrights/licenses/CLAs and want to crack down on mandating full ownership now. The article points out this feels almost an unnecessarily rude and authoritarian response. However, as other comments here point out, this is always the harsh learning cycle of Open Source Foundations going back to the OG FSF itself, and including just about everyone (Apache, Software Freedom Conservancy, you name it). Of those, the .NET Foundation is in the hard place of getting most of the blame that they couldn't stop IdentityServer taking their ball and going home and the rock of now trying to do the hard part that they should have done sooner to prevent this mess in the first place just a little bit too late (and making other projects feel like they are being punished even though they did nothing wrong). Between Microsoft and IdentityServer there should have been more ways to commercialize the success of the project without relicensing IdentityServer or dropping the project from open source to spite Microsoft trying to rely on it in templates. I don't know who is to blame more there, but I don't envy how much this seems a PR disaster to the .NET Foundation.

phillipcarter 5y ago
The major theme in that event is that there was poor communication all-around. Unfortunately, one of the primary functions of the foundation is to facilitate communication around things like this. It's clearly not done that (and issues highlighted in the article indicate more of the same problem).
Rapzid 5y ago
I wonder how much it was ever actually attempted to get more community involvement? At least as of few months back IdentityServer4 was not planning on updating the project for .Net 6. This led to Microsoft updating the ASP.NET templates to point use the new, not-FOSS IdentityServer. Seems like a situation like this, or bug fixes, or etc could have prompted community contribution from companies relying on the project. Frankly, the decision to not update the FOSS project for .Net 6 or accept PRs.. Adds some flavor to the situation: https://github.com/IdentityServer/IdentityServer4/issues/5354 https://github.com/IdentityServer/IdentityServer4/issues/535... .