22 ms·

How the .NET Foundation kerfuffle became a brouhaha

449 points by ghuntley 5y ago

ghuntley 5y ago
See also https://www.youtube.com/watch?v=traHIsUOInw&t=976s https://www.youtube.com/watch?v=traHIsUOInw&t=976s
- aliswe 5y ago
  For those who dont have the time to listen, this is basically the article but in audio format, from what I can tell.
trangus_1985 5y ago
I started a project that I hope to maybe turn into a product (foss/community edition hybrid approach). One of the tech stacks I evaluated was mono-based, using c# and the .net libraries. I ended up turning down that choice due to a couple of factors, but one of them was the glacial pace of .net process and development. It just didn't look or feel like a healthy ecosystem, if you weren't paying microsoft $$$$. Just a ton of small warning flags around the community, the stack, and the maintenance of core projects. C#, .NET, and the associated ecosystem doesn't feel good to work with, out of date, and in desperate need of modernization. The alternatives (spring, flask/falcon, lightbend) all seemed much more modern and easy to work with. I actually have a concrete example of this: one of the features of my project is that you can define yaml based configuration documents, and share them. Using something that was easy to write for small but coherent configurations was crucial - XML was right out. The .NET ecosystem's yaml support is not great, feels kinda janky, and yaml validation is a paid product! That's completely untenable for something that's still in the weekend work phase. And it wasn't just that, but tons of things I had become accustomed to in python were either incredibly immature or paid. Not to mention that the built in build system was horrific, confusing, and had weak documentation. It's probably a lot easier when you just write a check to a contractor to set up a template for your team, but I have no luxury. Sure, some of this is on me, but I wanted to get started building and the .net ecosystem repeatedly got in my way until I was forced to give up. So, upon hearing that the .net foundation is spending all of its time generating stacks of bureaucracy and causing internal drama, I feel like I made the right choice. At this point, it's unlikely I re-evaluate .net for future projects unless I hear massively good things (like what happened with java, which took a decade).
- heavyset_go 5y ago
  > And it wasn't just that, but tons of things I had become accustomed to in python were either incredibly immature or paid. What are some of those things?
  - trangus_1985 5y ago
    it's been about a year but it was a death by a thousand papercuts kinda thing. I want to add that I was not an experienced python developer at the time - I'd used it for a handful of simple automation scripts. My day job was writing scala. - targeting mono under nginx on linux, from within windows was really difficult, I could never quite get it to work - no support for monodevelop on windows - cross platform was crucial to me and it just got so onerous. And maybe it's just me, but I was really hitting a lot of frustration with visual studio. - i wanted to use both yamlschema (broken at the time) and jsonschema (paid) - msbuild is abysmal with useless error messages. I struggled to run a simple shell script during the build process. - a couple of libraries I tried were broken or unmaintained. The .net ecosystem seems to have very low quality of community maintained tools. - no clear guidance around using DAPR without paying microsoft (which i guess is fair, but being vendor locked before I even start is a rough look) - ... and that's all I can remember. There was more. I fully acknowledge that some, if not all, of those complaints may be self-inflicted. I can't say that, for my first complicated project in python, it's been completely smooth sailing. However, with python/falcon, it didn't feel like I was fighting with the ecosystem to define a package, import the package into a microservice codebase, and then get the service running with full test coverage. It didn't feel like I was fighting to bring a third party library in, verify it's actively being maintained, and start using it. I spent as much time getting a simple microservice hello world with authz/authn validation and a reasonable packaging system, in python, set up in about time as it took me to give up on msbuild. I've found bootstrapping python microservice development on windows to be quite well supported. I didn't find that with .net.
    - jolux 5y ago
      Have you tried using .NET Core? It's a pretty thorough reworking of .NET Framework that is officially supported by Microsoft on Mac, Linux, and Windows, and pretty much all of my experiences with it thus far have been positive. VS Code has great built-in support for it.
jrochkind1 5y ago
If they used some special microsoft insider access to github to move these projects... that's gonna really harm trust in github. They really oughta make it clear that they did NOT do this, or make it clear how it can never happen again.
- sundvor 5y ago
  Article has a whole section on how @dnfadmin was given owner access, in a sneaky way (for a different context) - and how that was a mistake.
  - still_grokking 5y ago
    And how they suppressed the e-mail notifications to the (real) owners about the move of the org? That part reads really fishy.
    - still_grokking 5y ago
      Someone answered my question: https://news.ycombinator.com/item?id=28795775 https://news.ycombinator.com/item?id=28795775 That seems very strange given the fact that GH sends otherwise mails for almost everything done there if you didn't disable it.
      - robmen 5y ago
        Someone else noted that it may only send emails to the person that kicked the process off. I don't know, I don't own a GitHub Enterprise to try.
        meragrin_ 5y ago
        Is it possible that anything which @dnfadmin is an owner of is automatically migrated by GitHub the moment it becomes an owner? Maybe they never realized that what happens?
- meragrin_ 5y ago
zippergz 5y ago
I'm not trying to be lazy (ok maybe a little bit), but can someone please provide like a 3-4 sentence summary of what happened? Everything I've seen on this either assumes you already know, or is very long and rambly, or both.
- heavyset_go 5y ago
  Project maintainers had their projects moved from their public GitHub accounts to the DNF's GitHub Enterprise account without notice. Some maintainers only found out about the transfers of their projects because of this[1] discussion. [1] https://github.com/dotnet-foundation/Home/discussions/38 https://github.com/dotnet-foundation/Home/discussions/38
  - flowerlad 5y ago
    So nothing changed with the source code or its licensing, only the location on github? That seems a bit inconsequential, tbh. Are there strings attached to the new location? If no, then move on.
    - kevin_b_er 5y ago
      You'd not say the same thing if the ownership of a domain changed hands quietly, in the background.
      - quickthrower2 5y ago
        That would be worse though. This is like a subdomain changing hands quietly. E.g. you mypage.github.io.
    - ethbr0 5y ago
      Per post, being part of a GitHub Enterprise organization grants the GEO's owners control over any projects contained in that organization. That's the change.
      - 5y ago
wly_cdgr 5y ago
Can someone ELI5 why this is a big deal?
- heavyset_go 5y ago
  See my comment here[1]. [1] https://news.ycombinator.com/item?id=28795275 https://news.ycombinator.com/item?id=28795275
  - robbedpeter 5y ago
    The corporate hierarchical malarkey that gave Novotny the wherewithal and motivation to do this should be ripped out root and branch, as well as whatever specific job role that currently defines the executive directorship. I'm not saying Novotny should be fired, simply that the Foundation has demonstrated a corporate behavior fundamentally at odds with its supposed reason for existence. Respect for community and contributors was obviously not encoded into the design of the organization. That a board exists to rectify, rationalize, or abet mistakes isn't enough. They have to fix the root of the problem, which is that Novotny was able to do this at all. They need to make an explicit and ironclad promise to developers. They allowed institutional structure to oppose their mission. That won't change with mere words and staffing shuffles.
    - jjm 5y ago
      I’m a bit alarmed by the many issues here. I’ve heard a lot from the maintainers but much from the foundation. - continued lack of communication - for so many issues to occur to multiple parties paints a picture of it being routine - that no immediate reversals have happened with utmost immediacy - the ethos of the maturity model - the policies apparently being enforced - even now… - for calls to solve things privately It’s culturally indicative of the foundation’s values whether they know it or not. A healthy community is one where discussions happen in the open, good and bad. This is not good, and I’d recommend the community coming together and maybe finding or forming an alternative - which is difficult I know. I think apache.org could help here.
grouphugs 5y ago
the only thing the .net foundation will live on in memory for is the breaking of tpm modules
xfer 5y ago
This is why microsoft loves open-source. Free code from others that they can point to while trying to sell their licenses.
- hulitu 5y ago
  Also they realized that there is a lot of free stuff that can be used for free.
- bayesian_horse 5y ago
  Arguably, for those who want to / have to work in the .NET ecosystem, it is better that .NET is adopting an open source model, even if imperfect. This actually lessens the vendor lock-in problem and also means less of a risk of Microsoft pulling out of providing security updates for key components. So far as I can observe, C#, F# and .NET Core as a platform for web development have benefited from the OSS-ification in the form of more dynamic and transparent progress/evolution. Disclaimer: I'm more of a Python/Django guy.
- robmen 5y ago
  This doesn't make sense to me. My company (FireGiant) sells support contracts for the open source project for companies that want guaranteed incident response times/SLAs. And Microsoft isn't involved. The .NET Foundation holds the copyright.
- npteljes 5y ago
  They "love open source" because that's what makes most business sense. FOSS is part of the developer zeitgeist so much that you can't avoid dealing with it. MS and others have bashed them for years, but it only got stronger. So it only makes sense to tone down the denial and start accepting that it won't go away.
munduz 5y ago
C#/.NET ecosystem was doing great lately!, Microsoft should not harm their reputation by these kind of actions.
- hulitu 5y ago
  > C#/.NET ecosystem was doing great lately!, Microsoft should not harm their reputation by these kind of actions. They already did.
  - oaiey 5y ago
    And it was years in coming. The .NET Foundation was never a transparent organization and this now is the consequences.
- pjmlp 5y ago
  It is not how it looks for those still targeting Windows desktop, a maze of incompatible GUI frameworks each competing for dev attention and a stagnate UWP .NET tooling, lack of comprehension to understand what AOT means, isn't doing great.
  - munduz 5y ago
    Totally agree about Desktop Applications. On the other side, C# is becoming great language to develop for web applications with Asp.Net Core.
marsdepinski 5y ago
People will never learn... You really don't own the data if you don't own the servers.
- pabs3 5y ago
  This is why my GitHub account links to "Free Software needs Free Infrastructure" by mako: https://mako.cc/writing/hill-free_tools.html https://mako.cc/writing/hill-free_tools.html
- yjftsjthsd-h 5y ago
  That doesn't seem like a super meaningful statement, not least because it's both excessive and insufficient. If you have a git repo on your laptop, microsoft or the dot net foundation or whoever can't alter it. If you make a repo on github, they still can't touch your local repo, but they can do things to the repo on their side. And so, yes, controlling more of the stack would give you more control; if you pushed it up to a gitea (or whatever) instance on an AWS EC2 instance that you manage, then it's vanishingly unlikely that someone can change "ownership" of the data (by modifying the metadata in git(hub|ea)), but of course AWS could do whatever they want to to your instance - so do you own it? Okay, well let's put it on a server that you bought yourself, and that you run in your basement (or even a colo; actually it doesn't change the situation). If you want anyone else to use it, you still need an ISP and probably (practically) a domain/DNS (read: domain registrar and name server(s)). In practice, you'll never own the whole stack, but on the other hand, you shouldn't need to, and in many cases you don't.
  - bsder 5y ago
    > That doesn't seem like a super meaningful statement, not least because it's both excessive and insufficient. That's very disingenuous. The "application server owner" has all the control. The "server owner" can transfer my repo, copy my PRs, inject their own PRs, and even lock me out. If I control the server, it becomes VASTLY more difficult to impersonate me or inject a change without my permission or cooperation. Sure, it can be done, but it will take far more than just a couple people of random employees typing for a couple minutes at a keyboard to pull it off. Someone will have to spend real money to usurp my DNS, set up another website, copy all the data (which they may or may not have full access to), etc. The cost to compromise me is orders of magnitude higher if I control my own servers.
willhinsa 5y ago
https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
- anonymousiam 5y ago
  Was just about to post exactly the same thing. You beat me to it by two minutes. I will add this link: https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents
- bayesian_horse 5y ago
  Though in the case of .NET core they'd have to extinguish their own ecosystem that was closed source, then they open sourced it and they partially opened the development process that was completely internal. For developers in the .NET ecosystem the OSS-ification is a net win (pardon the pun). If you are a Newcomer to .NET, you still should expect that Microsoft has some control over the ecosystem, just as the rest of the community also has certain rights and powers (through forking and patching) if it comes to that. Microsoft also controls part of the Node ecosystem (npm) and Typescript. Google controls Android and Angular. There are always tradeoffs, it's more important to be aware than to avoid all of them.
travisgriggs 5y ago
Anyone here old enough to remember when SourceForge was The Place(tm) to stick OSS code and then how it fell from grace? I’m curious in what ways the MicroSoft take over of GitHub is and is not starting to feel like that. For me, one is just the difference in scale. GitHub is vast in both content as well as tooling compared to SourceForge at it’s highest points. And a commercial entity orders of magnitude smaller than MicroSoft took over SF. The rate of descent into Not Good(tm) territory also seems slower and more ponderous. But while the magnitudes differ, the vectors look similar. Not exactly the same, because history rhymes with itself before it repeats itself. Curious what other similarities and dissimilarities other old timers see.
- zip1234 5y ago
  The .NET Foundation board doesn't even all work for MS.
- msdrigg 5y ago
  I honestly see this specific bruhaha as more of a DNF issue and less of a github issue. Even though both are affiliated with Microsoft, I dont think this is the same as SourceForge’s fall from grace. I can imagine copilot being another point in the not-so-good direction, but is there anything else you are thinking of when comparing Githubs trajectory to SourceForges?
  - deleted 5y ago
    [deleted]
  - meinheld111 5y ago
    > is there anything else you are thinking of when comparing Githubs trajectory to SourceForges? Popups, notifications, etc Hostile ui in general
    - mirekrusin 5y ago
      You must be joking?
still_grokking 5y ago
I read this as Microsoft is doing Microsoft things. No news whatsoever. Anybody old enough knows what this company stands for. It's tree big letters: EEE Of course nothing has changed. How could anybody dare to believe that?
- drekipus 5y ago
  that's the thing with the younger generations, they don't have the baggage of lessons learned from yore!
  - hvidgaard 5y ago
    No organization the size of MS is different - it's just how it works.
- robmen 5y ago
  That's unfortunate. That's not how I wrote it. The blog post is about the .NET Foundation and--ultimately--about one very consequential action they took recently.
  - deleted 5y ago
    [deleted]
devwastaken 5y ago
Clearly the org is far too gone at this point. It's a dead project people are funneled into that doesn't serve a purpose. Maintainers should do like the history of software has. Drop it and organize anew. A massive red flag for all this are the words "code of conduct". They're not "bad" to have, generally projects already have them, they were previously called "rules". But if the "code of conduct" is filled with title 9 speak then you know you're dealing with corporate types, not developers. For those that haven't taken title 9 training, you're told to be the gestapo morality police and actively go out of your way to vocally suppress any discussion that might involve something that could have the potential to be discriminatory. This is done for liability protection, for the company. Not because it would actually be discriminatory/immoral. Yet somehow its made it's way into software repos.
- red_trumpet 5y ago
  No, that's not the problem here. The author explicitly states they were totally fine with enforcing a code of conduct on their mailing list. The problem here was about trust in the foundation and power over the repositories.
  - robmen 5y ago
    Yes, exactly. Thank you.
  - devwastaken 5y ago
    That's fine, the point given is that when orgs push for it, and they're doing so like they did here, that's a massive red flag that whom you're working with is not qualified to be doing that work. Call it an "org smell".
- Zababa 5y ago
  I also really dislike the fact that code of conducts usually present a very american-centric view, sometimes even a silicon valley-centric view, for projects that are supposed to be open to people all over the world.
  - 5y ago
UltraViolence 5y ago
This spat is exactly the reason why I don't host my most precious projects on any outside source code repository like Github. Even when it's a private repository I assume Microsoft will eventually gain access if they feel the need for it. That the company is now an accomplice in STEALING people's open source projects, doesn't surprise me in the least.
bayesian_horse 5y ago
I'm currently a grudging newcomer to the .NET ecosystem because I need it for work. Stuff like this doesn't ease my feelings.
- robmen 5y ago
  Why? Were you planning to contribute source code to the .NET Foundation?
  - bayesian_horse 5y ago
    When you invest work into a code-base that depends on something like .NET, you are taking up some stake in the community and ownership of that base. You do need at the very least security updates, but you also need support and documentation. It's hard to describe fully in words. And most of the time, you can't just switch that particular part of your stack overnight. I'd rather be stuck with a community that looks healthy. And you can argue about the trade-offs of different "ownership structures", and compare for example the .NET foundation over the Django/Python foundation over whatever Java is currently doing.
    - oaiey 5y ago
      Do not worry. .NET is a good choice independent of this hickup. The maintainer will change their foundation backing and the .NET Foundation will serve its original purpose: owning the core .NET runtime so AWS, Google, Samsung and Microsoft can take save bets on it. JavaScript had it nodejs drama, Perl its community drama, Swift it's drop of support from IBM, the Linux Kernel has Linus, etc. They are still there and strong. Let this fold out for a while and reassess it.
      - bayesian_horse 5y ago
        Well, I would never choose .NET if I had any choice. It's much too verbose and is dominated in terms of productivity by many other frameworks/ecosystems. Some people seem to enjoy it, and more power to them, but if I ask, they often haven't done much of anything else.
zivkovicp 5y ago
A scorpion wants to cross a river but cannot swim, so it asks a frog to carry it across. The frog hesitates, afraid that the scorpion might sting it, but the scorpion argues that if it did that, they would both drown. The frog considers this argument sensible and agrees to transport the scorpion. The frog lets the scorpion climb on its back and begins to swim. Midway across the river, the scorpion stings the frog anyway, dooming them both. The dying frog asks the scorpion why it stung despite knowing the consequence, to which the scorpion replies: "I couldn't help it. It's in my nature." https://en.wikipedia.org/wiki/The_Scorpion_and_the_Frog https://en.wikipedia.org/wiki/The_Scorpion_and_the_Frog
- cudgy 5y ago
  Lol. Just heard this story in an episode of a series called “Startup.”
  - square_usual 5y ago
    It's also part of a resurgent, currently-trending meme: https://knowyourmeme.com/photos/2184135-scorpion-and-frog https://knowyourmeme.com/photos/2184135-scorpion-and-frog
  - the_cramer 5y ago
    It was also told in star trek : voyager by chakotay. Seems to be a popular philosophical metaphor.
- siwatanejo 5y ago
  So the analogy here being Microsoft something you shouldn't trust? Or rather, DNF being actually Microsoft... an scorpion? just double checking here
  - Xelbair 5y ago
    Replace Microsoft with any for profit entity and you got this right. If such entity can do something that will earn it's profit, it will do it. moral or not.
bennysomething 5y ago
Can anyone give me a short version of what happened please? I have no idea what the guy is talking about.
bobross12345678 5y ago
I want to express my sympathy towards open source maintainers and builders. Really they go through so much shit they dont need to go through more, but I think this has made most open source maintainers either too sensitive or their fuck-o-meter go crazy. There is obvious a communication issue from the .net foundation but also from the maintainers themselves. If they ask you for X permission, you cant just say no, sorry but you are part of an organization and it doesnt work that way, one way or another regardless of what was told to you X years ago, things might change and you will need to take an active stance to it. Horrible move from the foundation to ABUSE their admin rights and move the repo to GitHub Enterprise, but posting a tweet about your emotions and then trying to find a way to move the repo without reaching out to someone is not the way to go. Most likely even if the person did reach out to someone, the reply would be dry and late, but this is something that has been cultivated by the maintainers as well. As the article mentions "the communication was shit but it was fine as long as it didnt affect me" - not direct quote. I think both sides need to reconsider their communication channels and behaviors. They both need to understand that one way or another they have an obligation to each other. I hope communication and transparency will help to not have similar issues in the future.
- robmen 5y ago
  You are correct about communication being the core of the issue. I understand what you are saying with "If they ask you for X permission, you cant just say no, sorry but you are part of an organization and it doesnt work that way". But I didn't say no to the requirement from the .NET Foundation. I was happy to enforce the Code of Conduct. Where I drew the line was granting admin access to an alias. The .NET Foundation owns the copyright but they don't own me. I'll also argue they don't own the issue tracker and other non-source code things in the project. And opinions on that could differ so conversations could be in order. Also, I didn't spend a lot of time in the blog post discussing the evaluation of repercussions but Bob and I did talk about the for a while. In the end, I decided that those of us that work on the WiX Toolset would be in a better place to communicate if our organization was in "public". I take responsibility for that decision and I'm transparent about what and why I did it. But, in the end, I agree with you. Communication and transparency will help to avoid similar issues in the future.
bob1029 5y ago
I was hoping we'd have another day of manufactured outrage over the Microsoft/opensource boogeyman. Seeing actual quotes personifying Microsoft as a burglar today. Looking forward to the productive conclusion on all of this.
- oaiey 5y ago
  Good luck with that. I hope for a independent foundation founded by the community.
periheli0n 5y ago
Some leaders just need to issue “all hands” commands every now and then. These commands often make little sense to those at the receiving end. But those leaders need this to have their leader status confirmed. It serves also as proof of authority to their superiors. This is particularly frustrating when an organisation switches leadership and goes from participative to hierarchical. I think this is what happened here: .NET Foundation leadership must have changed and with it came a new, hierarchical leadership style.
- vmkw 5y ago
  I don't know why this is down-voted. It happens literally in formerly open projects like Python: https://discuss.python.org/t/all-hands-on-deck-the-release-of-python-3-9-0b1-is-currently-blocked/4217 https://discuss.python.org/t/all-hands-on-deck-the-release-o... Python is fully corporate now and free spirits have been removed.
  - periheli0n 5y ago
    Apparently the view I voiced is controversial. I can see how some organisations vitally depend on a strong decision hierarchy. The military for example, or some startups. Someone running such an organisation will not be open to the view that such decisions can frustrating for their employees.
  - faho 5y ago
    That's just the release manager asking for help with getting the release out. The wording also strikes me as fairly playful (it's a maritime reference!) so I fail to see how that's "fully corporate" or makes python "formerly open". This isn't a literal "I am your boss, you MUST work now", this is "hey, I'm the person who volunteered to get this release out, please help if you can!".
square_usual 5y ago
Extremely bizarre that the main concern in this thread is with GitHub, even though they did absolutely nothing here: the repo that was transferred had given admin rights to the DNF account for a bit. What the DNF did here is questionable, no doubt, but seeing people here claim this portends the death of GitHub is disappointing.
- robmen 5y ago
  You are exactly correct. It isn't necessary to drag GitHub or Microsoft into the conversation. They aren't involved in this situation.
  - lawl 5y ago
    I realize it's weird to argue against you, because you wrote the article and are the one affected by this. But, i disagree. Even if it were an entirely different company. The fact that GitHub didn't send an e-mail and that repos can be hijacked like that, is in itself something GitHub needs to address. And thus at the very least, GitHub needs to be dragged in.
    - pnt12 5y ago
      The email would be nicer, but what's the solution exactly? The admin of one project moved it somewhere else - how do you restrict that, if the admin has total control over a project? Are there improvements that could be done to allow these bots to perform with less rights? That would be something maybe github could tackle but it's not the worst thing about this problem.
      - lawl 5y ago
        > how do you restrict that, if the admin has total control over a project? This isn't a new problem, how do you prevent a rougue admin from kicking all other admins and taking over. The simplest and a pretty effective solution is to have another privilege level: Founder. Of which there can only be one, and admins can do everything, except strip the founder of their rights. (And/or transfer the repo, if the founder can't easily undo that.)
shp0ngle 5y ago
As I have no idea about .NET development, I don't really understand the relation between these projects and .NET Foundation. Is .NET foundation paying them money? Or what is the relationship between the projects and Microsoft/.NET Foundation? Reading the "apology" on github, it seems that .NET Foundation/Microsoft thinks those projects are essentially theirs, and they are free to put them under their enterprise account to "simplify billing" https://github.com/dotnet-foundation/Home/discussions/39 https://github.com/dotnet-foundation/Home/discussions/39 But reading this article, and the one below, the maintainers think otherwise? https://www.glennwatson.net/posts/dnf-problems-solutions https://www.glennwatson.net/posts/dnf-problems-solutions There are also some notes about copyright that I don't understand. Who owns the copyright? Microsoft or the maintainers? edit: From the github "apology": > Projects might not fully understand what joining the .NET Foundation means. We share a checklist with project maintainers on project changes they accept as part of becoming part of the .NET Foundation. That’s obviously not sufficient. We will post a new document that describes what you can expect when your project joins the .NET Foundation. This will include changes (observable or legal) and new benefits. It will also include changes that could occur later. ....ok? That seems scary, coming from Microsoft
- rob74 5y ago
  Yeah, scary, in the "you signed an agreement without reading it properly and now your souls, er, your projects belong to us" sense. And in the case of WiX Toolset, they apparently never agreed to the terms & conditions of the .NET foundation in the first place. Also, being forced by the .NET foundation to give an account admin permissions for your repos, and then having that account move your repos to GitHub Enterprise without your permission, even without informing you... I can understand how that creates mistrust. According to the article, the only thing the .NET foundation did for them was provide certificates, other than that they did nothing for a very long time. And then, of course, this...
  - robmen 5y ago
    Well, the .NET Foundation also holds the copyright and provides the CLA bots. But the great bulk of your point is correct.
gadders 5y ago
Does anyone else love these technology psycho-dramas? I really don't have a dog in this fight but I find myself following them more avidly than a netflix mini-series.
- oaiey 5y ago
  It is drama about people, power and emotions. People read books which are classified as drama. And honestly, this conversation is really civil (at least after moderation and ignoring everything which contains EEE and $ as a string) and therefore also a good read.
tim_cookie 5y ago
Might be tangential but I have not seen a word addressing this fuckery from either Jon Galloway or Scott Hanselman or any of the "dev evangelist" type people. Weird
- jerriep 5y ago
  They’re long-time MS employees who know how to play the political game. Highly doubtful they do anything that put their cushy jobs at risk
- robmen 5y ago
  As far as I can tell, Jon and Scott are Microsoft dev evangelists. It really isn't their place to step into .NET Foundation issues. It might be even more weird if they did try weigh in.
  - jerriep 5y ago
    I think it is well established by now that this .NET Foundation is ultimately answerable to Microsoft. Also, Claire - who started the "kerfuffle" - is a Microsoft employee. Given how especially Scott always has a big opinion about how great OSS is and how much Microsoft loves OSS, and given how it was ultimate MS employees that were responsible for creating this current distrust, I think it would be very appropriate for them to voice their opinion about this. And, who knows, maybe they are doing something behind closed doors. But I very much doubt they'll embarrass their employer by speaking up in public. They know who pays their salary and are much to good at corporate politics to do that.
SomeHacker44 5y ago
Maybe it is just me but I find this headline inscrutable. I have no idea what is meant by kerfuffle or brouhaha. More common vernacular might be better. Does it mean "a minor argument became a foundation threatening problem"? Does it mean "an interpersonal conflict impacted the whole org?" I don't know... And probably do not care at this point.
- politician 5y ago
  “How a bad situation got worse” yw
  - robmen 5y ago
    Once again, someone else is far more pithy than I. +1
- robmen 5y ago
  The title came from a comment from one of the maintainers of the WiX Toolset. I called the initial missteps a "maintainer kerfuffle" and he responded, "As long as it doesn't turn into a brouhaha". Now that I think about it, I didn't write the blog post for the uninitiated. If you didn't understand what was going on, that was fine, it was content for you. I don't know how I ended up here on Hacker News. :)
kova12 5y ago
So... about a decade ago, a guy was found guilty and convicted to 5 years in jail for unauthorized computer access because he scraped a data from open website (see this for details: https://www.zdnet.com/article/jury-convicts-hacker-over-at-t-ipad-user-data-breach/ https://www.zdnet.com/article/jury-convicts-hacker-over-at-t... ). Can somebody explain to me, why isn't foundation guilty of the same crime? Clearly, they were given an access so that they install a bot, not to take over the project.
watersb 5y ago
How long before this brouhaha boils over into a hullabaloo?

449 points by ghuntley 5y ago

ghuntley 5y ago

See also https://www.youtube.com/watch?v=traHIsUOInw&t=976s https://www.youtube.com/watch?v=traHIsUOInw&t=976s

aliswe 5y ago
For those who dont have the time to listen, this is basically the article but in audio format, from what I can tell.

trangus_1985 5y ago

I started a project that I hope to maybe turn into a product (foss/community edition hybrid approach). One of the tech stacks I evaluated was mono-based, using c# and the .net libraries. I ended up turning down that choice due to a couple of factors, but one of them was the glacial pace of .net process and development. It just didn't look or feel like a healthy ecosystem, if you weren't paying microsoft $$$$. Just a ton of small warning flags around the community, the stack, and the maintenance of core projects. C#, .NET, and the associated ecosystem doesn't feel good to work with, out of date, and in desperate need of modernization. The alternatives (spring, flask/falcon, lightbend) all seemed much more modern and easy to work with. I actually have a concrete example of this: one of the features of my project is that you can define yaml based configuration documents, and share them. Using something that was easy to write for small but coherent configurations was crucial - XML was right out. The .NET ecosystem's yaml support is not great, feels kinda janky, and yaml validation is a paid product! That's completely untenable for something that's still in the weekend work phase. And it wasn't just that, but tons of things I had become accustomed to in python were either incredibly immature or paid. Not to mention that the built in build system was horrific, confusing, and had weak documentation. It's probably a lot easier when you just write a check to a contractor to set up a template for your team, but I have no luxury. Sure, some of this is on me, but I wanted to get started building and the .net ecosystem repeatedly got in my way until I was forced to give up. So, upon hearing that the .net foundation is spending all of its time generating stacks of bureaucracy and causing internal drama, I feel like I made the right choice. At this point, it's unlikely I re-evaluate .net for future projects unless I hear massively good things (like what happened with java, which took a decade).

heavyset_go 5y ago
> And it wasn't just that, but tons of things I had become accustomed to in python were either incredibly immature or paid. What are some of those things?
- trangus_1985 5y ago
  it's been about a year but it was a death by a thousand papercuts kinda thing. I want to add that I was not an experienced python developer at the time - I'd used it for a handful of simple automation scripts. My day job was writing scala. - targeting mono under nginx on linux, from within windows was really difficult, I could never quite get it to work - no support for monodevelop on windows - cross platform was crucial to me and it just got so onerous. And maybe it's just me, but I was really hitting a lot of frustration with visual studio. - i wanted to use both yamlschema (broken at the time) and jsonschema (paid) - msbuild is abysmal with useless error messages. I struggled to run a simple shell script during the build process. - a couple of libraries I tried were broken or unmaintained. The .net ecosystem seems to have very low quality of community maintained tools. - no clear guidance around using DAPR without paying microsoft (which i guess is fair, but being vendor locked before I even start is a rough look) - ... and that's all I can remember. There was more. I fully acknowledge that some, if not all, of those complaints may be self-inflicted. I can't say that, for my first complicated project in python, it's been completely smooth sailing. However, with python/falcon, it didn't feel like I was fighting with the ecosystem to define a package, import the package into a microservice codebase, and then get the service running with full test coverage. It didn't feel like I was fighting to bring a third party library in, verify it's actively being maintained, and start using it. I spent as much time getting a simple microservice hello world with authz/authn validation and a reasonable packaging system, in python, set up in about time as it took me to give up on msbuild. I've found bootstrapping python microservice development on windows to be quite well supported. I didn't find that with .net.
  - jolux 5y ago
    Have you tried using .NET Core? It's a pretty thorough reworking of .NET Framework that is officially supported by Microsoft on Mac, Linux, and Windows, and pretty much all of my experiences with it thus far have been positive. VS Code has great built-in support for it.

jrochkind1 5y ago

If they used some special microsoft insider access to github to move these projects... that's gonna really harm trust in github. They really oughta make it clear that they did NOT do this, or make it clear how it can never happen again.

sundvor 5y ago
Article has a whole section on how @dnfadmin was given owner access, in a sneaky way (for a different context) - and how that was a mistake.
- still_grokking 5y ago
  And how they suppressed the e-mail notifications to the (real) owners about the move of the org? That part reads really fishy.
  - still_grokking 5y ago
    Someone answered my question: https://news.ycombinator.com/item?id=28795775 https://news.ycombinator.com/item?id=28795775 That seems very strange given the fact that GH sends otherwise mails for almost everything done there if you didn't disable it.
    - robmen 5y ago
      Someone else noted that it may only send emails to the person that kicked the process off. I don't know, I don't own a GitHub Enterprise to try.
      - meragrin_ 5y ago
        Is it possible that anything which @dnfadmin is an owner of is automatically migrated by GitHub the moment it becomes an owner? Maybe they never realized that what happens?
meragrin_ 5y ago

zippergz 5y ago

I'm not trying to be lazy (ok maybe a little bit), but can someone please provide like a 3-4 sentence summary of what happened? Everything I've seen on this either assumes you already know, or is very long and rambly, or both.

heavyset_go 5y ago
Project maintainers had their projects moved from their public GitHub accounts to the DNF's GitHub Enterprise account without notice. Some maintainers only found out about the transfers of their projects because of this[1] discussion. [1] https://github.com/dotnet-foundation/Home/discussions/38 https://github.com/dotnet-foundation/Home/discussions/38
- flowerlad 5y ago
  So nothing changed with the source code or its licensing, only the location on github? That seems a bit inconsequential, tbh. Are there strings attached to the new location? If no, then move on.
  - kevin_b_er 5y ago
    You'd not say the same thing if the ownership of a domain changed hands quietly, in the background.
    - quickthrower2 5y ago
      That would be worse though. This is like a subdomain changing hands quietly. E.g. you mypage.github.io.
  - ethbr0 5y ago
    Per post, being part of a GitHub Enterprise organization grants the GEO's owners control over any projects contained in that organization. That's the change.
    - 5y ago

wly_cdgr 5y ago

Can someone ELI5 why this is a big deal?

heavyset_go 5y ago
See my comment here[1]. [1] https://news.ycombinator.com/item?id=28795275 https://news.ycombinator.com/item?id=28795275
- robbedpeter 5y ago
  The corporate hierarchical malarkey that gave Novotny the wherewithal and motivation to do this should be ripped out root and branch, as well as whatever specific job role that currently defines the executive directorship. I'm not saying Novotny should be fired, simply that the Foundation has demonstrated a corporate behavior fundamentally at odds with its supposed reason for existence. Respect for community and contributors was obviously not encoded into the design of the organization. That a board exists to rectify, rationalize, or abet mistakes isn't enough. They have to fix the root of the problem, which is that Novotny was able to do this at all. They need to make an explicit and ironclad promise to developers. They allowed institutional structure to oppose their mission. That won't change with mere words and staffing shuffles.
  - jjm 5y ago
    I’m a bit alarmed by the many issues here. I’ve heard a lot from the maintainers but much from the foundation. - continued lack of communication - for so many issues to occur to multiple parties paints a picture of it being routine - that no immediate reversals have happened with utmost immediacy - the ethos of the maturity model - the policies apparently being enforced - even now… - for calls to solve things privately It’s culturally indicative of the foundation’s values whether they know it or not. A healthy community is one where discussions happen in the open, good and bad. This is not good, and I’d recommend the community coming together and maybe finding or forming an alternative - which is difficult I know. I think apache.org could help here.

grouphugs 5y ago

the only thing the .net foundation will live on in memory for is the breaking of tpm modules

xfer 5y ago

This is why microsoft loves open-source. Free code from others that they can point to while trying to sell their licenses.

hulitu 5y ago
Also they realized that there is a lot of free stuff that can be used for free.
bayesian_horse 5y ago
Arguably, for those who want to / have to work in the .NET ecosystem, it is better that .NET is adopting an open source model, even if imperfect. This actually lessens the vendor lock-in problem and also means less of a risk of Microsoft pulling out of providing security updates for key components. So far as I can observe, C#, F# and .NET Core as a platform for web development have benefited from the OSS-ification in the form of more dynamic and transparent progress/evolution. Disclaimer: I'm more of a Python/Django guy.
robmen 5y ago
This doesn't make sense to me. My company (FireGiant) sells support contracts for the open source project for companies that want guaranteed incident response times/SLAs. And Microsoft isn't involved. The .NET Foundation holds the copyright.
npteljes 5y ago
They "love open source" because that's what makes most business sense. FOSS is part of the developer zeitgeist so much that you can't avoid dealing with it. MS and others have bashed them for years, but it only got stronger. So it only makes sense to tone down the denial and start accepting that it won't go away.

munduz 5y ago

C#/.NET ecosystem was doing great lately!, Microsoft should not harm their reputation by these kind of actions.

hulitu 5y ago
> C#/.NET ecosystem was doing great lately!, Microsoft should not harm their reputation by these kind of actions. They already did.
- oaiey 5y ago
  And it was years in coming. The .NET Foundation was never a transparent organization and this now is the consequences.
pjmlp 5y ago
It is not how it looks for those still targeting Windows desktop, a maze of incompatible GUI frameworks each competing for dev attention and a stagnate UWP .NET tooling, lack of comprehension to understand what AOT means, isn't doing great.
- munduz 5y ago
  Totally agree about Desktop Applications. On the other side, C# is becoming great language to develop for web applications with Asp.Net Core.

marsdepinski 5y ago

People will never learn... You really don't own the data if you don't own the servers.

pabs3 5y ago
This is why my GitHub account links to "Free Software needs Free Infrastructure" by mako: https://mako.cc/writing/hill-free_tools.html https://mako.cc/writing/hill-free_tools.html
yjftsjthsd-h 5y ago
That doesn't seem like a super meaningful statement, not least because it's both excessive and insufficient. If you have a git repo on your laptop, microsoft or the dot net foundation or whoever can't alter it. If you make a repo on github, they still can't touch your local repo, but they can do things to the repo on their side. And so, yes, controlling more of the stack would give you more control; if you pushed it up to a gitea (or whatever) instance on an AWS EC2 instance that you manage, then it's vanishingly unlikely that someone can change "ownership" of the data (by modifying the metadata in git(hub|ea)), but of course AWS could do whatever they want to to your instance - so do you own it? Okay, well let's put it on a server that you bought yourself, and that you run in your basement (or even a colo; actually it doesn't change the situation). If you want anyone else to use it, you still need an ISP and probably (practically) a domain/DNS (read: domain registrar and name server(s)). In practice, you'll never own the whole stack, but on the other hand, you shouldn't need to, and in many cases you don't.
- bsder 5y ago
  > That doesn't seem like a super meaningful statement, not least because it's both excessive and insufficient. That's very disingenuous. The "application server owner" has all the control. The "server owner" can transfer my repo, copy my PRs, inject their own PRs, and even lock me out. If I control the server, it becomes VASTLY more difficult to impersonate me or inject a change without my permission or cooperation. Sure, it can be done, but it will take far more than just a couple people of random employees typing for a couple minutes at a keyboard to pull it off. Someone will have to spend real money to usurp my DNS, set up another website, copy all the data (which they may or may not have full access to), etc. The cost to compromise me is orders of magnitude higher if I control my own servers.

willhinsa 5y ago

https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

anonymousiam 5y ago
Was just about to post exactly the same thing. You beat me to it by two minutes. I will add this link: https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents
bayesian_horse 5y ago
Though in the case of .NET core they'd have to extinguish their own ecosystem that was closed source, then they open sourced it and they partially opened the development process that was completely internal. For developers in the .NET ecosystem the OSS-ification is a net win (pardon the pun). If you are a Newcomer to .NET, you still should expect that Microsoft has some control over the ecosystem, just as the rest of the community also has certain rights and powers (through forking and patching) if it comes to that. Microsoft also controls part of the Node ecosystem (npm) and Typescript. Google controls Android and Angular. There are always tradeoffs, it's more important to be aware than to avoid all of them.

travisgriggs 5y ago

Anyone here old enough to remember when SourceForge was The Place(tm) to stick OSS code and then how it fell from grace? I’m curious in what ways the MicroSoft take over of GitHub is and is not starting to feel like that. For me, one is just the difference in scale. GitHub is vast in both content as well as tooling compared to SourceForge at it’s highest points. And a commercial entity orders of magnitude smaller than MicroSoft took over SF. The rate of descent into Not Good(tm) territory also seems slower and more ponderous. But while the magnitudes differ, the vectors look similar. Not exactly the same, because history rhymes with itself before it repeats itself. Curious what other similarities and dissimilarities other old timers see.

zip1234 5y ago
The .NET Foundation board doesn't even all work for MS.
msdrigg 5y ago
I honestly see this specific bruhaha as more of a DNF issue and less of a github issue. Even though both are affiliated with Microsoft, I dont think this is the same as SourceForge’s fall from grace. I can imagine copilot being another point in the not-so-good direction, but is there anything else you are thinking of when comparing Githubs trajectory to SourceForges?
- deleted 5y ago
  [deleted]
- meinheld111 5y ago
  > is there anything else you are thinking of when comparing Githubs trajectory to SourceForges? Popups, notifications, etc Hostile ui in general
  - mirekrusin 5y ago
    You must be joking?

still_grokking 5y ago

I read this as Microsoft is doing Microsoft things. No news whatsoever. Anybody old enough knows what this company stands for. It's tree big letters: EEE Of course nothing has changed. How could anybody dare to believe that?

drekipus 5y ago
that's the thing with the younger generations, they don't have the baggage of lessons learned from yore!
- hvidgaard 5y ago
  No organization the size of MS is different - it's just how it works.
robmen 5y ago
That's unfortunate. That's not how I wrote it. The blog post is about the .NET Foundation and--ultimately--about one very consequential action they took recently.
- deleted 5y ago
  [deleted]

devwastaken 5y ago

Clearly the org is far too gone at this point. It's a dead project people are funneled into that doesn't serve a purpose. Maintainers should do like the history of software has. Drop it and organize anew. A massive red flag for all this are the words "code of conduct". They're not "bad" to have, generally projects already have them, they were previously called "rules". But if the "code of conduct" is filled with title 9 speak then you know you're dealing with corporate types, not developers. For those that haven't taken title 9 training, you're told to be the gestapo morality police and actively go out of your way to vocally suppress any discussion that might involve something that could have the potential to be discriminatory. This is done for liability protection, for the company. Not because it would actually be discriminatory/immoral. Yet somehow its made it's way into software repos.

red_trumpet 5y ago
No, that's not the problem here. The author explicitly states they were totally fine with enforcing a code of conduct on their mailing list. The problem here was about trust in the foundation and power over the repositories.
- robmen 5y ago
  Yes, exactly. Thank you.
- devwastaken 5y ago
  That's fine, the point given is that when orgs push for it, and they're doing so like they did here, that's a massive red flag that whom you're working with is not qualified to be doing that work. Call it an "org smell".
Zababa 5y ago
I also really dislike the fact that code of conducts usually present a very american-centric view, sometimes even a silicon valley-centric view, for projects that are supposed to be open to people all over the world.
- 5y ago

UltraViolence 5y ago

This spat is exactly the reason why I don't host my most precious projects on any outside source code repository like Github. Even when it's a private repository I assume Microsoft will eventually gain access if they feel the need for it. That the company is now an accomplice in STEALING people's open source projects, doesn't surprise me in the least.

bayesian_horse 5y ago

I'm currently a grudging newcomer to the .NET ecosystem because I need it for work. Stuff like this doesn't ease my feelings.

robmen 5y ago
Why? Were you planning to contribute source code to the .NET Foundation?
- bayesian_horse 5y ago
  When you invest work into a code-base that depends on something like .NET, you are taking up some stake in the community and ownership of that base. You do need at the very least security updates, but you also need support and documentation. It's hard to describe fully in words. And most of the time, you can't just switch that particular part of your stack overnight. I'd rather be stuck with a community that looks healthy. And you can argue about the trade-offs of different "ownership structures", and compare for example the .NET foundation over the Django/Python foundation over whatever Java is currently doing.
  - oaiey 5y ago
    Do not worry. .NET is a good choice independent of this hickup. The maintainer will change their foundation backing and the .NET Foundation will serve its original purpose: owning the core .NET runtime so AWS, Google, Samsung and Microsoft can take save bets on it. JavaScript had it nodejs drama, Perl its community drama, Swift it's drop of support from IBM, the Linux Kernel has Linus, etc. They are still there and strong. Let this fold out for a while and reassess it.
    - bayesian_horse 5y ago
      Well, I would never choose .NET if I had any choice. It's much too verbose and is dominated in terms of productivity by many other frameworks/ecosystems. Some people seem to enjoy it, and more power to them, but if I ask, they often haven't done much of anything else.

zivkovicp 5y ago

A scorpion wants to cross a river but cannot swim, so it asks a frog to carry it across. The frog hesitates, afraid that the scorpion might sting it, but the scorpion argues that if it did that, they would both drown. The frog considers this argument sensible and agrees to transport the scorpion. The frog lets the scorpion climb on its back and begins to swim. Midway across the river, the scorpion stings the frog anyway, dooming them both. The dying frog asks the scorpion why it stung despite knowing the consequence, to which the scorpion replies: "I couldn't help it. It's in my nature." https://en.wikipedia.org/wiki/The_Scorpion_and_the_Frog https://en.wikipedia.org/wiki/The_Scorpion_and_the_Frog

cudgy 5y ago
Lol. Just heard this story in an episode of a series called “Startup.”
- square_usual 5y ago
  It's also part of a resurgent, currently-trending meme: https://knowyourmeme.com/photos/2184135-scorpion-and-frog https://knowyourmeme.com/photos/2184135-scorpion-and-frog
- the_cramer 5y ago
  It was also told in star trek : voyager by chakotay. Seems to be a popular philosophical metaphor.
siwatanejo 5y ago
So the analogy here being Microsoft something you shouldn't trust? Or rather, DNF being actually Microsoft... an scorpion? just double checking here
- Xelbair 5y ago
  Replace Microsoft with any for profit entity and you got this right. If such entity can do something that will earn it's profit, it will do it. moral or not.

bennysomething 5y ago

Can anyone give me a short version of what happened please? I have no idea what the guy is talking about.

bobross12345678 5y ago

I want to express my sympathy towards open source maintainers and builders. Really they go through so much shit they dont need to go through more, but I think this has made most open source maintainers either too sensitive or their fuck-o-meter go crazy. There is obvious a communication issue from the .net foundation but also from the maintainers themselves. If they ask you for X permission, you cant just say no, sorry but you are part of an organization and it doesnt work that way, one way or another regardless of what was told to you X years ago, things might change and you will need to take an active stance to it. Horrible move from the foundation to ABUSE their admin rights and move the repo to GitHub Enterprise, but posting a tweet about your emotions and then trying to find a way to move the repo without reaching out to someone is not the way to go. Most likely even if the person did reach out to someone, the reply would be dry and late, but this is something that has been cultivated by the maintainers as well. As the article mentions "the communication was shit but it was fine as long as it didnt affect me" - not direct quote. I think both sides need to reconsider their communication channels and behaviors. They both need to understand that one way or another they have an obligation to each other. I hope communication and transparency will help to not have similar issues in the future.

robmen 5y ago
You are correct about communication being the core of the issue. I understand what you are saying with "If they ask you for X permission, you cant just say no, sorry but you are part of an organization and it doesnt work that way". But I didn't say no to the requirement from the .NET Foundation. I was happy to enforce the Code of Conduct. Where I drew the line was granting admin access to an alias. The .NET Foundation owns the copyright but they don't own me. I'll also argue they don't own the issue tracker and other non-source code things in the project. And opinions on that could differ so conversations could be in order. Also, I didn't spend a lot of time in the blog post discussing the evaluation of repercussions but Bob and I did talk about the for a while. In the end, I decided that those of us that work on the WiX Toolset would be in a better place to communicate if our organization was in "public". I take responsibility for that decision and I'm transparent about what and why I did it. But, in the end, I agree with you. Communication and transparency will help to avoid similar issues in the future.

bob1029 5y ago

I was hoping we'd have another day of manufactured outrage over the Microsoft/opensource boogeyman. Seeing actual quotes personifying Microsoft as a burglar today. Looking forward to the productive conclusion on all of this.

oaiey 5y ago
Good luck with that. I hope for a independent foundation founded by the community.

periheli0n 5y ago

Some leaders just need to issue “all hands” commands every now and then. These commands often make little sense to those at the receiving end. But those leaders need this to have their leader status confirmed. It serves also as proof of authority to their superiors. This is particularly frustrating when an organisation switches leadership and goes from participative to hierarchical. I think this is what happened here: .NET Foundation leadership must have changed and with it came a new, hierarchical leadership style.

vmkw 5y ago
I don't know why this is down-voted. It happens literally in formerly open projects like Python: https://discuss.python.org/t/all-hands-on-deck-the-release-of-python-3-9-0b1-is-currently-blocked/4217 https://discuss.python.org/t/all-hands-on-deck-the-release-o... Python is fully corporate now and free spirits have been removed.
- periheli0n 5y ago
  Apparently the view I voiced is controversial. I can see how some organisations vitally depend on a strong decision hierarchy. The military for example, or some startups. Someone running such an organisation will not be open to the view that such decisions can frustrating for their employees.
- faho 5y ago
  That's just the release manager asking for help with getting the release out. The wording also strikes me as fairly playful (it's a maritime reference!) so I fail to see how that's "fully corporate" or makes python "formerly open". This isn't a literal "I am your boss, you MUST work now", this is "hey, I'm the person who volunteered to get this release out, please help if you can!".

square_usual 5y ago

Extremely bizarre that the main concern in this thread is with GitHub, even though they did absolutely nothing here: the repo that was transferred had given admin rights to the DNF account for a bit. What the DNF did here is questionable, no doubt, but seeing people here claim this portends the death of GitHub is disappointing.

robmen 5y ago
You are exactly correct. It isn't necessary to drag GitHub or Microsoft into the conversation. They aren't involved in this situation.
- lawl 5y ago
  I realize it's weird to argue against you, because you wrote the article and are the one affected by this. But, i disagree. Even if it were an entirely different company. The fact that GitHub didn't send an e-mail and that repos can be hijacked like that, is in itself something GitHub needs to address. And thus at the very least, GitHub needs to be dragged in.
  - pnt12 5y ago
    The email would be nicer, but what's the solution exactly? The admin of one project moved it somewhere else - how do you restrict that, if the admin has total control over a project? Are there improvements that could be done to allow these bots to perform with less rights? That would be something maybe github could tackle but it's not the worst thing about this problem.
    - lawl 5y ago
      > how do you restrict that, if the admin has total control over a project? This isn't a new problem, how do you prevent a rougue admin from kicking all other admins and taking over. The simplest and a pretty effective solution is to have another privilege level: Founder. Of which there can only be one, and admins can do everything, except strip the founder of their rights. (And/or transfer the repo, if the founder can't easily undo that.)

shp0ngle 5y ago

As I have no idea about .NET development, I don't really understand the relation between these projects and .NET Foundation. Is .NET foundation paying them money? Or what is the relationship between the projects and Microsoft/.NET Foundation? Reading the "apology" on github, it seems that .NET Foundation/Microsoft thinks those projects are essentially theirs, and they are free to put them under their enterprise account to "simplify billing" https://github.com/dotnet-foundation/Home/discussions/39 https://github.com/dotnet-foundation/Home/discussions/39 But reading this article, and the one below, the maintainers think otherwise? https://www.glennwatson.net/posts/dnf-problems-solutions https://www.glennwatson.net/posts/dnf-problems-solutions There are also some notes about copyright that I don't understand. Who owns the copyright? Microsoft or the maintainers? edit: From the github "apology": > Projects might not fully understand what joining the .NET Foundation means. We share a checklist with project maintainers on project changes they accept as part of becoming part of the .NET Foundation. That’s obviously not sufficient. We will post a new document that describes what you can expect when your project joins the .NET Foundation. This will include changes (observable or legal) and new benefits. It will also include changes that could occur later. ....ok? That seems scary, coming from Microsoft

rob74 5y ago
Yeah, scary, in the "you signed an agreement without reading it properly and now your souls, er, your projects belong to us" sense. And in the case of WiX Toolset, they apparently never agreed to the terms & conditions of the .NET foundation in the first place. Also, being forced by the .NET foundation to give an account admin permissions for your repos, and then having that account move your repos to GitHub Enterprise without your permission, even without informing you... I can understand how that creates mistrust. According to the article, the only thing the .NET foundation did for them was provide certificates, other than that they did nothing for a very long time. And then, of course, this...
- robmen 5y ago
  Well, the .NET Foundation also holds the copyright and provides the CLA bots. But the great bulk of your point is correct.

gadders 5y ago

Does anyone else love these technology psycho-dramas? I really don't have a dog in this fight but I find myself following them more avidly than a netflix mini-series.

oaiey 5y ago
It is drama about people, power and emotions. People read books which are classified as drama. And honestly, this conversation is really civil (at least after moderation and ignoring everything which contains EEE and $ as a string) and therefore also a good read.

tim_cookie 5y ago

Might be tangential but I have not seen a word addressing this fuckery from either Jon Galloway or Scott Hanselman or any of the "dev evangelist" type people. Weird

jerriep 5y ago
They’re long-time MS employees who know how to play the political game. Highly doubtful they do anything that put their cushy jobs at risk
robmen 5y ago
As far as I can tell, Jon and Scott are Microsoft dev evangelists. It really isn't their place to step into .NET Foundation issues. It might be even more weird if they did try weigh in.
- jerriep 5y ago
  I think it is well established by now that this .NET Foundation is ultimately answerable to Microsoft. Also, Claire - who started the "kerfuffle" - is a Microsoft employee. Given how especially Scott always has a big opinion about how great OSS is and how much Microsoft loves OSS, and given how it was ultimate MS employees that were responsible for creating this current distrust, I think it would be very appropriate for them to voice their opinion about this. And, who knows, maybe they are doing something behind closed doors. But I very much doubt they'll embarrass their employer by speaking up in public. They know who pays their salary and are much to good at corporate politics to do that.

SomeHacker44 5y ago

Maybe it is just me but I find this headline inscrutable. I have no idea what is meant by kerfuffle or brouhaha. More common vernacular might be better. Does it mean "a minor argument became a foundation threatening problem"? Does it mean "an interpersonal conflict impacted the whole org?" I don't know... And probably do not care at this point.

politician 5y ago
“How a bad situation got worse” yw
- robmen 5y ago
  Once again, someone else is far more pithy than I. +1
robmen 5y ago
The title came from a comment from one of the maintainers of the WiX Toolset. I called the initial missteps a "maintainer kerfuffle" and he responded, "As long as it doesn't turn into a brouhaha". Now that I think about it, I didn't write the blog post for the uninitiated. If you didn't understand what was going on, that was fine, it was content for you. I don't know how I ended up here on Hacker News. :)

kova12 5y ago

So... about a decade ago, a guy was found guilty and convicted to 5 years in jail for unauthorized computer access because he scraped a data from open website (see this for details: https://www.zdnet.com/article/jury-convicts-hacker-over-at-t-ipad-user-data-breach/ https://www.zdnet.com/article/jury-convicts-hacker-over-at-t... ). Can somebody explain to me, why isn't foundation guilty of the same crime? Clearly, they were given an access so that they install a bot, not to take over the project.

watersb 5y ago

How long before this brouhaha boils over into a hullabaloo?