SponsorLink and supporting OSS more broadly

[kzu]

Trying to aggregate the various issues into one to collect feedback.

I invite everyone to read the SponsorLink announcement to understand the intention behind it. No nefarious purpose, I promise! 🙏. I also wrote a follow-up post with additional context based on feedback so far.

With that in mind, I'm obviously open to suggestions that help achieve both your goals and mine :)

SponsorLink is now OSS too

An improved and more privacy-preserving implementation could use your feedback

NOTE: 4.20.2 removes SponsorLink since it breaks MacOS/Linux restore. I'll take the opportunity to collect more feedback.
The underlying issue still needs addressing, IMHO.

NOTE: SponsorLink won't be coming back until I improve on the suggestions made here. In particular, those mentioned in the announcement on OSS'ing it

[kzu]

Thoughtful blog post here: https://codingbolt.net/2023/08/08/a-deep-dive-into-sponsorlink-implications-for-open-source-and-privacy/

[rouke-broersma]

@kzu there's two main issues:

1. You're collecting email addresses. Even though you say you only send hashes, you send these hashes to your infrastructure. We don't know what you do with these. You could store these hashes (we can't verify because it's your infrastructure) and at some point compare these hashes to hashes you or someone else with access to email address hashes collected from somewhere else. As a non-evil example, you could use this list to give a priority to issues created in this repo based on if the hashed public email of the github user matches a user on your sponsor list, or on your non-sponsor list (since you could save whether a given hash is a sponsor or not, again we cannot verify). You can then also start building out your user info list with the other information you can gather from the github user. This is not a justified use of the email address we configure on our local machine, so for example any employer in Europe would be forced to move away from Moq, so they are not in violation of GDPR.
2. SponsorLink is obfuscated and closed source. It connects remotely to your infrastructure. You or some external entity could modify SponsorLink and/or your private infrastructure with malicious intent and we would not have an easy way of verifying the changes made. It's basically supply-chain malware in the making. It doesn't matter that it only runs on developer machines (at the moment) either because there are tons of developers who still publish from visual studio (yes, the horror).

[maartenvana]

Maybe, just maybe, you should approve #1373 first, to save whatever goodwill there is left. Then try to get a discussion going about how to get sponsers/paid.

That whole PR to add this closed source nonsense to this otherwise great package has only hurt this project and will continue to do so the longer this version is live.

[bartdebever]

I'm pretty sure a discussion about this is pointless, people are already mass removing your software and I'd personally not trust someone that added this to an objectively popular package. Figuring out you made it yourself is even worse.

This seems like a way for you to get more support and money but with this move I'm pretty sure you are going to get the reverse of that. Even IF you revert the PR, I doubt anyone will still trust you or the package and the mass amount of PRs removing Moq within a day confirms that point.

[DanielCordell]

No nefarious purpose, I promise!

I do actually believe you, and I'm glad that you're opening up a place to collect feedback rather than just closing any issues discussing the point. I think people should want to help projects like this continue to support themselves sustainably, just in a way that is agreeable to as many people as possible, and doesn't have any potential security/vulnerability ramifications.

A lot of people are going to be very negative, maybe rightly so, but I think that if we're going to have this discussion it should be from a place of "known safety" for everyone involved (and to reduce the general panic from everyone!) so would seriously consider merging #1373 or some equivalent ASAP, just so everyone can calm down a bit and have this discussion without having to be worried about their own projects.

I do think it is a conversation that needs to happen though, what is the best way that a FOSS developer can continue to make great stuff for the betterment of the entire dev community.

Of course to some people the project may just be "tainted" for good, not necessarily much you can do there, but reverting the change for now will definitely help with anyone who's currently "on the fence".

Edit: devlooped/SponsorLink#16 (comment)

edit: @kzu as other have said, you are now exposed to litigation. I would urge you to remove the 4.20.x versions just to limit the legal risk. It would only take one vindicative organisation to make things worse for you.

This is definitely something else to consider, you (probably) don't want to be at the receiving end of something like this.

[jakoss]

A lot of people are going to be very negative, maybe rightly so, but I think that if we're going to have this discussion it should be from a place of "known safety" for everyone involved (and to reduce the general panic from everyone!) so would seriously consider merging #1373 or some equivalent ASAP, just so everyone can calm down a bit and have this discussion without having to be worried about their own projects.

Exactly, opening discussion after merging the changes without bigger announcement is the biggest issue here i think

[baynezy]

Sponsorship is problematic for many companies as it does not fit into their financial model. Guerilla tactics to run code that harvests information from developers' machines and stores it in a closed system is not the way to solve this problem.

I have no issue with OSS maintainers making money, but you have to understand that if you don't engage your community on how you go about this and just try and sneak (and there is no way you can deny that is what has happened here) a data mining system into your product there is going to be a backlash.

This has just harmed your reputation and now means that many people will have to look for alternatives. Whereas maybe you could have looked at a licensing model or some other vehicle that companies can actually get past their finance department more easily.

[PoteRii]

https://github.com/moq/moq/pull/1373#issuecomment-1670914563
Are you trying to blackmail the community or what? LMFAO

Sorry no time for discussion, got to go remove Moq.

[DanielCordell]

I'm pretty sure a discussion about this is pointless, people are already mass removing your software and I'd personally not trust someone that added this to an objectively popular package. Figuring out you made it yourself is even worse.

@bartdebever Feel this is a bit defeatist no? Maybe I'm being too optimistic here, but a lot of this could easily be attributed to a genuine unintentional mistake on the part of @kzu. I'm sure there are plenty of people who would be perfectly happy if this change was removed, but arguing that the discussion is "pointless" just means that the sort of problems that incite people to do stuff like this never get looked at.

[BenjaminAbt]

You asked for feedback: @kzu, it's too late. You screwed up really hard. Sorry to say that but you have damaged the .NET community very badly after doing very very very great work for many many years.

With https://github.com/moq/moq/pull/1373#issuecomment-1670914563 you started to blackmail the community.

From a financial point of view, by taking this step you have decided that a great many hundreds of thousands of dollars/euros/X will have to be invested in order for projects to remain privacy compliant.
The only way to save this now is to accept the PR (https://github.com/moq/moq/pull/1373) now, take the affected versions offline and provide a new version.

However, the damage is beyond repair for us/me. We already revert to 4.18 and then switch to another library.
Thanks for Moq. It was great with Moq.

[LarsWesselius]

@kzu Really appreciate all the hard work that went into Moq. No one is denying it's hard work, and often underappreciated. It's fair to ask for something in return.

But I cannot stress enough that you can not do this by introducing a closed source, obfuscated dependency without discussion, and then pushing it as a new version. I'm sure your intentions are good but we can't see the code and we can't afford to assume it's ok. You have a massive user base in massive companies. I reported this to the large company I work at and they shit themselves. Does this not make you see that the way you've gone about this is totally insane?

The problem is now that even if the change is reverted, the trust in its maintainer(s) is gone.

[cdrnet]

SponsorLink would be a reason for me to stop sponsoring this project (if I were a sponsor).