What's going on with Moq? SponsorLink and burnt soil!

[giscus[bot]]

What's going on with Moq? SponsorLink and burnt soil!

The famous Moq library faced some criticism due to the usage of SponsorLink. What is the problem, and what is going on here? And obviously, I will add all the sources to the articles.

https://steven-giesel.com/blogPost/1939d20c-2493-4bf7-9636-96436283fb72

[Cloudkill]

Well said! One comment:

Well for starters everyone has to evaluate if (s)he can use Moq (again, the problematic bid was removed) and trust Moq in the future.

The main problem I see here is that kzu has already promised in the 4.20.2 release notes that this feature is going to return. Not recognizing the problem after it was pointed out is the biggest trust killer for me (and many).

The best chance to save some trust would have been to announce a pause on this while it was reconsidered and consulting an attorney that is knowledgeable in international privacy laws. I can say from personal experience that finding just one attorney that has extensive knowledge in all countries/regions is difficult. We have had to hire outside counsel from multiple companies to get a full understanding of what our responsibility and liability is.

[linkdotnet]

Hey @Cloudkill - thanks for the comment.

The main problem I see here is that kzu has already promised in the 4.20.2 release notes that this feature is going to return.

Thanks for the hint. Yes that doesn't sound much better to be honest. Kzu is steading he did make SponsorLink open source:

SponsorLink is OSS now. You can inspect the code and hopefully I've done quite a bit of work to ensure the impact on build is absolutely minimal. There may be further improvements to make (such as checking all-local) though.

^Source

But I am not sure if that helps now, as the community around Moq is already shrinking.

I can say from personal experience that finding just one attorney that has extensive knowledge in all countries/regions is difficult.

Totally understandable - luckily I was never in the situation until now, that I need that. It is a lot of money you have to spend.

[DevD4v3]

The problem originated when kzu merged this PR: https://github.com/moq/moq/pull/1363

What upset the developers is that kzu did not discuss the introduction of this package (SponsorLink) with the community, it was done without consultation. From there on trust was completely lost. The action of kzu is what upset everyone.

I honestly do not support the SponsorLink package at all.
Open Source is not about getting sponsors to fund the project or making money or receiving donations.

If I'm a maintainer of open source projects, it's because I do it to share/contribute with the community, no matter if I get anything in return.
Imagine integrating in all my open source libraries the SponsorLink package, now a consumer will depend on an external dependency that has no use for his own project.

[linkdotnet]

I am also no keen fan of SponsorLink - I did use kzu's GitInfo package until this was added.
I can relate to the wish of getting something back - especially because the log4j incident showed how "rough" it can get for the maintainers. Of course, a mocking library is a different category.

Personally, I am on the same site as you. I don't expect any money on my open-source projects or blog - I don't have any advertisement, tracking, or other things running on that site that generates revenue.