Moq is a mocking library for .NET Unit Testing (cue the TDD folks reminding us mocks are unnecessary), and it is by far the most widely used mocking library in .NET (475 million downloads vs 87 million for the next largest, NSubstitute). Yesterday, its author released version 4.20.1; which added nagware and a backdoor to Moq, in a bid to drive up paid usages of Moq through ‘Sponsorships’.
This had the predictable result of enraging folks that use Moq, and the change was subsequently removed in version 4.20.2 (released a few hours ago as of this writing), ostensibly because it broke MacOS restore. The author of Moq wants discussion on the topic of sponsership under Github issue #1374.
I’ll get the tactical analysis out of the way first by way of these three points:
- This was a backdoor (unintentionally) to supply-chain attacks. The project linked to an obfuscated DLL that provided two functions: a) retrieving its settings from a third-party server, and b) spawning a git process, and sending hashed git email addresses to that same server.
- This is also nagware. A message popped up in the build window if the person wasn’t a supporter (by checking hashed email addresses found locally vs. what’s on the server), to tell them to sponsor the project.
- This action by the maintainer is a cry for help. They have 475 Million downloads, and their work on Moq can’t support them financially. This is a cruel and unjust world where giving away software that supports Fortune 50 companies would result in poverty if they didn’t keep their full time job. They get to choose between maintaining Moq, or seeing their family.
For the security minded among us, there are any number of ways for this to be exploited, from DNS based attacks to any code vulnerabilities to simply waiting for that domain to expire and taking it over, to any number of attacks that an enterprising malware author would find. This is a textbook opening for a supply-chain attack.
There’s also a betrayal of the social contract involved with OSS software: You don’t rely on closed-source software as a necessary part of ensuring your software does what it says it does, and you don’t surprise the folks that depend on your work.
This is also one of those character-building opportunities for the author and an object lesson to everyone else in the .NET OSS community on what not to do. But more so an object lesson for us that .NET open source is not sustainable. Popular projects become force multipliers for Fortune 50 companies that would otherwise have to spend hundreds of thousands of dollars in salaries recreating the functionality, or spending tens of thousands of dollars on licenses to buy software that does what OSS provides for free.
I won’t spend too much more time on the tactical part because there’s a much more interesting strategic problem sitting here waiting to be dined on: The .NET Foundation and .NET Open Source Software.
I wrote a while back about the .NET Foundation’s fundamental problem, and if the Discussions tab is any indication, the .NET Foundation as a community is dead. 4 discussions in 2022, and 4 in 2023 is not a healthy community. Also, all but one committee stopped meeting (wg-projects, wg-maintainers, wg-marketing, wg-membership, wg-corporate-relations, wg-education have all stopped meeting/posting their minutes/updating agendas) — the wg-outreach team is the only committee to have met recently.
Update: Glenn Watson, .NET Foundation Board Member, had the following response to the above:
Committees are meeting regularly. The thing is I went hunting for meeting details. if I wasn’t getting invites by the foundation I wouldn’t know the times and where and how to join. Something I need to fix. Also we hire a company at the moment to take notes and minutes and I need to discover where that is going. I will get back to you on this one too.
With that update down, back to the original post:
Ok, great, George, so an OSS project is feeling the pressure of producing software for free, and the .NET Foundation has about as much activity as your blog, how does this all connect? Allow me to quote from the .NET Foundation’s own front page:
The .NET Foundation is an independent, non-profit organization established to support an innovative, commercially friendly, open-source ecosystem around the .NET platform.
It appears the problem of supporting an innovative, commercially friendly, open-source ecosystem around the .NET platform is right up their alley. Literally. Now, I have my concerns with the way they wrote commercially friendly, and there’s been no clarification since that blog post of their intentions, so at this point that part is an open question: Who does the .NET Foundation want software to be made commercially friendly for? Is it for maintainers? Is it for Microsoft? Is it for other large companies? Who is the beneficiary of the .NET Foundation’s work? Who does it serve?
The .NET Foundation should be all over the open-source commercial viability problem. We should see leadership from them not only on this Moq issue, but on the state of open-source in .NET. Maintainers aren’t business folks, and they don’t know how to turn something that has 475 million downloads into a viable business, and yet every enterprise that uses .NET more than likely uses Moq. Heck, even the streaming music industry pays better than .NET Open source. If the foundation is foundering, and looking for problems to solve, the viability of open-source is right up there, waiting to be tackled.
The .NET Foundation should be that interest group for open source, enacting policies and frameworks to help OSS maintainers get paid, to build the foundation for what it means to be sustainable for open source.There’s no question, Open source software has to change, and money has to come into the equation. In one possible future, projects join the .NET Foundation, and their maintainers are paid by the .NET Foundation, while corporate members pay thousands to 10s of thousands in dues every year in return for support and commercial licenses to use .NET Foundation projects. Dual-licenses, and an interest group sitting in between that handles the payment backbone of OSS is a possible path forward, but it’s going to take someone like Microsoft leading the way. Do they have that leadership potential in them? Only time will tell. For our part, we should continue to remind the .NET Foundation as to why they exist, and use our soap-boxes to get them to take action on this pressing issue. We won’t have open-source viability until we fix the sustainability issue.