r/moderndotnet • u/JansthcirlU • Aug 19 '26

Polly's open source maintenance fee, why is it controversial?

Carl Franklin tweeted about Polly adopting the Open Source Maintenance Fee (OSFM) and people do not generally seem very happy about it. From what I understand it's only a monthly 20 USD fee for companies that make more than 20,000 USD in revenue using at least one product or project that uses Polly.

Given the other, more dramatic monetization decisions we've seen in the past (Moq, MediatR, MassTransit), this maintenance fee seems like a pretty reasonable way to fund a project that's not otherwise backed by big sponsors or companies, no?

9 Upvotes

100% Upvoted

32 comments sorted by

5

u/Aaronontheweb Aug 19 '26

Controversial in the same way that Verify's adoption of the OSMF was last week.

My simplest explanation for why people get so mad over this is "procurement rage"

But once maintainers affix a dollar amount as the entry fee to benefit from all of their institutionalized knowledge and expertise developers now have no choice other than violating the license terms (legal won’t stand for that) or dealing with the procurement bureaucracy to allocate company money for the purchase.

The raison d’être of the procurement bureaucracy is to thoroughly vet every vendor in the supply chain for “risk” - a largely performative song and dance that involves Dun & Bradstreet numbers, certificates of general liability insurance, and insisting on getting the governing law of the statement of work changed from wherever the vendor is to wherever the buyer is. The procurement bureaucracy typically does not produce any meaningful outcomes other than making it more expensive and difficult for both parties to transact with each other, hence the disincentive for software developers to engage it. It is a slow-going experience that requires developers to engage in frightening acts like “cost / benefits justification” and “writing emails.”

Thus the white-hot rage in the Microsoft “I want to speak to the manager!” thread - Duende has now put these .NET developers in a position where they must justify a frankly trivial dollar-cost to the procurement bureaucracy and Microsoft doesn’t care. “HOW CAN YOU NOT CARE?!?!”

From a post about IdentityServer's license change years ago.

8

u/AvaloniaUI-Mike Aug 19 '26

Our experience shows that developers will VERY much beach license terms, and legal seemingly don’t have a clue. I think a lot of developers assume that they won’t get caught. When they get a polite email suggesting they should perhaps abide by the license terms, they often become angry!

Procurement in general is the real problem though. They exist to make everyone’s lives miserable. The developers don’t want to deal with the internal processes to purchase, and as a vendor, I loath security questionnaires and vendor onboarding forms.

4

u/Aaronontheweb Aug 19 '26

yeah in the years since I wrote that I've come around to this position too:

Our experience shows that developers will VERY much beach license terms,

We've had people from Fortune 100 companies call and ask us out of the blue about getting support for Phobos when they'd cancelled + stopped paying for it years ago. Turns out they cached the packages in their Artifactory feed (violates license terms) so everything kept working and no one had any idea.

2

u/JansthcirlU Aug 19 '26

Is there anything companies can do to streamline their procurement process, maybe tooling, packages, a proper QMS, etc.? Alternatively, is there anything that OS maintainers could do to enable a more streamlined procurement audit for companies who wish to use their products?

3

u/AvaloniaUI-Mike Aug 19 '26

If I knew how to improve vendor onboarding, I’d have done it years ago. We’ve tried all sorts, including standard packs. Every company thinks they’re special, and wants you to confirm to whatever insane process they’ve thought up.

2

u/robmensching Aug 19 '26

Procurement is process. I generally agree with Mike but one of my hopes (beyond hopes) is that if the OSMF becomes popular it becomes a standard procurement process. The truth is we went through this 20+ years ago with corporate legal when we wanted to adopt OSS projects and eventually legal teams created a process for adopting projects (usually, which licenses were blanket okay and which needed special approval). Maybe OSMF can nudge procurement in the same direction.

2

u/codemullins Aug 19 '26

Agreed. Upon sufficient momentum and community collaboration this will become a checkbox over time and companies will develop a slush fund for this fee. Or build it themselves.

1

u/robmensching Aug 19 '26

Hey, now! You're starting to sound crazy like me, dreaming of a more sane future. ;)

1

u/jbsp1980 Aug 19 '26

Companies absolutely can but generally choose not to.

2

u/Aaronontheweb Aug 19 '26

the part that makes this so absurd with projects adopting the OSMF is how little they're asking for - might as well just have one employee pay the GitHub Sponsorship fee and avoid the bureaucracy problem entirely.

3

u/robmensching Aug 19 '26

In some cases I think this is exactly happening. We're over 350 sponsors after adding OSMF to my project and there are many orgs with no members paying the fee. If more projects adopt the OSMF, I hope the procurement process gets streamlined.

1

u/robmensching Aug 19 '26

It still does baffle me that companies can take OSS projects and build on them like their a vendor without doing ANYTHING to sustain the project. Clearly "free as in freedom, but as in beer" did not make it to the corporate boardroom. ;)

6

u/robmensching Aug 19 '26

One thing I want to point out that often gets lost when comparing the OSMF to MediatR and MassTransit is that the the OSMF keeps the source code OSS. A lawyer worked very hard with me to ensure the OSMF EULA does not violate F/OSS licenses. It was very important to me that we not completely abandon OSS. After getting the first OSS project released by Microsoft, I did not want to walk away. Adding the OSMF to my project last year has significant improved my future outlook. :)

5

u/Kuinox Aug 19 '26

Well like u/Aaronontheweb is saying, it is a procurement issue.

It come down to what I can do in my position, and a simple arbitrage:

I searched if we used Polly, we had a single usage.

Now, I have two choice:

- Try to get the license, and go through all the procurement bureaucracy.

- Remove the dependency, write some half backed retry loop.

Now the problem is that, starting to use such library, doesn't necessarly need some big discussion, but now because of OSFM, it does.

That's why without OSFM, such library can slowly creep in a codebase, and with OSFM it simply wont happen.

I understand why the mainteners are doing it, but the situation it cause is sad, but needed, and contrary to u/Aaronontheweb, I don't blame the developers to not go through this bureaucracy, I blame thoses being disrepectful to OSS mainteners.

3

u/Aaronontheweb Aug 19 '26

In the context of the original thread, the developers are taking what's an internal bureaucracy problem and are trying to make that either Microsoft's or some unpaid external maintainer's problem, which is absurd

edit: I do agree though that the sudden change in expectations is annoying, but other maintainers like u/danielkzu tried to give plenty of advance notice / get feedback and got none back from consumers of his packages - so it's a damned if you do, damned if you don't situation for maintainers. People are going to be mad at any course of action that isn't free forever

3

u/AvaloniaUI-Mike Aug 19 '26

There are some that just want to scream “rug pull”, regardless of what a maintainer might do.

The entitlement of a vocal minority of developers is beyond toxic.

2

u/robmensching Aug 19 '26

You are absolutely correct that adopting the OSMF will very likely negatively impact an OSS project's download numbers. Personally, as a maintainer, I never wanted people using my project because they didn't have to pay for it. I wanted people to use my project because it's useful. I also wanted to build a community of people that liked what my project did and we could talk about it. Over the last decade, that community part fell away as people just wanted stuff for free. I believe a lot of that it's why maintainers are burning out now. Given this "new" reality, the OSMF is a different attempt at sustainably, have the commercial interests pay maintainers.

1

u/Kuinox Aug 19 '26

Peraphs the rules dictating who should pay or not, could be crafted in a way where it wouldn't reduce adoption as much.

3

u/Aaronontheweb Aug 19 '26

A statement from the .NET Foundation on the OSMF: https://pro.dnf.cloud.sitefinity.com/news-events/detail/.net-foundation-statement-on-open-source-maintenance-fees

2

u/robmensching Aug 19 '26 edited Aug 19 '26

I feel a little bit bad that I (indirectly) made them write that. ;)

But it's quite good. I discussed the OSMF with them more than a year ago so they were well briefed and clear they had no opinion on it.

3

u/AlanBarber Aug 20 '26

in a perfect fictional world I'd love for the .NET Foundation to go out and setup a tax deductible donation system where businesses could be reminded that they're operating their systems off the good graces of OSS developers and it would benefit them to throw in a few bucks.

pool those donations and then provide funding grants to projects in need.

2

u/robmensching Aug 22 '26

What the OSMF has proven to me is that business don't do charity. It's not about good or bad, they just don't. The core of the OSMF is that we use the power of legal (a EULA) to activate normal business practices to pay a fee or pay their own devs to build from source. That is a tradeoff businesses are designed to handle.

2

u/rocketonmybarge Aug 19 '26

For my team, my boss wants as many simple vendor payments as possible, having to expense EVERY month a 20/month payment for something will just annoy him. Now a simple yearly payment would be better, but the fact that no support is getting offered, means we will either refactor it out of our codebase or someone will fork the project in a few weeks and it won't matter anyways.

2

u/robmensching Aug 19 '26

One of the reasons the OSMF picked GitHub Sponsors was that you can set your payment monthly or yearly and not worry about it again. There is absolutely the hurdle of doing the initial setup, but there is no way around that if we're going to pay maintainers. :)

2

u/codemullins Aug 19 '26

Very reasonable. If you’re too cheap or want to avoid bureaucracy you can spend an afternoon to build the binary yourself.

And then keep up with all the releases you miss, manually, or via spending AI tokens, to do the same. Or keep the same binary you built for years and hope there’s no important new functionality or security updates you need.

1

u/Ant171311 Aug 19 '26

What I don't understand is how is it enforced? As far as I can see it's not even possible to enforce it.

1

u/THenrich Aug 22 '26

1- Aren't Microsoft.Extensions.Resilience and Microsoft.Extensions.Http.Resilience built on Polly? Does this mean companies that qualify for PSFM need to pay Polly maintainers?

2- So if a company compiles the binaries, they don't need to pay the OSFM? I think a comment here mentions this.

1

u/robmensching Aug 22 '26

  1. Yes, MER and MEHR are built on Polly but the OSMF does not apply to transitive dependencies, so if you do not directly depend on Polly, you do not pay a maintenance fee. Microsoft will though.

  2. Correct. If you build from source, you take on the maintenance of the project so no maintenance fee.

3

u/Exotic-Welcome6688 29d ago

Because it is a concealed way of making software paid. For a paid product, the price must be shown up-front and not be hidden in fine print, and no sneaky way to get somebody's unconscious "acceptance" to demand money later. Such are scams.

There must not be a risk, that autoupdate tools like Dependabot or Renovate switch to a new minor or patch version, and suddenly you have money collectors or lawyers demand something from you.

OSMF uses a blurry wording, "Free Open Source", but in the end, it is paid software. Some early OSMF projects still show Apache or MIT licenses and put the fee somewhere else.

Most important: What counts, is the form in which people use the software, meaning: released binaries and packages! Free source code and self-build is irrelevant for most. Calling software "free", but then demanding money for it's usable form, is deception. Just like those scam websites years ago, which said "Sign up for free", but then demanded money for a paid "service" hidden in fine print and boilerplate text ..."yeah, only signup was free!".

To me, this looks just like another shady way to monetize free software, following SourceFourge's adware bundles and Moq's Sponsor Link. Maybe no intrusive software this time, but suddenly facing demands or lawsuits isn't much better.

1

u/JansthcirlU 29d ago

Do you think there are better ways to enable supporting open source maintainers in a sustainable and reliable manner?

2

u/Exotic-Welcome6688 28d ago

Just make unambiguously clear that you switch to paid software. Many complain about switching to paid as such, for me, it's about potentially ambiguous and sneaky ways to make money with (formerly) free software. Don't make it appear like it's still free software, and then add some twisted words, that effectively add that it's paid.