DNF and its relationship with member projects

[Aaronontheweb]

It's been tough to miss the disturbing reports from some of our member projects that the DNF has, in essence, abused its administrative access to these projects:

• https://www.glennwatson.net/posts/dnf-problems-solutions
• Add support for reproducible builds reactiveui/splat#778
• https://twitter.com/JeremySkinner/status/1445272800185495555

And there's Rodney's recent post clarifying the... frankly, dishonest way his departure from the foundation was explained via the official mailing list: https://rodneylittlesii.com/posts/topic/foundation-echo-chamber - among other issues he highlights.

The more I hear, the more I'm outraged at the foundation's behavior. The set of expectations that were made to our project was that we were to be left to our own devices, but the behavior of the foundation leadership has become increasingly erratic, uncommunicative, and fait accompli.

Transferring projects out of public Github to the .NET Foundation's Enterprise Github account without so much as notifying them? Blocking their signing keys on NuGet? Forcing pull requests over the objections of maintainers?

I'm far from alone among DNF maintainers in saying that the behavior that's been exposed here has deeply undermined my confidence and trust in the foundation going forward.

What's the justification for any of this? Why have these steps been taken without any communication with the maintainers who oversee day-to-day operations of these projects?

[robmen]

August 3rd, I got this email:

Yesterday we announced Foundation-wide Code of Conduct Enforcement. Part of making that work requires that the dnfadmin GitHub user has owner permissions to GitHub organizations. GitHub org ownership by the dnfadmin account has been required for all Foundation projects for some time, but we noticed that the account does not have the proper permissions in wixtoolset. Please assign the org ownership role to the dnfadmin user as soon as possible.

I was busy on a major deadline and responded on September 14th:

Thanks for reaching out. The bulk of our day to day conversations happen on a couple mailing list (wix-users@lists.wixtoolset.org and wix-devs@lists.wixtoolset.org) that are (fortunately) very civil and quite installation-geeky. But we could/would unsubscribe anyone that violated the Code of Conduct there.

Also, the WiX Toolset’s repositories are too important to us to grant ownership access to an account that isn’t a core maintainer of the codebase. So, thank you for the offer to automate the Code of Conduct enforcement but we’ll pass if it requires significant access to repo permissions.

I think I made it explicitly clear that I did not trust the .NET Foundation with admin access to the repository.

However, another of our maintainers was blocked from approving a PR due to the clabot being broken. He was told the fix was to make @dnfadmin an owner of the project.

Apparently, I made a fatal mistake on September 21st by granting the @dnfadmin access to the @wixtoolset organization to get the CLA bot fixed.

I just read Glenn's blog post gobsmacked and thought to check the @wixtoolset organization. I was floored. We too were moved into the .NET Foundation's GItHub Enterprise.

We were moved into the .NET Foundation's GitHub Enterprise without discussion after I explicitly called out I did not trust the organization.

I am so angry. I feel so betrayed.

[poke]

I'm not sure what owning the code (whatever exactly that is supposed to mean with open source licenses) has to do with them gaining (admin) access to a GitHub organization or even the project itself. If I fork a DNF project, they cannot administer my fork either, even though me forking it changed nothing about copyrights, ownership or licenses.

[IanKemp]

However, another of our maintainers was blocked from approving a PR due to the clabot being broken. He was told the fix was to make @dnfadmin an owner of the project.

Apparently, I made a fatal mistake on September 21st by granting the @dnfadmin access to the @wixtoolset organization to get the CLA bot fixed.

I honestly don't understand why you'd ever even do this... there's no logical explanation for why a CLA bot would require a completely different user to have any special access to your project, especially ownership rights! If the answer to "how do I fix feature X" is "give user Y god mode", your alarm bells should be going off regardless of the trust relationship between you and Y.

[FransBouma]

@poke owning the code is owning the copyright of the code, as stated in the copyright law that's applicable on the location the code is used in. OSS licenses are about distribution and usage, not about copyright. You never transfer copyright through an OSS license, you merely give rights to use the code and distribute it in a certain shape/form.

If you own the copyright of a codebase, you can do whatever you want with it, also revoke OSS (so distribution) licenses, move it elsewhere etc. If you fork a repo, you can alter the code, but you don't own it, you might think you can change the license, but that's not true; only the copyright holder can. That's why it's critical to know who owns a codebase in this case, if the DNF moves a codebase to a different location or does other things with it that are allowed only by the copyright holder.

[matkoniecz]

See https://robmensching.com/blog/posts/2021/10/6/how-the-.net-foundation-kerfuffle-became-a-brouhaha/ for how this story ended. Noteworthy parts:

If you are not part of the GitHub Enterprise, you can't tell if an org is part of "public" GitHub or a GitHub Enterprise.

so regular user cannot check whether projects stolen and silently transferred as part of this supply chain attack are back with real maintainers. And answer to "So, how did you leave the .NET Foundation's GitHub Enterprise?" turned out to be a loophole in settings.

Congratulations on recovering your repositories!

See also #59 where they started allowing to recover repositories, but only after an explicit request. And after blog post mentioned above.

[glennawatson]

They have been transferring repositories to the public instance. They been doing opt out for greater transparency. Eg there is potential billing implications etc if you have private repos or LFS data.

[leastprivilege]

After reading these tweets and articles I had a look at our organization page. To my surprise, I found this new link at the top:

When I follow this link, it brings me to https://github.com/enterprises/dotnet

My questions are:

• What is this and what does it mean?
• Why was this change made without our prior consent or discussion?
• How can do we undo this change?

thanks

[brianlagunas]

They did it using the dnfadmin account which was given the owner role to your org

[FransBouma]

The root question is why, though. That they used that account doesn't mean they should, the account is also necessary for other housekeeping duties, right?
To me this particular case is a cornerstone to distrust the DNF in every action they do, and especially the lack of any communication with the people who actually form the project: the maintainers.

[nathan-alden-sr]

A theory:

1. They considered "if we tell maintainers we're going to do this, they will resist and likely take immediate action to prevent it, or raise a stink."
2. They feel convicted that they own the code and the management of said code.
3. They decided the only course of action was to secretly, and with automation, transfer ownership that likely can't be reverted by maintainers.

It makes sense if you think about it.

[IanKemp]

I personally don't see any evil intent here - just standard Microsoft stupidity, incompetence, and failure to communicate. When it comes to large organisations, Hanlon's razor almost always applies.

[TechnikEmpire]

Embrace. Extend. Extinguish. Frankly though in this case, I'm happy to see it since I can't use blazor without having a multi-thousand-dollar-per-year, non-oss layer deeply integrated into the microsoft libraries.

[MeikTranel]

Just a reminder: we're still talking in a public forum. I was pointed here after asking why the internal member discussions were disabled by the admins and if there is a new place for those discussions - it certainly is not internal.
Every comment here is visible to the public and might just amplify certain opinions that aren't necessarily a good representation of the dnf membership; maybe even just push some people to express themselves differently that they would without public scrutiny. (may i remind everyone here that part of this drama started because people were brigrading from twitter etc.)

[phillip-haydon]

@jnm2 It happening behind closed doors leads me to believe it's damage control and not wanting to change anything.

The first thing that should be done is reversing what has being done, that does not need a discussion behind closed doors. Once the reversal has been done that gives a level of trust back to all the maintainers here that something was done accidently without being discussed with maintainers of the projects in the DNF.

If that happens, the board meeting to discuss privately what went wrong, and why, and such, is much easier to accept and move forward.

Effectively in regards to the pulling all the projects under the DNF org is the org saying "all your stuff belongs to us now", and delaying rectification just makes the org more distrustworthly.

If you pull down a production database by mistake, do you have a meeting to discuss what happened or do you get the database online first?

[jnm2]

I don't see it the same way. There should be an internal discussion with time for people to understand and get behind a fuller perspective, rather than knee-jerk actions that relieve the pressure. That would be damage control and it's not how I would want the foundation to make decisions.

[jen20]

An important reason for this discussion to be held in public, here, rather than on Twitter, is that it grants permanent visibility for those who may consider allowing their work to fall under the .NET Foundation umbrella in future, or for those who may be evaluating whether or not it is acceptable to sign a CLA which assigns copyright.

(Edited to fix minor typo)

[jnm2]

Just to clarify, this public discussion is good and I am relieved that it's happening. But the internal discussion (that Philip was referring to) within the foundation before responding back to us is also good.

[tracker1]

For what it's worth... Collectivist bargaining isn't a bad think. From boycotts to unionization. Even if it's brigading, it's not inherently bad.

It just needs to be considered before over reacting wether it's brigading or cancel culture in general.

[BillWagner]

I'll provide a brief status from the board:

• The board met yesterday to learn more about what happened, what was and wasn’t communicated, and start working on what we must do better. This was the incoming board, so some members are just getting background.
• The board will issue an apology statement later today. It's being draft now. This will address both the Rx PR, and the GitHubEnterprise account.
• The board is meeting every day this week to make an initial plan to improve communications / discussions with all project maintainers. We obviously need to do better. I'm using "initial plan" here because we want to take some thoughts to all project maintainers. We want to get their thoughts on how and how often to communicate. Once we agree on a plan with the project maintainers, we'll implement it.

[hhariri]

Right, but from my understanding, nobody ever asked permission from the project owners to make this transition.

[glennawatson]

Yup but bill already said he's addressing it above

[JimBobSquarePants]

The board will issue an apology statement later today.

It’s been 2 days. Where is the apology?

[gortok]

It’s been 2 days. Where is the apology?

@JimBobSquarePants In case you aren't being snarky, it's here: #39

IF you are being snarky (and I don't blame you if you are), yes, the apology lacked all six parts an apology should have, but given the structure of the Foundation and its relationship with Microsoft; this would appear to be the best they can 'legally' do.

[JamesRandall]

If it’s the best they can legally do with regard to an apology imagine how that relationship influences everything else…. If it’s the best they can do with regard to an apology…. good lord.

Edit: for what it’s worth I do think it’s been fed through an organisational acceptability filter. But it also mixed up a personal apology with an organisational one and that’s not ideal because it leaves us all to try and put the line in the right place and land criticism in the right place.

[uabarahona]

[jnm2]

@huunab On the contrary, this being public is an opportunity for the .NET Foundation to show what kind of foundation it's capable of being when confronted with its own miscommunications or mistakes in the future. If it handles it poorly, it's a good thing for everyone that this is public. If it handles it skillfully, it's also a good thing for everyone that this is public.

[glennawatson]

Sure having a discussion with stakeholders without all the heat involved would be a smart one. However, it can't always be hiding behind the iron mask, and the outcome must be made public.

[poke]

I would really hate to loose another great initiative like "Identity Server done by the .NET team" or the "Project Maturity Model"

Are you saving that MS building their own identity provider library, directly replacing the IdentityServer from the community would have been a good idea? Are you saying that the rules behind the Project Maturity Model would have been good for the health of the .NET open source ecosystem?

[poke]

probably will never want to provide one, that is […] a hole for the dotnet users.

It is only a hole if you believe that Microsoft (not the foundation, but Microsoft) needs to provide a default implementation for every major use case. This even contradicts the idea behind the maturity model because it would basically prevent community projects from getting to a similar acceptance stage, while also allowing Microsoft to short-circuit the model completely just because they built something. – But I am not going to continue this discussion here again since I believe enough opinions have been collected in that issue about it and Microsoft made their stance clear on the topic.

[tracker1]

Personally, I found IdentityServer interesting but overly complicated,. Not using it and creating my own using RSA signed jwt was easier. In the end, I don't think MS needed to create one.

Azure AD does that from an MS perspective.

That aside, I don't think the maturity model was appropriate given the relationship with maintainers and contributors. If MS was paying them, maybe... As an OSS community, hell no.

[CumpsD]

As an outsider I'm left wondering why you'd keep your project part of the DNF with such an overreach? What do you gain over being a normal OSS project?

[Aaronontheweb]

Please forgive this silence but I wasn't willing to speak up until I had a chance to speak to everyone and get my feet under me

Definitely not an easy first week to begin your tenure, Rob.

Your suggestion of getting the projects more involved in their own governance is a very positive development. I look forward to hearing more about it.

[glennawatson]

I've discussed offline with you @rprouse

• I think fundamentally some maintainers are worried that MSFT is kinda muscling in and attempting to take control. Given there has been so much confusion, there should be mechanisms for projects to opt-in/out. Make something more fitting to what the community was expecting.
• There's a lot of significant changes without any communication about what or why those changes are happening. Allow maintainers to buy into new procedures and policies.
• Revert the GitHub changes and the NuGet changes. If you need these for the MSFT managed projects apply only to these projects.
• I would stop forcing DNF admin users on maintainers, offer this to maintainers who want the ability to have coverage in case of accident/death etc. More mature projects already have their own redundancy in place.

We were told that there would be more communication after the last major issue with Jon Galloway, so you'd have to follow through with this.

Cheers

[dggmez]

@rprouse

Several people are saying that we cannot salvage the Foundation because of its DNA but I disagree. The Foundation belongs to us its members and it is up to us to decide what it should be.

I get where you're coming from and I would like to think that's the case. However, I agree with what @dustinmoris said here:

#39 (comment)

After reading the bylaws (that you can argue are a pretty important part of the foundation's DNA) I think that as long as the Founding Member has special powers it's pretty hard to claim that the DNF really belongs to the members and not to the Founding Member.

[JamesRandall]

Completely concur with @dggmez - any changes and steps forward have to be presented within the reality and constraints of what the foundation is. And as @dustinmorris showed it is controlled by its Founding Member and not the members.

If people want it to be controlled by its members then their needs to be a proposal to change the bylaws and remove the special powers belonging to the Founding Member. It would be fascinating to see how that played out. Call me a cynic (realist) but I’m 99% certain that a) it would be blocked and b) if it looked even remotely like happening Microsoft would suddenly become as concerned about copyright assignment and the topics in this thread as regular members.

I’d never paid much heed to the strapline on the foundations homepage until yesterday but looking now it strikes me as disingenuous at best.

[phillip-haydon]

Several people are saying that we cannot salvage the Foundation because of its DNA but I disagree.

I know it may sound like that I think the DNF should disband, but I don't believe that. When Nancy join the DNF I thought even if Nancy didn't need the help/support that being part of the DNF would help promote the idea that the DNF is here to help promote, contribute, support, and do everything within its power with possible financial backing of MS to foster good growth in the .NET OSS community.

Even tho I rarely contribute to stuff these days as real life is too chaotic, I still really want to see the .NET OSS community grow.

I saw a tweet and I cannot remember who tweeted it but it said that we (the community) should support projects directly. If being part of the DNF is that there's a member fee then some that money should go to help projects via sponsership, especially considering the events that have happened I think alot of projects will absolutely not want to consider joining the DNF in the short term and what we really need is to help these smaller projects that people depend on.

Right now when the budget: https://dotnetfoundation.org/about/budget

I cannot understand the expenses at all. Half the subscription stuff is going where??? But there's 80k that's sitting somewhere that could be helping projects.

I obviously have absolutely NO idea how to run a foundation, or what a director and board members do, or a committe. And I'm DEFINITLY not the sort of person who should be representing the DNF. But I do know that I want to help the .NET OSS community and I really wanna see the DNF help! I just don't see it happening at the moment, or in the past :(

[bjablonsky]

I'd like to chime in.

Full disclosure: I'm a member of the .NET Foundation. I am NOT an elected member of the board nor have I run for the board. I'm the chairperson of the .NET Foundation Education Committee as I pitched an educational project to the board as a member and was offered the education committee chairperson role since it was vacant. As a chairperson, I have no responsibilities or powers that an elected board member does. These words/thoughts/opinions are my own.

This news is worrisome to hear that open source project maintainers feel that the .NET Foundation has lied to them and abused their administrative privileges. I understand their frustration.

I would like to ask everyone to take a deep breath, not to assume the worst, hear out both sides, and keep an open mind.

Please give the board time. Remember, we just had an election (that hopefully all .NET Foundation members participated in). It takes time for the new board members to onboard to the foundation as the old board members leave. Also remember, that most of the board are not paid to be a member of the board. They're volunteering their time and effort.

Also, at least to my knowledge, please realize that the board discussing these things internally before talking to the community is due to the way the bylaws and the .NET Foundation run. There needs to be a quorum of members to vote on decisions surrounding the .NET Foundation. As .NET Foundation members, we voted for these board members to represent us. Please don't assume the worst.

Finally, I'd like to say one thing I think the .NET Foundation and the community needs to continue to improve is communication. I've been frustrated in the past with the .NET Foundation and communication. As a community member, I did nothing to try to rectify and express my concerns until recently. There are growing pains. The foundation is still relatively young. The first openly elected board was just elected in March of 2019 after the announcement of the open membership of the foundation in December 2018. So, hopefully we can use this as a learning experience to have a more open dialog between the members and the board.

[dustinmoris]

Please give the board time. Remember, we just had an election (that hopefully all .NET Foundation members participated in). It takes time for the new board members to onboard to the foundation as the old board members leave.

That is such a poor excuse. It wasn't the entire board that got replaced. Also there is nothing holding old board members back from chiming in or providing reassurance on the whys of their actions within the DNF.

The fact that there is such much radio silence from the DNF on both public GitHub discussions just shows how out of touch they are with their members. If this was a member run foundation then they would be at the centre of this discussion, but nobody except some corporate Microsoft employees at the DNF have a clue, because they are the ones who really call the shots and they prefer to say as little as possible because their number one priority is to protect their employer and not stand up for members of the DNF.

It's complete shambles.

[JimBobSquarePants]

The Foundation has been around since 2014. There’s no excuse