Daniel Cazzulino has been developing open source software prolifically for over a decade. Among his many works is the popular Moq library for .NET, with over 100k daily downloads on NuGet. In early 2023, Daniel announced SponsorLink, and in August 2023 he added it to Moq for the 4.20 release. The response was swift and negative, with hundreds of reactions coming in on a GitHub issue (the first of many) in the repository, and wide coverage of the incident across many websites, including Reddit and Hacker News.
I reached out to Daniel in the aftermath of the drama to see if he would be interested in doing an interview for the Code Code Ship blog. He immediately agreed. Let's jump right into the interview.
Daniel, thank you for taking time out of your day to talk about SponsorLink and Moq, and also the state of open source in general, and what it's like being an open source maintainer. Can you explain your personal motivation for developing SponsorLink?
As I explained in my blog post extensively, I tried rewriting Moq several times, trying to bring it to a level where it can satisfy the increasing (and never-ending) changes in .NET/C# capabilities which are being left behind due to the underlying technology (Castle DynamicProxy / Reflection.Emit) being used by Moq but also every other mocking library out there.
In addition, I'm an eager OSS creator (to the tune of 300+ packages), to the point where everything I encounter in a specific project (most recently, Cloud Actors for example, as I was implementing Microsoft Orleans) that is generic and something I think others might find valuable, I immediately go ahead, set up a repo, properly set up CI and release as OSS and on nuget.org. Sure, I'd be more productive in my own projects if I didn't do any of that :).
I feel like other OSS authors I know that also enjoy and love their passion projects would love it if it were possible to just do that full-time. I know I do! So the motivation goes way beyond Moq (where vNext may not happen at all, since there wasn't much cheering for it from the feedback I got, we'll see). I'd love my OSS contributions to essentially be the kind of "content" I produce. As long as folks think it's valuable, it would be nice to have a nice recurring revenue stream that makes it sustainable to do full-time. The moment it stops being useful or enjoyable, well, I'd just do something else :).
I saw on your blog that you added SponsorLink to some of your smaller projects earlier this year. How did people respond to that?
There was no negative feedback, but also got very few sponsors. This was somewhat expected since those are much lower volume packages (perhaps with the exception of GitInfo). See the GitInfo issues related to SponsorLink for example. GitInfo gets 1.5k daily downloads, is over 4.4M total, and it had SponsorLink added back in Feb 6th (see the PR).
Did you hear anything from users or gain any sponsors?
Very few. I could count them on one one hand ;).
Given this feedback, how did you expect that adding it to Moq would be received?
I was expecting a similar shrugging off, but given Moq is 100x GitInfo, one hand times 100x would have been a significant milestone anyway. Especially since the annoyance of SponsorLink in that v1 implementation was just a warning message PER IDE instance, with a random (max 4s) build pause also once per IDE instance. And only in active editor context, never on CLI or CI.
You reverted the change very quickly; were you surprised with the negative reaction?
I had (wrongly) considered a one-way SHA256 of the email to be sufficiently privacy-preserving. The feedback was loud and clear that that wasn't enough. In addition, lack of testing in Mac/Linux caused actual build breaks.
Many critics seem to have forgotten that there is a person at the other end of the keyboard. What is it like to be at the center of an internet drama?
It was a really intense few days. I tried to respond to as much of the feedback as possible, as calmly as possible. It's tough, but angry folks on the internet seem to forget that the actual person on the other end, typically has a life outside the internet, work and coding. Family, friends and fellow OSS devs were very supportive and that was key to keeping a cool head and taking on the onslaught with a strong mind. I'm super grateful to all those that voiced their support, regardless of the underlying discussion about SponsorLink itself. I'm only human and can make mistakes as much as the next guy.
Some of the loudest critics have insisted that you have irreparably damaged your reputation. Do you think this is fair criticism? I noticed that moq's star count has continued to grow at the same rate as before SponsorLink. Does this and other evidence support their claim?
My personal life doesn't revolve around getting random folks on the internet's approval or gaining some points in their personally perceived reputation scale. As long as the projects I create are useful, solve a real problem and are enjoyable to use, I think this "reputation" thing they mention is irrelevant. Case in point: most folks just learned my name and my relationship to Moq for the first time, after more than a decade it came out. I'm not doing OSS for fame, reputation or to get cheered. I do it because I learned to code in C# thanks to other great OSS libraries (most notably back then, log4net), and I just think it's beneficial for anyone going through the same journey today.
It seems Moq keeps solving folks' real world problems in an elegant way. I expect most consumers are interested in that more than any fleeting drama. Likewise for my other libraries. I don't even publicize them at all, folks just try them from nuget and if they like them, they just keep using them. As it should be.
Did you also get messages of support?
Many! Privately and also publicly. That was really heart warming, TBH. I'm almost 50, and these acts of kindness did make me emotional, I have to say, unexpectedly so even. I've known many fellow devs over the years, through conferences and (mostly) being an MVP (I wish I could be one again!) and going to a bunch of MVP Summits.
You have open sourced SponsorLink and continued development on it. What is your plan to address the criticisms that have been raised so far? Are you planning to add it to moq again in the near future?
The plan (already acted on) was to:
Do you think that the criticism will die off if you can address the privacy concerns that have been raised? There is prior art in this area: the author of CoreJS, a library that is present in nearly all JavaScript projects as a transitive dependency, has dealt with a constant stream of abuse since adding a post-install log message asking for sponsorship.
It seems that after all the drama, it has started to pay off for him! I checked his OpenCollective and it's looking better nowadays:
That gives me hope that the conversation and attitude towards OSS sustainability might be changing.
Will it be worth it to you if you manage to gain significant sponsors, as the CoreJS author has done (NB: after an internet drama and a prominent emotional plea), if the negativity remains?
I think so. I think nowadays we have tools at our disposal (automation, sentiment analysis, GPT-4) to shield our communities from the worst parts. I'm not particularly bothered by the negativity, as long as a significant user base (which is nevertheless far quieter than the loud angry users) remains using the product and actively sponsoring it.
It's a bit like handling community feedback for any product (I did that at Xamarin/Microsoft): all you get are how the product fails them and sucks, and it can be a bit demoralizing. But when you see good adoption numbers, folks tweeting about how they enjoy this or that feature, it's all worth it, IMHO.
Do you think open source has a toxicity problem? How big do you think it is?
I've no idea, honestly. I don't have a good view of "open source" as a whole, beyond my small niche with .NET and the projects I work on. The reaction to SponsorLink certainly didn't seem the healthiest. Reading on the CoreJs journey, it doesn't seem an isolated occurrence.
Despite all of this, I understand from reading your blog that you really like Open Source. Can you explain what it means to you personally?
Personally, it's both a "content-creation" pleasure, as well as a "for posterity" selfish act too. Many times I go looking for things I blogged or published on github.com that I simply forgot. And as I mentioned, just as I re-learn many things that way, I also learned them that way too to begin with, way back then. For example, the sheer amount of knowledge you can get by just exploring Roslyn' source, or dotnet's is simply amazing. It's great for every learner that all of those things and many more are OSS.
Have you considered other ways to monetize your work?
Yeah. But none seemed satisfactory. I don't want to go "corporate" and be tied long-term to a single project. It may very well be the case that mocking becomes irrelevant when/if AI takes over writing code, for example. It would not make me happy in the least to still be tied to support long-term licensees that are for all intent and purposes "stuck" on effectively legacy stuff, for example. I still want to do "just OSS", for the most part, if I can get away with it :).
That's what I like about GitHub Sponsors: you sponsor the *developer* (or organization behind him), regardless of the project he's currently most active on. This is a good thing, you support the *creator*. That said, it's complementary (I think) with sponsoring a specific project or issues. GitHub can do more in that regard, by more deeply integrating Sponsors into issue reports, for example (i.e. you offer up $$ to get an issue fixed). That would be orthogonal to sponsoring a given developer.
Daniel, thanks again for taking the time to share your side of the story. I have been working hard to make it easy for library authors to commercialize their libraries, but there is not one single path towards sustainability for the ecosystem, and I sincerely hope that you manage to make SponsorLink work for you and anyone else who uses it in the future. Most of all, I hope you find a way to continue developing libraries for the greater ecosystem. It would be a shame if the negativity that you have experienced would cause you to stop.
I don't think that will happen in the very short term. I intend to make the tools from SponsorLink more generic so they apply more broadly and hopefully that will make an impact eventually down the road. We'll see.
