Why Microsoft can't ship open source code
I've suggested a few times that Microsoft could go beyond just cooperating with the open source community and actually ship open source code. For instance, Paint.NET is a great alternative to MS Paint, so not just bundle it? Tonight I had a very long conversation with someone who is in a position to really understand both Microsoft and open source. Now I understand why my suggestion - though well intentioned - was hopelessly naive.
Update: As pointed out in the comments, I'm referring to cases where Microsoft would be shipping open source software they didn't write. Microsoft ships several projects as open source via CodePlex and SourceForge.
The problem boils down to code pedigree, the nightmare scenario, and software patents.
There are only really four software license - proprietary, and copy-left, public domain, and copy-center. Here's a gross oversimplification, just for the sake of discussion:
- Proprietary - The code is covered by copyright and / or patent. It is illegal to use this code without a license.
- Copy-left - Think GPL. You can use the code, but must ship the source and contribute any changes back to the original project.
- Public Domain - The code is yours to use. Have fun, don't blame us if it doesn't work.
- Copy-center - BSD, MIT - You can use the code, but you have to keep the copyright notices with it.
So, you can understand why Microsoft couldn't ship code under proprietary and copy-left licenses. But why not ship public domain and copy-center code? For instance, Paint.NET is under MIT license, which clearly says that it's okay to distribute or even resell the application or derivative application. Because it's not possible to verify the code pedigree.
To understand the code pedigree problem, let's talk about the nightmare scenario. Let's say Microsoft took my advice and shipped Paint.NET as a Windows Vista Ultimate Extra. Unbeknownst to Microsoft - or even the Paint.NET project leads - a project contributor had copied some GPL code and included it in a patch submission (either out of ignorance or as with malice aforethought). Two years later, a competitor runs a binary scan for GPL code and serves Microsoft with a lawsuit for copyright infringement. Microsoft is forced to pay eleventy bajillion dollars and damages. Perhaps even worse, they're hit with an injunction which prevents selling the offending application, which requires recalling shrinkwrapped boxes and working with computer vendors who've got the software pre-installed on computers in their inventory. All for shipping a simple paint program.
So, the risk is too great to justify the small reward.
Note that this is a simple business decision, not a religious one. Microsoft's not avoiding the open source code because they don't trust the code quality, features, etc. They're a big target, and they just can't take a major risk like that.
That also explains why Microsoft can't just bundle developer tools like NUnit and NHibernate with Visual Studio and ends up re-implementing those features in Microsoft-native releases. Since there's no real way to prove the code is "clear" for redistribution, in most cases the code can't be shipped. There's no real way out of that until software patent law changes.
That doesn't prevent Microsoft from participating in the open source community, though. There are two main ways it can do that:
Microsoft can release projects with source code on sites like SourceForge and CodePlex when the potential damage is low. The kinds of projects you'll see released as open source are generally good tools which will benefit developers, but wouldn't cause a major crisis if they had to be pulled. They can't, however, accept community contributions since they can't verify that the code is free of copyright / left restrictions.
Microsoft can support open source projects run by non-Microsoft developers (by support, I'm not really talking about financial contributions). I've been part of some great talks with Sam Ramji and others who are working hard to help out Microsoft's growing open source developer community[1]That . You can connect with Microsoft's open source strategy team on Port 25.
[1] Note that while I've had several good talks with Sam here at MIX, he wasn't the person who explained the above issues to me. That person asked that I not use his name, then vanished behind a ninja smokebomb cloud. I've done a good amount of editorializing here, so I'll take all the blame for this post. These views are my own and should not be construed to express the views of Microsoft, its employees, your neighbors, or of Forest Whitaker.