Microsoft Open Source Blog

> The fact that there can be security issues at the application level is no reason to add memory safety issues to them!

> You may well have the resources to fork a process per customer, not have a database pool, not cache etc. its a trade-off with resources needed and performance.

This feels like one of those weird things that wind up happening in discussions about a lot of things, including say, renewable energy. People get so hung up about certain details that the discussion winds up going into a direction that really doesn't make sense, and it could only go there incrementally because it would've been very obvious if you followed the entire chain.

Please bear with me. Consider the primary problem in the first place:

The problem is that we have a bunch of things that are not memory safe, already. Rewriting all of those things is going to take a lot of time and effort.

All of these ideas about isolating requests are totally fine, honestly. If you can afford those sorts of trade-offs in your design, then go hog wild. I find many of these architectural decisions to be a bit pointless for reasons I'm happy to dig into in more detail if people really care, but the important thing to understand is that I'm not telling you to not try to isolate requests. I'm just saying that in practice, there are no "legacy" servers that apply this degree of request isolation. They were architected with the assumption that the process would not get RCE'd, and therefore it would require a…

I don't want to get all righteous, especially considering some excellent projects I've seen from Microsoft such as VSCode, but it feels like you may not understand the culture of the community you're trying to reach.

First, let me say that there's nothing wrong with closed-source software. If Microsoft wants to create the best node.js dev and/or production environment ever, and if it does so without violating any OSS licenses (which are mostly MIT, so it's possible), more power to them (/you).

However, if you call it an "open source [...] platform", and you host the source code on Github, and you're soliciting and accepting PRs from the public, then you may be creating all sorts of headaches for yourself and others. Yes, people should check the licenses for software they use. But as it is right now, many people will take the project's tagline at face value, and may be reminded of a very different Microsoft if, at some point, some other division at MS decides to crack down on the illegal use of this source code, or when you turn people's contributions into a closed-source project.

Edit: the projects also reference Microsoft's "Open Source Code of Conduct", and they are listed at https://opensource.microsoft.com/?keyword=glimpse. I've filed an issue at https://github.com/Glimpse/Home/issues/109

No it's not, and yes it does. This trend on HN that has consisted in wanting to kill the meaning of "open source" as most people understand it is very weird and surprising. I don't understand what is at stake. I have noticed this since one month or so.

The vast majority of projects that call themselves open source mean the open source definition as defined by the open source initiative, or something equivalent.

You might not like or recognize the OSI and that's fine, but you can't decide what people mean when they say open source.

You are the one starting the battle and I don't understand your motives.

I just searched for "open source" in a search engine, I'm getting [1,2,3] and lists of "the best open source software". And they are all using the OSD. You are at odds with Wikipedia, IBM, RedHat and with Microsoft, Google, Amazon, Facebook, Apple [4,5,6,7,8], and with everyone else, really.

[1] https://en.wikipedia.org/wiki/Open_source

[2] https://www.redhat.com/en/topics/open-source/what-is-open-source

[3] https://www.ibm.com/en-en/topics/open-source

[4] https://opensource.microsoft.com/

[5] https://opensource.google/

[6] https://aws.amazon.com/fr/opensource/

[7] https://opensource.fb.com/

[8] https://opensource.apple.com/

Microsoft Open Source Programs Office (https://opensource.microsoft.com) | REMOTE OR REDMOND, WA, USA | React / Node / Azure / Javascript / Docker | Full time

The Microsoft Open Source Programs Office is hiring a Principal Software Engineer to be a technical leader and community manager for ClearlyDefined[0]. We're looking for folks particularly interested in the open source compliance space.

Full job description and applications can be done at the job posting[1].

Basic qualifications:

- Experience working with open source software projects, especially maintainer and community management roles.

- 4-5 years’ experience in software development emphasizing open source and stack technologies such as Node, React, JavaScript, Docker, cloud services, GitHub, Maven, and more.

- Excellent community and leadership skills.

- Excellent written and verbal communication skills.

[0] - https://clearlydefined.io

[1] - https://careers.microsoft.com/us/en/job/800721/Principal-Software-Engineer

> Nixiesearch uses an S3-compatible block storage (like AWS S3, Google GCS and Azure Blob Storage)

Hair-splitting: I don't believe Blob Storage is S3 compatible, so one may want to consider rewording to distinguish between whether it really, no kidding, needs "S3 compatible" or it's a euphemism for "key value blob storage"

I'm fully cognizant of the 2017 nature of this, but even they are all "use Minio" https://opensource.microsoft.com/blog/2017/11/09/s3cmd-amazon-s3-compatible-apps-azure-storage/ which I guess made a lot more sense before its license change. There's also a more recent question from 2023 (by an alleged Microsoft Employee!) with a very similar "use this shim" answer: https://learn.microsoft.com/en-us/answers/questions/1183760/s3-api-support-over-azure-blob-storage

I work on an open-source project for Microsoft, and I review and merge community PRs all the time. Nobody pays for the product I work on (or for C# or TypeScript, for that matter).

The Contributor License Agreement used on all MSFT open source projects doesn't ask you to transfer your copyright, though it does require submitters to agree to grant a permissive copyright and patent license. IANAL, but the copyright and patent clauses in Microsoft's CLA[0] do not look substantially different from the equivalent clauses in the Apache 2.0 license[1].

[0]: https://opensource.microsoft.com/pdf/microsoft-contribution-license-agreement.pdf

[1]: https://github.com/rust-lang/rust/blob/master/LICENSE-APACHE#L66