The Build-Time Rebellion: When .NET Maintainers Fought Back

Maintainer burnout — Fody vs Moq

Introduction: The Invisible Infrastructure

In the world of .NET development, we often take our build tools for granted. Libraries like Fody (for IL weaving) and Moq (for unit testing) are the invisible scaffolding of modern software. For years, these tools were offered under the MIT License — free to use, free to modify, and free to ignore the human cost of maintaining them.

But between 2018 and 2023, two of the most prominent figures in the .NET community, Simon Cropp (Fody) and Daniel Cazzulino (kzu), decided that “free” had a limit. Their attempts to force a sustainability model onto their users sparked a debate that changed the way we view the software supply chain.

Phase 1: The Fody “Honesty System” (2018)

The Fody incident was the first major “shot across the bow.” Simon Cropp, frustrated by the lack of corporate contributions, introduced a mandatory “Honesty System” via Fody.Funding.

The Tactic: Build Interruption

If a project used Fody, the build process would check for a sponsorship flag. If the user wasn’t a patron, Fody would emit build warnings — and in certain versions, it would throw build errors, effectively breaking CI/CD pipelines.

The Controversy: “Hostage-Taking”

The community’s reaction was visceral. Critics argued that even if the goal was noble, breaking a build for non-payment felt like “hostage-taking.” It turned a developer tool into nagware. While technically still “open source,” the injection of code that intentionally degraded the user experience felt like a violation of the “social contract” inherent in the MIT license.

Phase 2: The Moq & SponsorLink Scandal (2023)

Fast forward to 2023, and the industry saw a different — and arguably more dangerous — approach from Daniel Cazzulino (kzu). As the maintainer of Moq and GitInfo, kzu introduced a dependency called SponsorLink.

The Tactic: Metadata Harvesting

Instead of just breaking builds, SponsorLink attempted to verify sponsorship by hashing the user’s local Git email address and sending it to a cloud service.

The Controversy: From Nagware to “Spyware”

If Fody was about availability, Moq became about privacy. The backlash was far more severe. Developers discovered that their email hashes were being transmitted without explicit consent. Within 48 hours, the community labeled it “spyware” and a “supply chain breach.” Major tech companies began blacklisting Moq overnight, and many developers migrated to alternatives like NSubstitute.

Comparative Analysis: Two Roads to the Same Dead End

The Lesson: You Can’t Patch Economics with Code

Both Simon Cropp and kzu were trying to solve a real problem: Maintainer Burnout. They were tired of “corporate leaching,” where billion-dollar companies used their work for free while providing zero support.

However, their stories prove a critical point: You cannot fix a funding problem by introducing technical friction into a permissive license.

• Fody showed that breaking builds loses you fans.
• Moq showed that compromising privacy loses you your entire user base.

The MIT license grants the freedom to use, but it doesn’t guarantee the creator’s happiness. When maintainers try to “patch” the license with technical enforcement (Fody) or identity verification (SponsorLink), the “Open Source” definition begins to break down.

Conclusion: The Future of .NET Sustainability

Today, Fody has settled into a “soft honesty” model, while Moq is still recovering from its reputational damage. These incidents serve as a warning to both sides of the screen.

To Maintainers: Technical enforcement is a double-edged sword that usually cuts the creator deeper than the user. To Users: If you rely on a tool for your livelihood, don’t wait for a build error or a privacy scandal to start contributing.

The “free” in Free Software is a privilege, not a right — and if we don’t support the humans behind the code, we might not like the code they eventually ship.

Reference

[embed]Fix it, Fork it, Fuck off (2019) | Hacker News Fuck off? Many third-party dependencies in mature projects are non-negotiable. Removing them would require a complete…news.ycombinator.com

[embed]SponsorLink and supporting OSS more broadly · Issue #1374 · devlooped/moq Trying to aggregate the various issues into one to collect feedback. I invite everyone to read the SponsorLink…github.com