Hacker News Reader

Comment by ilaksh | Hacker News Reader

I really like F# but am concerned there might be some kind of gotcha with using it in a commercial project. Like somehow Microsoft might decide to require payment for .NET or something.

View on HN

.NET (SDK/Runtime) has always been free, but it's also been Open Source for several years now whilst F# has basically always been OSS and is stewarded by the non-profit F# Software Foundation.

Microsoft will never charge for usage of .NET simply because that's not their business model which relies on mainstream adoption, previously it was to spur sales of Windows Desktop, Servers & their Infrastructure software but now with Azure they're happy for it to have ubiquitous adoption on Linux or Windows servers as well.

If you're really concerned, you can always also compile F# to Mono assemblies (though in my experience it does lag .NET CLR in functionality, so you'll probably need to use an F# version a few minor releases earlier than the official one).

However, this isn't something I'm really concerned about. I think there's practically nil chance something like that would ever happen.

If you're still concerned, there's probably nothing they could do at this point.

I think the worse that will happen is Azure ads in your build STDOUT. Worth the cost of admission IMO. Dotnet is faster than Java now.

It's all open source now

I'm fairly sure fsharp has always been open source, or at least it was open sourced very early. Somewhat pioneering of MS approach to licensing basic development tools.

You're still going to have to download a binary from Microsoft. This is the nature of self hosting compilers. It would be nice if there were an alternative implementation (say, a gcc or llvm front end) that you could bootstrap it from but that's not how it is right now.

This creeped me out just enough that I haven't played with it. Microsoft has changed a lot but downloading Linux binaries from them is still just a bit too much.

If you're concerned, why can't you just build F# from its OSS Repo with their build.cmd or build.sh scripts?

https://github.com/dotnet/fsharp#contributing

They even have a Visual Studio Online quickstart which provisions the build environment with all necessary dependencies:

https://github.com/dotnet/fsharp#visual-studio-online-quicks...

Where the build environment wouldn't be running on your machine.

The F# compiler seems to be written in F#. Therefore, you need to already have an F# compiler to build it. That GitHub repo mentions that "You will also need the latest .NET 5 SDK", which looks like it includes F#. (Presumably, when the language was first written, there existed a compiler written in some other language. However, that compiler is almost certainly not maintained anymore, so it wouldn't be able to compile today's compiler, which probably uses language features added since then.)

So where's the issue with using a cloud hosted build environment for the builds?

None? That's not what they are arguing against. You can see and compile the F# code, but since you need for that to use an already built compiler provided by Microsoft, you need to trust it.

Even compiling the compiler and then use that compiler to compile your code doesn't help, because the first compiler that was compiled by someone's else might tamper the resulting compiler binary.

> None? That's not what they are arguing against.

So why are you still looking for issues when there's solutions avoiding their stated objection?

> Even compiling the compiler and then use that compiler to compile your code doesn't help

So what's the threat model now? that MS will risk their reputation, established business models and subject themselves to liability to poison the bootstrapped compiler to detect when a modified F# compiler is being built so they can inject vulnerabilities into all new modified F# compilers ensuring they're similarly poisoned whilst avoiding detection from easily disassembled byte code (that can be crossed checked against its original source), Does that sound plausible?

http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...

That's not an answer, you are building the compilers and tools from source, the only reason not to trust the builds of a cloud hosted build environment is if you believe Microsoft is maliciously poisoning builds of OSS compilers its compilers build in a way that escapes detection from its easily disassembled byte code of the compiler and everything it generates, including other modified F# compilers it builds which has to somehow retain its reciprocal poisonous code - all undetected.

I'm not looking for issues. You asked a question, I answered it.

the SDK will always be free, but that's not the business model. the business model is get more people to buy Windows licenses. to that end, they give you a second-class experience on non-Windows (both for development and end-users). eventually you cave and just use Windows and Visual Studio, and rationally so, because you would be at a competitive disadvantage if you did not.

That's BS, none of the core F# developers have a VS/Windows agenda. F# was one of the first MS products Open Sourced and they were an early adopter of running on Mono back in 2010 in order to run cross-platform. Now they're a supported language on the latest high-performance cross-platform .NET runtime.

For a long time the F# community criticized Microsoft for their lackluster tooling support in VS where it was treated like a 2nd class citizen, but that's less of an issue now that a lot of devs are developing F# with cross-platform IDEs like VS Code and JetBrains Rider.

windows no, azure yes.

Reply on news.ycombinator.com