Hacker News Reader

Comment by yoyohello13 | Hacker News Reader

Look, if you willingly have any piece of your stack relying on Microsoft you have to be ready for the rug pull. They WILL fuck you, it's guaranteed.

View on HN

Lucky no-one is reliant on niche tools like NPM or GitHub, otherwise they'd be feeling mightily insecure right now.

Or ChatGPT… maybe not their development but that is who runs it.

Now, I get why you made the quip, but I for one keep both of those out of the business I run for this exact reason: I do not trust MICROS~1 in the medium to long term.

I also present the CEO and board with other arguments, like moral ones about involvement in atrocities and tyranny, legal ones regarding things like data protection, market related ones such as the likelihood of a future showdown between the EU and US.

But the risk that MICROS~1 fucks us over directly is even easier for them to understand, because they have been using Windows and Office for decades and are quite queasy about 10 going EOL and what the next set of annoyances in document management will be that they'll have to suffer under. It's something they have immediate experience of and didn't like.

A year from now it's probable we'll only have a couple of Windows machines left, because some of our customers use software that doesn't run under Wine and tries to block execution under both debuggers and container environments.

I don't like to be seen as defending Microsoft, they definitely have their share of faults, but as far as business goes, I think Microsoft is the least likely company to screw you over as a (business) customer. Microsoft has kept old software working pretty much unchanged for the last 20 years. I know, I still have software built on early Windows 95/NT4 that works fine on Windows 11...and with some registry tweaks Windows 11 will run on a computer from 2005 without too many issues (sure, 3rd party security software and js-heavy web pages will be slow but that is not directly MS fault). Windows 10 EOL in 2025 is only for consumer level stuff, you can get Windows 10 support for enterprise for another 2 years at least and some versions even up to 2029, so again, if you are a business, you are taken care of (if you are "cheaping" you way with Windows Home and Pro in business then you kind of get what you pay for, I am sure you as a business don't give away free products/services for years on end). And you can keep using your Windows 10 after EOL, not like they lock you out, they just don't support you...just like you don't repair stuff for free after warranty end. Compare that to any other tech company that churns through HW and SW much faster and much more severely where old HW and SW no longer works or cannot connect to the internet or use the latest browser so you cannot connect to the latest HTTPS servers. Even open source software breaks compatibilty with older versions much more oftern than Microsoft, but since that is "free" people just shrug it off.

We're building the business, i.e. setting the foundations we expect to stand on for decades to come. Enterprise license that might be possible to extend into the medium term isn't good enough for our long term commitments and the time to adapt to an alternative family of operating systems is now.

As for stability, if you learned GUI Ubuntu twenty years ago you'll be right at home in contemporary Debian systems, while someone hopping from XP or Server 2000 into 10 or 11 would be quite confused for quite some time. Xenial (2016), Bionic (2018) and Fossa (2020) will likely get twenty years of security updates each, into the beginning of the 2030s.

I think something similar holds for the SoftMaker office suite. If you learned TextMaker twenty years ago I believe you'll be less annoyed by their 2024 release than if you learned Office 2003 and get dropped into the 365 style applications. Personally I'd use something else entirely, likely doing a roundtrip through LaTeX or straight PostScript under the hood, but it will be interesting to evaluate some MICROS~1 Office alternatives in my organisation and see what, if anything, sticks.

Microsoft's primary business is software running on Microsoft platforms. In the past that was Windows, nowadays it's also Azure.

That famous "developers developers developers" video with Steve Ballmer was a prime example of that corporate ethos.

For most other giant companies in tech, either the primary business is selling a product (and killing competitors) or giving products away as loss leaders and making bank on advertisement

Lucky I don't. It's my employer that takes the big risk. But I guess they take larger risks than their Microsoft-only strategy.

> Lucky no-one is reliant on niche tools like NPM or GitHub, otherwise they'd be feeling mightily insecure right now.

I did completely move away from GitHub (which is by now named "ShitHub" in some circles) the moment that Microsoft enforced 2FA on my account.

Yes, perhaps 2FA is a good idea for many scenarios, but if some company forces it upon me, I won't have any tolerance to be willing to be their customer/user anymore.

See [1] for a different perspective on this topic.

---

And yes, I agree with you that is a great idea for a next step to at least strongly reduce (or even cut) your dependence on NPM wherever possible.

---

[1] https://stackoverflow.com/questions/72512276/how-to-disable-...

I think even Microsoft is in too deep to suddenly pull the carpet on NPM/Github. Talk about a public relations nightmare

You say that but they are going ahead with copilot crap despite the backlash.

I don't see how it can be a rug pull when in this case it was clearly against the terms of use?

Not to quibble, but VSCode (and GitHub for that matter) are part of my tooling, not part of any of my stacks.

To me the former is tolerable, the latter is not.

I think they are talking about products like Cursor.

Ah, that’s a painful situation.

Eh MS wasn’t going to just let VSCode derivatives soak up all the AI gold rush money, these companies knew the risks. I wonder what it’s going to mean for projects like Zig, a migration of VSCode refugees could crank things up to 11 pretty quick.

How do VSCode refugees impact a project like Zig?

I would bet they meant the editor “Zed”.

Shoot yeah I did haha

Zed don't have many extensions like VSCode.

I guess the point is that VSCode won because it collected critical mass (despite people practically chanting Microsoft’s “embrace, extend, extinguish” game plan). If a sort of exodus were to happen, perhaps that same critical mass would stoke the flames of mass plugin catch-up.

I have no skin in the game, I’m just a guy in the internet back alley throwing down a couple bucks on a dice game.

I've been shafted by Github under MS ownership in the past, after 7 years. I'm using a gitea instance ever since. The only thing Github is good for is visibility/discoverability. Do not trust Microsoft ever. They will fuck you.

At this point, GH is like Twitter, people are begrudgingly using it because it has the most visibility.

Yep. Was a Microsoft dev from 1992 until 2017. Won’t touch them now because I spent my entire career rewriting rug pulls. It paid off a mortgage and fed me well but it was a bad outcome for my orgs and customers.

If anyone remembers WCF/AppFabric/WWF and Silverlight, that was the last stack I rewrote someone out of the shit on.

I’m still dealing with the long goodbye of a silverlight app which now must be somehow ported.

if there's an escape hatch you should probably use it. In my experience companies never support you during rewrites "well why don't you just convert the code to X language" almost never works on a huge project, it takes a ground up approach, and relying on the old stuff as "more like guidelines than the actual law"

The escape hatch is OpenSilver basically.

A clean rewrite isnt possible for a variety of business reasons.

I started my career rewriting a product using Microsoft's DNA business server with Java and never looked back. I'm shocked this keeps happening, honestly. I guess I'm a "never again" sort but surprised there's not more companies refusing to deal with Microsoft.

Due to experiences like that I refused to buy volume licenses from them, too. Sometime later I got an audit demand for which I had a reply ready.

"lol, no."

Sorry if I'm being dense, but what is an "audit demand?" (Looked it up and couldn't find anything obviously relevant.)

I think he refers to Microsoft auditing a business' licence compliance. Have you aquired the correct amount of licenses for all the instances you are running and accessing. Microsoft licensing is so insanely complex that even if you ask 2 MS sales reps what licenses you need to cover a certain scenario, you will get a different answer each time. This is also why an audit almost 100% results in finding non-compliance.

https://www.npifinancial.com/smartspend-bulletins/the-anatom...

An Enterprise customer of Microsoft agrees to be audited by MS. In exchange they pay a certain amount for effectively “unlimited use” of the appropriate software. In the past this meant volume license keys that would always activate; wouldn’t count how many devices, etc.

And MS audit would check that what you reported was what you had. And could result in big increases in contract pricing.

Now that everything is cloud this and 365 that I don’t know how much it applies anymore - everything is dynamic and traceable.

Famously in the early 2000s it was a huge issue for “medium” businesses who had used enterprise-style licensing. Tiny and small businesses just bought normal computers and software and would often escape notice.

That was one aspect of the auditing, but they also sent audit notices to random small and medium businesses who were not volume license customers. Basically fishing for license violations, which obviously were very common (and usually unintentional) back in the 90s and early 2000s. Things like installing windows XP or Office on multiple machines without buying extra licenses.

AFAIK it was mainly a scare tactic to pressure companies into compliance and mostly just involved scary looking letters from a Microsoft-hired law firm.

It was a scare tactic, and it only really worked because there were a large percentage of illicit installs going around.

Business would have an "IT guy" who "saved money" - and they'd get a letter saying "let us audit you or we're taking you to court for copyright violations" and they'd scramble and agree to the audit.

Of course, the proper response was the legal version of "bite me" but since many of them were in violation, they acquiesced.

I never had it happen to anyone I was involved with or knew, but the stories were certainly flying around Slashdot (it was going to be the proximate trigger of the Year of Linux on the Desktop, don't you know).

I was working for a law firm when they did that to us. The letter they got sent back was hilarious.

This was what happened to us, we were a small company and were just buying Dells with Windows already installed. We had valid license keys from the factory on everything, so it didn't make sense to me that we needed some volume key for more Windows. So we didn't buy a volume license but still got the audit demand.

Microsoft was double-dipping for a long time, selling volume licensing deals to companies that were often buying preinstalled Windows anyhow, just out of fear of non-compliance. Then once you have the volume deal, Microsoft products become easier to use and dominate the company's tech and reaching new deals with Microsoft becomes a nice-business-you-got-there-shame-if-something-happened-to-it kind of conversation.

Microsoft hasn't changed a bit, just smarter about tactics.

There was a lot of hype and momentum around Silverlight back in the day, until their wasn't. You got a cross-platform (Mac/Windows) WPF-like UI and C# programming environment, which was powerful.

I had the fortune to be involved developing the LEGO Mindstorms EV3 programming software. Under the hood, it was a small web browser shell (using Mono on Mac and WPF on Windows) around a Silverlight Out-of-Browser app. Anything beyond the permissions of the Silverlight app (e.g. bluetooth/USB comms) was an RPC from Silverlight to the shell.

After completing the Mac/Windows app, LEGO wanted to deliver a similar experience on iPad. There was no Silverlight there, and it was clear there never would be. But we were able to leverage Xamarin stuff to reuse most of the same codebase, just with an iOS UI on top.

By chance, do you happen to know if the Mindstorms NXT (the old one, before EV3) software was based on the same toolkit? I always wondered what UI framework it used, it had an unusual look.

It was not... it actually was, IIRC, a LabVIEW program with some tweaks here and there. The UI was basically a LabVIEW VI front panel with a LabVIEW 2D Picture Control. Most of the program logic and the compiler to the NXT was LabVIEW G code.

There was a hot minute (and it was about a minute!) where Silverlight was absolutely phenomenal.

Too bad “every app is just a website” took over because of the cross-platform issues.

oof, :%s/their/there

Funnily enough, those ancient WPF, WinForms, and even MFC apps still compile and work fine. The rug pull only became the standard operating procedure at a certain point.

> WCF/AppFabric/WWF

SharePoint Server Subscription Edition still uses those techs today.

Is it really a rug pull? It's a closed source extension with terms specific to use with vs code. Nothing has changed in that regard. All they did was close a workaround for a competing company's product.

It's hard not to rely on Microsoft.

Open source project hosted on GitHub, for the network effect.

Use Rust which also rely on GitHub for crates.io

> Open source project hosted on GitHub, for the network effect.

> Use Rust which also rely on GitHub for crates.io

It is a very good idea to get rid of both as far and soon as possible. And, as I wrote at https://news.ycombinator.com/item?id=43793095 in some circles it already became very fashionable to call GitHub "ShitHub" and somewhat look down upon open-source projects that have their central repository on GitHub (i.e. are willing to enslave themselves to Microsoft for some stupid "network effect").

> it already became very fashionable to call GitHub "ShitHub"

You’ve said this a few times, without stating which circles? I assume mostly among four-year-olds given the level of wit involved?

They are attributing it "in some circles", like when a news actor says, "some people say". They are only trying to making shithub catch on like M$.

Although, given how lax they have been at removing Golang infected malware, it might just have legs.

Wikipedia calls those "weasel words".

> it already became very fashionable to call GitHub "ShitHub"

I talk to a lot of people developing both open-source, and proprietary software. Some of those are on GitHub, others on SourceHut, others on Codeberg. I have never heard, not even once, a single person other than you use the word ShitHub.

Maybe it's used in some obscure circle you are in, but it's nowhere close to fashionable.

Crates.io stopped relying on Github in June 2023. Now Cargo uses sparse HTTP-based index lookups rather than cloning the old git-based index repo (the old repo is still offered for users on older versions). And the crates themselves have never been served from Github. https://blog.rust-lang.org/2023/06/01/Rust-1.70.0/#sparse-by...

Don't build castles in other people's kingdoms, apparently a lesson that keeps being relearnt.

Then it's hard to build anything.

Why should it be easy to start with?

Hardly anything is given for free in this life, it has to be earned.

Let me clarify.

You need an OS, you need compiler, you need some libraries.

Unless you write all that by yourself you always build in somebodies kingdom.

Indeed, however all of those have a license that most certainly was abied for, at least if we are speaking about doing the right thing.

Many of these "building castles in other people kingdoms" projects, tend to use free tier WebAPIs, forked projects, reversed engineered protocols, and then folks get entitled when the owners pull the carpet.

Do not forget the hardware. And having the means of creating said hardware.

It took them five years to actually take action on enforcing their ToS. It's not as much of a rug pull as it's the result of their competitors blatantly ignoring the license on proprietary code from a proprietary code giant.

Unless the developers of the IDEs hit by this never actually read the ToS, of course, which would only make them less reliable as an IDE provider.

Nah, obviously an AI read the ToS and wrote the code for Cursor!

After all MS is completely okay with their AI darling reading ToS-protected stuff.

Anything that’s not gpl-licensed is going to pull the rug from under your feet, people should have learned this by now.

Also, if you do open source contributions, never ever agree to assign copyright to the project: doing so means the project owners can relicense the code base, even towards proprietary license.

Absolutely. I signed one copyright assignment, ever, with the FSF. I trust them enough to do that, but they're just about the only ones.

They don't require it anymore.

Better yet.

FreeBSD must be pulling a very long con, then.

Uh, yes?

Half of the initial mac os x kernel was ripped off freebsd, giving pretty much nothing back.

Afaik netapp is also basing their system on bsd.

Sony uses freebsd as the OS for their playstation.

And many more, giving essentially nothing back.

Regarding apple: They support cups and clang, and stuff like swift and webkit. Also, the darwin kernel is open source.

I’d be shocked if netapp hard forked bsd and doesn’t upstream fixes.

They support the version of cups that nobody uses anymore, except themselves.

ONTAP is a fork of BSD (dunno if they upstream or not) and NetApp are far from the only ones in the storage sector who have done this.

> Half of the initial mac os x kernel was ripped off freebsd, giving pretty much nothing back.

That is open source.

https://github.com/apple-oss-distributions/distribution-macO...

https://en.wikipedia.org/wiki/Darwin_(operating_system)

https://en.wikipedia.org/wiki/XNU

You'll notice the FreeBSD folks don't seem to be particularly bothered by this. FreeBSD loses nothing to Apple or NetAPP.

This attitude of "OMG you're being ripped off" any time a company incorporates code from a BSD/MIT/whatever licensed project baffles me.

Yeah.

I think project governance matters more than license, and the BSDs are great examples.

Having said that, I’ve soured on the GPL. V3 more-or-less bans companies from selling you hardware that runs free software, but lets Google, Meta, etc use the software to expand their cloud-based monopolies where surveillance capitalism and enshittification have won out.

AGPL or BSL seem much better if you want free as in freedom. BSD and Apache at least don’t force your software off of machines that end users control.

Yes, BSL is not open (TM) or free (TM) or whatever. It’s still better IMHO, since it at least has some path to revenue for the developers.

Are there AGPL or BSL success stories? (Ie. projects that started as such and became/remained sustainable?)

The whole Grafana ecosystem afaik. They are thriving as a company and they don’t risk amazon or some other company coming in and selling a forked version of their software (see redis/valkey, elasticsearch/opensearch, etc)

A little off-topic but a few companies (e.g. Aerospike) use AGPL in the free versions of their paid products to avoid getting leeched off.

meanwhile here i am using dot net 4.5 on windows server 2022 haven't changed the code in a decade

Then they will gaslight you.

Reply on news.ycombinator.com