Mono-mania: It's risky business

[The opinions expressed here are mine alone, and not those of Google, Inc. my current employer.]

There has been a lot of press recently about the Open Source "Mono" project, arguing about whether it is safe to use by the Free Software community, and even comparing it to the project I work on, Samba. Given all this controversy, I thought I might as well write down my own thoughts on the matter, and even try and change a few minds in the bargain.

Mono is controversial as it is a re-implementation of Microsoft's .NET technology, in much the same way as Samba is a re-implementation of Microsoft's Server Message Block (SMB) file sharing protocol. The genesis of each project and how they have developed over the years is somewhat different, however.

Samba was initially written by the original developers to "scratch our own itch." It was code that was specifically useful to us, and originally had no wider purpose than that. We have gotten a little more ambitious over the years, but one of our primary purposes is still to write code that's useful to us (or to me at least :-). Witness our development of a UNIX variant of the SMB protocol, which has no use for Windows clients or servers, but is a great way of networking Linux boxes together.

Miguel De Icaza [at right], the original creator of the Mono project, would argue the same for Mono. Miguel was one of the original creators of the Gnome Linux desktop code, and personally wrote some of the large Gnome desktop applications in C. I once asked Miguel (while we were stuck on a bus together traveling to some godforsaken LinuxWorld event in Boston) why he decided to create Mono, which re-implements Microsoft's C# language and the runtime environment that goes with it, "It's simple," he replied, "I'm fed up of writing memory garbage collection code for C applications. There had to be an easier way to write Linux desktop applications than that."

He does have a point. Writing complex graphical user interface (GUI) applications in C or even C++ is hard, with many opportunities for memory corruption, memory leaks or security errors. The question is, why recreate a Microsoft technology for this, when Sun's Java already existed at the time the Mono project was started, and solved many of the same problems?

Miguel and many others argue that .NET and Mono is simply better technology. It's true that .NET is a later design than Java, as it was instigated after Microsoft was unable to wrest control of Java from Sun by creating a Windows-specific version of Java (a lawsuit promptly settled that). Also, at the time Mono was started in 2001, Sun had yet to release Java under a Free Software license, forcing Free Software developers to have to re-implement the Java technology if they wanted to use it openly.

But I'm not buying that excuse. Miguel and the other Mono developers are smart enough to have made Java do what they needed, even if it would have required creating Gnome-specific wrappers for the Gnome GUI. After all, this is exactly what they're doing for C# and Mono. No, I'm guessing it was simply the old Open Source/Free Software disease of being unable or unwilling to cooperate with existing developers who are doing something similar to what you have in mind. Much easier to start your own project to do something similar; after all, that way you have complete control over it. And if you believe that by developing Mono you will get Microsoft Windows .NET developers to move their code over to Linux then you can even claim the moral high ground.

But the problem is that Mono is dangerous for Free Software. The heart of the matter is, as usual, software patents. Microsoft have patents on the technology inside .NET, and since the TomTom lawsuit, Microsoft have shown they are not averse to attacking Free Software using patent infringement claims. Microsoft have tried to allay some fears by putting the .NET specification under their Microsoft Community Promise.

Miguel hailed this as the solution to all the patent problems with Mono. But this promise is simply not good enough to base a language environment implementation upon. After all, if the rug is pulled out from under that implementation by the threat of patent infringement, you don't just lose the implementation itself, you lose all the programs that depend upon it. That's a really dangerous situation for Free Software programs to be in. The Free Software Foundation wrote a good analysis of the problems.

But my basic issue with the Microsoft Community Promise is that Miguel doesn't have to depend on it like everyone else does. Miguel's employer, Novell, has a patent agreement with Microsoft that exempts Mono users from Microsoft patent aggression, so long as you get Mono from Novell. Miguel takes pains to point this out. This is not a level playing field, or software freedom for all. This is a preferred supplier trying to pretend there is no problem. Sure there isn't a problem, for them. If it isn't good enough for Miguel, why is it good enough for other developers ?

I'd like to contrast this with the agreement that Andrew Tridgell negotiated with Microsoft for Samba over the very same issues of software patents covered in a specification. You can read an overview of the agreement.

I can't say anything better than Andrew's own words so I won't try, I'll just call attention to them here: "For me, one of the key things about free software and patents is that we are all in the same boat. It is vitally important to the continued success of the community development model that one part of the community does not enter into an agreement which gives some people patent protection while leaving other people out in the cold. That is why I was so opposed to the patent agreements recently entered into by Novell, Xandros and other companies."

This agreement is available to all willing to affiliate with the Protocol Freedom Information Foundation (PFIF) and provides implementors with a limited number of Microsoft patents that may be asserted, and clear and timely warning if new patents are added by Microsoft.

This is at the heart of why Samba is different from the Mono project, at least in terms of how we view software freedom for all, and how we dealt with patent threats in the implementation. If Miguel and the Mono folks had been so careful when negotiating with Microsoft, and just a little less excited about the cool new technology, then I think they'd have done their users a better service.

Lest I get tarred with a reputation as a hopeless Luddite, afraid of new technology just because Microsoft developed it, I do want to say that I think Mono is pretty amazing work. If Microsoft could see their way to issuing a patent promise that was acceptable to Free Software developers, I'd happily see it as a core part of any Linux (or GNU/Linux if you wish) distribution. I actually do use a Mono application to index all my personal photographs, the very capable F-Spot. I prefer it to the alternative of Google Picasa because at least F-Spot is Free Software. (and yes I've reported bugs in F-Spot by looking at the code.)

But if I had to give up F-Spot due to patent threats I could, because all the picture meta-data it indexes is stored inside the photographs themselves. So even if I lost the use of F-spot I wouldn't lose any photograph data, just the time needed to re-tag and re-sort the photos. Annoying, but not a fatal loss.

Just like installing programs to play the patented MP3 format, this is a risk some Linux users are willing to take. But this should be the user's decision, not an accident of it being a default application in a distribution. Most distributions have a way to manage patent risk, by separating out the Free Software that may have patent problems into separate downloadable repositories that are not enabled by default. People in counties with software patents and willing to take the patent risk can then enable the repository and download the patent-covered software themselves. I think it is time for the Mono implementation and applications that use it to be moved into the "risky" category, until the patent situation around it is deemed to be truly safe to use by default in Free Software.

Microsoft isn't playing games any more by merely threatening to assert patents. Real lawsuits have now occurred and the gloves are off against Free Software. Moving Mono and its applications to the "restricted" repositories is now just plain common sense.