Microsoft's Empty Promise

by Brett Smith Contributions — Published on Jul 16, 2009 06:06 PM

Last week, Microsoft extended the terms of their Community Promise toimplementations of the ECMA 334 and 335 standards. You might thinkthis means it's safe to write your software in C#. However, thispromise is full of loopholes, and it's nowhere near enough to make C#safe.

Why Worry About C#?

Since we publishedRichard's article about Mono last week, somepeople have been asking us why we're expressing special concern aboutfree software developers relying on C# and Mono, instead of otherlanguages. Sun probably has patents that cover Java. Maybe IBM haspatents that cover C compilers. "Shouldn't we discourage the use ofthese too?" they ask.

It's true that all software patents are a threat todevelopers—but that doesn't mean that all software patents areequally threatening. Different companies might have patents thatcould be used to attack other languages, but if we worried aboutevery patent thatcould be used against us, we wouldn't get anythingdone. Microsoft's patents are much more dangerous: it's the onlymajor software company that has declared itself the enemy of GNU/Linuxand stated its intention to attack our community with patents. IfMicrosoft designed a patent trap into C#, that is no more than what itsaid it would do.

The company has been quite clear about its intentions since late2006. At a user conference in November that year, Microsoft CEOSteve Ballmer said, responding to a question about their patentagreement with Novell:

... the fact that [GNU/Linux] uses our patentedintellectual property [sic] is a problem for our shareholders. We spend $7 billion a year on R&D, our shareholders expect us to protect or license or get economic benefit from our patented innovations. So how do we somehow get the appropriate economic return for our patented innovation...?

(Seattle Post-Intellegencer, The Microsoft Blog, "Ballmer on Novell,Linux and patents," November 16, 2006.)

A few days later, an interview with Microsoft President Bob Muglia waspublished, and he made it clear that they considered C# one of theseso-called "patented innovations:"

There is a substantive effort in open source [sic] to bring such an implementation of .Net to market, known as Mono and being driven by Novell, and one of the attributes of the agreement we made with Novell is that the intellectual property [sic] associated with that is available to Novell customers.

(eWeek.com, "Microsofts Muglia Talks Longhorn, Novell and Java",November 17, 2006.)

They've been turning up the heat ever since. In May 2007,Microsoft followed all this up by announcing in a Fortune magazineinterview that they believed GNU/Linux infringed 235 Microsoftpatents. And recently they made it very clear that these were notidle threats: the company sued TomTom for using the VFAT filesystemimplementation in the kernel Linux without buying a license from it.

All of this can't simply be brushed aside. These are statements andactions made at the highest executive levels of the company. Usingpatents to divide and conquer the free software community is afundamental part of their corporate strategy. Because of that, C#represents a unique threat to us. The language was developed insideMicrosoft, so it's likely they have many patents to cover differentaspects of its implementation. That would make free softwareimplementations of C#, like Mono, an easy target for attack.

The Community Promise does nothing to change any of this. Microsofthad an opportunity to take action and demonstrate that it meant usno harm with C#. Instead, they took meaningless half-measures thatleave them with plenty of opportunities to hurt us.

Incomplete Standards

The ECMA 334 and 335 specifications describe the core C# language,including information about standard libraries that must be availablein any compliant implementation. However, there are several librariesthat are included with Mono, and commonly used by applications likeTomboy, that are not required by the standard. And just to be clear,we're not talking about Windows-specific libraries like ASP.NET andWindows Forms. Instead, we're talking about libraries under theSystem namespace that provide common functionality programmersexpect in modern programming languages: binary object serialization,regular expressions, XPath and XSLT, and more.

Because these libraries are not defined in the ECMA specifications,they are not protected in any way by Microsoft's Community Promise.If this were the only problem with the promise, it might be safe touse applications that avoid these libraries, and stick to what's inthe standard. But even the code that's covered by the promise isn'tcompletely safe.

Figuring Out What's Necessary

The Community Promise only extends to claims in Microsoft patents thatarenecessary to implement the covered specifications. Judging justby the size of its patent portfolio, it's likely that Microsoft holdspatents which a complete standard implementation probably infringeseven if it's not strictly necessary—maybe the patent covers astraightforward speed optimization, or some common way of performingsome task. The Community Promise doesn't say anything about thesepatents, and so Microsoft can still use them to threaten standardimplementations.

Moving the Goalposts

Let's say you've written an implementation of one of thespecifications covered by the Community Promise, and you want todetermine whether or not you'll be sued for infringing a certainMicrosoft patent. The necessity question already makes it difficultenough to figure this out. But even if you manage it, you should makesure you check again tomorrow, because the Community Promise might notprotect you then.

The Community Promise does not give you any rights to exercise thepatented claims. It only says that Microsoft will not sue you overclaims in patents that it owns or controls. If Microsoft sells one ofthose patents, there's nothing stopping the buyer from suing everyonewho uses the software.

The Solution: A Comprehensive Patent License

If Microsoft genuinely wants to reassure free software users that itdoes not intend to sue them for using Mono, it should grant the publican irrevocable patent license for all of its patents that Monoactually exercises. That would neatly avoid all of the existingproblems with the Community Promise: it's broad enough in scope thatwe don't have to figure out what's covered by the specification orstrictly necessary to implement it. And it would still be in forceeven if Microsoft sold the patents.

This isn't an unreasonable request, either. GPLv3 requiresdistributors to provide a similar license when they convey modifiedversions of covered software, and plenty of companies large and smallhave had no problem doing that. Certainly one with Microsoft'sresources should be able to manage this, too. If they're unsure howto go about it, they should get in touch with us; we'd be happy towork with them to make sure it's satisfactory.

Until that happens, free software developers still should not writesoftware that depends on Mono. C# implementations can still beattacked by Microsoft's patents: the Community Promise is designed togive the company several outs if it wants them. We don't want to seedevelopers' hard work lost to the community if we lose the ability touse Mono, and until weeliminate software patents altogether,using another language is the best way to prevent that from happening.