Open Source Software and Ecosystem

The .NET ecosystem has an open source problem it has not been honest about. A small number of unpaid maintainers ship the libraries that fund entire commercial product lines, and the sustainability math has never worked. The articles in this collection take that as a starting point rather than treating OSS as a feel-good background to a Microsoft keynote. License choices, funding models, and the relationship between corporate consumption and individual burnout are the actual subject, not a footnote.

A recurring theme is the .NET Foundation and what it does — and does not — do for the projects under its umbrella. Governance, neutral IP ownership, and a working CoC matter, but none of that pays a maintainer’s hosting bill. Articles examine where the Foundation has helped, where its mandate stops, and which projects have moved on for reasons worth taking seriously.

The author maintains NetEvolve and writes from that side of the table. That perspective shows up in posts about issue triage at scale, the cost of supporting old framework targets, dependency vulnerability response when you are also a consumer of the same dependencies, and the slow erosion that happens when a library becomes critical to companies that have never opened an issue. Maintainer fatigue is not a personality trait, it is a structural outcome.

License and funding tensions get specific attention. The shift from permissive to source-available licenses, the legal grey zones around AI training on public repos, and the increasingly common move to dual licensing all have direct consequences for what a .NET shop can safely depend on. Articles cover how to read a license change as a signal about a project’s economics, not just its legal terms.

Expect direct takes on which corporate sponsorship models actually reach maintainers, which OSS hygiene practices matter on the consumer side, and where the polite fiction of a “healthy ecosystem” no longer matches what maintainers are saying out loud.

My Analyzer Shipped Without Checking Its Own Source

My Analyzer Shipped Without Checking Its Own Source

NetEvolve.Analyzer enforces null-check idioms and file organization on other people’s code, but had never run against its own. Fixing that surfaced 39 warnings, a silent Visual Studio MEF failure, and a follow-up NE0008 bug where DateOnly and TimeOnly got flagged blind to which target framework actually has them, the same multi-targeting blindness in a different corner of the codebase.
Cyber Resilience Act for .NET Library Authors: Read the Fine Print

Cyber Resilience Act for .NET Library Authors: Read the Fine Print

The EU Cyber Resilience Act’s headline deadline is December 2027, but the reporting clock starts more than a year earlier. Article 14 vulnerability reporting applies from September 2026. Here is the engineering map I built for my own NuGet release pipeline: what the CRA regulates, the 24/72-hour cadence, SBOM tooling for .NET, and where the open-source carve-out holds.
2025 in Review: The Year .NET Stopped Lying to Itself

2025 in Review: The Year .NET Stopped Lying to Itself

Forget the hype—2025 was when .NET tooling finally stopped pretending complexity doesn’t exist Three tools won by being honest: Aspire exposed topology, TUnit killed flaky tests, Testcontainers made infrastructure real