Amazon Web Services (AWS) has formally severed its association with the open-source project Moq due to the project’s recent controversy over undisclosed data collection features, which was initially reported by BleepingComputer.
Moq, a widely utilized library listed on the NuGet software registry, was found to be surreptitiously collecting hashes of developer email addresses from the machines on which it was installed. This covert data gathering began after the developer of Moq incorporated his contentious SponsorLink dependency into the project without prior notice.
AWS’ Disassociation from Moq
The Moq project, which is maintained by contributors including Daniel Cazzulino (kzu), faced substantial backlash following the release of version 4.20, which included the controversial SponsorLink package without any prior notification.
The integration of the closed-source SponsorLink package led to the collection of SHA-256 hashes of developer email addresses from local Git configurations, subsequently uploading this data to SponsorLink’s content delivery network (CDN).
In response to this development, numerous developers opted to cease using Moq in favor of alternative solutions or even proposed the development of tools designed to detect and block projects running SponsorLink.
Some developers went a step further, expressing their intention to boycott projects associated with SponsorLink or report SponsorLink as “malware” to the NuGet registry.
Beyond the debate over whether Moq or SponsorLink adhered to open-source community expectations, a significant concern among users was whether this data collection violated privacy legislation, such as GDPR. It’s noteworthy that a German court had previously ruled that SHA-256 hashing was insufficient for data anonymization.
The developer eventually reverted the controversial change in Moq version 4.20.2, citing compatibility issues with MacOS as the reason, a decision that elicited further criticism.
However, despite these revisions, there remains a level of suspicion among users regarding the potential reintroduction of similar “features” in future Moq releases.
Amazon Web Services, aligning with numerous other stakeholders, has distanced itself from Moq and withdrawn its endorsement of the open-source project.
AWS’ open-source advocate submitted a code change to Moq, requesting the removal of references to AWS from the project, as reported by BleepingComputer.
The developer responded by replacing the manually crafted “Sponsors” list with an “auto-updated” version, as indicated in the pull request.
SponsorLink Goes Open Source
In a related development, in response to persistent feedback from its user base, the developer has now made the SponsorLink project open source.
The transition to open source, as explained by the developer, is aimed at making SponsorLink “less effective in contributing to an OSS project’s long-term sustainability.”
Despite these efforts to address concerns within Moq and SponsorLink, it may take some time for these projects to regain the trust of the open-source community.
