Comment by viraptor | Hacker News Reader

Comment by viraptor | Hacker News Reader

.net meant a Microsoft lock-in for a long time, so actual visual studio, Microsoft server, etc. with all the licensing issues attached to that. And as a simple web hosting solution, windows sucks whether you're thinking of third party hosting platforms, or your own deployments with automation.

But that changed a few years ago with dotnet being available for Linux and quite a bit more open. While you still effectively need VS to work with Blazor (or suffer), there are many other options for typical web apps. Whether you want to go MVC or something more bare bones, it's definitely a good option.

As to why it's not a popular option: I would guess that proper Linux dotnet has not been out for long enough to really change the idea of what .net4 was/meant. This applies to both sides too - there's lots of old .net people still unreasonably allergic to open source. I've used it for server apps on Linux when Mono was still the only option and was happy with it already then. It's a good system - go for it.

Hard to believe that .NET is now on Linux - .NET 4.0 feels like yesterday. The Windows factor was a big scare factor for me for sure; I won’t forget the time a client spent more than 70% of their hosting budget on Microsoft licensing fees…

Also, .NET loves leaving core features to paid/freemium third parties/cloud instead of offering it as a first class open source component. It makes it hard to justify buying into the ecosystem when it's a blatant funnel. Just look at how they do their OAuth:

https://learn.microsoft.com/en-us/aspnet/core/security/authe...

All cloud/paid solutions. At one point they were all in on open source but the tune quickly changed when they saw how much profit they were leaving on the table.

OAuth is an internet standard and you can write a client in literally C if you in any way know HTTP, and I do mean YOU can do it.

I haven't been very deep in the .net ecosystem but haven't had any issues implementing an api woth auth and rate limiting etc using dotnet and nothing Microsoft licensed.

For a small/solo team, which is the audience under consideration, they probably want to spend their time on their core product and not reimplementing oauth.

in what world would a business pay me to write an oauth client instead of just reaching one of the dozens of open source implementations?

I'm not saying they need to reimplment it. My argument is that it is absurdly simple in any batteries included stack to do OAuth even without specific support, not that .NET doesn't have a multitude of open source implementations that isn't what OP mentioned.

It's an API call to an external provider and like 2 endpoints on your side. If this doesn't take you at most a few hours to implement yourself then I don't think you should be relying on a library in the first place, go implement it in your spare time. Then you can use the library with your new found understanding of how absurdly easy it is.

Maybe you will learn about implicit flows and how OIDC would allow you to validate JWTs and never have to write a single line of server code to deal with OAuth.

Maybe you will learn about SCIM[1] and all the interesting stuff related to auth that you never bothered learning because the library does that. Maybe the business that is paying you would prefer SCIM + SAML/OIDC but you could not even begin to discuss is because your library doesn't do that.

[1] https://scim.cloud/

To be more precise: MS loves to make you think you need those, see also WebSocket support. But in reality you don’t need that, if you know what you are doing. Also don’t implement your authorization server folks, at least when possible.

> At one point they were all in on open source but the tune quickly changed when they saw how much profit they were leaving on the table.

Correction: At one point they said they were all-in on open source - 10 minutes after creating an innovative new open source product called ".net core", which is exactly like .net, but with all of the features you might actually be interested in stripped out.

Nobody in my circle talks about .net because we all saw immediately that it was just the same act again, if somewhat less openly hostile than Microsoft's previous MO.

What was the crucial functionality stripped in Core that's not completely MS-specific?

Nice trap!

But the things they stripped out that you say were "ms-specific" were only "ms-specific" because they didn't bother to port them along with the rest of core...

...And as a result, core didn't contain anything interesting, and there's no reason you'd use it.

Which is why nobody did

Reply on news.ycombinator.com