OStatic

There was a bit of a kerfluffle over at Microsoft's CodePlex site last week. It seems that an internal Microsoft project, Sandcastle (a documentation compiler for .NET) was published, ostensibly under the Ms-PL, without including source code. Microsoft's open source honcho Sam Ramji found out about this, apologized to the open source community, and had the project pulled. But will the story end there?

According to Ramji, the project may yet come back to CodePlex, source code and all. But what if it doesn't? Doesn't Microsoft have some commitment or responsibility to those who downloaded the project while it was out there under the Ms-PL?

Certainly it seems that anyone who downloaded Sandcastle while it was on CodePlex is now covered by section 2A of the Ms-PL:

Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free copyright license to reproduce its contribution, prepare derivative works of its contribution, and distribute its contribution or any derivative works that you create.

 So it shouldn't be a problem for those downloaders to make copies of Sandcastle and put it up on web sites for the unhappy people who can't download it directly from Microsoft right now.

But what about the source code? Does Microsoft have to make source available to those downloaders? My guess is "probably not" - but I'd dearly love to hear from open source lawyers on this issue. If not, is there any limit to a company who wants to play this sort of bait and switch game deliberately?

There's no evidence that this was anything other than an honest mistake; I'm thinking about the future. Can a company put a project out under an open source license for weeks, months, years and then suddenly claim a "do over" merely by removing the current downloadable copy from the web?

Hopefully, this particular case will resolve with Microsoft bringing back the project, and its source code. But open source users might want to think about what it means for trusting open source vendors in the future.

• sandcastle
• ms-pl