Computer Didn't Say No

So I don't know if you saw the news.

Well, I do know you saw the news, I should say, this week because you sent me a link about some exciting news about AI.

Yeah.

But before we get into that.

Yes.

I want to follow up on our last episode.

Yep.

So interestingly, this has come up over the past couple of weeks in a couple of the communities.

So it's come up on the Aspire Discord and there was actually a Reddit thread about it as well.

And we were wrong.

We missed something important, right? And in fairness, in defense of ourselves, it is a bit confusing.

But basically, the OSMF, the Open Source Maintenance Fund, specifically says that you are not responsible for transitive dependencies.

yes yeah yeah so well in our defense we were discovering that live on that recording yes so we didn't we didn't have a chance to actually pull it apart that's right more than what we did

yeah so but the thing is like and also in our defense it is confusing because it literally says you need to audit all of your dependencies and their dependencies yeah and that's how you figure out what you've got to what you've got to pay but That's not the case.

So, I mean, it's still like the specific thread on Reddit that I saw today is interesting in that it says that that's not good enough and it's still confusing.

And there's a lot of discussion on there about how there is risk that you are taking on this dependency.

The other thing is that a really interesting thing is people talking about this is something that we've spoken about before.

And actually, Jimmy brought it up and it doesn't get spoken about enough.

But in the real world, there's this pesky little thing called procurement.

And,

you know, like,

yeah, I mean, a procurement manager would look at that as a risk and just say, nah, can't do it.

But here's the other interesting thing, which is that, do you remember we speculated that maybe Microsoft have done some kind of deal? Yeah.

That effectively seems to be the case because Microsoft cannot distribute this without licensing it.

and they are so you so you don't have to you as a consumer of say poly because that was a sorry as of aspire yes that's our reference but even actually the the the one on github uh sorry the one on reddit was talking specifically about microsoft.extensions.resilience right Mm-hmm.