Status of .NET reference source

Question

Hi guys,

.NET Reference source is build specific. The initial scope of Reference source was RTM releases for a limited set of .NET managed sources ('RTM' includes .NET Framework builds included with OS service packs and redistributable releases).

The original design didn't include infrastructure to collect/publish reference sources for patches/hotfixes done in the process of servicing.

This means that the reference sources that may not be published could be specific to a small fileset that was later released in a servicing update. We're having a look at the servicing build infrastructure for improvements to also push up the more widely distributed servicing updates. Unfortunately the way the servicing build system works, this would be something fixed on a go forward basis. 

As for Vista SP2 and Win7 RTM, those sources have been published for the majority of in demand .NET reference sources.

**We're working on doing additional refreshes to expand the set of managed sources published over the next few months.**

An update on VS10/.NET 4:
That release has a different reference source infrastructure which is currently getting tooling put in place. We hope to get a first pass publication of a core set of .NET 4 Beta 2 sources by late Nov./early Dec.

Thanks,
Chris

Answer 1

Any chance on getting the symbols for System.Web.dll 2.0.50727.3082?

Answer 2

That build is a servicing related build, so it falls in the category of 'working on it', but on a go forward basis. The infrastructure for retaining the necessary symbols for servicing patches wasn't in scope for the initial source stepping feature and support.

However, there are also larger servicing related releases that supercede that particular binary that are reference source posted. Vista SP2 for instance updated that binary to a reference source posted version of 2.0.50727.4016.

Answer 3

Chris,

I do appreciate your role as "the guy who was sent to talk to the angry people in the RS forum", but could translate this into something that might be understood outside MS, please:

"That build is a servicing related build, so it falls in the category of 'working on it', but on a go forward basis ."

I'm guessing that roughly means:

"Version 2.0.50727.3082 was shipped as part of a hotfix, between our major releases.  We're hoping to make source for these interim versions available, but I can't say when it will happen".

Is that a fair summary for us humble straw-chewing provincial types?

While I have your attention, does the responsibility for .NET reference source fall on anyone who works for ScottGu (I was told it was going to be moved to his team sometime this year), or is it someone else?   If so, could you give us their name, please - I'm certainly not intending to drop you in any trouble, but someone senior at MS needs a rocket up their backside for the way the RS project has been handled, and I'm currently trying to find out who it is.

Thanks,

Will

Answer 4

Chris,

I do appreciate your role as "the guy who was sent to talk to the angry people in the RS forum", but could translate this into something that might be understood outside MS, please:

"That build is a servicing related build, so it falls in the category of 'working on it', but on a go forward basis ."

I'm guessing that roughly means:

"Version 2.0.50727.3082 was shipped as part of a hotfix, between our mjor releases.  We're hoping to make source for these interim versions available, but I can't say when it will happen".

Is that a fair summary for us humble straw-chewing provincial types?

While I have your attention, does the responsibility for .NET reference source fall on anyone who works for ScottGu (I was told it was going to be moved to his team sometime this year), or is it someone else?   If so, could you give us their name, please - I'm certainly not intending to drop you in any trouble, but someone senior at MS needs a rocket up their backside for the way the RS project has been handled, and I'm currently trying to find out who it is.

Thanks,

Will

It seems the info is expired, Any latest news?

Answer 5

Outside of RTM and service pack releases, security events are the majority widespread "out of band" releases which occur. Due to the risks involved in publishing source for security fixes, particularly for unpatched customers, there are no plans at this time to reference source publish those security fixes at the same time the "hotfix" or "out of band" security release occurs.

Meanwhile, a workaround is to do source stepping against an RTM or service pack major release.

We'll continue to evaluate the convenience needs here with our potential future servicing strategies (hotfix rollup's, etc.)

Respectfully,

Chris

Answer 6

Hi Chris,

IMHO, if an attacker is interested in exploiting .NET, he can do that without having the reference source, since .NET can be inspected with a disassembler anyway. Not publishing the reference source only causes problems (to developers) and creates a false sense of security to unpatched customers.

Regards,
George