Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects

Open Source Software plays an important role in many software ecosystems. Whether in operating systems, network stacks, or as low-level system drivers, software we encounter daily is permeated with code contributions from open source projects. Decentralized development and open collaboration in open...

Full description

Saved in:
Bibliographic Details
Main Authors: Wermke, Dominik, Wohler, Noah, Klemmer, Jan H., Fourne, Marcel, Acar, Yasemin, Fahl, Sascha
Format: Conference Proceeding
Language:English
Subjects:
Atmospheric measurements
Codes
Ecosystems
interviews
open-source
Particle measurements
Privacy
Security
Soft sensors
trust
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Open Source Software plays an important role in many software ecosystems. Whether in operating systems, network stacks, or as low-level system drivers, software we encounter daily is permeated with code contributions from open source projects. Decentralized development and open collaboration in open source projects introduce unique challenges: code submissions from unknown entities, limited personpower for commit or dependency reviews, and bringing new contributors up-to-date in projects' best practices & processes.In 27 in-depth, semi-structured interviews with owners, maintainers, and contributors from a diverse set of open source projects, we investigate their security and trust practices. For this, we explore projects' behind-the-scene processes, provided guidance & policies, as well as incident handling & encountered challenges. We find that our participants' projects are highly diverse both in deployed security measures and trust processes, as well as their underlying motivations. Based on our findings, we discuss implications for the open source software ecosystem and how the research community can better support open source projects in trust and security considerations. Overall, we argue for supporting open source projects in ways that consider their individual strengths and limitations, especially in the case of smaller projects with low contributor numbers and limited access to resources.
ISSN:2375-1207
DOI:10.1109/SP46214.2022.9833686