Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects

Won the Distinguished Paper Award (4 out of 147 papers).

Abstract

Open Source Software plays an important role in many software ecosystems. Whether in operating systems, network stacks, or as low-level system drivers, software we encounter daily is permeated with code contributions from open source projects. Decentralized development and open collabora- tion in open source projects introduce unique challenges: code submissions from unknown entities, limited personpower for commit or dependency reviews, and bringing new contributors up-to-date in projects’ best practices & processes.

In 27 in-depth, semi-structured interviews with owners, main- tainers, and contributors from a diverse set of open source projects, we aim to investigate their security and trust prac- tices. For this, we explore projects’ behind-the-scene processes, provided guidance & policies, as well as incident handling & encountered challenges. We find that our participants’ projects are highly diverse both in deployed security measures and trust processes, as well as their underlying motivations. Based on our findings, we discuss implications for the open source software ecosystem and how the research community can better support open source projects in trust and security considerations.

Overall, we argue for supporting open source projects in ways that consider their individual strengths and limitations, especially in the case of smaller projects with low contributor numbers and limited access to resources.

Reference

@inproceedings{conf/oakland/wermke22,
 author = {Dominik Wermke and
Noah Wöhler and
Jan H. Klemmer and
Marcel Fourné and
Yasemin Acar and
Sascha Fahl},
 booktitle = {43rd IEEE Symposium on Security and Privacy, IEEE S\&P 2022, May 22-26, 2022},
 month = {May},
 publisher = {IEEE Computer Society},
 title = {Committed to Trust: A Qualitative Study on Security \& Trust in Open Source Software Projects},
 year = {2022}
}