Open Source Software

Open Source Supply Chain

Open Source code appears as foundation, glue, or during the build process in many software projects.

Protestware

To what extent should one trust a statement that a program is free of Trojan horses. Perhaps it is more important to trust the people who wrote the software.

Research Questions

• RQ1:
  How are open source projects structured behind-the-scenes?
• RQ2:
  If and what guidance and policies are provided by open source projects?
• RQ3:
  How do open source projects approach security and trust challenges?

Email

				Dear `[name]`,
				
				Best regards,
				`[researcher]`
					

				Dear `[name]`,
				
				We are a group of researchers and contacting you due to your involvement
				in the `[project name]` project on GitHub.
				We are interested in how popular and active open source project
				communities tackle trust & security and would love to interview
				you about it.
				
				Best regards,
				`[researcher]`
					

				Dear `[name]`,
				
				We are a group of researchers and contacting you due to your involvement
				in the [project name] project on GitHub.
				We are interested in how popular and active open source project
				communities tackle trust & security and would love to interview
				you about it.
				
				We are not trying to sell anything, you & the project would be
				treated completely anonymously.
				We hope your answers and our findings will help with further
				improving security & trust procedures in the open-source community.
				
				Best regards,
				`[researcher]`
					

				Dear `[name]`,
				
				We are a group of researchers and contacting you due to your involvement
				in the [project name] project on GitHub.
				We are interested in how popular and active open source project
				communities tackle trust & security and would love to interview
				you about it.
				
				We are not trying to sell anything, you & the project would be
				treated completely anonymously.
				We hope your answers and our findings will help with further
				improving security & trust procedures in the open-source community.
				
				If an interview sounds interesting to you, feel free to check out
				our landing page for this research with more information:
				`[landing page URL]`
				
				Simply respond to this email with your preferred time slots and
				we will work something out.
				
				Lastly, we are very sorry to take up your valuable time with this email.
				Regrettably, cold emailing is an approach to reach a more diverse set
				of projects. If you do not want to participate, please accept our
				deepest apologies and simply ignore this email,
				we will not contact you again.
				
				Best regards,
				`[researcher]`
					

Community Channels

				Hi `[project name]` community,
				
				We are a group of researchers from `[affiliations]` and
				we are interested in how open source projects tackle
				trust & security and would love to interview someone
				from the community about it.
				
				Our Landing page: `[landing page URL]`
				
				You can message me directly here on `[platform]` if you
				have any questions or want to schedule an interview!
				
				Thanks for your time,
				`[researcher]`
					

• Moderator

  (12:14PM, Today)

  Hmm, nobody ever contacted us for posting something like this before 🤔
• Sure, go ahead.

  But we decided to update the rules for the future 🔨🔨

Interviews

Demographics

Demographics

Distribution

Contributors are often highly distributed

But to be honest, I don’t really mind. As long as one has the same interests, it’s still easy to collaborate if you have the same goal.

Interviews

Interviews

Security Challenges

Past Incidents

Past Incidents

Past Challenges

[T]here’s definitely been people that have intentionally tried to put malicious code in projects, but it’s always very easy to spot immediately. It’s like those spam emails where they have bad grammar and stuff

Hypocrite Commit

Hypocrite Commit

Hypocrite Commit

I do understand both sides of this […] It would be much better if this kind of research was done in cooperation with somebody at the Linux kernel, who knew that it’s happening and without disclosing that to a lot of people.

Guidance & Policies

Guidance

Guidance

Somebody would have to write the guide, and I am the only one who can write it. I mean, there is nobody paid to write it and I am also not paid to write it.

Trust Processes

Trust Incidents

Trust Incidents

Trust Incidents

Opinions & Improvements

Reputation

Amongst the people on the project, everybody trusts it a lot.

We follow very, very high standards there, mainly because we have a few people who are very, very keen on that.

Reputation

Improvements

Improvements

If I could, I would write the entire stack myself.

[…] I would rewrite a lot of the code. That’s just a historical thing, because it has already become big and complex […] It’s just like building a house; you’d have to build it three times before it becomes good.

“What I’d like to do is oxidize [the project] over time, to integrate Rust and Rust code into the codebase – which is quite an undertaking […] and an incredibly tedious task to do it well."

Improvements

So the first thing I do is that a group of people would review every pull request exclusively from the view of security.

“I could always use more participants in the review process and so if I could hire some people, if I had the disposable income to do that, I would probably hire people to get more eyes on pull requests than just myself […]"

Improvements

[W]ith unlimited resources, I would like some more investment into automatic tools that are better in like finding vulnerabilities and problems with code

“I think getting more tools and more CI-type tools to watch for that, because I think humans are vulnerable […] If I had unlimited budget and unlimited engineers, I’d really work on improving our testing systems."

Summary

Summary

Open Source Supply Chain

Open Source code appears as foundation, glue, or during the build process in many software projects.

Closing

• Against treating open source developers solely as data sources and review process blackboxes
• For supporting open source projects in ways that better consider their individual strengths and limitations

Committed to Trust

Additional Slides

Project Demographics

Project Structure

Release & Updates

• Releases and updates based on direct community input and feedback
• Exceptions from schedule for vulnerability fixes

Roles & Responsibilities

• Projects have a variety of contributor hierarchies which are mostly relatively flat with two levels
• Most of the projects do not staff teams dedicated to project security