Modeling Interconnected Social and Technical Risks in Open Source Software Ecosystems

TL;DR

This paper presents a framework to assess systemic risks in open source ecosystems by analyzing how social and technical factors, such as developer activity and dependency failures, interact and impact ecosystem resilience.

Contribution

It introduces a novel methodological framework that jointly considers social and technical risks in open source ecosystems, highlighting systemic vulnerabilities and intervention strategies.

Findings

Identifies key libraries that are systemically important but overlooked by dependency analysis.

Demonstrates how developer departure and dependency failures jointly increase risk.

Suggests targeted interventions to improve ecosystem resilience.

Abstract

Open source software ecosystems consist of thousands of interdependent libraries, which users can combine to great effect. Recent work has pointed out two kinds of risks in these systems: that technical problems like bugs and vulnerabilities can spread through dependency links, and that relatively few developers are responsible for maintaining even the most widely used libraries. However, a more holistic diagnosis of systemic risk in software ecosystem should consider how these social and technical sources of risk interact and amplify one another. Motivated by the observation that the same individuals maintain several libraries within dependency networks, we present a methodological framework to measure risk in software ecosystems as a function of both dependencies and developers. In our models, a library's chance of failure increases as its developers leave and as its upstream dependencies fail. We apply our method to data from the Rust ecosystem, highlighting several systemically important libraries that are overlooked when only considering technical dependencies. We compare potential interventions, seeking better ways to deploy limited developer resources with a view to improving overall ecosystem health and software supply chain resilience.