Trusting code in the wild: Exploring contributor reputation measures to review dependencies in the Rust ecosystem

TL;DR

This paper investigates how contributor reputation, measured via network centrality, can help developers prioritize dependency reviews in the Rust ecosystem, proposing a reputation badge to improve security practices.

Contribution

It introduces a novel approach using network centrality measures to quantify contributor reputation and suggests implementing reputation badges to assist dependency review processes.

Findings

51% of developers consider contributor reputation when reviewing dependencies

Closeness centrality significantly influences dependency review decisions

Reputation badges could aid developers in prioritizing dependency reviews

Abstract

Developers rely on open-source packages and must review dependencies to safeguard against vulnerable or malicious upstream code. A careful review of all dependencies changes often does not occur in practice. Therefore, developers need signals to inform of dependency changes that require additional examination. The goal of this study is to help developers prioritize dependency review efforts by analyzing contributor reputation measures as a signal. We use network centrality measures to proxy contributor reputation using collaboration activity. We employ a mixed method methodology from the top 1,644 packages in the Rust ecosystem to build a network of 6,949 developers, survey 285 developers, and model 5 centrality measures. We find that only 24% of respondents often review dependencies before adding or updating a package, mentioning difficulties in the review process. Additionally, 51% of respondents often consider contributor reputation when reviewing dependencies. The closeness centrality measure is a significant factor in explaining how developers review dependencies. Yet, centrality measures alone do not account for how developers choose to review dependencies. We recommend that ecosystems like GitHub, Rust, and npm implement a contributor reputation badge based on our modeled coefficients to aid developers in dependency reviews.