Grant: Discovery Grants Program - Individual

A software ecosystem is the interaction of a set of actors (e.g., code contributors and consumers) on top of a common technological platform (e.g., Node.js) that results in a number of software solutions or services. These software ecosystems allow developers to easily share and reuse other's code, reducing development time. The openness of these ecosystems, which allows anyone to contribute and/or reuse code, is a major contributor to their success and rapid growth. For example, the node package manager (npm) hosts approximately 1.2 million packages. Although this openness is generally a positive trait, it also poses a major risk since it requires consumers to trust the ecosystem contributor's developers/organizations - people they generally know very little about. This notion of trust needs to be better understood and supported if ecosystems are to thrive in the future. Therefore, the objective of the proposed research is to improve trust in software ecosystems. Specifically, I plan to accomplish my objective by 1) empirically examining trust-related issues faced by ecosystem consumers; 2) developing actionable analytics and models to help warn about trust issues in ecosystem contributions; and 3) providing mitigations for trust-related issues facing ecosystem consumers. The successful completion of this program will enable ecosystem consumers better leverage software ecosystems. Consumers of the ecosystem will have novel analytics and models to gauge how well they can trust their dependencies. Also, ecosystem consumers will have potential mitigations that they can apply to help increase trust in the ecosystem contributions they depend on. Large-scale empirical studies will be performed to validate the effectiveness of the proposed analytics, models and mitigations. These empirical studies will be performed using many different ecosystems, analysis techniques and involve multiple stakeholders to to improve the generalizability of the program's outcomes. The proposed research will have a direct impact on the software engineering research and practice because it will advance the field by providing pragmatic techniques, based on novel, actionable analytics and models. Furthermore, the proposed research will expose, train and enable highly qualified personnel to learn and contribute to the state-of-the-art in the increasingly important topic of software ecosystems.