File(s) not publicly available

Committed to Trust: A Qualitative Study on Security and Trust in Open Source Software Projects

conference contribution
posted on 2023-11-29, 18:20 authored by dominik.wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar, Sascha FahlSascha Fahl
Open Source Software plays an important role in many software ecosystems. Whether in operating systems, network stacks, or as low-level system drivers, software we encounter daily is permeated with code contributions from open source projects. Decentralized development and open collaboration in open source projects introduce unique challenges: code submissions from unknown entities, limited personpower for commit or dependency reviews, and bringing new contributors up-to-date in projects' best practices & processes. In 27 in-depth, semi-structured interviews with owners, maintainers, and contributors from a diverse set of open source projects, we investigate their security and trust practices. For this, we explore projects' behind-the-scene processes, provided guidance & policies, as well as incident handling & encountered challenges. We find that our participants' projects are highly diverse both in deployed security measures and trust processes, as well as their underlying motivations. Based on our findings, we discuss implications for the open source software ecosystem and how the research community can better support open source projects in trust and security considerations. Overall, we argue for supporting open source projects in ways that consider their individual strengths and limitations, especially in the case of smaller projects with low contributor numbers and limited access to resources.


Preferred Citation

Dominik Wermke, Noah Wöhler, Jan Klemmer, Marcel Fourné, Yasemin Acar and Sascha Fahl. Committed to Trust: A Qualitative Study on Security and Trust in Open Source Software Projects. In: IEEE Symposium on Security and Privacy (S&P). 2022.

Primary Research Area

  • Empirical and Behavioral Security

Name of Conference

IEEE Symposium on Security and Privacy (S&P)

Legacy Posted Date


Open Access Type

  • Unknown


@inproceedings{cispa_all_3599, title = "Committed to Trust: A Qualitative Study on Security and Trust in Open Source Software Projects", author = "Wermke, Dominik and Wöhler, Noah and Klemmer, Jan H. and Fourné, Marcel and Acar, Yasemin and Fahl, Sascha", booktitle="{IEEE Symposium on Security and Privacy (S&P)}", year="2022", }

Usage metrics


    No categories selected


    Ref. manager