论文标题
部分可观测时空混沌系统的无模型预测
Modeling Interconnected Social and Technical Risks in Open Source Software Ecosystems
论文作者
论文摘要
开源软件生态系统由数千个相互依存的库组成，用户可以将其结合起来。最近的工作指出了这些系统中的两种风险：诸如错误和漏洞之类的技术问题可以通过依赖关系链接传播，并且相对较少的开发人员甚至负责维护最广泛使用的库。但是，软件生态系统中系统风险的更全面诊断应考虑这些社会和技术风险来源如何相互作用和扩大彼此。通过观察到同一个人在依赖性网络中维护多个库的动机，我们提出了一个方法学框架，以衡量软件生态系统的风险，这是依赖关系和开发人员的函数。在我们的模型中，随着开发人员的离开以及上游依赖性的失败，图书馆的故障机会增加了。我们将我们的方法应用于Rust生态系统的数据，突出显示了仅在考虑技术依赖性时被忽略的几个系统重要的库。我们比较潜在的干预措施，寻求更好的方法来部署有限的开发人员资源，以改善整体生态系统健康和软件供应链弹性。
Open source software ecosystems consist of thousands of interdependent libraries, which users can combine to great effect. Recent work has pointed out two kinds of risks in these systems: that technical problems like bugs and vulnerabilities can spread through dependency links, and that relatively few developers are responsible for maintaining even the most widely used libraries. However, a more holistic diagnosis of systemic risk in software ecosystem should consider how these social and technical sources of risk interact and amplify one another. Motivated by the observation that the same individuals maintain several libraries within dependency networks, we present a methodological framework to measure risk in software ecosystems as a function of both dependencies and developers. In our models, a library's chance of failure increases as its developers leave and as its upstream dependencies fail. We apply our method to data from the Rust ecosystem, highlighting several systemically important libraries that are overlooked when only considering technical dependencies. We compare potential interventions, seeking better ways to deploy limited developer resources with a view to improving overall ecosystem health and software supply chain resilience.
