Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities

  • Abstract
  • Literature Map
  • Similar Papers
Abstract
Translate article icon Translate Article Star icon

Vulnerability reports play a crucial role in mitigating open-source software risks. Typically, the vulnerability report contains affected versions of a software. However, despite the validation by security expert who discovers and vendors who review, the affected versions are not always accurate. Especially, the complexity of maintaining its accuracy increases significantly when dealing with multiple versions and their differences. Several advances have been made to identify affected versions. However, they still face limitations. First, some existing approaches identify affected versions based on repository-hosting platforms (i.e., GitHub), but these versions are not always consistent with those in package registries (i.e., Maven). Second, existing approaches fail to distinguish the importance of different vulnerable methods and patched statements in face of vulnerabilities with multiple methods and change hunks.

Similar Papers
  • Research Article
  • Cite Count Icon 1
  • 10.12720/jcm.8.10.665-671
Competition between Free Open Source, Commercial Open Source and Proprietary Software
  • Jan 1, 2013
  • Journal of Communications
  • Mingqing Xing

This paper investigates competition between open source and proprietary software. Open source software is divided into two types: free open source and commercial open source. Free open source software can be available from the not-for-profit community, and Commercial open source software is software product based on free open source software. The usability of both free and commercial open source software is assumed to be inferior to proprietary software. It finds that: (i) when commercial open source vendor faces competition from proprietary software and free open source software, it may still be able to obtain profits; (ii) commercial open source vendor's pricing (resp. share or profit) may still be much lower (resp. less) than that of proprietary vendor even if its software functionality is not inferior to proprietary software; (iii) commercial open source vendor's pricing and profit may not increase as its software usability increases; (iv) proprietary software's price decreases with the usability of commercial open source software. Index Terms—proprietary software, open source software, price competition, software features, software usability

  • Front Matter
  • Cite Count Icon 63
  • 10.1186/gb4173
On the middle ground between open source and commercial software - the case of the Newbler program
  • Jan 1, 2014
  • Genome Biology
  • Alexander J Nederbragt

On the middle ground between open source and commercial software - the case of the Newbler program

  • Research Article
  • Cite Count Icon 1
  • 10.14257/ijunesst.2016.9.6.11
The Impact of Community and Commercial Open Source Software on the Quality Strategies of Software Producers
  • Jun 30, 2016
  • International Journal of u- and e- Service, Science and Technology
  • Mingqing Xing + 1 more

This study investigates how open source software can play influences on the quality choices of commercial open source and proprietary software providers. It considers two types of open source software: community open source and commercial open source, and assumes that the usability of commercial open source software is better than community open source substitute but inferior to proprietary substitute. It finds that: (i) the functional quality of proprietary software decreases as the functional quality of community open source software increases, but it may increase as the usability of community open source software increases; (ii) even if commercial open source producers must open the source codes of their quality contributions, they have incentive to enhance the functional quality of community open source software; (iii) the influence of community open source software’s quality (usability or functional quality) or commercial open source software’s usability on the functional quality of commercial open source and proprietary software may be not same; (iv) the appearance of commercial open source software may lead to proprietary software producers lowering their software functional quality.

  • Research Article
  • Cite Count Icon 1
  • 10.30977/bul.2219-5548.2020.90.0.7
Analysis of the development of open GIS software and QGIS system
  • Dec 20, 2020
  • Bulletin of Kharkov National Automobile and Highway University
  • Olga Kovalova

Abstract. Open source software could emerge thanks to the development of the Internet, development tools, and computer literacy in general. The most attractive parameter of open source GIS software is a free license. The rapid pace of development, attracting developers from all over the world and high modularity stimulate the innovative nature of open source software. Here, the introduction of new technologies does not meet with opposition, but rather welcomes. These circumstances, as well as elucidation of the functional capabilities of such GIS, become very important in the search for means of providing the educational process with modern GIS software, which is traditionally an expensive proprietary software. Goal: Analysis of up-to-date GIS software protection and visual accessibility of the QGIS system in the first place with studying geoinformation systems.Quantum GIS (QGIS) is an open source software (GIS) geographic information system (GIS). Open software is one of the most interesting technological phenomena of the present, owing to its rapid growth in the development of the Internet, development tools and computer literacy in general. The key role in the creation, development and support of open source software is played, as a rule, by the community of developers forming around individual software products: commercial companies, groups of enthusiasts or research organizations. The term open source was proposed by Bruce Perens, one of the key leaders in the Open Source and Free Software movement, cofounder with Eric Raymind in 1998 of the Open Source Initiative (OSI), an open source software development organization that promotes and provides technical open source support. This open source term is used by OSI to determine whether a software license complies with open source standards. The main features of open source software as defined include free distribution, accessible source code, permission to modify this source code. At the same time, even successful open source software products require companies on the market ready to provide technical support and advice on issues related to the selected products. However, the number of companies providing support services for open source GIS software is still relatively small.

  • Conference Article
  • Cite Count Icon 2
  • 10.1109/iceee.2010.5660722
The Research on Differentiation Decisions between Open Source and Proprietary Software
  • Nov 1, 2010
  • Qing Xing Ming

By modifying Hotelling model, we research the differentiation decisions between open source software (OSS) and proprietary software (PS) and the location decisions of proprietary software when open source software and proprietary software coexist in a software market. In this paper, we assume proprietary software producer pursues profit maximization and open source software is freely available. The study finds that: (i) Higher (resp. lower) the OSS's learning cost, smaller (resp. greeter) the software differentiation between OSS and PS; (ii) the compatibility degree between open source and proprietary software affects software differentiation; (iii) how the network externality and OSS user's software development skills affect the software differentiation decisions and the location decisions of proprietary software depends on the compatibility degree between PS and OSS.

  • Research Article
  • Cite Count Icon 12
  • 10.1007/s10550-005-0033-2
The potential for open source software in telecommunications operational support systems
  • Jul 1, 2005
  • BT Technology Journal
  • G L Bruce + 3 more

Over the last five years, open source software has moved into mainstream areas such as Internet and financial applications, with software such as Linux and Apache Web Server now supporting mission-critical operations. Open source software can offer both cost reductions and improvements in software quality. However, the uptake by incumbent telecommunications providers has been virtually zero, instead focusing on major commercial-off-the-shelf (COTS) packages, due to a mixture of prior strategic investments and perceptions over open source risks. This paper addresses the scope for use of open source software in telecommunications operational support systems (OSS). Firstly, the technical scope for open source software is addressed, covering the maturity of available open source software components, and the ways in which these components can have an impact on OSS software architecture. Secondly, the commercial aspects are presented, covering benefits, commercial models and risks. An OSS life cost comparison of open source versus COTS software is included. Thirdly, a test OSS created by BT using primarily open source software, combined with OSS standards to provide a minimum cost base, is presented and analysed. The paper concludes with a statement on the potential for the use of open source software in OSS, and suggests possible next steps.

  • Research Article
  • Cite Count Icon 12
  • 10.1046/j.1365-2575.2001.00109.x
Guest Editorial Open source software: investigating the software engineering, psychosocial and economic issues
  • Oct 1, 2001
  • Information Systems Journal

Guest Editorial Open source software: investigating the software engineering, psychosocial and economic issues

  • Conference Article
  • Cite Count Icon 1
  • 10.1109/noms.2006.1687588
Direction of Open Source for OSS implementation
  • Jan 1, 2006
  • A Doshi

The Open Source movement has touched almost every sphere of software technology that we know today. The OSS/BSS world also has seen significant application of Open Source software into their products. Major carriers and service providers are still wary of migrating to Open Source software for critical applications though most of them are involved with Open Source initiatives in one form or the other. For most carriers and service providers the top-of-the-mind issues are scalability, security and performance. Some key questions raised by them are, • How does Open Source give / not give competitive advantage? • Is Open Source the best path to cheaper software? • Are Open Source and collaborative development necessarily tied together? • Is Open Source a way of reducing discontinuities that arise when conventional products leapfrog one another? • What are the relative lifetime costs of Open Source and conventional software? • Is it robust enough to handle my mission-critical applications? • What about service support once I migrate to an open source platform? Though Open Source software is much less expensive and tests have proven their efficacy, system integrators have not rushed headlong into the open software fray. Most SI's, though excited about the Open Source revolution, are still waiting and watching where this initiative is headed. This panel discussion focuses on some of the key issues and advantages of Open Source platforms in business impacting applications such as OSS/BSS solutions.

  • Research Article
  • Cite Count Icon 2
  • 10.2139/ssrn.1137964
The Move to the Middle: Convergence of the Open-Source and Proprietary Software Industries
  • May 27, 2008
  • SSRN Electronic Journal
  • Martin Campbell-Kelly + 1 more

Open source and proprietary software firms are no longer polar opposites on the business landscape. In the decade in which open source software has become a practical alternative to proprietary products, there has been a so-called move to the middle. Proprietary firms have begun to embrace open source development methods and products, while open source firms have resorted to traditional methods of generating revenues from free software. Further, in many important areas the two classes of firm have learned to co-operate as well as compete with one another. This article describes the evolution of co-operation and competition between open source and proprietary software product firms, focusing on the operating system, middleware, and application layers of the software stack.

  • Research Article
  • Cite Count Icon 3
  • 10.2139/ssrn.1093628
Open Source Licensing in Mixed Markets, or Why Open Source Software Does Not Succeed
  • Feb 15, 2008
  • SSRN Electronic Journal
  • Alexia Gaudeul

The rivalry between developers of open source and proprietary software encourages open source developers to court users and respond to their needs. If the open source developer wants to promote her own open source standard and solutions, she may choose liberal license terms such as those of the Berkeley Software Distribution as proprietary developers will then find it easier to adopt her standard in their products. If she wants to promote the use of open source software per se, she may use more restrictive license terms such as the General Public License to discourage proprietary appropriation of her effort. I show that open source software that comes late into a market will be less likely than more innovative open source software to be compatible with proprietary software, but is also more likely to be made more accessible to inexperienced users.

  • Research Article
  • Cite Count Icon 12
  • 10.1080/07421222.2020.1831777
Open to Your Rival: Competition between Open Source and Proprietary Software under Indirect Network Effects
  • Oct 1, 2020
  • Journal of Management Information Systems
  • Yu Wang + 2 more

With the popularity of open source software (OSS) as an alternative to proprietary software (PS), proprietary-software firms such as IBM and Microsoft started to embrace this new paradigm during the past decades. We analyze how firms choose the software development strategy between OSS and PS, by constructing a duopoly model in which consumers sequentially purchase software and complementary services in a market that exhibits an indirect network effect. We show that a PS firm may benefit from the presence of an OSS firm, and the software market can be dominated by a single OSS if the indirect network effect is weak and the cost saving effect of OSS is negligible. We also show that the market can support two OSS if the cost saving effect of OSS is sizeable, and two PS if firms can provide fully compatible services to competitor’s PS. Building upon the existing works that investigate the competition between PS and OSS, this study improves our understanding of the role of OSS in firm’s software development strategy and market equilibrium.

  • Research Article
  • Cite Count Icon 4
  • 10.1080/17483100902903366
Web accessibility and open source software
  • Jan 1, 2009
  • Disability and Rehabilitation: Assistive Technology
  • Željko Obrenović

A Web browser provides a uniform user interface to different types of information. Making this interface universally accessible and more interactive is a long-term goal still far from being achieved. Universally accessible browsers require novel interaction modalities and additional functionalities, for which existing browsers tend to provide only partial solutions. Although functionality for Web accessibility can be found as open source and free software components, their reuse and integration is complex because they were developed in diverse implementation environments, following standards and conventions incompatible with the Web. To address these problems, we have started several activities that aim at exploiting the potential of open-source software for Web accessibility. The first of these activities is the development of Adaptable Multi-Interface COmmunicator (AMICO):WEB, an infrastructure that facilitates efficient reuse and integration of open source software components into the Web environment. The main contribution of AMICO:WEB is in enabling the syntactic and semantic interoperability between Web extension mechanisms and a variety of integration mechanisms used by open source and free software components. Its design is based on our experiences in solving practical problems where we have used open source components to improve accessibility of rich media Web applications. The second of our activities involves improving education, where we have used our platform to teach students how to build advanced accessibility solutions from diverse open-source software. We are also partially involved in the recently started Eclipse projects called Accessibility Tools Framework (ACTF), the aim of which is development of extensible infrastructure, upon which developers can build a variety of utilities that help to evaluate and enhance the accessibility of applications and content for people with disabilities. In this article we briefly report on these activities.

  • Supplementary Content
  • Cite Count Icon 2
  • 10.25903/5c3eb27776753
Open source software GitHub ecosystem: a SEM approach
  • Jan 1, 2018
  • Abdulhassan Alshomali + 1 more

Open source software (OSS) is a collaborative effort. Getting affordable high-quality software with less probability of errors or fails is not far away. Thousands of open-source projects (termed repos) are alternatives to proprietary software development. More than two-thirds of companies are contributing to open source. Open source technologies like OpenStack, Docker and KVM are being used to build the next generation of digital infrastructure. An iconic example of OSS is 'GitHub' - a successful social site. GitHub is a hosting platform that host repositories (repos) based on the Git version control system. GitHub is a knowledge-based workspace. It has several features that facilitate user communication and work integration. Through this thesis I employ data extracted from GitHub, and seek to better understand the OSS ecosystem, and to what extent each of its deployed elements affects the successful development of the OSS ecosystem. In addition, I investigate a repo's growth over different time periods to test the changing behavior of the repo. From our observations developers do not follow one development methodology when developing, and growing their project, and such developers tend to cherry-pick from differing available software methodologies. GitHub API remains the main OSS location engaged to extract the metadata for this thesis's research. This extraction process is time-consuming - due to restrictive access limitations (even with authentication). I apply Structure Equation Modelling (termed SEM) to investigate the relative path relationships between the GitHub- deployed OSS elements, and I determine the path strength contributions of each element to determine the OSS repo's activity level. SEM is a multivariate statistical analysis technique used to analyze structural relationships. This technique is the combination of factor analysis and multiple regression analysis. It is used to analyze the structural relationship between measured variables and/or latent constructs. This thesis bridges the research gap around longitude OSS studies. It engages large sample-size OSS repo metadata sets, data-quality control, and multiple programming language comparisons. Querying GitHub is not direct (nor simple) yet querying for all valid repos remains important - as sometimes illegal, or unrepresentative outlier repos (which may even be quite popular) do arise, and these then need to be removed from each initial OSS's language-specific metadata set. Eight top GitHub programming languages, (selected as the most forked repos) are separately engaged in this thesis's research. This thesis observes these eight metadata sets of GitHub repos. Over time, it measures the different repo contributions of the deployed elements of each metadata set. The number of stars-provided to the repo delivers a weaker contribution to its software development processes. Sometimes forks work against the repo's progress by generating very minor negative total effects into its commit (activity) level, and by sometimes diluting the focus of the repo's software development strategies. Here, a fork may generate new ideas, create a new repo, and then draw some original repo developers off into this new software development direction, thus retarding the original repo's commit (activity) level progression. Multiple intermittent and minor version releases exert lesser GitHub JavaScript repo commit (or activity) changes because they often involve only slight OSS improvements, and because they only require minimal commit/commits contributions. More commit(s) also bring more changes to documentation, and again the GitHub OSS repo's commit (activity) level rises. There are both direct and indirect drivers of the repo's OSS activity. Pulls and commits are the strongest drivers. This suggests creating higher levels of pull requests is likely a preferred prime target consideration for the repo creator's core team of developers. This study offers a big data direction for future work. It allows for the deployment of more sophisticated statistical comparison techniques. It offers further indications around the internal and broad relationships that likely exist between GitHub's OSS big data. Its data extraction ideas suggest a link through to business/consumer consumption, and possibly how these may be connected using improved repo search algorithms that release individual business value components.

  • Conference Article
  • Cite Count Icon 6
  • 10.1109/iciii.2010.50
The Quantity Competition between Open Source and Proprietary Software
  • Nov 1, 2010
  • Mingqing Xing

By modifying Cournot model, this paper researches the quantity competition between open source software (OSS) and proprietary software (PS) in a software market exhibiting network externality. We assume open source software is free for users and proprietary software producer pursues profit maximization, and find the following results: (i) the optimal quantity of PS is bigger than that of OSS when the learning (maintenance or development) cost of OSS is high enough, and the opposite situation may appear when the learning (maintenance or development) cost of OSS is low enough, (ii) the optimal price, quantity and profit of PS increase with the learning (maintenance or development) cost of OSS, (iii) the optimal quantity of OSS decreases with the learning (maintenance or development) cost of OSS, (iv) the optimal price of PS decreases with the software development skills of OSS user and intensity of network externality.

  • Front Matter
  • 10.1007/s10278-010-9280-y
Free Stuff for Your Computer
  • Feb 24, 2010
  • Journal of Digital Imaging: the official journal of the Society for Computer Applications in Radiology
  • Janice Honeyman-Buck

Free Stuff for Your Computer

Save Icon
Up Arrow
Open/Close