Open Source Software Projects Research Articles

Organizational Influence on Security Development in Open-Source Software Projects

Increasing technological complexity, intensified competition, and security requirements have driven open-source software (OSS) projects to become a crucial part of organizations' software development. This study focuses on the OSS project TensorFlow (TF) and uses a case study to examine how organizations and their associated developers collaborate to identify, fix and prevent security vulnerabilities. Social Network Analysis (SNA) of archived security data from software repositories is used to gain insight into security activities. The study examines the internal structure and evolution of security code collaboration, organizational networks, and top organizational contributors to TF. It also examines productivity, homophily, development diversity, and turnover rates among developers across various software releases. The in-depth insights from this research enhance our understanding of collaborative patterns in OSS communities within open software ecosystems, particularly in the security context.

A portal to catalog worked examples extracted from open source software projects to support the teaching of Software Engineering

A portal to catalog worked examples extracted from open source software projects to support the teaching of Software Engineering

Don’t forget to change these functions! recommending co-changed functions in modern code review

Context:Code review is effective and widely used, yet still time-consuming. Especially, in large-scale software systems, developers may forget to change other related functions that must be changed together (aka. co-changes). This may increase the number of review iterations and reviewing time, thus delaying the code review process. Based on our analysis of 66 projects from five open-source systems, we find that there are 16%–33% of code reviews where at least one function must be co-changed, but was not initially changed. Objectives:This study aims to propose an approach to recommend co-changed functions in the context of modern code review, which could reduce reviewing time and iterations and help developers identify functions that need to be changed together. Methods:We propose CoChangeFinder, a novel method that employs a Graph Neural Network (GNN) to recommend co-changed functions for newly submitted code changes. Then, we conduct a quantitative and qualitative evaluation of CoChangeFinder with 66 studied large-scale open-source software projects. Results:Our evaluation results show that our CoChangeFinder outperforms the state-of-the-art approach, achieving 3.44% to 40.45% for top-k accuracy, 2.00% to 26.07% for Recall@k, and 0.04 to 0.21 for mean average precision better than the baseline approach. In addition, our CoChangeFinder demonstrates the capacity to pinpoint the functions related to logic changes. Conclusion:Our CoChangeFinder outperforms the baseline approach (i.e., TARMAQ) in recommending co-changed functions during the code review process. Based on our findings, CoChangeFinder could help developers save their time and effort, reduce review iterations, and enhance the efficiency of the code review process.

HyperGen: Compact and Efficient Genome Sketching using Hyperdimensional Vectors.

Genomic distance estimation is a critical workload since exact computation for whole-genome similarity metrics such as Average Nucleotide Identity (ANI) incurs prohibitive runtime overhead. Genome sketching is a fast and memory-efficient solution to estimate ANI similarity by distilling representative k-mers from the original sequences. In this work, we present HyperGen that improves accuracy, runtime performance, and memory efficiency for large-scale ANI estimation. Unlike existing genome sketching algorithms that convert large genome files into discrete k-mer hashes, HyperGen leverages the emerging hyperdimensional computing (HDC) to encode genomes into quasi-orthogonal vectors (Hypervector, HV) in high-dimensional space. HV is compact and can preserve more information, allowing for accurate ANI estimation while reducing required sketch sizes. In particular, the HV sketch representation in HyperGen allows efficient ANI estimation using vector multiplication, which naturally benefits from highly optimized general matrix multiply (GEMM) routines. As a result, HyperGen enables the efficient sketching and ANI estimation for massive genome collections. We evaluate HyperGen 's sketching and database search performance using several genome datasets at various scales. HyperGen is able to achieve comparable or superior ANI estimation error and linearity compared to other sketch-based counterparts. The measurement results show that HyperGen is one of the fastest tools for both genome sketching and database search. Meanwhile, HyperGen produces memory-efficient sketch files while ensuring high ANI estimation accuracy. A Rust implementation of HyperGen is freely available under the MIT license as an open-source software project at https://github.com/wh-xu/Hyper-Gen. The scripts to reproduce the experimental results can be accessed at https://github.com/wh-xu/experiment-hyper-gen.

Can instability variations warn developers when open-source projects boost?

Although architecture instability has been studied and measured using a variety of metrics, a deeper analysis of which project parts are less stable and how such instability varies over time is still needed. While having more information on architecture instability is, in general, useful for any software development project, it is especially important in Open Source Software (OSS) projects where the supervision of the development process is more difficult to achieve. In particular, we are interested when OSS projects grow from a small controlled environment (i.e., the cathedral phase) to a community-driven project (i.e., the bazaar phase). In such a transition, the project often explodes in terms of software size and number of contributing developers. Hence, the complexity of the newly added features, and the frequency of the commits and files modified may cause significant variations of the instability of the structure of the classes and packages. Consequently, in this article we analyze the instability in OSS projects, especially during that sensitive phase where they become community-driven. Our results show that instability metrics can be easily obtained in such type of transitions. We also observed from our case studies that instability metrics can help finding out the balance between adding new functionality and performing refactoring. As a conclusions we state that instability metrics offer relevant information in the transition phase from the cathedral to the bazaar.

ProPTV: A probability-based particle tracking velocimetry framework

We present proPTV, a comprehensive framework for particle tracking velocimetry. The framework is an open-source software project and written in Python. It provides the user with all tools needed to process raw camera images of a particle-seeded flow in order to reconstruct the particle dynamics and to assimilate pressure fields. The advanced probabilistic tracking method enables accurate reconstruction of the most probable particle trajectories. Its performance is studied applying it to the numerical test case of turbulent Rayleigh-Bénard convection (Pr=6.9, Ra=1010) in a cubic cell generated by direct numerical simulation. For the highest tracer particle density of about 0.125ppp of this test case, 83% of the reconstructed tracks are correct. To check the performance also for experimental data, proPTV is additionally applied to particle measurements of turbulent Rayleigh-Bénard convection in a water-filled cell for similar Ra- and Pr-numbers as the numerical test case. Thereby, a tracer particle density of about 0.02 ppp is estimated. The obtained results are then compared with those obtained using LaVision's commercial particle tracking software DaVis (v10.2.1). Both frameworks provide velocity fields that have small deviations. However, the particle tracks generated by proPTV are on average 5 times longer than those generated with DaVis. proPTV including the numerical test case is available at: https://github.com/RobinBarta/proPTV.

Application of fuzzy Delphi technique to identify analytical lenses for determining the preparation of free and open source software projects for user experience maturity

User eXperience (UX) significantly influences the success of free and open source software (FOSS) projects and is measured using UX capability maturity models (UXCMMs). Every organization desires higher levels of UX maturity; however, it requires upfront preparations and process quality control.Harmonizing processes and analytical lenses for determining preparation for UX maturity are still challenging, and studies to create them are limited. The analysis is ad hoc and based on the actors’ will and experiences. This study proposes and validates analytical lenses.Findings show that UX experts agreed that the lenses could be used with a consensus percentage of 81 %, the threshold value (d) = 0.112, and crisp values greater than α-cut = 0.5. On validation, 47.57 % of stakeholders agreed, and 52.43 % strongly agreed they were relevant. Results help evaluate the status quo and change culture and policies toward ideal preparation. Two areas are suggested for future research.

FAIR-USE4OS: Guidelines for creating impactful open-source software.

This paper extends the FAIR (Findable, Accessible, Interoperable, Reusable) guidelines to provide criteria for assessing if software conforms to best practices in open source. By adding "USE" (User-Centered, Sustainable, Equitable), software development can adhere to open source best practice by incorporating user-input early on, ensuring front-end designs are accessible to all possible stakeholders, and planning long-term sustainability alongside software design. The FAIR-USE4OS guidelines will allow funders and researchers to more effectively evaluate and plan open-source software projects. There is good evidence of funders increasingly mandating that all funded research software is open source; however, even under the FAIR guidelines, this could simply mean software released on public repositories with a Zenodo DOI. By creating FAIR-USE software, best practice can be demonstrated from the very beginning of the design process and the software has the greatest chance of success by being impactful.

We’re in This Together: Visible Social Support Actions in Virtual Teams Using Enterprise Social Media

Enterprise social networks (ESNs) are a communication standard within virtual teams. Among other affordances, ESNs enable colleagues to provide each other with social support. In this paper, we analyzed the message logs of virtual teams in a large open-source software project to determine how virtual teams use ESNs to provide particular forms of social support to each other and, secondly, to determine how the visibility of these interaction patterns influences team functioning. Our findings reveal distinct ESN use patterns in relation to four types of social support, each described using a metaphor: a dynamic notice board for information sharing, a community of practice for teaching and knowledge sharing, a team huddle for emotional support, and a job board for instrumental support. The findings provide structure to the diverse set of social support actions in this context and identify the higher-order functions that the visibility of social support produces.

The yin yang of AI: Exploring how commercial and non-commercial orientations shape machine learning innovation

The scale of the potential implications of machine learning (ML) has prompted discussions on the issues of corporate control and technological openness. However, how commercial and non-commercially oriented organisations each contribute to ML progress remains an open question. This study uses the recombinant innovation perspective as a lens to explore recombinant patterns across projects in an open source software (OSS) environment – where a great deal of ML innovation occurs – and assess how commercial orientation influences such patterns. It builds on a unique dataset containing data on 28,443 OSS projects, their code dependencies and the organisations owning them. Exploratory analyses reveal that ML projects combine larger and more diverse components, and produce more atypical combinations in shorter timeframes than other OSS projects, and that both company and non-company owned ML projects contribute to such recombinant atypicality. Regression analyses indicate that company owned ML projects tend to rely more on distant combinations of technical knowledge, whereas non-company owned ML projects tend to produce more novel combinations of application ideas. By extending the theories of recombinant innovation and motivation in OS innovation into a new setting – ML technology, this study contributes to both literatures by confirming that the link between distant recombination and innovation still holds in contexts characterised by complex search spaces, and by suggesting complementarities between commercial and non-commercial orientations in OSS environments rich in knowledge diversity and recombinant activity.

Trust and involvement of Cameroonian software developers in open-source projects

Trust and involvement of Cameroonian software developers in open-source projects

Method-level Bug Prediction: Problems and Promises

Fixing software bugs can be colossally expensive, especially if they are discovered in the later phases of the software development life cycle. As such, bug prediction has been a classic problem for the research community. As of now, the Google Scholar site generates ∼113,000 hits if searched with the “bug prediction” phrase. Despite this staggering effort by the research community, bug prediction research is criticized for not being decisively adopted in practice. A significant problem of the existing research is the granularity level (i.e., class/file level) at which bug prediction is historically studied. Practitioners find it difficult and time-consuming to locate bugs at the class/file level granularity. Consequently, method-level bug prediction has become popular in the past decade. We ask, are these method-level bug prediction models ready for industry use? Unfortunately, the answer is no . The reported high accuracies of these models dwindle significantly if we evaluate them in different realistic time-sensitive contexts. It may seem hopeless at first, but, encouragingly, we show that future method-level bug prediction can be improved significantly. In general, we show how to reliably evaluate future method-level bug prediction models and how to improve them by focusing on four different improvement avenues: building noise-free bug data, addressing concept drift, selecting similar training projects, and developing a mixture of models. Our findings are based on three publicly available method-level bug datasets and a newly built bug dataset of 774,051 Java methods originating from 49 open-source software projects.

Characterizing Developers' Linguistic Behaviors in Open Source Development across Their Social Statuses

Open Source Software (OSS) development has attracted numerous developers. As a typical complex sociotechnical system, an OSS project often forms a hierarchical social structure where a few developers are elite while the rest are non-elite. Differences in social status may result in distinct language use behaviors in interpersonal communication. Characterizing such behaviors is critical for supporting efficient and effective communication among developers with different social statuses. This study empirically compared elite and non-elite developers' language behaviors in their communication. We compiled a corpus of - 216,000 discourses collected from 20 large projects on GitHub. We investigated the linguistic differences in three aspects, namely, linguistic styles and characters, main concerns, and sentence patterns. Our findings reveal that elite and non-elite developers showed different linguistic patterns and had different concerns in their discourses. Their discourses also reflect the variation of the main focuses in the development process. Furthermore, elite and non-elite developers exhibited noticeable patterns in their linguistic behaviors in accordance with their roles and corresponding divisions of labor in the production process, no matter which semantic contexts. These findings provide implications for supporting communication that crosses social statuses in OSS development.

Characterizing Usability Issue Discussions in Open Source Software Projects

Usability is a crucial factor but one of the most neglected concerns in open source software (OSS). While far from an ideal approach, a common practice that OSS communities adopt to collaboratively address usability is through discussions on issue tracking systems (ITSs). However, there is little knowledge about the extent to which OSS community members engage in usability issue discussions, the aspects of usability they frequently target, and the characteristics of their collaboration around usability issue discussions. This knowledge is important for providing practical recommendations and research directions to better support OSS communities in addressing this important topic and improve OSS usability in general. To help achieve this goal, we performed an extensive empirical study on issues discussed in five popular OSS applications: three data science notebook projects (Jupyter Lab, Google Colab, and CoCalc) and two code editor projects (VSCode and Atom). Our results indicated that while usability issues are extensively discussed in the OSS projects, their scope tended to be limited to efficiency and aesthetics. Additionally, these issues are more frequently posted by experienced community members and display distinguishable characteristics, such as involving more visual communication and more participants. Our results provide important implications that can inform the OSS practitioners to better engage the community in usability issue discussion and shed light on future research efforts toward collaboration techniques and tools for discussing niche topics in diverse communities, such as the usability issues in the OSS context.

Guiding the way: A systematic literature review on mentoring practices in open source software projects

Context:Mentoring in Open Source Software (OSS) is important to its project’s growth and sustainability. Mentoring allows contributors to improve their technical skills and learn about the protocols and cultural norms of the project. However, mentoring has its challenges: mentors sometimes feel unappreciated, and mentees may have mismatched interests or lack interpersonal skills. Existing research has investigated the different challenges of mentoring in different OSS contexts, but we lack a holistic understanding. Objective:A comprehensive understanding of the current practices and challenges of mentoring in OSS is needed to implement appropriate strategies to facilitate mentoring. Method:This study presents a systematic literature review investigating how literature has characterized mentoring practices in OSS, including their challenges and the strategies to mitigate them. We retrieved 232 studies from four digital libraries. Out of these, 21 were primary studies. Using this, we performed backward and author snowballing, adding another 27 studies. We conducted a completeness check by reviewing the references of the 4 most relevant primary studies, which resulted in us adding 1 additional study. We then conducted a full-text review and evaluated the studies using a set of criteria; as a result, 10 papers were excluded. We then employed an open-coding approach to analyze, aggregate, and synthesize the selected studies. Results:We reviewed 39 studies to investigate the different facets of mentoring in OSS, encompassing motivations, goals, channels, and contributor dynamics. We then identified 13 challenges associated with mentoring in OSS, which fall into three categories: social, process, and technical. We also present a quick-reference strategy catalog to map these strategies to challenges for mitigation. Conclusions:Our study serves as a guideline for researchers and practitioners about mentoring challenges and potential strategies to mitigate these challenges.

MR-Scout : Automated Synthesis of Metamorphic Relations from Existing Test Cases

Metamorphic Testing (MT) alleviates the oracle problem by defining oracles based on metamorphic relations (MRs), that govern multiple related inputs and their outputs. However, designing MRs is challenging, as it requires domain-specific knowledge. This hinders the widespread adoption of MT. We observe that developer-written test cases can embed domain knowledge that encodes MRs. Such encoded MRs could be synthesized for testing not only their original programs but also other programs that share similar functionalities. In this paper, we propose MR-Scout to automatically synthesize MRs from test cases in open-source software (OSS) projects. MR-Scout first discovers MR-encoded test cases (MTCs), and then synthesizes the encoded MRs into parameterized methods (called codified MRs ), and filters out MRs that demonstrate poor quality for new test case generation. MR-Scout discovered over 11,000 MTCs from 701 OSS projects. Experimental results show that over 97% of codified MRs are of high quality for automated test case generation, demonstrating the practical applicability of MR-Scout . Furthermore, codified-MRs-based tests effectively enhance the test adequacy of programs with developer-written tests, leading to 13.52% and 9.42% increases in line coverage and mutation score, respectively. Our qualitative study shows that 55.76% to 76.92% of codified MRs are easily comprehensible for developers.

Monotonic and Linear Relations between Growth of Quality vs Growth in Quantity in Open-Source Software Projects

Mathematical models have been developed to study the relation between the growth of quantity and the growth of quality of open-source collaborative software repositories of GitHub. GitHub events triggering the growth of quantity and quality have been identified. Linear regression analysis, Pearson’s, Spearman’s, and Kendall’s correlation coefficients have been used. Hypothesis testing has led to the conclusion that there may be a linear relation between quality and quantity within a certain range of values. Positive monotonic relations and dependency between quantity and quality have been strongly established. Scripts for automated testing have been developed.

Predicting the Number of Software Faults using Deep Learning

The software testing phase requires considerable time, effort, and cost, particularly when there are many faults. Thus, developers focus on the evolution of Software Fault Prediction (SFP) to predict faulty units in advance, therefore, improving software quality significantly. Forecasting the number of faults in software units can efficiently direct software testing efforts. Previous studies have employed several machine learning models to determine whether a software unit is faulty. In this study, a new, simple deep neural network approach that can adapt to the type of input data was designed, utilizing Convolutional Neural Networks (CNNs) and Multi-Layer Perceptron (MLP), to predict the number of software faults. Twelve open-source software project datasets from the PROMISE repository were used for testing and validation. As data imbalance can negatively impact prediction accuracy, the new version of synthetic minority over-sampling technique (SMOTEND) was used to resolve data imbalance. In experimental results, a lower error rate was obtained for MLP, compared to CNN, reaching 0.195, indicating the accuracy of this prediction model. The proposed approach proved to be effective when compared with two of the best machine learning models in the field of prediction. The code will be available on GitHub.

Commit-Level Software Change Intent Classification Using a Pre-Trained Transformer-Based Code Model

Software evolution is driven by changes made during software development and maintenance. While source control systems effectively manage these changes at the commit level, the intent behind them are often inadequately documented, making understanding their rationale challenging. Existing commit intent classification approaches, largely reliant on commit messages, only partially capture the underlying intent, predominantly due to the messages’ inadequate content and neglect of the semantic nuances in code changes. This paper presents a novel method for extracting semantic features from commits based on modifications in the source code, where each commit is represented by one or more fine-grained conjoint code changes, e.g., file-level or hunk-level changes. To address the unstructured nature of code, the method leverages a pre-trained transformer-based code model, further trained through task-adaptive pre-training and fine-tuning on the downstream task of intent classification. This fine-tuned task-adapted pre-trained code model is then utilized to embed fine-grained conjoint changes in a commit, which are aggregated into a unified commit-level vector representation. The proposed method was evaluated using two BERT-based code models, i.e., CodeBERT and GraphCodeBERT, and various aggregation techniques on data from open-source Java software projects. The results show that the proposed method can be used to effectively extract commit embeddings as features for commit intent classification and outperform current state-of-the-art methods of code commit representation for intent categorization in terms of software maintenance activities undertaken by commits.

Bug priority change: An empirical study on Apache projects

In issue tracking systems, each bug is assigned a priority level (e.g., Blocker, Critical, Major, Minor, or Trivial in JIRA from highest to lowest), which indicates the urgency level of the bug. In this sense, understanding bug priority changes helps to arrange the work schedule of participants reasonably, and facilitates a better analysis and resolution of bugs. According to the data extracted from JIRA deployed by Apache, a proportion of bugs in each project underwent priority changes after such bugs were reported, which brings uncertainty to the bug fixing process. However, there is a lack of in-depth investigation on the phenomenon of bug priority changes, which may negatively impact the bug fixing process. Thus, we conducted a quantitative empirical study on bugs with priority changes through analyzing 32 non-trivial Apache open source software projects. The results show that: (1) 8.3% of the bugs in the selected projects underwent priority changes; (2) the median priority change time interval is merely a few days for most (28 out of 32) projects, and half (50. 7%) of bug priority changes occurred before bugs were handled; (3) for all selected projects, 87.9% of the bugs with priority changes underwent only one priority change, most priority changes tend to shift the priority to its adjacent priority, and a higher priority has a greater probability to undergo priority change; (4) bugs that require bug-fixing changes of higher complexity or that have more comments are likely to undergo priority changes; and (5) priorities of bugs reported or allocated by a few specific participants are more likely to be modified, and maximally only one participant in each project tends to modify priorities.