Abstract:Open-source is frequently described as a driver for unprecedented communication and collaboration, and the process works best when projects support teamwork. Yet, open-source cooperation processes in no way protect project contributors from considerations of trust, power, and influence. Indeed, achieving the level of trust necessary to contribute to a project and thus influence its direction is a constant process of change, and developers take many different routes over many communication channels to achieve it. We refer to this process of influence-seeking and trust-building as trust ascendancy. This paper describes a methodology for understanding the notion of trust ascendancy and introduces the capabilities that are needed to localize trust ascendancy operations happening over open-source projects. Much of the prior work in understanding trust in open-source software development has focused on a static view of the problem using different forms of quantity measures. However, trust ascendancy is not static, but rather adapts to changes in the open-source ecosystem in response to new input. This paper is the first attempt to articulate and study these signals from a dynamic view of the problem. In that respect, we identify related work that may help illuminate research challenges, implementation tradeoffs, and complementary solutions. Our preliminary results show the effectiveness of our method at capturing the trust ascendancy developed by individuals involved in a well-documented 2020 social engineering attack. Our future plans highlight research challenges and encourage cross-disciplinary collaboration to create more automated, accurate, and efficient ways to model and then track trust ascendancy in open-source projects.

Elevating Software Trust: Unveiling and Quantifying the Risk Landscape

Artificial Intelligence Trust, Risk and Security Management (AI TRiSM): Frameworks, applications, challenges and future research directions

Software Supply Chain Risk Assessment Framework

A software application for rapid risk assessment in integrated supply chains

A value-sensitive design approach to minimize value tensions in software-based risk-assessment instruments

A Unified Measurement Solution of Software Trustworthiness Based on Social-to-Software Framework

A Survey on Trust Metrics for Autonomous Robotic Systems

Trust Challenges in Reusing Open Source Software: An Interview-based Initial Study

A survey of the state‐of‐the‐art approaches for evaluating trust in software ecosystems

A Trust-Based Approach to Estimating the Confidence of the Software System in Open Environments

TrustSECO: An Interview Survey into Software Trust

Trust in Motion: Capturing Trust Ascendancy in Open-Source Projects using Hybrid AI

Continuous risk assessment in secure DevOps

A Risk Assessment Framework and Software Toolkit for Cloud Service Ecosystems

Agile Risk Management for Multi-Cloud Software Development

Analyzing and Calibrating Risk Assessment by Software Developers

M-STAR: A Modular, Evidence-based Software Trustworthiness Framework

Risk Management Framework: Identifying and Mitigating Business Risks

Towards Achieving Trust Through Transparency and Ethics (Pre-Print)

A Trust and Risk Framework to Enhance Reliable Interaction in E-Commerce

Original cause of software untrustworthiness: Distrustable factor