Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 48

The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.

A systematic literature review on trust in the software ecosystem

Hou, Fang, Jansen, Slinger·2023·Empirical Software Engineering
DOI 10.1007/s10664-022-10238-y
Open this paper in CoChat — free account

Abstract

The worldwide software ecosystem is a trust-rich part of the world. Throughout the software life cycle, software engineers, end-users, and other stakeholders collaboratively place their trust in major hubs in the ecosystem, such as package managers, repository services, and software components. However, as our reliance on software grows, this trust is frequently violated by bad actors and crippling vulnerabilities in the software supply chain. This study aims to define software trust in the worldwide SECO, that is, to determine what signifies a trustworthy system, actor, or hub. We conduct a systematic literature review on the concept of trust in the software ecosystem. We acknowledge that trust is something between two actors in the software ecosystem, and we examine what role trust plays in the relationships between end-users and (1) software products, (2) package managers, (3) software producing organizations, and (4) software engineers. Two major findings emerged from the systematic literature review. To begin, we define trust in the software ecosystem by examining the definition and characteristics of trust. Second, we provide a list of trust factors that can be used to assemble an overview of software trust. Trust is critical in the communication between actors in the worldwide software ecosystem, particularly regarding software selection and evaluation. With this comprehensive overview of trust, software engineering researchers have a new foundation to understand and use trust to create a trustworthy software ecosystem.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s10664-022-10238-y

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Research works printed but not linked: 70

  1. Alarcon GM, Gibson AM, Walter C, Gamble RF, Ryan TJ, Jessup SA, Boyd BE, Capiola A (2020) Trust Perceptions of Metadata in Open-Source Software: The Role of Performance and Reputation. Systems 8(3):28 · DOI
  2. Amoroso Ed, Nguyen Thu, Weiss Jon, Watson John, Lapiska Pete, Starr Terry (1991) Toward an approach to measuring software trust. In: Proceedings. 1991 IEEE Computer Society Symposium on Research in Security and Privacy, pp 198–198
  3. Androutsellis-Theotokis S, Spinellis D, Kechagia M, Gousios G (2011) Open source software: a survey from 10,000 feet. Found Trends Technol Inf Oper Manag 4.3-4:187–347
  4. Badampudi Deepika, Wohlin Claes, Petersen Kai (2016) Software component decision-making: in-house, OSS, COTS or outsourcing-A systematic literature review. J Syst Software 121:105–124 · DOI
  5. Bennett K, Layzell P, Budgen D, Brereton P, Macaulay L, Munro M (2000) Service-based software: the future for flexible software. In: Proceedings seventh Asia-Pacific software engeering conference, APSEC 2000. IEEE, pp 214–221 · DOI
  6. Bogart C, Kästner C, Herbsleb J, Thung F (2016) ‘How to break an API: cost negotiation and community values in three software ecosystems’. In: Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering, pp. 109–120 · DOI
  7. Boyes HA, Norris P, Bryant I, Watson T (2014) Trustworthy Software: lessons from goto fail’& Heart- bleed bugs. In: 9th IET International Conference on System Safety and Cyber Security, pp. 17. · DOI
  8. Bugiel S, Davi LV, Schulz S (2011) Scalable trust establishment with software reputation, pp 15–24. In: Proceedings of the sixth ACM workshop on Scalable trusted computing · DOI
  9. Capra E, Francalanci C, Merlo F, Rossi-Lamastra C (2011) ‘Firms’ involvement in Open Source projects: a trade-off between software structural quality and popularity. J Syst Software 84.1:144–161 · DOI
  10. Catuogno L, Galdi C, Persiano G (2017) Secure dependency enforcement in package management systems. IEEE Trans Dependable Secure Comput 17.2:377–390
  11. Challa JS, Paul A, Dada Y, Nerella V, Srivastava PR, Singh AP (2011) Integrated software quality evaluation: a fuzzy multi-criteria approach. J Inf Process Syst 7.3:473–518 · DOI
  12. Chau P (1994) Selection of packaged software in small businesses. European J Inf Syst 3.4:292–302 · DOI
  13. Cho J-H, Chan K, Adali S (2015) A survey on trust modeling. ACM Comput Surveys (CSUR) 48.2: 1–40 · DOI · Paper page
  14. Cho J-H, Xu S (2019) Stram: measuring the trustworthiness of computer-based systems. ACM Comput Surveys (CSUR) 51.6:1–47 · DOI
  15. Crowston K, Annabi H, Howison J (2003) Defining open source software project success. In: Proceedings of the International Conference on Information Systems (ICIS)
  16. Cruz D, Wieland T, Ziegler A (2006) Evaluation criteria for free/open source software products based on project analysis. Software Process: improvement and Practice 11.2:107–122 · DOI
  17. Das TK, Teng B-S (2001) Trust, control, and risk in strategic alliances: an integrated framework. Organization studies 22.2:251–283 · DOI · Paper page
  18. Decan A, Mens T, Constantinou E (2018) On the impact of security vulnerabilities in the npm package dependency network. In: Proceedings of the 15th international conference on mining software repositories, pp 181–191 · DOI
  19. Del Bianco V, Lavazza L, Morasca S, Taibi D (2011) A survey on open source software trustworthiness. IEEE Softw 28.5:67–75 · DOI
  20. Donohue SK, Dugan JB, Brown CL (2005) Is my software good enough to release?-A probabilistic assessment. In: 29th annual IEEE/NASA Software engineering workshop, pp 5–13 · DOI
  21. Duan R, Alrawi O, Kasturi RP, Elder R, Saltaformaggio B, Lee W (2021) Towards measuring supply chain attacks on package managers for interpreted languages. In: Network and distributed systems security (NDSS) symposium 2021 · DOI
  22. Ellison R, Nichols W, Woody C (2016) Measuring software assurance. In: 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC), vol 2, pp 359–364 · DOI
  23. Gefen D, Keil M (1996) Developer responsiveness and perceived usefulness. In: Academy of management proceedings, Academy of management Briarcliff Manor, NY 10510. vol 1996, pp 313–317 · DOI
  24. Ghapanchi AH, Tavana M (2015) A longitudinal study of the impact of open source software project characteristics on positive outcomes. Inf Syst Manag 32.4:285–298 · DOI
  25. Godse M, Mulik S (2009) An approach for selecting software-as-a-service (SaaS) product. In: 2009 IEEE international conference on cloud computing. IEEE, pp 155–158 · DOI
  26. Goode S, Lin C, Tsai JC, Jiang JJ (2015) Rethinking the role of security in client satisfaction with software-as-a-service (SaaS) providers. Decision Support Syst 70:73–85 · DOI
  27. Grodzinsky FS, Miller KW, Wolf MJ (2011) Developing artificial agents worthy of trust: would you buy a used car from this artificial agent? Ethics Inf Technol 13.1:17–27 · DOI
  28. Guo G, Zhang J, Thalmann D, Basu A, Yorke-Smith N (2014) From ratings to trust: an empirical study of implicit trust in recommender systems. In: Proceedings of the 29th annual acm symposium on applied computing, pp 248–253 · DOI
  29. Haefliger S, Von Krogh G, Spaeth S (2008) Code reuse in open source software. Manag Sci 54.1:180–193 · DOI · Paper page
  30. Haenni N, Lungu M, Schwarz N, Nierstrasz O (2013) Categorizing developer information needs in software ecosystems. In: Proceedings of the 2013 international workshop on ecosystem architectures, pp 1–5 · DOI
  31. Haenni N, Lungu M, Schwarz N, Nierstrasz O (2014) A quantitative analysis of developer information needs in software ecosystems. In: Proceedings of the 2014 European conference on software architecture workshops, pp 1–6 · DOI
  32. He J, Hou H, Song Q, Hao K (2009) Reference model of trustworthy proof for trusted components. In: 2009 second international conference on future information technology and management engineering. IEEE, 136–139 · DOI
  33. Heiskanen A, Newman M, Eklin M (2008) Control, trust, power, and the dynamics of information system outsourcing relationships: a process study of contractual software development. J Strategic Inf Syst 17.4:268–286 · DOI
  34. Hejderup J, van Deursen A, Gousios G (2018) Software ecosystem call graph for dependency management. In: 2018 IEEE/ACM 40th international conference on software engineering: new ideas and emerging technologies results (ICSE-NIER). IEEE, pp 101–104 · DOI
  35. Hillebrand C, Coetzee M (2013) Towards reputation-as-a-service. In: 2013 Information Security for South Africa. IEEE, pp 1–8 · DOI
  36. Hong H, Chang-hui W, Ben W (2011) Research on management scheme of trusted application software. In: 2011 international conference on network computing and information security. Vol. 1. IEEE, pp. 311–315 · DOI
  37. Hoxmeier JA (2000) Software preannouncements and their impact on customers perceptions and vendor reputation. J Manag Inf Syst 17.1:115–139
  38. Hunter P, Walli S (2013) The rise and evolution of the open source software foundation. In: International Free and Open Source Software Law Review 5, p. 31 · DOI
  39. Immonen A, Palviainen M (2007) Trustworthiness evaluation and testing of open source components. In: Seventh international conference on quality software (QSIC 2007). IEEE, pp 316–321 · DOI
  40. Jackson D (2009) A direct path to dependable software. Commun ACM 52.4:78–88 · DOI
  41. Jadhav AS, Sonar RM (2009) Evaluating and selecting software packages: a review. Information and software technology 51.3:555–563 · DOI
  42. Jadhav AS, Sonar RM (2011) Framework for evaluation and selection of the software packages: a hybrid knowledge based system approach. J Syst Software 84.8:1394–1407 · DOI
  43. Jansen S (2014) Measuring the health of open source software ecosystems: beyond the scope of project health. Inf Software Technol 56.11:1508–1519 · DOI
  44. Koch S, Neumann C (2008) Exploring the effects of process characteristics on products quality in open source software development. J Data Manag (JDM) 19.2:31–57
  45. Kula RG, German DM, Ishio T, Inoue K (2015) Trusting a library: A study of the latency to adopt the latest maven release. In: 2015 IEEE 22nd International Conference on Software Analysis, Evolution, and reengineering (SANER). IEEE, pp 520–524 · DOI
  46. Lai IK, Tong VW, Lai DC (2011) Trust factors influencing the adoption of internet-based interorganizational systems. Electr Commerce Res Appl 10.1:85–93 · DOI
  47. Limam N, Boutaba R (2010) Assessing software service quality and trustworthiness at selection time. IEEE Trans Software Eng 36(4):559–574 · DOI
  48. Liu X, Iyer B (2007) Design architecture, developer networks and performance of open source software projects. In: International Conference on Information Systems 2007 Proceedings, p. 90
  49. Manikas K, Hansen KM (2013) Software ecosystems–a systematic literature review. J Syst Software 86.5:1294–1306 · DOI · Paper page
  50. McKnight DH (2005) Trust in information technology. Blackwell Encyclopedia Manag 7:329–331
  51. Mcknight DH, Carter M, Thatcher JB, Clay PF (2011) Trust in a specific technology: an investigation of its components and measures. ACM Trans Manag Inf Sys (TMIS) 2.2:1–25
  52. Midha V, Palvia P (2012) Factors affecting the success of Open Source Software. J Syst Software 85.4:895–905 · DOI
  53. Mockus A, Fielding RT, Herbsleb JD (2002) Two case studies of open source software development: apache and mozilla. ACM Trans Software Eng Method (TOSEM) 11.3:309–346 · DOI · Paper page
  54. Moyano F, Fernandez-Gago C, Lopez J (2016) A model-driven approach for engineering trust and reputation into software services. J Netw Comput Appl 69:134–151 · DOI
  55. Norris JS (2004) Mission-critical development with open source software: lessons learned. IEEE Softw 21.1:42–49 · DOI
  56. Pollock N, Williams R (2007) Technology choice and its performance: towards a sociology of software package procurement. Inf Org 17.3:131–161 · DOI
  57. Qian H, Zhu X, Ma J, Cao X (2009) Quality process-oriented software credibility measurement and assessment. In: 2009 international conference on computational intelligence and software engineering. IEEE, pp 1–6 · DOI
  58. Roumani Y, Nwankpa JK, Roumani YF (2017) Adopters trust in enterprise open source vendors: an empirical examination. J Syst Software 125:256–270 · DOI
  59. Sarrab M, Rehman OMH (2014) Empirical study of open source software selection for adoption, based on software quality characteristics. Adv Eng Software 69:1–11 · DOI
  60. Scacchi W (2007) Free/open source software development: recent research results and methods. Adv Comput 69:243–295 · DOI
  61. Schuur Hvd, Jansen S, Brinkkemper S (2011) The power of propagation: on the role of software operation knowledge within software ecosystems. In: Proceedings of the international conference on management of emergent digital ecosystems, pp 76–84
  62. Sen R, Singh SS, Borle S (2012) Open source software success: measures and analysis. Decision Support Syst 52.2:364–372 · DOI
  63. Van Den Berk I, Jansen S, Luinenburg L (2010) Software ecosystems: a software ecosystem strategy assessment model. In: Proceedings of the fourth european conference on software architecture: companion volume, pp 127–134 · DOI
  64. Vargas EL, Aniche M, Treude C, Bruntink M, Gousios G (2020) Selecting third-party libraries: the practitioners’ perspective. In: Proceedings of the 28th ACM joint meeting on european software engineering conference and symposium on the foundations of software engineering.
  65. Wang B, Chen Y, Zhang S, Wu H (2019) Updating model of software component trustworthiness based on users feedback. IEEE Access 7:60199–60205 · DOI
  66. Wang H (2011) TRUSTIE: design of a trustworthy software production environment. In: 2011IEEE 10th international conference on trust, security and privacy in computing and communications. IEEE, pp 3–4 · DOI
  67. Wang H, Yin G, Li X, Li X (2015) TRUSTIE: a software development platform for crowdsourcing. In: Crowdsourcing. Springer, pp 165–190 · DOI
  68. Wang J, Shih PC, Wu Y, Carroll JM (2015) Comparative case studies of open source software peer review practices. Inf Software Technol 67:1–12 · DOI
  69. Yan Z (2008) A comprehensive trust model for component software. In: Proceedings of the 4th international workshop on security, privacy and trust in pervasive and ubiquitous computing, pp 1–6 · DOI
  70. Zhu M-X, Luo X-X, Chen X-H, Wu DD (2012) A non-functional requirements tradeoff model in trustworthy software. Inf Sci 191:61–75 · DOI

Cited by

See all 48

Metadata

Authors
Hou, F., & Jansen, S.
ORCID
Hou, Fang
Venue
Empirical Software Engineering
Publisher
Springer Science and Business Media LLC
Published
2022-11-23
Volume
28
Issue
1
ISSN
  • 1382-3256
  • 1573-7616
DOI
10.1007/s10664-022-10238-y
Cited by
48
References
3
Language
en
Licence
Funders
TruBlo (Grant Agreement Number 957228)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.