arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2409.15674cs.SE
收藏

开源软件中开发者对“抗议软件”的反应:color.js 与 es5.ext 案例研究

Developer Reactions to Protestware in Open Source Software: The cases of color.js and es5.ext

Youmei Fan, Dong Wang, Supatsara Wattanakriengkrai, Hathaichanok Damrongsiri, Christoph Treude, Hideaki Hata, Raula Gaikovina Kula

AI总结:

本文以 colors.js 和 es5-ext 为例,研究开源社区对抗议软件讨论的传播、接收与响应,通过主题分析684条帖子识别五类主题,揭示抗议软件讨论的复杂面貌。

摘要:

人们日益担忧维护者为了表达政治或经济立场而自我破坏其工作成果的行为,这种做法被称为“protestware(抗议软件)”。我们的目标是理解围绕此类攻击的讨论话语、社区如何接收这些讨论,以及开发者是否及时对攻击做出响应。我们研究了两个著名的 protestware 案例,即 colors.js 和 es5-ext。结果表明,protestware 相关讨论在 GitHub 平台上传播更快,而安全漏洞信息则在社交媒体上传播更快。通过建立 protestware 讨论的分类体系,我们识别出表达立场的帖子和提供技术缓解措施的帖子。我们对 684 条与 protestware 相关的帖子进行了主题分析,识别出讨论过程中的五个主要主题:i. 传播与响应,ii. 立场,iii. 声誉,iv. 沟通风格,v. 权利与伦理。本研究揭示了 protestware 讨论的复杂面貌,为研究者和开发者提供了洞见,帮助他们在开发者的政治或社会行动与开源社区的整体福祉之间维持健康的平衡。

英文摘要:

There is growing concern about maintainers self-sabotaging their work in order to take political or economic stances, a practice referred to as "protestware". Our objective is to understand the discourse around discussions on such an attack, how it is received by the community, and whether developers respond to the attack in a timely manner. We study two notable protestware cases i.e., colors.js and es5-ext. Results indicate that protestware discussions are spread more quickly on the GitHub platform, while security vulnerabilities are faster on social media. By establishing a taxonomy of protestware discussions, we identify posts that express stances and provide technical mitigation instructions. We applied a thematic analysis to 684 protestware related posts to identify five major themes during the discussions: i. disseminate and response, ii. stance, iii. reputation, iv. communicative styles, v. rights and ethics. This work sheds light on the nuanced landscape of protestware discussions, offering insights for both researchers and developers into maintaining a healthy balance between the political or social actions of developers and the collective well-being of the open-source community.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑