软件供应链作为“柠檬市场”：信任信号崩溃的多视角综述
The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse
浏览论文内容
中文总结 AI 辅助
本研究通过多视角综述252个谷歌搜索来源和870个Reddit线程，揭示开源依赖项的廉价信任信号因三种力量崩溃，提出需强制实施加密证明等成本更高的信号。
中文摘要 AI 辅助
评估开源依赖项的从业者依赖廉价信任信号（如星标、下载量和贡献者活跃度）作为直接代码检查的替代，假设这些信号反映了真实的可信度。已有研究记录了单个信号的操纵，但所有依赖项采用信号的崩溃情况以及生态系统的应对措施仍未被探索。本研究通过对252个谷歌搜索来源和870个Reddit线程进行多视角综述，旨在帮助软件从业者理解下载量、贡献者活跃度等依赖项采用信任信号的可靠性。对语料库编码后，发现廉价信任信号在三种同时出现的力量下崩溃：对抗性操纵、与合法行为无法区分的操纵技术、非对抗性AI驱动的膨胀。记录的应对措施多为建议而非实际行动：54.6%的谷歌搜索来源包含从业者应采取行动的建议，但无实际行动。提出的应对措施包括用一种廉价信号替代另一种或聚合多种信号，而这些信号现在也可被操纵。非对抗性膨胀（即合法AI工具出现导致的退化）在两个语料库中均未记录到实际行为变化。已知补救措施与实际实践之间的差距指向了“柠檬市场”：当伪造信号的成本低于获取信号的成本时，优质和劣质依赖项变得无法区分。依赖单个从业者验证廉价信号是不可持续的，应强制实施加密证明等成本更高的信号，使其成为所有人的默认选择，而非少数人的自愿选择。
英文摘要
Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem's response, remains unexplored. The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads. After coding the corpora, we find that cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation. The documented responses are more advice than actual action: 54.6% of Google Search sources contain advice on what practitioners should do, with no actual action taken. Responses proposed substituting one cheap signal for another or aggregating multiple signals, which are now also gameable. Non-adversarial inflation, i.e., degradation caused by the emergence of legitimate AI tooling, lacks documented actual behavior change in either corpus. The gap between known remedy and actual practice points toward a market for lemons: when faking signals costs less than earning them, good and bad dependencies become indistinguishable. Relying on individual practitioners to verify the cheap signals is not sustainable. Costlier signals, such as cryptographic attestation, should be made mandatory so that they become the default for all, not a voluntary choice for the few.
