Collaborative Research: DASS: Accountable Open Source Infrastructure

企业、政府和整个社会都非常依赖开源库和框架，它们构成了一种“开源数字基础设施”。因此，许多重要应用程序的实用性和安全性取决于将此基础设施维护到高标准。然而，开源许可证通常完全回避任何形式的责任，不提供任何形式的保证。此外，开源项目的维护者通常可以在任何时候自由离开，而不是被期望遵守外部要求。本研究将调查开源软件的维护者在多大程度上对不同类型的用户负责，以及这种责任何时以及如何出现，以及如何响应不断发展的用户需求或监管举措而变化。本研究的结果将突出当前开源治理机制有助于或未能解决持久基础设施所寻求的外部问责制的情况，以及所涉及的任何权衡。最终，这项研究将有助于了解如何设计一系列有效的干预措施，使开源项目和生态系统朝着更大责任的方向发展，从而形成更可持续的开源基础设施。该项目将通过跨两个研究重点的一套精心编排的混合方法实证研究，阐明开源生态系统中的问责制。首先，定性访谈和调查将揭示维护者和用户如何看待问责制，它在项目和生态系统文化中嵌入的程度，以及双方期望的一致性，跨越十几个生态系统和涉及商业公司，政府机构和研究实验室与开源社区的一系列安排。其次，额外的访谈将揭示成功的开源社区如何对明确挑战问责制的特定事件（例如，法规的引入）进行有效的集体反应，统计和计量模型将估计这些冲击对项目结果的影响如何在治理模型和其他项目背景因素之间变化。该项目预计将产生一个框架，其中包含基于经验数据的不同偶然事件和权衡，这解释了开源社区中问责制系统的出现（或缺乏）。更一般地说，这项工作将汇集对开源生态系统感兴趣的软件工程、信息系统和管理研究社区的问责制观点，激发基于开源实践中当前挑战的这些学科的新研究。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Corporations, governments, and society as a whole have developed an extraordinary reliance on open-source libraries and frameworks, which comprise a sort of “open-source digital infrastructure.” As such, the utility and security of a great many important applications depends on maintaining this infrastructure to a high standard. However, open-source licenses typically completely eschew any form of accountability, providing no warranties of any kind. Moreover, maintainers of open-source projects are typically free to walk away at any time, rather than expected to comply with external demands. This research will investigate to what extent maintainers of open-source software are accountable to different types of users, as well as when and how this accountability emerges and varies in response to evolving user needs or regulatory moves. The results of this research will highlight the scenarios under which the current open-source governance mechanisms contribute to or fail to address the external accountability that is sought for durable infrastructure, as well as any trade-offs involved. Ultimately, this research will help inform how a range of effective interventions can be designed to move open-source projects and ecosystems in the direction of greater accountability, resulting in more sustainable open-source infrastructure. This project will shed light on accountability in open-source ecosystems through an orchestrated set of mixed-methods empirical studies across two research thrusts. First, qualitative interviews and a survey will reveal how maintainers and users think about accountability, the extent to which it becomes embedded in project and ecosystem culture, and the alignment of expectations of the two sides, across a dozen ecosystems and a spectrum of arrangements that involve commercial firms, government institutions, and research labs with open-source communities. Second, additional interviews will reveal how successful open-source communities mount effective collective responses to specific episodes that starkly challenge accountability (e.g., the introduction of regulation), and statistical and econometric models will estimate how the effects of such shocks on project outcomes vary across governance models and other project context factors. This project is expected to yield a framework, with different contingencies and trade-offs grounded in empirical data, that explains the emergence (or lack thereof) of a system of accountability in open-source communities. More generally, this work will bring together perspectives of accountability from the software engineering, information systems, and management research communities that are interested in open-source ecosystems, stimulating new research in these disciplines grounded in current challenges in open-source practice.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.