Maintainer Perspectives on Open Source Software Security: Survey-based Insights from Maintainers Regarding How They Address Best Practices for Secure Software Development
Stephen Hendrick, Ashwin Ramaswami · 2023
The security of open source software is so often a primary concern in this community, and maintainers play a crucial role in this endeavour by securing the health and sustainability of open source software. As we look to build out tooling and practices that increase software security, how do we make sure that these tools empower maintainers, and not add additional burden? This research tackles this question, surveying the practices, challenges, and expectations of maintainers across the open source community. This study used data collected from interviews with subject matter experts as well as from a 2022 study on the state of open source supply chain security, focusing on data collected from maintainers and core contributors. We found that there is room for greater automation, better documentation, employer incentives, and defined best practices to better support maintainers and avoid burnout.