Technical Leverage in a Software Ecosystem: Development Opportunities and Security Risks

by   Fabio Massacci, et al.

In finance, leverage is the ratio between assets borrowed from others and one's own assets. A matching situation is present in software: by using free open-source software (FOSS) libraries a developer leverages on other people's code to multiply the offered functionalities with a much smaller own codebase. In finance as in software, leverage magnifies profits when returns from borrowing exceed costs of integration, but it may also magnify losses, in particular in the presence of security vulnerabilities. We aim to understand the level of technical leverage in the FOSS ecosystem and whether it can be a potential source of security vulnerabilities. Also, we introduce two metrics change distance and change direction to capture the amount and the evolution of the dependency on third-party libraries. The application of the proposed metrics on 8494 distinct library versions from the FOSS Maven-based Java libraries shows that small and medium libraries (less than 100KLoC) have disproportionately more leverage on FOSS dependencies in comparison to large libraries. We show that leverage pays off as leveraged libraries only add a 4 while providing four times more code than their own. However, libraries with such leverage (i.e., 75 of being vulnerable in comparison to the libraries with lower leverage. We provide an online demo for computing the proposed metrics for real-world software libraries available under the following URL:


page 1

page 3


Dataset: Dependency Networks of Open Source Libraries Available Through CocoaPods, Carthage and Swift PM

Third party libraries are used to integrate existing solutions for commo...

An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities

Nowadays, an increasing number of applications uses deserialization. Thi...

VULNERLIZER: Cross-analysis Between Vulnerabilities and Software Libraries

The identification of vulnerabilities is a continuous challenge in softw...

Debloating Software through Piece-Wise Compilation and Loading

Programs are bloated. Our study shows that only 5 across Ubuntu Desktop ...

Modeling Interconnected Social and Technical Risks in Open Source Software Ecosystems

Open source software ecosystems consist of thousands of interdependent l...

In War and Peace: The Impact of World Politics on Software Ecosystems

Reliance on third-party libraries is now commonplace in contemporary sof...

Interactive Complexity: Software Metrics from an Ecosystem Perspective

With even the most trivial of applications now being written on top of m...

Please sign up or login with your details

Forgot password? Click here to reset