Interview Study:
Open-Source Maintainers
How are maintainers of open-source projects chosen?

🏁 We are finished - thanks to you! #

Thank you for your interest in our research! However, we have completed this study and no longer recruit participants! We want to thank all of our participants for trusting us with their experiences and insights, thereby enabling us to do this research.

About this study #

In this interview study, we investigate the processes and circumstances of becoming an open-source maintainer, aiming to shed light on how maintainers are chosen, and to derive recommendations for the future.

We are especially interested in your experiences of granting other people maintainer permissions. However, we would also like to interview you if you have been on the other side, i.e., been granted maintainer permissions in open-source projects.

Maintainers: Our definition of maintainers encompasses people who are stewards of open-source projects. In general, their tasks are dependent upon having extended permissions within the projects they govern, e.g., to release a new version, directly push commits of their own, or accept patches submitted by other, non-maintainer, developers.

We are looking for people who

  • have been maintainers in open-source projects
  • are 18 years of age or older
  • are comfortable with participating in an interview on this topic in English

Participants will

  • fill in a short preparatory questionnaire
  • book a time slot for an interview of about 60 minutes
  • answer questions on their experiences and opinions during the interview
  • be offered a compensation of $60 for their time. We can offer the following options:
    • Amazon vouchers for EU, US, or UK

    • SEPA transfer

    • PayPal

    • Donation to a project of your choice

      Please be aware that we cannot reimburse you for any transaction fees that might occur, depending on your choice of compensation.

Motivation #

Maintainers are the cornerstone of each software project. Prior research has established that maintainers as software engineers are integral to the success of each OSS project. With ongoing attacks on the software supply chain, they also play a crucial role when it comes to securing their projects, as they are the first line of defense against malicious actors. From a security standpoint, maintainers fill central positions in the network of trust that enables collaboration in OSS. However, there is a lack of insight into how maintainers are chosen and what security considerations are part of that choice.

Research questions #

  • RQ1: How are maintainers chosen in practice?
  • RQ2: What security factors are considered when collaborators are granted maintainer privileges?
  • RQ3: How can the risk of malicious maintainers be mitigated?

Study procedure and participation #

We value and appreciate your contribution in our study. As briefly described above, participation includes a small sign-up questionnaire of 5-10 minutes, at the end of which you can freely choose an interview time from our available slots. Participation in an interview will take about about 60 minutes. During the interview, we are interested in your experiences and opinions when choosing maintainers in open-source projects.

We are committed to maintaining your privacy and confidentiality of all data you provide. We will only use short quotes from the interviews in our publication with your approval, and make sure that you cannot be identified from our reporting. After the interview, we offer a compensation of $60 for your time and effort.

If you are still interested in participating, please fill out this short questionnaire.

Who we are #

We are a joined research team from the state-funded CISPA Helmholtz Center for Information Security in Germany and the North Carolina State University (NC State). Our group studies the intersection of computer security and privacy with human factors. We are particularly interested in investigating end users, administrators, developers, and designers of computer systems and their interdependencies with computer security and privacy mechanisms.

You can find our publications here.

Researchers

Kay Friedrich | Researcher & PhD Student (CISPA).
Contact: kay.friedrich@cispa.de

Sandra Höltervennhoff | Researcher & PhD Student (CISPA)
Anne Vonderheide | Researcher & PhD Student (CISPA)
Dr. Dominik Wermke | Assistant Professor (NC State)
Prof. Dr. Sascha Fahl | Principal Investigator, Tenured Faculty (CISPA) and Full Professor (Leibniz University Hannover)

Institutions

LUH logo

Leibniz University Hannover

CISPA logo

CISPA Helmholtz-Center for Information Security

NC State logo

North Carolina State University