Open innovation has been rising in popularity as an alternative to traditional model for organizations to enhance innovation in their products or services. In the past, the innovation processes was time-consuming and costly. It has now become significantly efficient and effective, supported by the advancement of today’s IT such as Internet, Cloud Computing and Big Data. Open innovation has changed the aspect of the innovation source; from closed internal R&D to fully utilization of consumers’ collaboration. Decision to shift towards open innovation strategy has been lying on several areas including motivation, financial direction, and preference of the innovation strategies and business models that fitting the organizational core strategy. This research studied the relation of these areas and its effect; it determined the way IT-organization creates and captures value that were done by opening its product platform. This thesis was conducted to analyze the open innovation approach in an open digital navigation platform, featuring two platforms as case study: Google Maps and OpenStreetMap. The investigation emphasized the utilizing of the open innovation strategy to build its platform where crowdsourcing and open source software as objects highlighted in the research. The data was collected from secondary sources. Research findings suggested that crowdsourcing and open source software strategy are the main strategies of open innovation implemented in IT digital mapping platform to create and capture value. While these strategies have been practiced in both platforms, circumstances (motivation, financial direction, and business strategy) that hovering around the internal aspect of organizations affected the application of those strategies. The implementation results are differ according to preferred business model. The result of this research suggested that a non-profit based organization tends to utilize open innovation to improve the value of their product through consumer collaboration, while a profit based organization adopts open innovation to generate additional pool of revenue through customers’ feedback and input data. The open innovation leads to creation of a new business model as the foundation of innovation.

In order for the collaborations to be fruitful and sustainable between organisations and open source software (OSS) ecosystems, maintainers need to understand if, and how it is possible to evaluate OSS ecosystem health in an effective manner. Understanding how OSS maintainers characterise ecosystem health and how they evaluate these health characteristics using digital evaluation tools is interesting to analyse since it could give insight in how ecosystem health in practice is evaluated, which health aspects can be evaluated with the help of digital tools, and what barriers exists in the evaluation processes. This qualitative study is based on semi-structured interviews and was conducted in order to answer two research questions regarding this topic. The answers which were produced by the semi-structured interviews were transcribed and coded to later be analysed where conclusions could be drawn. The research attempts to broaden the academic perspective on how ecosystem maintainers view health and how health evaluation digital tools can help maintainers understand the state of their ecosystem health, and what barriers exist. It became clear during the research that answering how ecosystem health is to be characterized is incredibly difficult since the answer might differ in many ways depending on the nature of the project, where the project is in its life cycle, and who is asking the questions. Two views surrounding the definition of ecosystem health are presented, one revolving around longevity and the other revolving around an ecosystem life cycle perspective. Furthermore, Diversity, Governance, Activity and Licensing seem to be the health characteristics maintainers find to be the most important for ecosystem health evaluation. Out of these, tools such as the ones offered by CHAOSS, seem somewhat geared towards assessing Activity, Licensing and Diversity. Saving time and finding trends when evaluating health are examples of how tools help maintainers however, barriers exist for maintainers in smaller or younger projects who have not practiced health evaluation for a very long time. Finally, another barrier is the amount of additional context and human judgment which is needed when using tools for the health evaluation. / För att samarbetet mellan organisationer och öppen källkod (OSS) ekosystem ska vara gynnsamma och hållbara, måste ekosystemsunderhållare förstå om och hur det är möjligt att utvärdera OSS-ekosystemhälsa på ett effektivt sätt. Att förstå hur OSS-underhållare karaktäriserar ekosystemhälsa och hur de utvärderar dessa hälsoegenskaper med hjälp av digitala utvärderingsverktyg är intressant att analysera eftersom det skulle kunna ge insikt i hur ekosystemhälsa i praktiken utvärderas, vilka hälsoaspekter som kan utvärderas med hjälp av digitala verktyg, och vilka hinder som finns i utvärderingsprocesserna. Denna kvalitativa studie är baserad på semistrukturerade intervjuer och genomfördes för att besvara två forskningsfrågor inom detta ämne. Svaren som producerades av de semistrukturerade intervjuerna transkriberades och kodades för att senare analyseras där slutsatser kunde dras. Forskningen försöker vidga det akademiska perspektivet på hur ekosystemsunderhållare ser på hälsa och hur hälsoutvärderingsverktyg kan hjälpa underhållare att förstå hälsotillståndet för deras ekosystem, men också vilka hinder som finns i processerna. Det blev tydligt under forskningen att det är otroligt svårt att svara på hur ekosystemhälsa ska karakteriseras eftersom svaret kan skilja sig åt på många sätt beroende på projektets karaktär, var projektet befinner sig i sin livscykel och vem som ställer frågorna. Två synpunkter kring definitionen av ekosystemhälsa tas upp, en som kretsar kring livslängd, och den andra som kretsar kring ett ekosystemlivscykelperspektiv. Dessutom verkar Mångfald, Styrning, Aktivitet och Licensiering vara de hälsoegenskaper som underhållare anser vara de viktigaste för hälsoutvärdering av ekosystem. Av dessa verkar verktyg som de som erbjuds av CHAOSS något inriktade på att bedöma Aktivitet, licensiering och mångfald. Att spara tid och hitta trender när man utvärderar hälsa är exempel på hur verktyg hjälper underhållare, men hinder finns för underhållare i mindre eller yngre projekt som inte har praktiserat hälsoutvärdering under en längre period. Slutligen är en annan barriär den mängden ytterligare kontext och mänskligt omdöme som behövs när man använder verktyg för hälsoutvärderingen.

The software supply chain constitutes all the resources needed to produce a software product. A large part of this is the use of open-source software packages.Although the use of open-source software makes it easier for vast numbers of developers to create new products, they all become susceptible to the same bugs or malicious code introduced in components outside of their control.Ethereum is a vast open-source blockchain network that aims to replace several functionalities provided by centralized institutions.Several software clients are independently developed in different programming languages to maintain the stability and security of this decentralized model.In this report, the software supply chains of the most popular Ethereum clients are cataloged and analyzed.The dependency graphs of Ethereum clients developed in Go, Rust, and Java, are studied. These client are Geth, Prysm, OpenEthereum, Lighthouse, Besu, and Teku.To do so, their dependency graphs are transformed into a unified format.Quantitative metrics are used to depict the software supply chain of the blockchain.The results show a clear difference in the size of the software supply chain required for the execution layer and consensus layer of Ethereum.Varying degrees of software diversity are present in the studied ecosystem. For the Go clients, 97% of Geth dependencies also in the supply chain of Prysm.The Java clients Besu and Teku share 69% and 60% of their dependencies respectively.The Rust clients showing a much more notable amount of diversity, with only 43% and 35% of OpenEthereum and Lighthouse respective dependencies being shared. / Mjukvaruleverantörskedjan sammanfattar
all resurser som behövs för att producera en mjukvaruprodukt.
En stor del av detta är användningen av öppen källkod. Trots att
användningen av öppen källkod tillåter snabb produktion av nya
produkter, utsätter sig alla som använder den för potentiella bug-
gar samt attacker som kan tillföras utanför deras kontroll. Ethere-
um är ett stort blockkedje nätverk baserad på öppen källkod som
försöker konkurrera med tjänster som tidigare endast erbjudits
av centraliserade institutioner. Det finns flera implementationer
av mjukvaran som implementerar Ethereum som alla utvecklas
oberoende av varandra i olika programmerings språk för att öka
stabiliteten och säkerheten av den decentraliserade modellen. I
denna rapport studeras mjukvaruleverantörskedjorna av de mest
populära klienterna som implementerar Ethereum. Dessa utveck-
las i programmeringsspråken Go, Rust, och Java. Dom studerade
klienterna är Geth, Prysm, OpenEthereum, Lighthouse, Besu, och
Teku. För att genomföra studien transformeras klienternas mjuk-
varuleverantörskedjor till ett standardiserat format. Kvantitiva
mått används för att beskriva dessa leverantörskedjor. Resultaten
visar en stor skillnad i storlek av leverantörskedjor för olika
lager i Ethereum. Det visas att det finns en varierande mångfald
av mjukvara baserat på de språk som klienter är utvecklade med.
Leverantörskedjorna av Go klienter sammanfaller i princip fullt,
medan de av Java klienter sammanfaller med en stor majoritet,
och de av Rust klienter visar på mest mångfald i mjukvarupaket. / Kandidatexjobb i elektroteknik 2022, KTH, Stockholm

No description available.

Background.The rapid expansion of open-source software has introduced significant security challenges, particularly concerning supply chain attacks. Software supply chain attacks, such as the NotPetya attack, have underscored the critical need for robust security measures. Managing dependencies and protecting against such attacks have become important, leading to the emergence of Software Bill of Materials (SBOMs) as a crucial tool. SBOMs offer a comprehensive inventory of software components, aiding in identifying vulnerabilities and ensuring software integrity. Objectives. Investigate the information contained within SBOMs in Python and Gorepositories on GitHub. Analyze the evolution of SBOM fields over time to understand how software dependencies change. Examine the impact of the US Executive Order of May 2021 on the quality of SBOMs across software projects. Conduct dynamic vulnerability scans in repositories with SBOMs, focusing on identifying types and trends of vulnerabilities. Methods. The study employs archival research and quasi-experimentation, leveraging data from GitHub repositories. This approach facilitates a comprehensive analysis of SBOM contents, their evolution, and the impact of policy changes and security measures on software vulnerability trends. Results. The study reveals that SBOMs are becoming more complex as projects grow, with Python projects generally having more components than Go projects. Both ecosystems saw reductions in vulnerabilities in later versions. The US Executive Order of 2021 positively impacted SBOM quality, with measures like structural elements and NTIA guidelines showing significant improvements post-intervention. Integrating security scans with SBOMs helped identify a wide range of vulnerabilities. Projects varied in critical vulnerabilities, highlighting the need for tailored security strategies. CVSS scores and CWE IDs provided insights into vulnerability severity and types. Conclusions. The thesis highlights the crucial role of SBOMs in improving software security practices in open-source projects. It shows that policy interventions like the US Executive Order and security scans can significantly enhance SBOM quality, leading to better vulnerability management and detection strategies. The findings contribute to the development of robust dependency management and vulnerability detection methodologies in open-source software projects.

The proliferation of web based technologies has resulted in new forms of communities and organizations with enormous implications for design of learning and education. This thesis explores learning occurring within open source software (OSS) communities. OSS communities are a dominant form of organizing in software development with implications not only for innovative product development but also for the training of a large number of software developers. The central catalyst of learning within these communities is expert-novice interactions. These interactions between experts and novices or newcomers are critical for the growth and sustenance of a community and therefore it is imperative that experts are able to provide newcomers requisite advice and support as they traverse the community and develop software. Although prior literature has demonstrated the significance of expert-novice interactions, there are two central issues that have not been examined. First, there is no examination of the role of external events on community interaction, particularly as it relates to experts and novices. Second, the exact nature of expert help, particularly, the quantity of help and whether it helps or hinders newcomer participation has not been studied. This thesis studies these two aspects of expert-novice interaction within OSS communities. The data for this study comes from two OSS communities. The Java newcomer forum was studied as it provided a useful setting for examining external events given the recent changes in Java's ownership. Furthermore, the forum has a rating system which classifies newcomers and experienced members allowing the analysis of expert-novice interactions. The second set of data comes from the MySQL newcomer forum which has also undergone organizational changes and allows for comparison with data from the Java forum. Data were collected by parsing information from the HTML pages and stored in a relational database. To analyze the effect of external events, a natural experiment method was used whereby participation levels were studied around significant events that affected the community. To better understand the changes contextually, an extensive study of major news outlets was also undertaken. Findings from the external event study show significant changes in participation patterns, especially among newcomers in response to key external events. The study also revealed that the changes in participation of newcomers were observed even though other internal characteristics (help giving, expert participation) did not change indicating that external events have a strong bearing on community participation. The effect of expert advice was studied using a logistic regression model to determine how specific participation patterns in discussion threads led to the final response to newcomers. This was supported by social network analysis to visually interpret the participation patterns of experienced members in two different scenarios, one in which the question was answered and the other where it was not. Findings show that higher number of responses from experienced members did not correlate with a response. Therefore, although expert help is essential, non-moderated or unguided help can lead to conflict among experts and inefficient feedback to newcomers. / Master of Science

Global System for Mobile Communications (GSM) networks are receiving increasing attention in the open-source community. Open-source software allows for deployment of a mobile cellular network with lower costs, more customization, and scalable control. Two popular projects have emerged that offer varying network architectures and allow users to implement a GSM network in different capacities depending on individual needs. Osmocom provides more network control and scalability but requires commercial Base Transceiver Station (BTS) hardware with limited availability and closed source code. OpenBTS provides minimal GSM network functionality with more easily available and open-source hardware; however, it does not allow multi-cellular network configuration. This thesis offers a significant contribution towards a fully open-source GSM network by integrating the two major open-source communities, Osmocom and OpenBTS. Specifically, the Osmo-USRP program provides an inter-layer interface between the different network architectures of two GSM base station projects. Inter-layer primitive messages are processed in a thread multiplexer that manages logical channels across the interface. Downstream flow control is implemented in order to receive data frames on time for transmitting at the appropriate GSM frame number (FN). Uplink measurements, which are necessary for decision making in the Base Station Controller (BSC), are also gathered in the physical layer of Osmo-USRP and reported to Osmocom. Osmo-USRP operation is tested using a Universal Software Radio Peripheral (USRP), a relatively inexpensive and accessible Software-Defined Radio (SDR). Standard GSM events are investigated for single cell and multi-cellular network configurations. These tests include subscriber authentication and encryption, location updating, International Mobile Subscriber Identity (IMSI) attach and detach, Short Message Service (SMS) storage and delivery, voice calls with the full-rate audio codec, and uplink and downlink measurement reporting. While most functionality is successfully tested, inter-cell handover is not currently implemented. Further details on the proposed implementation of program limitations, especially inter-cell handover, are also discussed. / Master of Science

No / Cloud computing is increasingly attracting large attention both in academic research and in industrial initiatives. However, despite the popularity, there is a lack of research on the suitability of software tools and parameters for creating and deploying Cloud test beds. Virtualization and how to set up virtual environments can be done through software tools, which are available as open source, but there still needs to be work in terms of which tools to use and how to monitor parameters with the suitability of hardware resources available. This paper discusses the concepts of virtualization, as a practical view point, presenting an in-depth critical analysis of open source cloud implementation tools such as CloudStack, Eucalyptus, Nimbus, OpenStack, OpenNebula, OpenIoT, to name a few. This paper analyzes the various toolkits, parameters of these tools, and their usability for researchers looking to deploy their own Cloud test beds. The paper also extends further in developing an experimental case study of using OpenStack to construct and deploy a test bed using current resources available in the labs at the University of Bradford. This paper contributes to the theme of software setups and open source issues for developing Cloud test bed for deploying and constructing private Cloud test bed.

<p dir="ltr">Our research revolves around the evolving landscape of Open-Source Software (OSS) supply chains, emphasizing their critical role in contemporary software development while investigating the escalating security concerns associated with their integration. As OSS continues to shape the software ecosystem, our research acknowledges the paradigm shift in the software supply chain, highlighting its complexity and the associated security challenges. Focusing on Debian packages, we employ advanced network science methods to comprehensively assess the structural dynamics and vulnerabilities within the OSS supply chain. The study is motivated by the imperative to understand, model, and mitigate security risks from interconnected software components.</p><p dir="ltr">Our research questions delve into 1) identifying high-risk packages 2) comparing risk profiles between source and build stages and 3) predicting future vulnerabilities. Data collection involves collecting source code repositories, build-info information, and vulnerability data of Debian packages. Leveraging a multifaceted methodology, we perform the following things: graph construction, subsampling, metrics creation, explorative data analysis, and statistical investigations on the Debian package network. This statistical approach integrates the Wilcoxon test, Chi-Square test, and advanced network dynamics modeling with machine learning, to explore evolving trends and correlations between different stages of the OSS supply chain.</p><p dir="ltr">Our goals include providing actionable insights for industry practitioners, policymakers, and developers to enhance risk management in the OSS supply chain. The expected outcomes encompass an enriched understanding of vulnerability propagation, the identification of high-risk packages, and the comparison of network-based risk metrics against traditional software engineering measures. Ultimately, our research contributes to the ongoing discourse on securing open-source ecosystems, offering practical strategies for risk mitigation and fostering a safer and more resilient OSS supply chain.</p>

Developing countries like Tanzania experience challenges towards utilization and acceptance of ICT; calling for a need to further research on the concept. Open Source (OS) usage is a potential strategy for addressing such challenges. However, the success of this strategy strongly relies on the strength of the promotional efforts. The study, therefore aims at assessing the OS promotional efforts in relation to ICT acceptance challenges in Tanzania. This study entailed a descriptive, mixed-methods research. A literature analysis, document analysis and observations of OS community activities were conducted in order to list the ICT acceptance challenges. The results formed a basis for survey and interview questions. The findings obtained were triangulated to determine the existing OS promotional activities and assess the effectiveness of the promotional efforts in addressing ICT acceptance challenges in Tanzania. The study also makes recommendations on how OS promotional efforts should be changed to improve their effectiveness. / Computing / (M.Sc. (Information Systems))