Download to read offline
Evolving Software Ecosystems: Health and beyond
- 1. Evolving software ecosystems: Health andbeyond Eleni Constantinou Tom Mens University of Mons Belgium
- 2. SOCIO- TECHNICAL A SoftwareEcosystem is X
- 3.
- 4. SECOHealth Inter-disciplinary inter-university researchproject Towards an interdisciplinary, socio-technical methodology and analysis of the health of software ecosystems www.secohealth.org
- 5. SECO-Assist Automated Assistance for DevelopingSoftware in Ecosystems of the Future secoassist.github.io Inter-university research project Tom Mens University of Mons Anthony Cleve Université de Namur Coen De Roover Vrije Universiteit Brussel Serge Demeyer University of Antwerp
- 6. SECO health Sustainability Longevity Growth Success ResilienceSurvival Diversity Popularity
- 7. SECO health Sustainability Longevity Growth Success ResilienceSurvival Diversity Popularity
- 8. Technical Health Problems • Outdateddependencies • Security vulnerabilities • Bugs • Duplicated code • Incompatible licenses • … • Abandonment of contributors • Lack of communication / interaction • Social conflicts • Insufficient diversity • …
- 9.
- 10. Evolution of package dependencynetworks A Decan, T Mens (2018) An Empirical Comparison of Dependency Network Evolution in Seven Software Packaging Ecosystems. Empirical Software Engineering Seven package dependency networks extracted using open source discovery service http://libraries.io (CC BY-SA 4.0) 830K packages – 5.8M package versions – 20.5M dependencies
- 11. Package changes arefrequent Findings • #package updates grows over time • >50% of package releases are updated within 2 months. • Required and young packages are updated more frequently. Changeability index: Maximal value n such that there exist n packages having been updated at least n times during the last month. CRAN differs due to rolling release policy: “Submitting updates should be done responsibly and with respect for the volunteers’ time. Once a package is established, ‘no more than every 1–2 months’ seems appropriate.”
- 12. Package changes arefrequent Package updates may cause many maintainability issues or even failures in dependent packages. "Especially with respect to package dependencies, the risk of things breaking at some point due to the fact that a version of a dependency has changed without you knowing about it is immense. That actually cost us weeks and months in a couple of professional projects I was part of."
- 13. Most packages dependon other packages Findings • 60% to 80% of all packages are connected. • A stable minority (20%) of required packages collect over 80% of all reverse dependencies. • # npm dependencies grows much faster. Reusability index: Maximal value n such that there exist n required packages having at least n dependent packages.
- 14. Package changes mayhave important impact March 2016 Unexpected removal of left-pad Caused > 2% of all packages to break (> 5,400 packages) November 2010 Release 0.5.0 of i18n broke dependent package ActiveRecord Transitively required by >5% of all packages
- 15.
- 16. Most of thecomplexity is deeply hidden … … in the transitive dependencies Proportion of top-level packages by depth of dependency tree Over 50% of top-level packages have deep dependency tree. Ecosystem complexity
- 17. Package changes mayhave important impact Evolution of 5-Impact Index Findings • Dependent packages have few direct but many transitive dependencies. • Ratio of indirect over direct dependencies increases over time. P-Impact Index : Number of packages that are transitively required by at least P% of all packages.
- 18.
- 19. SECO evolution Empirical investigationof software ecosystems • Social changes • Technical impact of social changes
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27. Evolution of packagedependency networks E Constantinou, T Mens (2017) Socio-Technical Evolution of the Ruby Ecosystem in GitHub. SANER 2017 26K packages/projects, 69K forks 76K contributors 5M commits
- 28. SECO health –Social Growth
- 29. SECO health –Technical Growth Technical growth 2008 2009 2010 2011 2012 2013 2014 2015 2016 2000 4000 6000 8000 10000 Projects Obsolete Projects New Projects Active Projects 2008 2009 2010 2011 2012 2013 2014 2015 0 1 2 3 4 Specialization
- 30. SECO health Major socialchanges can highly impact the ecosystem evolution Monitoring these changes can help in identifying such issues early
- 31. SECO health –Survival
- 32. Evolution of packagedependency networks E Constantinou, T Mens (2017) An Empirical Comparison of Developer Retention in the RubyGems and npm Software Ecosystems. Innovations in Systems and Software Engineering 70K packages/projects 32K contributors 3M commits 1.5M messages 179K packages/projects 64K contributors 8M commits 4M messages
- 33. SECO health –Survival Socio-technical activity • Intensity • Frequency • Inactivity length Survival analysis
- 34. SECO health –Developer survival
- 35. SECO health –Developer survival Population: all developers in an ecosystem Event: abandonment of a developer Developers tend to abandon the ecosystem sooner if they: do not communicate communicate less intensively communicate less frequently do not communicate for a longer period 0 50 100 150 200 0.00.20.40.60.81.0 npm Duration of commit activity (months) Survivalprobability Social inactivity Social activity Social abandoner 0 50 100 150 0.00.20.40.60.81.0 RubyGems Duration of commit activity (months) Survivalprobability Social inactivity Social activity Social abandoner 0 50 100 150 200 0.00.20.40.60.81.0 npm Duration of commit activity (months) Survivalprobability Very Short Short Long Very Long 0 50 100 150 0.00.20.40.60.81.0 RubyGems Duration of commit activity (months) Survivalprobability Very Short Short Long Very Long
- 36. SECO health –Developer survival Developers tend to abandon the ecosystem sooner if they: commit less intensively commit less frequently do not commit for longer periods 0 50 100 150 200 0.00.20.40.60.81.0 npm Duration of commit activity (months) Survivalprobability Very Weak Weak Strong Very Strong 0 50 100 150 0.00.20.40.60.81.0 RubyGems Duration of commit activity (months) Survivalprobability Very Weak Weak Strong Very Strong 0 50 100 150 200 0.00.20.40.60.81.0 npm Duration of commit activity (months) Survivalprobability Very Short Short Long Very Long 0 50 100 150 0.00.20.40.60.81.0 RubyGems Duration of commit activity (months) Survivalprobability Very Short Short Long Very Long
- 37. SECO health –Package survival 37
- 38. SECO health –Package survival Population: all packages in an ecosystem Event: commit inactivity of a package Packages tend to become inactive sooner if the developers contributing to these packages: do not communicate communicate less intensively communicate less frequently do not communicate for a longer period
- 39. SECO health –Package survival Packages tend to become inactive sooner if the developers contributing to these packages: commit less intensively commit less frequently do not commit for longer periods
- 40. SECO health –Survival Intense and frequent commit activity is not enough … Intense and frequent messaging activity is also necessary
- 41. Current work –Identity merging
- 42. Current work –Identity matching GitHub git Mailing list Gerrit BugZilla IRC
- 43. Current work –Forecasting inactivity
- 44. What next? Technical • Outdateddependencies • Security vulnerabilities • Bugs • Duplicated code • Incompatible licenses • … • Abandonment of contributors • Lack of communication / interaction • Social conflicts • Insufficient diversity • …
- 45.
Editor's Notes
- #9 Technical Diversity: different platforms, different programming languages, different application domains, different packages with similar functionality Community Smells: Lone Wolfs, Isolated Teams, Communication Problems Contributor Abandonment: Rage quitting
- #12 npm and nuget more subject to package updates. CRAN less subject to package updates.
- #16 “The package leftpad essentially contains a few lines of source code but has thousands of dependent projects, including Node and Babel. When its developer decided to unpublish all his modules for npm, this had important consequences, “almost breaking the internet “ March 2016 Unexpected removal of left-pad caused > 2% of all packages to break (> 5,400 packages) RubyGems, November 2010 Release 0.5.0 of i18n broke dependent package ActiveRecord, transitively required by >5% of all packages (930)
- #34 Study factors affecting the time to event (such as child birth, recovering from a disease, etc). Estimate the survival rate of a population over time, considering the notion of censoring.