Selecting third-party libraries: The practitioners' perspective
arXiv:2005.12574 · doi:10.1145/3368089.3409711
Abstract
The selection of third-party libraries is an essential element of virtually any software development project. However, deciding which libraries to choose is a challenging practical problem. Selecting the wrong library can severely impact a software project in terms of cost, time, and development effort, with the severity of the impact depending on the role of the library in the software architecture, among others. Despite the importance of following a careful library selection process, in practice, the selection of third-party libraries is still conducted in an ad-hoc manner, where dozens of factors play an influential role in the decision. In this paper, we study the factors that influence the selection process of libraries, as perceived by industry developers. To that aim, we perform a cross-sectional interview study with 16 developers from 11 different businesses and survey 115 developers that are involved in the selection of libraries. We systematically devised a comprehensive set of 26 technical, human, and economic factors that developers take into consideration when selecting a software library. Eight of these factors are new to the literature. We explain each of these factors and how they play a role in the decision. Finally, we discuss the implications of our work to library maintainers, potential library users, package manager developers, and empirical software engineering researchers.
References in corpus (1)
Cited by in corpus (11)
- Selecting third-party libraries: The practitioners' perspective
- AI Lifecycle Models Need To Be Revised. An Exploratory Study in Fintech
- DevOps Education: An Interview Study of Challenges and Recommendations
- ChatGPT Incorrectness Detection in Software Reviews
- Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks
- What makes a good Node.js package? Investigating Users, Contributors, and Runnability
- An Exploration of npm Package Co-Usage Examples from Stack Overflow: A Case Study
- "How do people decide?": A Model for Software Library Selection
- Trusting code in the wild: Exploring contributor reputation measures to review dependencies in the Rust ecosystem
- TrustSECO: An Interview Survey into Software Trust
- Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware