6 citations · 8 across the 8 of their papers we have counts for
3 papers · 1 filter
The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse
Ranindya Paramitha, Christian Kästner, Laurie Williams
Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, as…
The Rising Cost of Trust: Practitioners' Trust Signals, Controls, and Responses in the Software Supply Chain
Ranindya Paramitha, Siri Paidipalli, Laurie Williams +1
The software supply chain is becoming more complex, and AI is reshaping its threat landscape, e.g., raising concerns about the quality of AI-generated dependencies. Seen through th…
CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages
Imranur Rahman, Jill Marley, Ranindya Paramitha +1
Dependency resolution at a specified point in time in the past can provide insight into software evolution in software ecosystems and facilitate the design of dynamic metrics (e.g.…