{"action":"created","comment":{"url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/comments/69116307","id":69116307,"diff_hunk":"@@ -0,0 +1,591 @@\n+:author: Sebastian Benthall\n+:email: sb@ischool.berkeley.edu\n+:institution: Ion Channel, ionchannel.io\n+:institution: UC Berkeley School of Information\n+:corresponding:\n+\n+:author: Travis Pinney\n+:email: travis.pinney@ionchannel.io\n+:institution: Ion Channel, ionchannel.io\n+\n+:author: Kit Plummer\n+:email: kit.plummer@ionchannel.io\n+:institution: Ion Channel, ionchannel.io\n+:institution: kit.plummer@ionchannel.io\n+\n+\n+---------------------------------------------------------------\n+An Ecological Approach to Software Supply Chain Risk Management\n+---------------------------------------------------------------\n+\n+.. class:: abstract\n+\n+   Existing approaches to software assurance focus on\n+   evaluating individual software projects in isolation. We propose\n+   a novel method of risk management that considers the total ecosystem\n+   of software development. Our model makes minimal assumptions about the \n+   propogation of vulnerability and exposure through a software supply chain. \n+   Combined with data collected from package management systems, this model\n+   indicates \"hot spots\" in the ecosystem of higher expected risk. \n+   We demonstrate this model using data collected from PyPI.\n+\n+.. class:: keywords\n+\n+   risk management, software dependencies, complex networks\n+\n+Introduction\n+------------\n+\n+Critical systems that depend on complex software are open\n+to many kinds of risk.\n+Typical approaches to software security have mitigated this\n+risk with static analysis.\n+We are developing novel ways to manage software risk through\n+supply chain intelligence, with a focus on open source software\n+ecosystems.\n+\n+The Heartbleed bug in OpenSSL is an example of community failure\n+example of how vulnerabilities\n+in open source software can be a major security risk. [Wheeler2014]_\n+The recent failure of React, Babel, and many other NPM packages\n+due to the removal of one small dependency, ``left-pad``,\n+shows how dependencies can be a risk factor\n+for production software. [Haney2016]_ \n+As dependencies become more numerous and interlinked, the \n+complexity of the system increases, as does the scope of risk management.\n+Open source software projects make their source code and developer\n+activity data openly available for analysis.\n+This data can be used to mitigate software risk that have not been explored.\n+\n+With a small number of analytic assumptions about the propagation of vulnerability\n+and exposure through the software dependency network, we have developed a model\n+of ecosystem risk that predicts \"hot spots\" in need of more investment.\n+In this paper, we demonstrate this model using real software dependency data extracted\n+from PyPI using Ion Channel.\n+\n+\n+Prior work\n+----------\n+\n+[Verdon2004]_ outline the diversity of methods used for risk analysis in software design.\n+Their emphasis is on architecture-level analysis and its iterative role in software development.\n+Security is achieved through managing information flows through architecturally distinct tiers of trust.\n+They argue for a team-based approach with diverse knowledge and experience because \"risk analysis\n+is not a science\".\n+\n+In computer science, however, there is a long history of security achieved through static analysis.\n+[Wagner2000]_ points out that the dependency of modern Internet systems on legacy code and the\n+sheer complexity of source code involved makes manual source code level auditing infeasible.\n+Therefore, static analysis tools based on firm mathematical foundations are significant\n+for providing computer security at scale. \n+\n+[Wheeler2015]_ develops a risk index for determing which open source software projects need \n+security investments. This work is part of the Linux Foundation (LF) Core Infrastructure \n+Initiative (CII) and published by the Institute for Defense Analysis. \n+This metric is based on their expertise in software development analytics and an \n+extensive literature review of scholarly and commercial work on the subject. \n+They then apply this metric to Debian packages and have successfully identified \n+projects needing investment. This work is available on-line as the CII Census project.\n+","path":"papers/sebastian_benthall/sebastian_benthall.rst","position":89,"original_position":89,"commit_id":"dd582da64b69d69f3abb987b74d05d12ab480840","original_commit_id":"dd582da64b69d69f3abb987b74d05d12ab480840","user":{"login":"dalippa","id":7816645,"avatar_url":"https://avatars.githubusercontent.com/u/7816645?v=3","gravatar_id":"","url":"https://api.github.com/users/dalippa","html_url":"https://github.com/dalippa","followers_url":"https://api.github.com/users/dalippa/followers","following_url":"https://api.github.com/users/dalippa/following{/other_user}","gists_url":"https://api.github.com/users/dalippa/gists{/gist_id}","starred_url":"https://api.github.com/users/dalippa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dalippa/subscriptions","organizations_url":"https://api.github.com/users/dalippa/orgs","repos_url":"https://api.github.com/users/dalippa/repos","events_url":"https://api.github.com/users/dalippa/events{/privacy}","received_events_url":"https://api.github.com/users/dalippa/received_events","type":"User","site_admin":false},"body":"I think you need a transition between the risk index paragraph and the success/failure of open source projects. It doesn't seem to flow well.","created_at":"2016-06-30T11:33:03Z","updated_at":"2016-06-30T11:33:03Z","html_url":"https://github.com/scipy-conference/scipy_proceedings/pull/205#discussion_r69116307","pull_request_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205","_links":{"self":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/comments/69116307"},"html":{"href":"https://github.com/scipy-conference/scipy_proceedings/pull/205#discussion_r69116307"},"pull_request":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205"}}},"pull_request":{"url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205","id":71946590,"html_url":"https://github.com/scipy-conference/scipy_proceedings/pull/205","diff_url":"https://github.com/scipy-conference/scipy_proceedings/pull/205.diff","patch_url":"https://github.com/scipy-conference/scipy_proceedings/pull/205.patch","issue_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/205","number":205,"state":"open","locked":false,"title":"Paper: \"An Ecological Approach to Software Supply Chain Risk Management\". Benthall et al. 2016","user":{"login":"sbenthall","id":68752,"avatar_url":"https://avatars.githubusercontent.com/u/68752?v=3","gravatar_id":"","url":"https://api.github.com/users/sbenthall","html_url":"https://github.com/sbenthall","followers_url":"https://api.github.com/users/sbenthall/followers","following_url":"https://api.github.com/users/sbenthall/following{/other_user}","gists_url":"https://api.github.com/users/sbenthall/gists{/gist_id}","starred_url":"https://api.github.com/users/sbenthall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbenthall/subscriptions","organizations_url":"https://api.github.com/users/sbenthall/orgs","repos_url":"https://api.github.com/users/sbenthall/repos","events_url":"https://api.github.com/users/sbenthall/events{/privacy}","received_events_url":"https://api.github.com/users/sbenthall/received_events","type":"User","site_admin":false},"body":"SciPy 2016 submission.","created_at":"2016-05-31T00:49:50Z","updated_at":"2016-06-30T11:33:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8f287e85a3e29d58a483c5065cd3fe82a5b3b41e","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205/commits","review_comments_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205/comments","review_comment_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/comments{/number}","comments_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/205/comments","statuses_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/statuses/dd582da64b69d69f3abb987b74d05d12ab480840","head":{"label":"sbenthall:2016","ref":"2016","sha":"dd582da64b69d69f3abb987b74d05d12ab480840","user":{"login":"sbenthall","id":68752,"avatar_url":"https://avatars.githubusercontent.com/u/68752?v=3","gravatar_id":"","url":"https://api.github.com/users/sbenthall","html_url":"https://github.com/sbenthall","followers_url":"https://api.github.com/users/sbenthall/followers","following_url":"https://api.github.com/users/sbenthall/following{/other_user}","gists_url":"https://api.github.com/users/sbenthall/gists{/gist_id}","starred_url":"https://api.github.com/users/sbenthall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbenthall/subscriptions","organizations_url":"https://api.github.com/users/sbenthall/orgs","repos_url":"https://api.github.com/users/sbenthall/repos","events_url":"https://api.github.com/users/sbenthall/events{/privacy}","received_events_url":"https://api.github.com/users/sbenthall/received_events","type":"User","site_admin":false},"repo":{"id":36956177,"name":"scipy_proceedings","full_name":"sbenthall/scipy_proceedings","owner":{"login":"sbenthall","id":68752,"avatar_url":"https://avatars.githubusercontent.com/u/68752?v=3","gravatar_id":"","url":"https://api.github.com/users/sbenthall","html_url":"https://github.com/sbenthall","followers_url":"https://api.github.com/users/sbenthall/followers","following_url":"https://api.github.com/users/sbenthall/following{/other_user}","gists_url":"https://api.github.com/users/sbenthall/gists{/gist_id}","starred_url":"https://api.github.com/users/sbenthall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbenthall/subscriptions","organizations_url":"https://api.github.com/users/sbenthall/orgs","repos_url":"https://api.github.com/users/sbenthall/repos","events_url":"https://api.github.com/users/sbenthall/events{/privacy}","received_events_url":"https://api.github.com/users/sbenthall/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sbenthall/scipy_proceedings","description":"Tools used to generate the SciPy conference proceedings","fork":true,"url":"https://api.github.com/repos/sbenthall/scipy_proceedings","forks_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/forks","keys_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/teams","hooks_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/hooks","issue_events_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/issues/events{/number}","events_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/events","assignees_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/assignees{/user}","branches_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/branches{/branch}","tags_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/tags","blobs_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/git/refs{/sha}","trees_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/statuses/{sha}","languages_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/languages","stargazers_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/stargazers","contributors_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/contributors","subscribers_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/subscribers","subscription_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/subscription","commits_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/commits{/sha}","git_commits_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/git/commits{/sha}","comments_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/comments{/number}","issue_comment_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/issues/comments{/number}","contents_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/contents/{+path}","compare_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/merges","archive_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/downloads","issues_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/issues{/number}","pulls_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/pulls{/number}","milestones_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/milestones{/number}","notifications_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/labels{/name}","releases_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/releases{/id}","deployments_url":"https://api.github.com/repos/sbenthall/scipy_proceedings/deployments","created_at":"2015-06-05T21:26:44Z","updated_at":"2016-05-26T04:36:48Z","pushed_at":"2016-06-29T19:47:36Z","git_url":"git://github.com/sbenthall/scipy_proceedings.git","ssh_url":"git@github.com:sbenthall/scipy_proceedings.git","clone_url":"https://github.com/sbenthall/scipy_proceedings.git","svn_url":"https://github.com/sbenthall/scipy_proceedings","homepage":"","size":3327,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"scipy-conference:2016","ref":"2016","sha":"c91d1c88fe313a4503f92413cbdc879ecddf223a","user":{"login":"scipy-conference","id":4884274,"avatar_url":"https://avatars.githubusercontent.com/u/4884274?v=3","gravatar_id":"","url":"https://api.github.com/users/scipy-conference","html_url":"https://github.com/scipy-conference","followers_url":"https://api.github.com/users/scipy-conference/followers","following_url":"https://api.github.com/users/scipy-conference/following{/other_user}","gists_url":"https://api.github.com/users/scipy-conference/gists{/gist_id}","starred_url":"https://api.github.com/users/scipy-conference/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scipy-conference/subscriptions","organizations_url":"https://api.github.com/users/scipy-conference/orgs","repos_url":"https://api.github.com/users/scipy-conference/repos","events_url":"https://api.github.com/users/scipy-conference/events{/privacy}","received_events_url":"https://api.github.com/users/scipy-conference/received_events","type":"Organization","site_admin":false},"repo":{"id":1825629,"name":"scipy_proceedings","full_name":"scipy-conference/scipy_proceedings","owner":{"login":"scipy-conference","id":4884274,"avatar_url":"https://avatars.githubusercontent.com/u/4884274?v=3","gravatar_id":"","url":"https://api.github.com/users/scipy-conference","html_url":"https://github.com/scipy-conference","followers_url":"https://api.github.com/users/scipy-conference/followers","following_url":"https://api.github.com/users/scipy-conference/following{/other_user}","gists_url":"https://api.github.com/users/scipy-conference/gists{/gist_id}","starred_url":"https://api.github.com/users/scipy-conference/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scipy-conference/subscriptions","organizations_url":"https://api.github.com/users/scipy-conference/orgs","repos_url":"https://api.github.com/users/scipy-conference/repos","events_url":"https://api.github.com/users/scipy-conference/events{/privacy}","received_events_url":"https://api.github.com/users/scipy-conference/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/scipy-conference/scipy_proceedings","description":"Tools used to generate the SciPy conference proceedings","fork":false,"url":"https://api.github.com/repos/scipy-conference/scipy_proceedings","forks_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/forks","keys_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/keys{/key_id}","collaborators_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/teams","hooks_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/hooks","issue_events_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/events{/number}","events_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/events","assignees_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/assignees{/user}","branches_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/branches{/branch}","tags_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/tags","blobs_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/git/refs{/sha}","trees_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/git/trees{/sha}","statuses_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/statuses/{sha}","languages_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/languages","stargazers_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/stargazers","contributors_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/contributors","subscribers_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/subscribers","subscription_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/subscription","commits_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/commits{/sha}","git_commits_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/git/commits{/sha}","comments_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/comments{/number}","issue_comment_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/comments{/number}","contents_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/contents/{+path}","compare_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/compare/{base}...{head}","merges_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/merges","archive_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/downloads","issues_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues{/number}","pulls_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls{/number}","milestones_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/milestones{/number}","notifications_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/labels{/name}","releases_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/releases{/id}","deployments_url":"https://api.github.com/repos/scipy-conference/scipy_proceedings/deployments","created_at":"2011-05-31T10:26:48Z","updated_at":"2016-05-14T13:06:42Z","pushed_at":"2016-06-30T09:01:43Z","git_url":"git://github.com/scipy-conference/scipy_proceedings.git","ssh_url":"git@github.com:scipy-conference/scipy_proceedings.git","clone_url":"https://github.com/scipy-conference/scipy_proceedings.git","svn_url":"https://github.com/scipy-conference/scipy_proceedings","homepage":"","size":216846,"stargazers_count":87,"watchers_count":87,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":171,"mirror_url":null,"open_issues_count":26,"forks":171,"open_issues":26,"watchers":87,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205"},"html":{"href":"https://github.com/scipy-conference/scipy_proceedings/pull/205"},"issue":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/205"},"comments":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/issues/205/comments"},"review_comments":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205/comments"},"review_comment":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/pulls/205/commits"},"statuses":{"href":"https://api.github.com/repos/scipy-conference/scipy_proceedings/statuses/dd582da64b69d69f3abb987b74d05d12ab480840"}}}}
{"actor":{"display_login":"dalippa"}}