This document presents a 3-layer approach to managing risks in open source software projects. Layer 1 involves collecting data through scenario-based assessments of risk drivers and their distributions. Layer 2 computes risk indicators for projects and communities and links them to business risks. Layer 3 uses goal reasoning to analyze the impact of risks on business goals. The approach separates concerns in risk analysis and the authors are working to improve automation and apply the approach through a platform called RISCOSS.

1. A Layered Approach to Managing
Risks in OSS Projects
X. Franch , R. Kenett , F. Mancinelli , A. Susi ,
D. Ameller , R. Ben‐Jacob , A. Siena
OSS 2014 – San José, Costa Rica

2. Risks and OSS
Insufficient risk management has been reported as one
of the topmost mistakes to avoid when implementing
OSS‐based solutions
Such risks can be manifold:
– evaluation, integration, context, process, quality and
evolution

3. Hypothesis of work
Understanding, managing and mitigating OSS
adoption risks is crucial to avoid potentially
significant adverse impact on business goals,
in terms of e.g. time to market, customer
satisfaction, revenue and brand image

4. The OSS project ecosystem

5. The risk ontology

6. A 3‐layer approach

7. Layer 1. Data collection

8. Layer 1. Scenario‐based assessment
Scenario 1 Scenario 2 Scenario N
15 21 …
3 3 …
15 23 …
mostly
morning
mostly
night
…
mostly
weekdays
mostly
weekdays
…
never sometimes …
? ? ?
Expert judgment
(Random) scenarios
Risk drivers and value of the intervals of their distributions

9. Layer 2. Risk indicator computation
Project
Timeliness
Weekday: When
the commit was
made
Bug fix time
Bug fix time for
critical & blocker
level bugs
Month: When the
commit was made
Hour: When the
commit was made
Month day: When
the commit was
made
Timeliness Risk Drivers
Commit frequency
/ week
Probabilistic, efficient:
• Diagnosis
• Prediction
• Classification
• Decision-making
Built using:
GeNie-SIMILE

10. Project
Timeliness
Outdated mobile
technology
Business risks
Investment not
reused
Distance learning
buggy
Students
dissatisfied
Reputation school
declined
School objects
distance learning
Activeness
Timeliness
Comunity
activiness
Comunity
cohesion
Project risk
indicators
Community risk
indicators
Layer 2. Linking to business risks

11. Layer 3. Goal reasoning

12. The RISCOSS platform

13. Conclusions and ongoing work
The 3‐layer approach helps in separating concerns in
analysis of the impact of risks in business goals
Ongoing work
– Improving the automation degree of the solution
– Running use cases in the RISCOSS project (cf. COMPSAC 2014)
– Building a catalogue of patterns representing OSS business
strategies
– Connecting existing sensors / measurement instruments to
the RISCOSS platform

14. For more information:
Xavier Franch, franch@essi.upc.edu