FSE 2025
Mon 23 - Fri 27 June 2025 Trondheim, Norway
Wed 25 Jun 2025 15:10 - 15:30 at Vega - Dependency Chair(s): Alexandre Bartel

Protests are public expressions of personal or collective discontent with the current state of affairs. Although traditional protests involve in-person events, the ubiquity of computers and software opened up a new avenue for activism: protestware. Recent events in the Russo-Ukrainian war have sparked a wave of protestware, especially in the open-source community. While news and media heavily report individual protestware as discovered, an in-depth understanding of how they impact the open-source software supply chain is largely missing. In particular, we do not have a detailed understanding of their characteristics and impact on the open-source community who rely on free contributions. To address this gap, we first collect 163 samples of libraries that are either modified (protestware) or created (which we call protestware enablers) with a clear intention to protest. In addition, we analyze the aftermath of the protestware, which has the potential to affect the software supply chain in terms of community sentiment and usage. We report that: (1) protestware has three notable characteristics, namely, i) the way protests are induced is diverse, ii) the issue that triggered the protestware (i.e. what is being protested), iii) the altered functionality can be discriminatory, and iv) the transparency (i.e. reporting the change for protest) is not always respected; (2) disruptive protestware may cause a substantial adverse impact on downstream users; (3) developers of protestware may not shift their beliefs even with pushback; (4) the usage of protestware from JavaScript libraries has been seen to generally increase over time.

Wed 25 Jun

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

14:00 - 15:30
DependencyResearch Papers / Journal First / Demonstrations at Vega
Chair(s): Alexandre Bartel Umeå University
14:00
20m
Talk
Automatically fixing dependency breaking changes
Research Papers
Lukas Fruntke University College London, Jens Krinke University College London
DOI
14:20
10m
Talk
AutoPyDep: A Recommendation System for Python Dependency Management Utilizing Graph-Based Analytics
Demonstrations
Dibyendu Brinto Bose Virginia Tech, USA , Travis Chan Virginia Tech, Matthew Trimble Virginia Tech, Chris Brown Virginia Tech
14:30
20m
Talk
Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend Against Supply Chain Attacks
Research Papers
Hao He Carnegie Mellon University, Bogdan Vasilescu Carnegie Mellon University, Christian Kästner Carnegie Mellon University
DOI
14:50
20m
Talk
Towards Better Comprehension of Breaking Changes in the NPM Ecosystem
Journal First
Dezhen Kong Zhejiang University, Jiakun Liu Singapore Management University, Lingfeng Bao Zhejiang University, David Lo Singapore Management University
15:10
20m
Talk
On the Characteristics and Impacts of Protestware Libraries
Research Papers
Tanner Finken University of Arizona, Jesse Chen University of Arizona, Sazzadur Rahaman University of Arizona, Tucson, Arizona, USA
DOI

Information for Participants
Wed 25 Jun 2025 14:00 - 15:30 at Vega - Dependency Chair(s): Alexandre Bartel
Info for room Vega:

Vega is close to the registration desk.

Facing the registration desk, its entrance is on the left, close to the hotel side entrance.