Communications of the ACM
Communications of the ACM
Nurturing Software
Software doesn't grow on trees. Instead, software is nurtured and cultivated in several different environments from universities to firms. In each environment software is nurtured differently, which in turn influences the final features of software. This simple observation has important implications not only for software development, but also for society. After all, as Lessig and others have argued, software is the law of cyberspace and affects fundamental societal issues such as security, privacy, trust, and accessibility [5].
Scholars studying software have emphasized that software designs contain biases that favor certain actors or social values [3, 12]. For example, Internet search engines do not provide results in an unbiased and neutral fashion. Instead, they systematically favor certain types of sites over others [4, 6]. Similarly, there is concern that the design of digital rights management software may inadequately consider values of fair use and privacy [9]. This has led scholars to examine the role of organizations in which software is developed [11].
We argue that an important source of values in software is the institution in which it is developed. An institution is composed of a group of actors who are subject to a system of rules that structures their activities. These rules concern goals, rights, procedures, social norms, and formal legal rules that attenuate individual preferences. We examine four environments or societal institutions where most software is developed: universities, firms, consortia, and the open source movement. While there is a great degree of variation within each of these categories, social theorists recognize these as distinct sources of software.
Specifically, we consider how institutional rules are evident in the different structures, motivations, and influences of these four societal institutions. Once we understand how all these factors operate, we can offer predictions on the resulting attributes of software. Understanding the development of software has larger implications than revealing the differing working conditions for software engineers. Increasingly, society seeks to shape software development to address its concerns. This is evident in governmental policies from funding research into cybersecurity to regulations regarding accessibility features for software. Through these policies, government is attempting to shape the development of software in various societal institutions. We examine how these institutional factors explain the variation in the development of Web browsers, and how institutional factors affect the incorporation of the societal value of security into software. We discuss the current state of security as well as how it could be improved.
To understand how institutions nurture software differently we utilized a series of historical case studies that included NCSA Mosaic, Netscape's cookies, the Platform for Internet Content Selection (PICS), and the Apache Web server. The criteria for these case studies were for the software to be significantly developed within the societal institution of interest, and involve an interaction with substantial public policy issues. After all, without significant public policy involvement, society has little interest in understanding software development. The data for the case studies was built on documentary sources and interviews.
Universities. The purpose of this institution is to expand the frontiers of knowledge. Many significant computing technologies have emerged from universities including the Internet, artificial intelligence, and computer graphics. Society funds universities because private firms will underinvest in basic research [8]. Universities now account for about half of all basic research spending within the U.S. and are also the genesis of many technology firms [7].
Developers in universities are primarily motivated to enhance their reputation in the scientific community [1]. Reputation is derived from being the first to discover or develop innovative findings as measured through peer recognition. Consequently, software developed within universities is institutionally biased toward matters regarded as important by a researcher's peers. This leads to a secondary regard for potential economic gain when developing software within a university.
To foster the development of innovative software, universities provide their developers with a measure of autonomy. Universities have recognized that the freedom to pursue self-directed research can lead to new knowledge and the development of innovative software. For example, our research found that autonomous university-style environments facilitated two key developments for the World Wide Web: the original conception of the Web by Tim Berners-Lee at the European particle physics laboratory, Conseil Européen pour la Recherche Nucléaire (CERN); and Marc Andreessen's initial development of NCSA Mosaic, the first popular Web browser, at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign. Andreessen has said he believes the unstructured work environment at NCSA supported the development of innovative ideas and software.
The scarcity of resources within universities is an important economic influence affecting software development. Universities simply cannot fully fund all their ongoing research. Developers cannot depend upon a large technical support staff, and functions seen as "bells and whistles," such as technical support and documentation, are not fully supported. Consequently, this provides researchers with the impetus to seek resources, such as research grants, outside the university. This can also lead developers to focus on developing the standards and building blocks for others to build upon. Berners-Lee used this strategy during the development of the Web. He developed the standards and reusable building blocks of software that became the basis for future Web browsers and servers.
Firms. In our economic system, it is the private sector that develops most software. In 1999, firms spent six times more than government on basic research, applied research, and development activity [7]. As a result, firms such as IBM and Microsoft have historically developed much of the software widely adopted in society.
The motivation of a firm is straightforward. Firms are driven by profit. To achieve profits, firms must provide goods and services that meet consumer demand. Successful firms listen to their customers, provide them with services they need and will need, and provide support when they run into trouble [10]. As a result, economic concerns shape the development of software created by firms. Consequently, values assumed to be unprofitable are not factored into a firm's decision-making process, even if these values are important to society. For example, consider the cookies technology, which allows Web sites to save state and therefore maintain user information. When Netscape implemented cookies, it did not address the privacy concerns posed by the cookies technology since this action could be viewed as unprofitable. Thus, early versions contained no cookie management tools or even cookie documentation. This neglect of unprofitable societal concerns by firms is understandable and is further discussed later.
Consortia consist of cooperation between various entities, including firms and government. Two prominent Internet consortia are the World Wide Web Consortium (W3C) and the Internet Engineering Task Force (IETF). These consortia develop standards that serve their members through cooperation. The primary influence on the development of standards within a consortium is its members, who decide what projects to pursue and what resources to invest. The members also affect the development process through their choice of consortium structure. This involves decisions on membership composition and membership rights, intellectual property rights, and the procedural rules that govern their work. Additionally, these structures are not fixed but can change over the lifetime of a consortium. For example, the W3C was established with the intent of creating a faster standards process than the IETF. As the W3C has aged, it has added formal procedures that have slowed down its development process.
Consortia may ignore or overlook outside influences or third parties during the development process. This is important because, at first glance, consortia often appear to be working for the benefit of society. But because consortia are accountable only to their members, they do not adequately consider the needs of third parties, such as independent software vendors and end users. This can result in ineffective or technically poor solutions. For example, our research found the W3C developed PICS largely in response to political and legal pressures placed upon its members. As a result, the technology it developed was of little use to end users, such as parents, or firms that sell filtering software.
Open source movement. The open source movement is the exemplar of the amateur movement in software. It stands apart from universities, firms, and consortia. It has developed softwareincluding Apache, the Linux operating system, the scripting language PERL, and the popular email server Sendmailthat rivals commercially available software. The defining characteristic of the open source movement is an overriding norm that source code should be made available to the public [2]. By keeping the source code publicly available, developers can build upon others' earlier work to create more refined and complex software.
The motivations of the open source movement are varied. There are a small number of paid participants as well as private firms such as IBM, which have a direct financial motivation in the development of open source software. The motivations for the vast majority of unpaid participants include creative satisfaction, utilitarian enhancement including a rise in reputation, or a political motivation based on a perception of open source as superior to proprietary software.
The open source movement's development process is primarily influenced by its membership of volunteer developers. Because they can only provide limited time and resources, the limits of volunteerism shape the development of software. In contrast to a firm, there is no pressure to force volunteers to work on a particular project in a timely manner. Consequently, it is the volunteers who decide what software will be written and on what time schedule. They also wish to work on interesting tasks. The resulting software is then biased toward the interests of the volunteers, who are sophisticated developers and not ordinary users. This leads to projects that developers think are interesting or useful, such as desktop environments and text editors. As a result, volunteer members may not necessarily work on software that is in greater demand or more socially beneficial.
The emphasis on personal motivation attenuates external influences on open source software. An international team of volunteer members leads the open source movement. At times, this diverse set of developers disregards external political or economic concerns. For example, Mozilla, an open source Web browser based on Netscape's Web browser, contains features to block images from third party Web sites and pop-up advertising windows. Moreover, at times, the open source movement can be defiant of conventional economic and political influences. For example, consider the refinement of the Gnutella file-sharing program. The open source movement improved Gnutella largely because its decentralized design prevented users from being blocked access to the file-sharing network, and also to avoid vicarious copyright liability concerns after Napster. The results of our findings, summarized in tables 1 and 2, are from our larger body of research, only a portion of which is discussed here.
Implications
Once we understand the institutional features and influences that shape software, we can explain certain attributes of software. A schematic of this process is shown in the figure. The attributes affected could include technical issues, such as the use of open standards; or business issues, such as the provision of technical support; or social characteristics such as the concern for privacy. We use the term "shape" instead of "cause" because all of these institutional factors do not cause specific features in a simple one-to-one fashion. Instead, software development is more complex and nuanced. Our analysis seeks to indicate salient institutional factors that can influence or shape the development of certain attributes. Our findings regarding how institutional features and influences affect the technical and social attributes of software are shown in Table 3. Here, we illustrate these implications with two examples. We briefly consider the difference in the development of Web browsers, and discuss how institutions differ in how they address societal security concerns.
Web browsers. A cursory examination of Web browsers shows how institutional factors affect software development. Web browsers created within universities, such as NCSA Mosaic, tend to focus on innovative features. This browser was a significant advance over other Web browsers because of its ease of use and the capability to view images in Web pages. Firms tend to focus on features that contribute to profits. Priorities for the Netscape Web browser, for example, included improving security, commerce, and performance, and resulted in new technologies such as cookies, continuous document streaming, and Secure Sockets Layer. In contrast, consortia focus on members needs. The W3C's Web browser, Amaya, is not designed to compete with commercial Web browsers, but to test new technologies produced by the W3C and their members. Finally, the open source movement has developed a wide variety of Web browsers including Mozilla and Konqueror. Their accomplishment has not been innovation, but instead continual incremental refining and the inclusion of features that commercial Web browsers were hesitant to incorporate, such as pop-up ad blocking and cookie management tools.
Societal concerns. Institutions differ in their incorporation of societal concerns into software. Examples of societal concerns include features such as privacy, protecting minors from inappropriate content, and protecting intellectual property rights. If these concerns are not adequately expressed in software, society may use actions such as government regulation to force the development of software. To illustrate the different inclinations of institutions, let us consider the incorporation of security.
Universities have traditionally conducted research into a variety of issues including cybersecurity issues. Security is but one of many sub-fields of computer science. Recently, governments and firms have been showing considerable interest in security research. This is being accomplished by increasing funding for research as well as increasing the demand for graduates well versed in cybersecurity.
Firms generally do not produce software that supports unprofitable, but socially beneficial, values. They seek to meet the needs of their customers and not society in general. Historically, we see a decreased emphasis on security in many software products, since firms believed consumers were seeking speed, convenience, and new features over security. These attitudes can be explained by consumers not fully understanding the costs of security and not having to fully bear the costs of poor security. If consumers become more knowledgeable about security issues and choose to collectively bear greater responsibility for security, this could prompt firms to incorporate security.
Consortia differ in their willingness to develop standards that address societal values. In the case of security, several consortia are actively developing new security standards. However, the final standard that is adopted is only approved by the consortia's members and necessarily excludes certain third parties who may be affected by the standards. As a result, the standards developed by consortia may be ineffective or not widely adopted. This is what happened with PICS.
Finally, the open source movement is subject to a variety of influences and can incorporate a wide range of social values including security. The development of secure software is fundamentally affected by whether it is a motivating concern for open source developers. If developers care about security then it will be reflected in the final software. Another factor that results in improved security is the widespread dissemination of source code, which allows for peer review of the software. Thus far, there is a wide variation in security among open source projects, with some projects being heavily scrutinized and improved upon while others languish with security flaws.
Conclusion
The nurturing or the development of software is not universally uniform. Instead, software engineers labor within institutions with differing structures, motivations, and influences that affect software development. In this article we identified salient institutional factors in the development process. Because of these varying institutional factors, software with the same technical functionality may have very different features, characteristics, and values. We illustrated this by showing how universities, firms, consortia, and the open source movement each have shaped the development of Web browsers in different ways. We also showed how institutional factors can explain the current state of software security, as well as how it can be improved in the future. While institutional factors cannot explain all features of software, they provide a starting point for understanding how software develops. Our hope is this analysis not only describes the nurturing of software, it also may inform how society could intervene to develop better software.
References
1. Dasgupta, P. and David, P.A. Toward a new economics of science. Research Policy 23 (1994), 487521.
2. DiBona, C., Ockman, S., and Stone M. Open Sources: Voices From the Open Source Revolution. O'Reilly, Cambridge, 1999.
3. Friedman, B. and Nissenbaum, H. Bias in computer systems. ACM Transactions on Information Systems 14, 3 (1996), 330347.
4. Introna, L. and Nissenbaum, H. Defining the Web: The politics of search engines. IEEE Computer 33, 1 (2000), 5462.
5. Lessig, L. Code and Other Laws of Cyberspace. Basic Books, NY, 1999.
6. Mowshowitz, A. and Kawaguchi, A. Bias on the Web. Commun. ACM 45, 9 (2002), 5660.
7. National Science Board, Science and engineering indicators2002. National Science Foundation, Arlington, Va. 2002.
8. Nelson, R. The simple economics of basic scientific research. Journal of Political Economy 67, 3 (1959), 297306.
9. Samuelson, P. Encoding the law into digital libraries. Commun. ACM 41, 4 (Apr. 1998), 1318.
10. Shapiro, C.L. and Varian H.R. Information Rules. Harvard University Press, Cambridge, 1998.
11. Vincent, C. and Camp, J. Looking to the Internet for models of governance. Ethics & Information Technology 6, 3 (2004), 161173.
12. Winner, L. Do artifacts have politics? Daedalus 110, 4 (Winter 1980), 121136.
Tables
Table 1. Institutional features.
Table 2. Influences on the developmental processes of software.
©2005 ACM 0001-0782/05/0900 $5.00
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.
The Digital Library is published by the Association for Computing Machinery. Copyright © 2005 ACM, Inc.
No entries found