The discussed "Stacking the Deck" attack and our solution are relevant only to software controlled by loosely constituted communities. Developers can change their vision and abandon features that are essential for certain users. Moreover, well funded attackers can effectively take control of a project by orchestrating the transfer of the leadership of the developers to people that they control. We propose a mechanism to reduce the level of trust that users are required to have in the maintainers of free and open-source agent software. In fact, with the proposed method, it is sufficient for the user to trust that his constellation of independent testers are safe from attack, even as all testers may be subject to different attacks. Our solution inserts independent intermediaries (testers) between the developers and the end-users. To encourage independence of the testers, essential for the desired security, a distributed recommendation mechanism is employed, suggesting testers for end-users based on preferences of immediate connections, and on the frequency of usage of these testers in her neighborhood. Metrics of success and experiments for identifying promising parameters are reported.

Currently many users trust binaries downloaded from repositories such as sourceforge.net. As with any system connected to the Internet, such repositories can be subject to attacks tampering with the distributed binaries (inserting viruses, changing behavior). We propose a mechanism to reduce the level of trust that users are required to have into repositories for open source software that is maintained by volunteers. In fact, with the proposed method, it is sufficient for the user to trust that his flexibly specified constellation of independent testers are safe to each given attack, even as all may be subject to different attacks. The interesting configuration when any majority t out of n testers of the given user’s choice have to be believed safe, is just a special case. A new integrated framework of open source development, testing, distribution and updating is defined, implemented and made available. A tester is a person that builds and tests an existing source code revision from a repository, and then distributes a signed binary release of it, tagged with a Quality of Test (QoT) and a Result of Test (RoT). An ontology for the QoT and RoT is defined and managed by the developers of the source code, and is fixed at each given revision. The final management of the mirrors distributing binaries tested by several testers is done by the mirror maintainers, who may or may not be from among the trusted testers. Some testers can be defined as reference (a new release is not automatically accepted without their signature and minimum RoT).