2026-09-19T10:13:27Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/350932022-01-13T07:55:19Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
Eric A. von Hippel.
Shapira, Yoav
System Design and Management Program.
System Design and Management Program.
2006-12-18T20:39:47Z
2006-12-18T20:39:47Z
2006
2006
http://hdl.handle.net/1721.1/35093
71333049
Thesis (S.M.)--Massachusetts Institute of Technology, System Design and Management Program, 2006.
Page 141 blank.
Includes bibliographical references (p. 84-87).
There exists a broad body of literature documenting organizational responses to competitive threats, including those responses which fit into the threat-rigidity hypothesis. The purpose of this thesis is to investigate how a novel organizational form, the open-source software development community known as the Apache Software Foundation, responds to a specific type of threat: security issues reported to exist in its software products. An analysis of publicly available data from the Apache Software Foundation is conducted, the security issue handling process is described in detail, and an analysis on security issue origin, severity, and resolution is provided. Special attention is given to communication along the issue resolution process, as the threat-rigidity hypothesis predicts a reduction in the flow of information across the organization.
(cont.) The results show that this organization defies some central predictions of the hypothesis: there is little reduction in information flow, little or no centralization in decision-making, and no loss of group-level focus. The research results are framed within the literature of user-led innovation and organizational behavior. The implications for traditional software development organizations are discussed, and recommendations for further research are provided.
by Yoav Shapira.
S.M.
141 p.
8159896 bytes
8167337 bytes
application/pdf
application/pdf
eng
Massachusetts Institute of Technology
M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.
http://dspace.mit.edu/handle/1721.1/7582
System Design and Management Program.
A threat-rigidity analysis of the Apache Software Foundation's response to reported server security issues
Thesis
application/pdf
false
Publication
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="2dd086a6-1473-41f7-b71f-2d75a1e53e01">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>A threat-rigidity analysis of the Apache Software Foundation's response to reported server security issues</Title>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2006</PublicationDate>
<Authors>
<Author>
<DisplayName>Shapira, Yoav</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>System Design and Management Program.</Keyword>
<Abstract>There exists a broad body of literature documenting organizational responses to competitive threats, including those responses which fit into the threat-rigidity hypothesis. The purpose of this thesis is to investigate how a novel organizational form, the open-source software development community known as the Apache Software Foundation, responds to a specific type of threat: security issues reported to exist in its software products. An analysis of publicly available data from the Apache Software Foundation is conducted, the security issue handling process is described in detail, and an analysis on security issue origin, severity, and resolution is provided. Special attention is given to communication along the issue resolution process, as the threat-rigidity hypothesis predicts a reduction in the flow of information across the organization.</Abstract>
<Abstract>(cont.) The results show that this organization defies some central predictions of the hypothesis: there is little reduction in information flow, little or no centralization in decision-making, and no loss of group-level focus. The research results are framed within the literature of user-led innovation and organizational behavior. The implications for traditional software development organizations are discussed, and recommendations for further research are provided.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>