As pressures increase for faster software development and delivery and pressures for reduced cost grow, organizations are increasing their reliance on Open Source Software (OSS) and 3rd party software. OSS has been compared to an open market bazaar where one is free to browse all the source code and take a copy. The lack of understanding on the part of the consumer, and lack of information provided by the author(s)/maintainer(s) has made this largess of reusable material riskier than expected. What are the most pressing concerns, what options have been successfully used to improve the current situation, and where are the gaps that need further research? How can risk be quantified?

We are soliciting papers from students for topics related to measurement of software risk, especially related to Open Source. Papers of interest include (but are not limited to) the following:

• Measuring OSS vulnerability and risk
• Analysis of alternatives for OSS (e.g. a means for selecting the least risky option)
• Monitoring OSS to identify unacceptable risk increases
• Evaluating OSS to determine a level of acceptability
• Evaluation of process(es) and improvements in OSS projects
• Pilot efforts to evaluate and/or monitor OSS within an acquisition life cycle

Technical Paper Submissions

Submissions should be 6-10 pages, using the double-column IEEE template for your ACSAC paper, available at IEEE Manuscript Templates for Conference Proceedings. For Latex, use \documentclass[conference,compsoc]{IEEEtran}. Two additional pages can be used for references and well-referenced appendices. Note that the reviewers are not expected to read these appendices.

All submissions must be anonymous.

Publication

Accepted papers will be published by IEEE Computer Society Conference Publishing Services (CPS) and will appear in the Computer Society Digital Library and IEEE Xplore® in an ACSAC Workshops 2024 volume alongside the main ACSAC 2024 proceedings. We are currently transitioning to technical sponsorship by IEEE Computer Society's Technical Community on Security and Privacy (TCSP) and expect approval before the proceedings are compiled.

Also, an effort is underway to establish an Open Source Measurement Special Interest Group within a (yet to be selected) Working Group under the Open Source Security Foundation. Results of this workshop can shape the agenda of the working group. Authors of accepted papers will be invited to participate in the working group.

Important Dates

• Submission deadline: September 30, 2024 (extended)
• Acceptance Notification: October 18, 2024
• Camera Ready Deadline: November 1, 2024 (new requirement for IEEE publications)
• Workshop Date: December 10, 2024

Further details about the workshop can be found on the workshop website: https://www.acsac.org/2024/workshops/icss/

Contact the workshop organizers at OSS3PST24@easychair.org

Visa Requests for Workshop Participants

ACSAC is being held in the US, so participants from outside the US may require a visa to travel to the conference and workshops. Since the US visa process varies based on nationality, we would like to inform any author submitting work to OSS3pst24 to request a visa letter in advance by following the instructions the instructions at https://www.acsac.org/visa/

Authors outside the US should apply for a visa letter in anticipation of their work being accepted. However, the visa letter does not indicate that their work will be accepted in the workshop. It is to remediate the potential delay and last-minute requests that can impact their travel plans. We also encourage the organizers to make a decision on accepting papers as soon as possible to give authors requiring a visa to the US time to process one.

Workshop Registration

If you are interested in attending, please check off the appropriate box on the conference registration form and add in the OSS and 3rd Party Software Transparency (OSS3PST) Workshop fee.

For accepted papers, at least one author must register and attend.