{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,26]],"date-time":"2025-10-26T15:01:09Z","timestamp":1761490869948,"version":"3.41.2"},"reference-count":75,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2019,10,3]],"date-time":"2019-10-03T00:00:00Z","timestamp":1570060800000},"content-version":"vor","delay-in-days":275,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Alfred P. Sloan Foundation Digital"},{"name":"Open Source Health and Sustainability"},{"name":"University of Nebraska at Omaha Libraries' Open Access"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019,1,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>The security of software is becoming increasingly important. Open source software forms much of our digital infrastructure. It, however, contains vulnerabilities which have been exploited, attracted public attention, and caused large financial damages. This article proposes a solution to shortcomings in the current economic situation of open source software development. The main idea is to introduce price signals into the peer production of software. This is achieved through a trading market for futures contracts on the status of software issues. Users, who value secure software, gain the possibility to predict outcomes and incentivize work, strengthening collaboration and information sharing in open source software development. The design of such a trading market is discussed and a prototype introduced. The feasibility of the trading market design is corroborated in a proof-of-concept implementation and simulation. Preliminary results show that the implementation works and can be used for future experiments. Several directions for future research result from this article, which contributes to peer production, software development practices, and incentives design.<\/jats:p>","DOI":"10.1093\/cybsec\/tyz011","type":"journal-article","created":{"date-parts":[[2019,10,3]],"date-time":"2019-10-03T15:22:49Z","timestamp":1570116169000},"source":"Crossref","is-referenced-by-count":1,"title":["A market for trading software issues"],"prefix":"10.1093","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2080-2006","authenticated-orcid":false,"given":"Malvika","family":"Rao","sequence":"first","affiliation":[{"name":"Incentives Research, Ottawa, ON, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6769-7867","authenticated-orcid":false,"given":"Georg J P","family":"Link","sequence":"additional","affiliation":[{"name":"University of Nebraska at Omaha, Omaha, NE, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Don","family":"Marti","sequence":"additional","affiliation":[{"name":"Mozilla, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andy","family":"Leak","sequence":"additional","affiliation":[{"name":"Mountain View Smart Contracts, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rich","family":"Bodo","sequence":"additional","affiliation":[{"name":"Mountain View Smart Contracts, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"286","published-online":{"date-parts":[[2019,10,3]]},"reference":[{"key":"2020072716065278600_tyz011-B1"},{"volume-title":"Estimating the Global Cost of Cyber Risk: Methodology and Examples","year":"2018","author":"Dreyer","key":"2020072716065278600_tyz011-B2"},{"volume-title":"Fourth Workshop on the Economics of Information Security","year":"2005","author":"Nizovtsev","key":"2020072716065278600_tyz011-B3"},{"year":"2001","author":"Anderson","key":"2020072716065278600_tyz011-B4"},{"year":"2016","author":"Eghbal","key":"2020072716065278600_tyz011-B5"},{"key":"2020072716065278600_tyz011-B6","doi-asserted-by":"crossref","first-page":"369","DOI":"10.2307\/1562247","article-title":"Coase\u2019s penguin, or, \u201clinux and the nature of the firm\u201d","volume":"112","author":"Benkler","year":"2002","journal-title":"Yale LJ"},{"year":"2015","key":"2020072716065278600_tyz011-B7"},{"key":"2020072716065278600_tyz011-B8","first-page":"1","article-title":"Open-source software - an economic assessment","volume":"4","author":"Kooths","year":"2003","journal-title":"MICE Econ Res Stud"},{"year":"2018","key":"2020072716065278600_tyz011-B9"},{"year":"2016","key":"2020072716065278600_tyz011-B10"},{"year":"2016","key":"2020072716065278600_tyz011-B11"},{"year":"2013","key":"2020072716065278600_tyz011-B12"},{"year":"2001","key":"2020072716065278600_tyz011-B13"},{"year":"2009","key":"2020072716065278600_tyz011-B14"},{"first-page":"973","year":"2009","author":"Bacon","key":"2020072716065278600_tyz011-B15"},{"year":"2010","author":"Bacon","key":"2020072716065278600_tyz011-B16"},{"year":"2018","author":"Rao","key":"2020072716065278600_tyz011-B17"},{"year":"2015","author":"Malvika","key":"2020072716065278600_tyz011-B18"},{"year":"2005","author":"Rainer","key":"2020072716065278600_tyz011-B19"},{"key":"2020072716065278600_tyz011-B20","doi-asserted-by":"crossref","first-page":"298","DOI":"10.1007\/11766155_21","volume-title":"Emerging Trends in Information and Communication Security, LNCS 3995","author":"Bohme","year":"2006"},{"author":"Stuart","key":"2020072716065278600_tyz011-B21"},{"year":"2004","author":"Ozment","key":"2020072716065278600_tyz011-B22"},{"key":"2020072716065278600_tyz011-B23","doi-asserted-by":"crossref","first-page":"610","DOI":"10.1126\/science.1130992","article-title":"The economics of information security","volume":"314","author":"Anderson","year":"2006","journal-title":"Science"},{"year":"2015","author":"Cofone","key":"2020072716065278600_tyz011-B24"},{"key":"2020072716065278600_tyz011-B25","doi-asserted-by":"crossref","first-page":"726","DOI":"10.1287\/mnsc.1040.0357","article-title":"Market for software vulnerabilities? Think again","volume":"51","author":"Kannan","year":"2005","journal-title":"Manag Sci"},{"year":"2015","author":"Laube","key":"2020072716065278600_tyz011-B26"},{"key":"2020072716065278600_tyz011-B27","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1093\/cybsec\/tyx008","article-title":"Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs","volume":"3","author":"Maillart","year":"2017","journal-title":"J Cybersecur"},{"key":"2020072716065278600_tyz011-B28","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1109\/MSP.2005.30","article-title":"Toward econometric models of the security risk from remote attack","volume":"1","author":"Schechter","year":"2005","journal-title":"IEEE Security Privacy"},{"year":"2012","author":"Hosseini","key":"2020072716065278600_tyz011-B29"},{"key":"2020072716065278600_tyz011-B30","doi-asserted-by":"crossref","first-page":"542","DOI":"10.1257\/aer.91.3.542","article-title":"The optimal allocation of prizes in contests","volume":"91","author":"Moldovanu","year":"2001","journal-title":"Am Econ Rev"},{"key":"2020072716065278600_tyz011-B31","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1016\/j.jet.2004.10.004","article-title":"Contest architecture","volume":"126","author":"Moldovanu","year":"2006","journal-title":"J Econ Theory"},{"key":"2020072716065278600_tyz011-B32","first-page":"97","volume-title":"Towards a Theory of the Rent Seeking Society","author":"Tullock","year":"2001"},{"year":"2009","author":"Archak","key":"2020072716065278600_tyz011-B33"},{"year":"2012","author":"Chawla","key":"2020072716065278600_tyz011-B34"},{"first-page":"119","year":"2009","author":"DiPalantino","key":"2020072716065278600_tyz011-B35"},{"key":"2020072716065278600_tyz011-B36","doi-asserted-by":"crossref","first-page":"359","DOI":"10.1198\/016214506000001437","article-title":"Strictly proper scoring rules, prediction, and estimation","volume":"102","author":"Gneiting","year":"2007","journal-title":"J Am Stat Assoc"},{"key":"2020072716065278600_tyz011-B37","first-page":"1","article-title":"Logarithmic market scoring rules for modular combinatorial information aggregation","volume":"1","author":"Hanson","year":"2007","journal-title":"J Predict Markets"},{"first-page":"129","year":"2008","author":"Lambert","key":"2020072716065278600_tyz011-B38"},{"key":"2020072716065278600_tyz011-B39","first-page":"489","article-title":"Probability forecasting in meteorology","volume":"79","author":"Murphy","year":"1984","journal-title":"J Am Stat Assoc"},{"key":"2020072716065278600_tyz011-B40","doi-asserted-by":"crossref","first-page":"783","DOI":"10.1080\/01621459.1971.10482346","article-title":"Elicitation of personal probabilities and expectations","volume":"66","author":"Savage","year":"1971","journal-title":"J Am Stat Assoc"},{"year":"2008","author":"Boudreau","key":"2020072716065278600_tyz011-B41"},{"key":"2020072716065278600_tyz011-B42","first-page":"97","article-title":"The principles of distributed innovation","volume":"2","author":"Lakhani","year":"2007","journal-title":"Innov Technol Gov Glob"},{"key":"2020072716065278600_tyz011-B43","doi-asserted-by":"crossref","DOI":"10.7551\/mitpress\/2366.001.0001","volume-title":"Design Rules","author":"Baldwin","year":"2000"},{"key":"2020072716065278600_tyz011-B44","doi-asserted-by":"crossref","first-page":"1015.","DOI":"10.1287\/mnsc.1060.0552","article-title":"Exploring the structure of complex software designs: an empirical study of open source and proprietary code","volume":"52","author":"MacCormack","year":"2006","journal-title":"Manag Sci"},{"key":"2020072716065278600_tyz011-B45","doi-asserted-by":"crossref","first-page":"197","DOI":"10.1111\/1467-6451.00174","article-title":"Some simple economics of open source","volume":"50","author":"Lerner","year":"2003","journal-title":"J Ind Econ"},{"key":"2020072716065278600_tyz011-B46","doi-asserted-by":"crossref","first-page":"637","DOI":"10.1162\/105864002320757280","article-title":"Open source software: private provision of a public good","volume":"11","author":"Johnson","year":"2002","journal-title":"J Econ Manag Strategy"},{"key":"2020072716065278600_tyz011-B47","doi-asserted-by":"crossref","first-page":"294","DOI":"10.1111\/jems.12053","article-title":"Dynamics of open source movements","volume":"23","author":"Athey","year":"2014","journal-title":"J Econ Manag Strategy"},{"key":"2020072716065278600_tyz011-B48","doi-asserted-by":"crossref","first-page":"748","DOI":"10.1257\/aer.89.4.748","article-title":"The redesign of the matching market for American physicians: some engineering aspects of economic design","volume":"89","author":"Roth","year":"1999","journal-title":"Am Econ Rev"},{"key":"2020072716065278600_tyz011-B49","doi-asserted-by":"crossref","first-page":"1299","DOI":"10.1111\/1468-0262.00334","article-title":"Architecture of power markets","volume":"70","author":"Wilson","year":"2002","journal-title":"Econometrica"},{"key":"2020072716065278600_tyz011-B50","doi-asserted-by":"crossref","first-page":"7202","DOI":"10.1073\/pnas.1701997114","article-title":"Economics and computer science of a radio spectrum reallocation","volume":"114","author":"Leyton-Brown","year":"2017","journal-title":"Proc Natl Acad Sci"},{"key":"2020072716065278600_tyz011-B51","doi-asserted-by":"crossref","first-page":"1547","DOI":"10.1093\/qje\/qjv027","article-title":"The high-frequency trading arms race: frequent batch auctions as a market design response","volume":"130","author":"Budish","year":"2015","journal-title":"Q J Econ"},{"year":"2018","author":"Immorlica","key":"2020072716065278600_tyz011-B52"},{"key":"2020072716065278600_tyz011-B53","doi-asserted-by":"crossref","first-page":"541","DOI":"10.1093\/oxrep\/grx063","article-title":"An invitation to market design","volume":"33","author":"Kominers","year":"2017","journal-title":"Oxf Rev Econ Policy"},{"year":"2018","author":"Rao Georg","key":"2020072716065278600_tyz011-B54"},{"year":"2012","key":"2020072716065278600_tyz011-B55"},{"year":"2012","key":"2020072716065278600_tyz011-B56"},{"year":"2012","key":"2020072716065278600_tyz011-B57"},{"key":"2020072716065278600_tyz011-B58","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1016\/j.jss.2016.09.015","article-title":"A survey of the use of crowdsourcing in software engineering","volume":"126","author":"Mao","year":"2017","journal-title":"J Syst Software"},{"key":"2020072716065278600_tyz011-B59","doi-asserted-by":"crossref","first-page":"29","DOI":"10.25300\/MISQ\/2014\/38.1.02","article-title":"Collaboration through open superposition: a theory of the open source way","volume":"38","author":"Howison","year":"2014","journal-title":"MIS Q"},{"key":"2020072716065278600_tyz011-B60","doi-asserted-by":"crossref","first-page":"345","DOI":"10.1023\/A:1004957109535","article-title":"The private provision of public goods via dominant assurance contracts","volume":"96","author":"Tabarrok","year":"1998","journal-title":"Public Choice"},{"key":"2020072716065278600_tyz011-B61","volume-title":"Auction Theory","author":"Krishna","year":"2010","edition":"2nd edn"},{"key":"2020072716065278600_tyz011-B62","doi-asserted-by":"crossref","first-page":"393","DOI":"10.25300\/MISQ\/2015\/39.2.06","article-title":"Leading collaboration in online communities","volume":"39","author":"Faraj","year":"2015","journal-title":"MIS Q"},{"key":"2020072716065278600_tyz011-B63","first-page":"1","volume-title":"Advances in Economic Theory: Fifth World Congress","author":"Milgrom","year":"1987"},{"key":"2020072716065278600_tyz011-B64","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1007\/978-1-4020-7953-5_5","volume-title":"Handbook of Quantitative Supply Chain Analysis: Modeling in the E-Business Era","author":"Kalagnanam","year":"2004"},{"key":"2020072716065278600_tyz011-B65","doi-asserted-by":"crossref","first-page":"593","DOI":"10.7551\/mitpress\/9780262033428.003.0024","volume-title":"Combinatorial Auctions","author":"Bichler","year":"2005"},{"key":"2020072716065278600_tyz011-B66","first-page":"1079","article-title":"Derivatives clearinghouses and systemic risk: a bankruptcy and Dodd-Frank analysis","volume":"64","author":"Allen","year":"2012","journal-title":"Stanford L Rev"},{"key":"2020072716065278600_tyz011-B67","doi-asserted-by":"crossref","first-page":"237.","DOI":"10.1002\/fut.3990040302","article-title":"Futures markets: their purpose, their history, their growth, their successes and failures","volume":"4","author":"Carlton","year":"1984","journal-title":"J Futures Markets (Pre-1986); New York"},{"key":"2020072716065278600_tyz011-B68","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1007\/978-1-4939-0378-8_4","volume-title":"Ways of Knowing in HCI","author":"Hudson","year":"2014"},{"key":"2020072716065278600_tyz011-B69","doi-asserted-by":"crossref","first-page":"395","DOI":"10.1007\/978-1-4939-0378-8_16","volume-title":"Ways of Knowing in HCI","author":"Ren","year":"2014"},{"key":"2020072716065278600_tyz011-B70","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1109\/TDSC.2014.2298011","article-title":"Extending the agile development process to develop acceptably secure software","volume":"11","author":"Othmane","year":"2014","journal-title":"IEEE Trans Depend Secure Comput"},{"key":"2020072716065278600_tyz011-B71","doi-asserted-by":"crossref","first-page":"1","DOI":"10.4018\/IJSSE.2017100101","article-title":"Risk centric activities in secure software development in public organisations","volume":"8","author":"Tondel","year":"2017","journal-title":"Int J Secure Softw Eng"},{"key":"2020072716065278600_tyz011-B72","doi-asserted-by":"crossref","first-page":"176","DOI":"10.1016\/j.jss.2015.06.063","article-title":"Continuous software engineering: a roadmap and agenda","volume":"123","author":"Fitzgerald","year":"2017","journal-title":"J Syst Softw"},{"year":"2015","author":"Karl","key":"2020072716065278600_tyz011-B73"},{"year":"2013","author":"Hansson","key":"2020072716065278600_tyz011-B74"},{"key":"2020072716065278600_tyz011-B75","doi-asserted-by":"crossref","first-page":"739","DOI":"10.1016\/j.jss.2008.10.026","article-title":"Identifying exogenous drivers and evolutionary stages in FLOSS projects","volume":"82","author":"Beecher","year":"2009","journal-title":"J Syst Softw"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/5\/1\/tyz011\/33536116\/tyz011.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/5\/1\/tyz011\/33536116\/tyz011.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,7,27]],"date-time":"2020-07-27T20:07:24Z","timestamp":1595880444000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyz011\/5580665"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,1,1]]},"references-count":75,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2019,1,1]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyz011","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"type":"print","value":"2057-2085"},{"type":"electronic","value":"2057-2093"}],"subject":[],"published-other":{"date-parts":[[2019]]},"published":{"date-parts":[[2019,1,1]]},"article-number":"tyz011"}}