Yifan Zhang, Chen Huang, Yueke Zhang, Jiahao Zhang, Toby Jia-Jun Li, Collin McMillan, Kevin Leach, Yu Huang. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Open Source Software for Social Good (OSS4SG), a specialized segment within the Open Source Software (OSS) domain, is gaining increasing recognition for its focus on addressing societal challenges and delivering positive social impact. Learning about how contributors engage with OSS4SG is crucial to its sustainability, as the long-term success of these projects relies heavily on active and ongoing contributor participation. However, no study has yet examined the dynamics of contributors within OSS4SG. To fill this gap, we analyzed over 2.2 million commits made by 5,860 contributors to both OSS4SG and general OSS projects on GitHub, identifying contribution patterns and factors influencing sustained contribution to OSS4SG. We found that although OSS4SG contributors tend to show lower overall contribution intensity and shorter active lifespans, their activity during engaged periods is relatively more regular compared to contributions to general OSS. In addition, contributors from developing regions (e.g., Africa) or women are more likely to start with and continue contributing to OSS4SG, despite their overall contribution levels being lower than those of others. Based on these insights, we propose targeted strategies to increase contributions to OSS4SG projects to maximize their social impact to benefit society and harness their potential to foster broader participation in open source, ultimately enhancing the sustainability of the whole community.

GitHub is one of the largest open-source software (OSS) communities for software development and collaboration. Impersonation in the OSS communities refers to the malicious act of assuming another user's identity, often aiming to gain unauthorized access to code, manipulate project outcomes, or spread misinformation. With several recent real-world attacks resulting from impersonation, this issue is becoming more and more concerning within the OSS community. We present the first exploration of the impact of impersonation in GitHub. Specifically, we conduct structured interviews with 17 real-world OSS contributors about their perception of impersonation and corresponding mitigations. Our study reveals that, in general, GitHub users lack awareness of impersonation and underestimate the severity of its implications. After witnessing a demo of impersonation, they show significant concern for the OSS community. Meanwhile, we also demonstrate that the current best practices (i.e., commit signing) that might mitigate impersonation must be improved to encourage use and adoption. We also present and discuss participant perceptions of potential ways to mitigate GitHub impersonation. We collect a dataset comprising 12.5 million commits to investigate the current status of impersonation. Interestingly, we find out that currently impersonation cannot be easily detected. We observe that existing commit histories treat impersonation behavior identically to pull request events, resulting in a lack of detection methods for impersonation.

Reading code is a fundamental activity in both software engineering and computer science education. Understanding the cognitive processes involved in reading code is crucial for identifying effective cognitive strategies, which can inform teaching methods and tooling support for developers. However, collecting large human subject eye tracking datasets, especially for programming tasks, is often costly and time-consuming, limiting its scalability and applicability. To address this issue, we present CodeACT-R, the first cognitive simulation framework tailored for code reading, based on the well-established Adaptive Control of Thought—Rational (ACT-R) architecture from cognitive science. CodeACT-R simulates how humans read code and requires only a small, manageable amount of human data to initiate the simulator design, offering a cost-effective and scalable alternative to traditional data collection methods like eye tracking.Specifically, we first collected real human visual attention data from 48 programmers reading code using eye tracking. These data were then used to develop CodeACT-R, enabling the simulation of human-like code reading behaviors. Our evaluation demonstrates that CodeACT-R is capable of simulating visual attention patterns (i.e., scanpaths) that closely resemble real-world human attention patterns, also accounting for up to 87% of observed pattern variations.