Alvaro Cardenas
University of California-Santa Cruz, CA·Computer Science
Open-source software is now part of the basic infrastructure of science, yet little reliable data exists on who writes it, who funds it, and how a problem in one project can spread to everything that depends on it. These questions matter most in fast-moving fields such as drones, embodied artificial intelligence (AI that controls physical machines), and autonomous systems.
- Fields
Computer Science
Social Science
- Topics
open-source software
research security
software supply chain
- Grants
- 1 known grant, through Jul 2028
What they work on
- Build a canonical, longitudinal dataset of high-impact research software that links repositories to dependencies, downstream users, contributors, affiliations, funding sources, scholarly use, and documented security events.
- Develop formal models of influence, concentrated control, and risk propagation across research-software supply chains, using statistical and network methods to derive validated indicators of systemic criticality and single points of failure.
- Test whether these indicators explain historical disruptions in open-source ecosystems, and whether governance, due diligence, and other policy interventions reduce risk, using drones and embodied AI as test cases.
- Release an international open-source repository browser (iORB) so other researchers can replicate and extend the data and methods, including future studies of AI-generated open-source software.
More about the research
In these fields the same code supports both civilian research and capabilities relevant to national defense. Software may be built across several countries, maintained by a handful of people, and reused through long chains of dependencies, where one package relies on another.
Why it matters
Policymakers and research institutions need evidence to protect the software that science depends on without shutting down open international collaboration. Indicators of which projects are critical and which hinge on a few people could support more precise security policies. Researchers in drones and autonomous systems could also benefit from earlier warning of risky single points of failure in the code they rely on.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Justin Cappos
New York University, NY·Computer Science
Build a command-line framework that automatically records software artifacts, environments, dependencies and actions during experiments, so computational studies can be rebuilt and rerun in the cloud for independent verification.
Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
Xing Gao
University of Delaware, DE·Computer Science·Early-career
Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
The school
University of California-Santa Cruz: 15 labs on PI Pages, $218M a year on research, 183 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.