Is Open Source Secure?

In the light of the recent Heartbleed and ShellShock vulnerabilities (both of which were apparently innocuous code bugs),  I was approached for comment for an article about the security of open source software.  The journalist (Anthony Caruana) wanted to know about how code gets approved for inclusion in open source projects, and especially about the potential for the inclusion of "malicious" code. This is a subject I touched on in a previous posting, so it was good to be able to address it more directly.

Here are the questions & my responses:

With such a huge community of developers contributed code to open source applications, what steps are in place to prevent malicious code being injected into widely distributed applications?

I take the term "malicious code"  to mean code that has been deliberately added for some nefarious purpose – to introduce a security back-door, or capture credentials and identifies, or do some other kind of damage. 

It's important to differentiate between this kind of deliberate attack, and the kind of programming errors that can result in exploitation, such as the openSSL Heartbleed bug.
The way that open source projects are managed actively works against the inclusion of malicious code. Firstly, the fact that the source is open and available to be audited by a large audience means that there is a much greater opportunity to find deliberate attacks than there is in closed source. It was source code audits that found the bugs in openSSL and Bash.  Malicious code would have to be carefully hidden - without leaving trace that it is being hidden – to avoid detection. Obfuscated code immediately attracts attention. 

The second factor is that major open source projects operate in a community where reputation is the critical factor:  simply submitting code is not necessarily enough to have it included into the main codeline.  The author must be known to, and trusted by,  the project maintainer.  It's human nature that when a new programmer joins a project, his or her code will be vetted more carefully than already-known contributors.  Establishing and maintaining a high reputation requires significant effort, so lends against the rapid or repeated insertion of malicious code. 

In contrast with this, closed-source code is not open for wide review by a large audience, and simply requires a disgruntled employee or the instruction of some agency to add the malicious code (as has been alleged by the Snowden leaks ).

What testing is done with open source software before it is released into the community? 

Testing varies from project to project - in this sense "open source" is not some homogenous group with identical policies. One of the features of the open source community is the rapid turn-around and release of projects:  with a major project there may be several different versions of software available at once - for example  a "stable" release, a "development" release, and a "nightly build".  A stable release can be considered to have gone through the most amount of testing; a development release is a version that developers and testers are working on; and a nightly build is version of the code that has the latest changes integrated & is almost certainly still buggy.  Of course, with commercial open source organisations like SUSE,  only stable versions are released.
Since this is open source it is the community itself that does the testing. The community may include commercial organisations like SUSE, but also includes researchers and hobbyists.  Users of open source software have to decide what level of comfort they have for possible bugs when they choose which version to use. One of the biggest contributions non-programmers can make is to try development release software & report back any problems.  Again - the potentially wider audience than you can achieve in a closed-source project means that this phase can be more effective and faster than in proprietary software (the "crowd source" effect). 

Hobbyists and non-programmers may only be able to investigate to a certain level, but commercial organisations and researchers can perform more involved tests. When SUSE contributes changes – either as new product features or patches – the software goes through our QA team to test functionality, stability, scalability and for regressions including vulnerabilities, as well as integration testing with our partners. SUSE makes heavy use of testing automation, and a lot of effort goes into maintaining & refining our automated methods. SUSE also relies on individual expertise to review results and find errors. 

At the end of the day for any software - open source, closed source or embedded - it's a question of confidence.  The attractive thing about open source is that there is potential for a much higher degree of confidence than for closed source.  It is much harder to hide mistakes, much harder to secretly introduce malicious code, and much more likely that a programmer wanting to make a name for him or herself will discover (and fix) problems when the source is open and available for review.  Ultimately, if the users of open source software want to perform rigorous and exhaustive examinations of code, they can;  the option is not even there for closed source software.

Is Your Leadership Style Fixed or Changeable?

This was originally a scholarly article written as a discussion of whether the leadership style of an individual was fixed and unchangeable, or adaptable and flexible.  The style is a little more formal for that reason.

 “Inventories can be managed, but people must be led.”

- H. Ross Perot

Leadership, and the development of leaders, is an activity that organisations of all kinds have been applying a great deal of effort to for time immemorial. In the past 100 years, theories on the nature of leaders have undergone a great deal of development, and in the modern environment of change the quest to understand how leadership works is as important as ever.

This essay considers the question “is leadership style fixed and unchangeable for a leader or flexible and adaptable?”, with a focus on the modern business environment. It will examine the theories of “leadership” in the modern business context, and discuss some of the leadership styles which have been described in the literature.

It is apparent from the literature and ongoing discussion that the question of leadership and the ability of leaders to change is the subject of much debate and research. This paper will propose that adaptability is a complex and difficult exercise, and that there may be alternatives available for an organisation to achieve leadership goals more efficiently.

What is leadership?

Despite a lot of research into the question, there is no single defined understanding of what constitutes a “leader”, or what distinguishes an effective leader from an ineffective one or “non-leader” (Bennis & Nanus, 1985 in Vroom & Jago, 2007).

The original (and still popularly held) concept of leadership is of a “great man” whose internal
qualities, or “traits”, provided the ability to lead, and that such people simply needed to be identified and placed into positions of power (Horner, 1997). Indeed, some traits are frequently seen in effective leaders, such as: persistence, tolerance for ambiguity, self-confidence, drive, honesty, integrity, internal locus of control, achievement motivation, and cognitive ability (Avolio, 2007). However leadership itself is not a specific trait, and although many attempts have been made to measure for such a thing, they have been unsuccessful (Vroom & Jago, 2007).

Leadership can be described as the exercise of social power to influence others (Kruglanksi, Pierro & Higgins, 2007), and French and Raven (1959, in Kruglanksi, et al, 2007) describe five specific power bases:

1. coercive power, associated with the threat of punishment or discipline
2. legitimate power, associated with a perceived “right” to exert influence (such as rank)
3. expert power, associated with a influencer's superior knowledge (as recognised by the person being influenced)
4. referent power, associated with the target’s identification & feelings of connectedness with the influencer, such that the target will seek to gain the approval of the leader
5. reward power, associated with the ability to provide desirable things like money, security or pleasure

Of these power bases, coercive and legitimate powers are described as “hard”, since compliance is demanded but enforced rules or threats, whilst expert, referent and reward are described as “soft”, since they are effective only so long as the person being influenced is willing to accept the advice of the influencer.

The ability to influence does not lie in isolation, though: in the modern context, leadership is understood be a process. Vroom & Jago (2007) define leadership as:

“...a process of motivating people to work together collaboratively to accomplish great things.”

In this definition it should be understood that the “great things” are the in the minds of both the leader and any followers, although this view may not be held by outsiders.

It is important to note that both this definition and the description of power bases above refer to strong links with the followers in the leader-follower relationship. Followers are a vital part of that relationship – it's self-evident that without at least one follower there can be no leader. Avolio (2007), asserts that “the quality of the exchange relationship between leaders and followers will determine the qualities of leadership and outcomes achieved”. As will be discussed later, followers can and do greatly influence leadership styles.

It may also be worth considering whether the classical role of “leader” even exists in modern contexts. Horner (1997) notes that a great deal of research into leadership focusses on male-dominated work places in manufacturing industries; as this profile becomes less and less prevalent in Western organisations, other modes of coordination are developing, such as self-managing teams and collaborative peer groups. Such groups also include innovators, entrepreneurs & thinkers working on leadership as a shared purpose (Gardner, 1990 in Horner, 1997). Drath (2008) suggests that in these collaborative situations there is still leadership, which can be viewed as the outcomes of agreeing on direction, developing a framework for aligning effort, and committing to the work at hand. He goes on to suggest that a collaborative leadership process might be observed in a discussion between peers: suggestions, disagreement and compromise form the discussion and eventually result in a consensus.

It could be argued, however, that such consensual decision-making is simply a specialised example of a “democratic” (Goleman, 2000) or “group decision making” (House, 1996) leadership style, as described in more detail below.

What is leadership style?

There are many definitions and theories of leadership style, but they can be generally classified into one of the following groups: trait, behavioural, contingency and contemporary (Horner, 1997).

As previously discussed, trait theories relate to the perceived innate qualities of leaders. Although no single “leadership” trait has been discovered, there is a body of thought that certain qualities may be both necessary and changeable for truly effective leadership styles, particularly the charismatic trait in times of change (Avolio, 2007; Bass, 1985).

Figure 1:Continuum of leadership behaviour - from Tannenbaum & Schmidt (1973)

Behavioural theories focus on what the leader actually does, and one premise of these theories is that these behaviours can be taught to, and adopted by, other employees in order to develop leaders. Tannenbaum & Schmidt (1973) defined leadership behaviours along a continuum from authoritarian to democratic, as shown in Figure 1. The ends of this continuum have also been labelled “forceful” & “advisory” (Kruglanski et al, 2007)

Contingency theories focus on the interrelationship between the traits and behaviours of leaders, and the situations in which the leader acts (Fiedler, 1969). Also important are the the interactions between leaders & their followers, such as described in path-goal theory (House, 1971, House & Mitchell, 1974, in House 1996).

Fiedler (1969) described two leadership styles: task-oriented, which is an authoritarian approach focussed on issuing directives and clarifying goals; and relationship-oriented, which is a supportive approach focussed on personal relations. These styles are then affected by the group situational factors in which leadership must be applied. The most important of these factors is leader-member personal relationships: a trusted, admired person will be able to influence a group regardless of any positional power; this can be related back to the “referent power” of described above. The second most important situational factor is task structure, which refers to how rigidly an assignment is defined. Highly structured tasks have leadership roles clearly defined, and so do not rely on a leader's individual positional power; unstructured tasks frequently have more than one solution, and so leaders must be able to influence group members in a more creative environment. The third most important situational factor is the position power of the leader, which is closely tied to “legitimate power” described above. It should be noted that leaders with high positional power do not always get better performance from their groups (Fielder, 1969).

Hersey & Blanchard (1969) described a curvilinear relationship between these task-oriented and relationship-oriented leadership styles as a way of illustrating the effective styles to use based on follower maturity (see Figure 2). As the readiness and capability of followers develops, the leader can adopt different styles as appropriate (see Table 1).

Figure 2: The Life-Cycle Theory of Leadership - from Hersey & Blanchard (1969)

Quadrant	Follower Readiness	Leader Style	Leader Actions
1	Unable and unwilling	Directing	Specific instructions and close supervision
2	Unable but willing	Coaching	Explain decisions and provide clarity
3	Able but unwilling	Supporting	Share ideas and facilitate group decisions
4	Able and willing	Delegating	Delegate responsibility

Table 1: Life Cycle Theory stages

Although identifying the suitability of different leadership styles with different workers, Hersey & Blanchard (1969) stress that changing style is difficult and can take a long time. For this reason, it should be gradual, and the result of planned growth.

Path-goal theory is concerned with the dyadic relationship between formally-assigned leader and subordinates (House, 1971, in House, 1996), and describes the role of the leader as one of clarifying the work goal for the subordinate, and making the path to the goal easier by reducing roadblocks and pitfalls and increasing opportunities for worker satisfaction. This theory was further developed to define a range of associated leader behaviours (House, 1996):

Path-Goal Clarifying: these behaviours include identifying subordinate goals, setting standards by which performance will be judged, and judicious use of rewards and punishment based on performance. These behaviours relate to the “task-oriented” style described above.

Achievement-Oriented: these behaviours are directed to encouraging excellence by setting challenging goals, seeking improvement, and showing confidence that subordinates will attain high standards of performance. These behaviours also relate to the “task-oriented” style described above.

Work Facilitating: these behaviours include planning, scheduling and organising work. It also includes mentoring and coaching subordinates and providing feedback for their development. The behaviours are most closely related to the “relationship-orient” style described above.

Supportive: these behaviours are focussed on supporting subordinate needs, such as showing concern for welfare and creating a friendly workplace. These behaviours are associated with the “relationship-oriented” style described above.

Interaction Facilitating: these behaviours include enabling collaboration, encouraging teamwork, and facilitating the resolution of disputes. These behaviours are also “relationship-oriented”.

Group-oriented decision making: this participative leader behaviour includes posing problems rather than solutions to the work group, encouraging all group members to be involved in the discussion, and ensuring that participation is balanced so that no individual dominates. Again, these behaviours fit into a “relationship-oriented” style.

With these behaviours in mind, House's (1996) revised theory of path-goal leadership proposes that:

1. Leader behaviour is acceptable and satisfying to subordinates
2. Leader behaviour will enhance subordinate goal-oriented performance

Avolio (2007) noted that contingency theories were developed as a result of past research examining relationships between pure “traits” and leadership performance produced conflicting results (Stogdill, 1974 in Avolio, 2007), leading to the idea that there needed to be a fit or match between the leader's style and the situation the leadership effort was being applied to.

Contemporary theories include the full-range model theory of transactional, transformational, and laissez-faire leadership (Bass, 1985). With the transactional style, leaders provide clear-cut roles and outcomes to their followers, and generally stay clear if workers are achieving. Transformational leadership emphasises the individualism of followers, and involves mentoring and a focus on relationships; workers are generally motivated to do more than they originally expected; transformational leaders may provide individualised consideration and/or intellectual stimulation to their followers, but are almost always associated with charismatic individuals. The laissez-faire style of leadership sees the avoidance of responsibility, and is generally perceived as has having negative effects. There is also the concept of “management by exception”, in which the leader remains disconnected from the workers unless a failure or breakdown occurs.

It is important to note that although transformational leadership is generally perceived to be the most effective (Avolio, 2007), it is not always the best style for a given situation (Bass, 1985). Even the laissez-faire style may be more appropriate for situations with the possibility of self-management (van Eeden, Cilliers & van Deventer, 2008).

There are many other recent descriptions of leadership styles in the literature, often focussing on how styles can be applied or adjusted. Rowe, Reardon & Bennis (1995, in Reardon, Reardon & Rowe, 1998) propose a Leadership Style Inventory (LSI) as summarised in Table 2. They assert that most leaders actually have a combination of these styles in varying degrees, and that the strongest strategic leaders demonstrate flexibility between styles.

Leader style	Focuses on	Persuades by	Makes changes	Learns by
Commanding	Results	Directing	Rapidly	Doing
Logical	Innovation	Explaining	Carefully	Studying
Inspirational	Opportunities	Creating trust	Radically	Questioning
Supportive	Facilitating work	Involvement	Slowly	Listening

Table 2: Leadership style inventory - from Rowe, Reardon & Bennis (1995, in Reardon, Reardon & Rowe, 1998)

Overlapping these descriptions, Goleman (2000) proposes six styles of leadership:

1. Coercive leaders who demand immediate compliance.
2. Authoritative leaders who mobilize people toward a vision.
3. Affiliative leaders who create emotional bonds and harmony.
4. Democratic leaders who build consensus through participation.
5. Pacesetting leaders who expect excellence and self-direction.
6. Coaching leaders who develop people for the future

Only four of these styles – authoritative, affiliative, democratic and coaching – consistently have a positive effect (Goleman, 2000). The coercive style limits the flexibility and creativity of followers, whilst the pacesetting style can lead to followers becoming overwhelmed by the high expectations placed on them. As with Reardon, et al (1998), Goleman suggests that leaders should engender multiple leadership styles in order to take the appropriate approach for a given situation, especially in times of change.

In a slightly different vein, Rooke & Torbert (2005) propose leadership styles are part of an evolutionary process. They define seven types of internal “action logic”, being how people interpret their surroundings and react when their power or safety is challenged (as in leadership situations). The seven action logics are summarised in Table 3:

Action Logic	Characteristics	Strengths
Opportunist	Wins any way possible. Self-oriented; manipulative; “might makes right.”	Good in emergencies and in sales opportunities.
Diplomat	Avoids overt conflict Wants to belong; obeys group norms; rarely rocks the boat.	Good as supportive glue within an office; helps bring people together.
Expert	Rules by logic and expertise. Seeks rational efficiency.	Good as an individual contributor.
Achiever	Meets strategic goals. Effectively achieves goals through teams; juggles managerial duties and market demands.	Suited to managerial roles; action and goal oriented
Individualist	Interweaves competing personal and company action logics. Creates unique structures to resolve gaps between strategy and performance.	Effective in venture and consulting roles.
Strategist	Generates organizational and personal transformations. Exercises the power of mutual inquiry, vigilance, and vulnerability for both the short and long term.	Effective as a transformational leader.
Alchemist	Generates social transformations. Integrates material, spiritual, and societal transformations.	Good at leading society-wide transformation

Table 3: Seven Ways of Leading - from Rooke & Torbert (2005)

Rooke & Torbert describe these action logic stages as being part of an evolutionary path, starting with “Opportunist” and heading towards “Alchemist”. Movement between these stages is difficult, and not everyone is able reach the later stages. In this way, these styles can be perceived as much as traits as anything else, leading leadership theory to circle back to some of the original ideas of leadership comprising innate characteristics.

Regardless of the model of leadership styles being investigated, it is clear that the effectiveness of any given styles depends greatly on the situation (Fiedler, 1969; Tannenbaum & Schmidt, 1973; Vroom & Jago, 2007; etc), which includes interdependencies with non-managers (followers) and with external influences (Tannenbaum & Schmidt, 1973). The variations in situation may include the type of organisation and organisational culture, team effectiveness and ability, the nature of the problem, and time pressures. The variations of non-managers include their level of independence, their tolerance for ambiguity, their experience, their affinity with the goals of the organisation and the expectations of decision making they may have for themselves.

Why change leadership style?

As previously discussed, changes in leadership style are likely to be necessary in different situations, caused by internal or external circumstances. The 2007 global economic crisis was a clear case in point of how external influences can significantly impact day-to-day business and pose new and different situations for leaders to content with.

Similarly, different different skills and styles are required in the stages in an organisation's lifespan of startup → growth → consolidate → maintain (Tozzi, 2008).

It's also worth considering that what constitutes “good” leadership can vary greatly between cultures (Avolio, 2007). Cross-cultural leadership (eg of multinational firms) are an example of where leadership styles must change to be effective, although anecdotally this seems to be rare in practice.
Generational differences can also be significant factors in the need to change leadership style; the popularly-discussed difficulty of “Baby-boomer”¹ managers to understand the work culture of “Generation Y”² employees is a case in point (eg Erickson et al, 2009; Waxer, 2009).

Can leaders change their styles?

Arguments about whether a leader can change his or her leadership style vary according to the leadership style model proposed.

The continuum of leadership behaviour model (Tannenbaum & Schmidt, 1973) offers opportunities to respond to different situations differently, with the implication that all behaviours on a range are equally accessible to the leader.

Vroom & Jago (1988 in Vroom & Jago, 2007) found that managers were able to adopt more participative styles after training, however there is evidence that individuals will revert to older behaviours when faced with stressors such as time pressure, poor appraisal methods, and lack of skills (Bass, 1985), and that day-to-day work takes precedence over the perceived additional effort required to enact change (Pfeffer, 2007).

Bass (1990), asserts that transformational (as opposed to transactional) leadership can be taught and learned, although he also states that “charismatic leadership is central to transformational process” (Bass, 1985). Charisma is arguably an intrinsic trait, rather than a skill that can be learned, which implies that truly achieving transformational leadership may be difficult for some.

It's also interesting to note that the leadership styles of the full-range model of leadership (transactional, transformational, laissez-faire) have been associated with personality traits in experiments conducted by van Eeden, et al (2008). Again, if traits are difficult to change, then changes in leadership style may also be difficult to achieve.

Avolio (2007), suggests that leadership traits may not be fixed, and may be affected by contexts (for example, disaster scenarios or emergencies), that result in the emergence of leadership and/or greater effectiveness. However it can be argued that if one's basic style of leadership is driven by one's personality, then making changes permanent may take years (Fielder, 1969), which does not lend to easy flexibility in an individual.

Goleman (2000) asserts that styles can be added to a leader's repertoire by developing the "emotional intelligence" competencies related to the new styles. Emotional intelligence is “the ability to manage ourselves and our relationships effectively”, and consists of four fundamental capabilities: self-awareness, self-management, social awareness, and social skill (Goleman, 2000).

In their discussion of the constructive-development theory and its relationship to leadership styles, McCauley, et al (2006) suggest that certain contexts encourage movement in adult development, and hence progression into new leadership styles. They also note, however, that even though a great deal of theorists' attention has been paid to developing tools to stimulate progression, there have been very few studies to validate their efficacy.

Rooke & Torbert (2005) describe cases in which leaders have been able to “evolve” their action-logic leadership styles, especially in circumstances where new opportunities (such as promotions) have opened outlets to demonstrate additional abilities. In the same paper, however, many example are given of failures of individual to achieve those changes, implying that the ability to change varies from person to person. Indeed, Avolio (2007) suggests that interactions between genetics and developmental components (at different life stages) are worthy of further study. If genes prove to be a component, then complete flexibility between leadership styles must be extremely difficult, if not impossible, for many people.

The overall implication seems to be that the more leadership styles are associated with personal traits rather than some learned behaviour, change becomes harder to attain and retain. Flexibility of leadership style can be observed in a small percentage of the population, but these are the exceptions rather than the rule.

Since leadership styles and their effectiveness are strongly influenced by the situation and target audience (Kruglanski et al, 2007), there may be alternatives to requiring a change in an individual leader's style in order to improve the result. Fiedler (1969) proposed that fitting a leader to a situation by finding places where s/he can perform well is a more effective strategy. Alternatively, it may be possible to adjust the situation to suit leader's style by altering the relationships, the task structure, or the leader's rank & relative position - a process described as “job engineering” (Fielder, 1998).

Conclusion

The definition of leadership and characterisation of leadership styles has developed a great deal over the past 100 years, and are still subjects of research and debate.

It's clear from the literature that situations (including follower characteristics) affect leadership style as much, or more so, as leaders themselves (Vroom & Jago, 2007; Kruglanski et al, 2007). With this in mind, awareness of one's own style and where other styles might be required is a big step in itself, even if the change cannot be managed by a single person (Reardon et al, 1998).

Flexibility in leadership style is certainly a desirable thing, as the different situations arising in the lifespan of an organisation will inevitably require different approaches to solve effectively. However, despite all the management programs and leadership courses made available in recent times, it appears that personal traits make up a significant amount of what distinguishes effective leaders (Bateman & Snell, 1999 in van Eeden et al, 2008). For those styles heavily influence by traits, change is possible, but requires recognition, understanding, desire and intrinsic ability, as well as opportunity for the change to occur and time for changes to truly take hold (Rooke & Torbert, 2005).

It may be that the most effective way of affecting changes in leadership style is to appropriately place leaders into situations which match their style (Fielder, 1998). Clear examples of this can be seen when businesses move from the start-up phase into the growth phase, and engage a professional and experienced CEO to manage the company, rather than the entrepreneurs and innovators who set things going.

Finally, leadership and leadership styles are all about people: it is people being led, and people doing the leading. Even with the emergence of self-managed teams and leadership as a collaborative exercise within a group, it is inevitable that the inter-personal relationships and group success will be affected by the personalities of the individual members; and so the investigation of leadership traits and styles remains an important area of research.

1 The Baby-boomer generation are those individuals born between 1945 and 1964

2 Generation Y individuals were born between approx 1980 and 1999