1. Rahul Telang1 Provision of Software Quality in the Presence of Patching Technology Rahul Telang With Ashish Arora and Jon Caulkins The Heinz School

2. Rahul Telang2 Agenda Motivation Prior Work Model Results Competition Discussion

3. Rahul Telang3 Motivation Software has become inherent in modern business activities. Examples of software failures abound. Empirical estimates of cost of software failure is an open question. A recent study by NIST (2002) puts the number at $60 B. 62% business managers believe that software vendors provide poor quality software (Information Week 2002). Overall quality experienced by users is combination of both the number of bugs in the product and vendor’s ability to fix them later.

4. Rahul Telang4 Motivation Practice of releasing patches is very common amongst software vendors Sun released more than 250 patches to fix about 1200 bugs in last six months for Solaris 9.0 (sunsolve.com) Microsoft releases patches on weekly basis. (Economic times, 2002) HP puts out on an average 60-80 patches per week for its HP-UX (Inter Works, 2000) Many organizations have explicit “patch- management” systems in place.

5. Rahul Telang5 Research Questions? How does the ability of a vendor to issue patches affect their time to market and quality of product? Is there a systematic sub-optimality of value provision by a firm with market power? How does competition affect firm behavior? What are the managerial and policy implications?

6. Rahul Telang6 Software is different? Marginal cost of issuing patch for the vendor is negligible. Internet has made it even easier. Much of the cost is fixed in nature. Users still suffer disutility due to patches. They may have to integrate patches and retest their systems On the other hand, typical physical goods incur significant marginal cost of fixing (For example, recalling an automobile) Strong empirical evidence to support the fact that firms issue patches regularly.

7. Rahul Telang7 Prior Work Much work on software quality and reliability in software engineering domain. Process improvements (CMM) leads to better quality and lower costs (Krishnan 2000, Banker 1998). Catching a bug later is costly and maintenance is significant part of software life cycle (Arthur 1988). Cohen at al (1996,1997) offer a model of time to entry and after sale support but patching is not an option (Production and operation domain). Higher performance is more valued but it also delays the product entry (Dyson 1991; Griffin 1992). We also draw from Industrial Org theory for modeling competition (Mussa and Rosen 1978; Ronnen 1991)

8. Rahul Telang8 Results Ability of the firms to patch later leads to early and buggier release of products. Systematic differences in a monopolist’s strategy vs. social planner’s strategies [No such failure for physical goods] Firms tend to enter the larger markets earlier with buggier products but provide aggressive ex-post patching support to increase the overall value offered to customers. Competition forces high value firm to enter the market earlier. The order of entry and value provision depends on the cost of patching.

9. Rahul Telang9 Model (User’s Utility) Three major components: 1. Time t – All else equal, users want a product released earlier. Higher t means product is released early and users get to use it for longer period of time. 2. Number of Bugs B(t) – If the product is released early then it has more bugs than otherwise. Bugs reduce user utility. We assume B’ > 0 and B’’ > 0.

10. Rahul Telang10 User Utility 3. Patching Support k(  ) – Vendor can reduce the user disutility due to a bug by releasing its patch. But it can not bring the product to its original utility level. It could be due to time elapsed between bug discovery and patch release. Patch is in imperfect remedy. Costly patch installation We assume that k’(  ) 0.

11. Rahul Telang11 User Utility Users are heterogeneous in their valuation of the product. High θ users derive more utility per unit time but incur more disutility as well when the product fails. We assume a uniform distribution on θ. Vendors sell their products at price p.

12. Rahul Telang12 Key Assumption Firms can not release the same quality product earlier by simply investing more (money or people) [Brook’s law 1995; Amhdal’s law]. In other words, wait time (in designing, coding and testing) is inherent and can not be bypassed by simply investing more [beyond a point]. It is empirically documented that small well- coordinated teams tend to perform better, (Wall Street Journal 1991) Mathematically, we assume that: where F 1 is the development cost.

13. Rahul Telang13 Software firm Costs Firms incur cost in providing patching support. They respond to bug reports by choosing to issue patches for the reported bugs by incurring patching costs. This is a common practice [See Cisco Policy] G (.) = F C (  )B (t) The higher investments in patching support costs increasingly more [C’>0, C’’>0] but users get more benefits [K’<0]. Note this cost is invariant to the number of copies sold. Our results are robust to other variants of cost function.

14. Rahul Telang14 Physical Good Case For physical goods, firm will incur a positive marginal costs in fixing a product [For example, recalling an automobile] We assume the marginal costs are g (.) = f C(  )B(t) They are not invariant to the number of copies sold anymore

15. Rahul Telang15 Monopolist Profit The profit function for software monopolist is The profit function for physical good monopolist is Social planner maximizes social welfare. It offers the product at marginal costs in both cases

16. Rahul Telang16 Comparative Analysis Investments in patching and time to entry are “strategic complements” (Milgrom and Roberts, 1990). Higher investments lead to earlier product release. Earlier product release leads to more bugs. In the case of software market, social planner prefers to enter the market earlier but provides better after- sale support than does a monopolist. In case of physical goods, no such sub-optimality. Both the monopolist and social planner enter the market at the same time and provide the same level of ex-post sales support.

17. Rahul Telang17 Implications More generally, the results imply that software firms tend to enter a large, attractive market earlier with buggier products but provide better after-sale support [“penetrate and patch” strategy] This may also be interpreted as frequency of new versions released. A large market invites more frequent release of new versions.

18. Rahul Telang18 Discussion Amortize fixed cost of patching over larger market: Monopolists serve smaller market. If patching is ruled out, both software and physical goods exhibit similar results. Microsoft typically serves large market. It also provides lot of patching support via “service-packs”; reducing the user disutility in installing and finding the right patches. It is willing to incurs higher costs C(  ), to provide better support by lowering k(  ). But does it release buggier product by entering the market early?

19. Rahul Telang19 Competition (Duopoly Market) Firms would like to differentiate themselves to reduce competitive pressure. They have two dimensions to differentiate (time to enter and patching support). We study the vertically differentiated market (one firm is high value, high price and the other firm is low value, low price). The value is specified as

20. Rahul Telang20 Competition The profit function for high value (H) and low value (L) firm can be written as Solution in terms of t and  is hard to get but we prove that value q is increasing in t and 

21. Rahul Telang21 Results Cost of Patching Sequence of Entry L firm, H firm, Monopolist [Only H Firm and Monopolist patch] H Firm, L firm, Monopolist [Only H Firm and Monopolist patch] H Firm, Monopolist, L Firm [Only H Firm and Monopolist patch] H Firm, Monopolist, L Firm [Everyone invests in patching]

22. Rahul Telang22 Results Interestingly, competition forces the high value firm to enter the market early (earlier than the monopolist!) with a buggier product but offers good patching support. On the other hand, low value firm offers lower after- sale support and may enter earlier or later depending on cost of patching. Again, a larger market in the presence of competition encourages an early entry. But firm compensate for poorer ex-ante quality later by providing better ex- post support. Competition provides more incentives for firms offer “penetrate-and-patch” strategy.

23. Rahul Telang23 Discussion What is the policy implications of software liability? Role of institutions like “CERT” Lack of innovation and features by monopolist software vendor. Empirical Support?

24. Rahul Telang24 Q & A Suggestions. Q & A.