Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience

I. Pashchenko; D.-L. Vu; Fabio Massacci

doi:10.1145/3377812.3390903

Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience

I. Pashchenko, D.-L. Vu, Fabio Massacci

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

17 Downloads (Pure)

Abstract

Developers are known to keep third-party dependencies of their projects outdated even if some of them are affected by known vulnerabilities. In this study we aim to understand why they do so. For this, we conducted 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. The results of the study reveal important aspects of developers' practices that should be considered by security researchers and dependency tool developers to improve the security of the dependency management process.

Original language	English
Title of host publication	ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering
Subtitle of host publication	Companion Proceedings
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	284-285
Number of pages	2
ISBN (Electronic)	9781450371223
DOIs	https://doi.org/10.1145/3377812.3390903
Publication status	Published - Jun 2020
Event	42nd ACM/IEEE International Conference on Software Engineering: Companion, ICSE-Companion 2020 - Seoul, Korea, Republic of Duration: 27 Jun 2020 → 19 Jul 2020

Conference

Conference	42nd ACM/IEEE International Conference on Software Engineering: Companion, ICSE-Companion 2020
Country/Territory	Korea, Republic of
City	Seoul
Period	27/06/20 → 19/07/20

Funding

This research has been partly funded by the EU under the H2020 Programs H2020-EU.2.1.1-CyberSec4Europe (Grant No. 830929) and the NeCS: European Network for Cyber Security (Grant No. 675320).

Funders	Funder number
European Network for Cyber Security	675320
Horizon 2020 Framework Programme	830929
European Commission

Access to Document

10.1145/3377812.3390903

Preliminary Findings on FOSS Dependencies and SecurityFinal published version, 492 KBLicence: Article 25fa Dutch Copyright Act

Persistent URL (handle)

Persistent link

Cite this

Pashchenko, I., Vu, D.-L., & Massacci, F. (2020). Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience. In ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Companion Proceedings (pp. 284-285). Article 9270337 Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1145/3377812.3390903

@inproceedings{60197e3a9d4f45f599dc388b18fd898a,

title = "Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience",

abstract = "Developers are known to keep third-party dependencies of their projects outdated even if some of them are affected by known vulnerabilities. In this study we aim to understand why they do so. For this, we conducted 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. The results of the study reveal important aspects of developers' practices that should be considered by security researchers and dependency tool developers to improve the security of the dependency management process.",

author = "I. Pashchenko and D.-L. Vu and Fabio Massacci",

year = "2020",

month = jun,

doi = "10.1145/3377812.3390903",

language = "English",

pages = "284--285",

booktitle = "ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

address = "United States",

note = "42nd ACM/IEEE International Conference on Software Engineering: Companion, ICSE-Companion 2020 ; Conference date: 27-06-2020 Through 19-07-2020",

}

Pashchenko, I, Vu, D-L & Massacci, F 2020, Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience. in ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Companion Proceedings., 9270337, Institute of Electrical and Electronics Engineers Inc., pp. 284-285, 42nd ACM/IEEE International Conference on Software Engineering: Companion, ICSE-Companion 2020, Seoul, Korea, Republic of, 27/06/20. https://doi.org/10.1145/3377812.3390903

Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience. / Pashchenko, I.; Vu, D.-L.; Massacci, Fabio.
ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Companion Proceedings. Institute of Electrical and Electronics Engineers Inc., 2020. p. 284-285 9270337.

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Preliminary Findings on FOSS Dependencies and Security

T2 - 42nd ACM/IEEE International Conference on Software Engineering: Companion, ICSE-Companion 2020

AU - Pashchenko, I.

AU - Vu, D.-L.

AU - Massacci, Fabio

PY - 2020/6

Y1 - 2020/6

N2 - Developers are known to keep third-party dependencies of their projects outdated even if some of them are affected by known vulnerabilities. In this study we aim to understand why they do so. For this, we conducted 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. The results of the study reveal important aspects of developers' practices that should be considered by security researchers and dependency tool developers to improve the security of the dependency management process.

AB - Developers are known to keep third-party dependencies of their projects outdated even if some of them are affected by known vulnerabilities. In this study we aim to understand why they do so. For this, we conducted 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. The results of the study reveal important aspects of developers' practices that should be considered by security researchers and dependency tool developers to improve the security of the dependency management process.

UR - https://www.scopus.com/pages/publications/85098594552

UR - https://www.scopus.com/inward/citedby.url?scp=85098594552&partnerID=8YFLogxK

U2 - 10.1145/3377812.3390903

DO - 10.1145/3377812.3390903

M3 - Conference contribution

SP - 284

EP - 285

BT - ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 27 June 2020 through 19 July 2020

ER -

Pashchenko I, Vu DL, Massacci F. Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience. In ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Companion Proceedings. Institute of Electrical and Electronics Engineers Inc. 2020. p. 284-285. 9270337 doi: 10.1145/3377812.3390903

Preliminary Findings on FOSS Dependencies and Security: A Qualitative Study on Developers' Attitudes and Experience

Abstract

Conference

Funding

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this