A Dataset of Enterprise-Driven Open Source Software

Spinellis, Diomidis; Kotti, Zoe; Kravvaritis, Konstantinos; Θεοδώρου, Γεώργιος; Λουρίδας, Πάνος

doi:10.1145/3379597.3387495

Cited by 15 publications

(8 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Analyzing available data from code repositories like GitHub comes with the risk of working on non-representative data. Consequently, the data source for this paper consists of the database by Spinellis et al [12]. They elucidate, that working on data from enterprise-driven software development projects addresses generalization issues that come with volunteer developed projects.…”

Section: B Mining Repositoriesmentioning

confidence: 99%

“…We based the data collection of this study on the enterprisedriven open source software dataset, presented by Spinelli et al at the Mining Software Repositories Conference 2020 [23]. This dataset contains 17,264 GitHub projects driven, or at least mainly contributed to, by enterprise employees.…”

Section: B Data Collectionmentioning

confidence: 99%

“…The main threat refers to the use of an existing data set, which was not specifically gathered for this study. To prove validity, we use a research data set that is the basis of a peer-reviewed scientific publication [12]. Later, we report results based on three layers of analysis: crawling, manual review, and direct contact with maintainers.…”

Section: B Threats To Validitymentioning

confidence: 99%

“…We mine a validated dataset (c.f. Spinellis et al [12]) rendering the state-of-practice based on automatic analysis of 8,243 projects, with manual validation of 400 projects and survey-based confirmation of 67 projects. Further, we discussed implications for industrial companies.…”

Section: Co N C L U S Io N a N D Fu T U R E Wo R Kmentioning

confidence: 99%

“…We further validate our findings by approaching a sample of the projects' maintainers, to understand the role security plays in their projects and how project characteristics correlate with the security. Our analysis is based on the dataset published by Spinellis et al [12], consisting of enterprise-driven open source software using GitHub as code repository. With our approach, we address one of the future research ideas of Spinellis et al with a focus on security tools usage.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Enterprise-Driven Open Source Software: A Case Study on Security Automation

Angermeir

Voggenreiter

Moyón

et al. 2021

2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)

View full text Add to dashboard Cite

Agile and DevOps are widely adopted by the industry. Hence, integrating security activities with industrial practices, such as continuous integration (CI) pipelines, is necessary to detect security flaws and adhere to regulators' demands early.In this paper, we analyze automated security activities in CI pipelines of enterprise-driven open source software (OSS). This shall allow us, in the long-run, to better understand the extent to which security activities are (or should be) part of automated pipelines. In particular, we mine publicly available OSS repositories and survey a sample of project maintainers to better understand the role that security activities and their related tools play in their CI pipelines. To increase transparency and allow other researchers to replicate our study (and to take different perspectives), we further disclose our research artefacts. Our results indicate that security activities in enterprise-driven OSS projects are scarce and protection coverage is rather low. Only 6.83% of the analyzed 8,243 projects apply security automation in their CI pipelines, even though maintainers consider security to be rather important. This alerts industry to keep the focus on vulnerabilities of 3rd Party software and it opens space for other improvements of practice which we outline in this manuscript.

show abstract

Section: B Mining Repositoriesmentioning

confidence: 99%

Section: B Data Collectionmentioning

confidence: 99%

Section: B Threats To Validitymentioning

confidence: 99%

Section: Co N C L U S Io N a N D Fu T U R E Wo R Kmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Enterprise-Driven Open Source Software: A Case Study on Security Automation

Angermeir

Voggenreiter

Moyón

et al. 2021

2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)

View full text Add to dashboard Cite

show abstract

One Microservice per Developer: Is This the Trend in OSS?

Amoroso d’Aragona,

Li,

Cerny

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Pitfalls and guidelines for using time-based Git data

Flint

Chauhan²,

Dyer³

2022

Empir Software Eng

View full text Add to dashboard Cite

Many software engineering research papers rely on time-based data (e.g., commit timestamps, issue report creation/update/close dates, release dates). Like most real-world data however, time-based data is often dirty. To date, there are no studies that quantify how frequently such data is used by the software engineering research community, or investigate sources of and quantify how often such data is dirty. Depending on the research task and method used, including such dirty data could affect the research results. This paper presents an extended survey of papers that utilize time-based data, published in the Mining Software Repositories (MSR) conference series. Out of the 754 technical track and data papers published in MSR 2004-2021, we saw at least 290 (38%) papers utilized time-based data. We also observed that most time-based data used in research papers comes in the form of Git commits, often from GitHub. Based on those results, we then used the Boa and Software Heritage infrastructures to help identify and quantify several sources of dirty Git timestamp data. Finally we provide guidelines/best practices for researchers utilizing time-based data from Git repositories. Keywords literature review • time data • mining software repositoriesThis paper is a revised and extended version of Flint et al. (2021a).

show abstract

A Dataset of Enterprise-Driven Open Source Software

Cited by 15 publications

References 28 publications

Enterprise-Driven Open Source Software: A Case Study on Security Automation

Enterprise-Driven Open Source Software: A Case Study on Security Automation

One Microservice per Developer: Is This the Trend in OSS?

Pitfalls and guidelines for using time-based Git data

Contact Info

Product

Resources

About