Learning secure programming in open source software communities

Wen, Shao-Fang

doi:10.1145/3178158.3178202

Cited by 15 publications

(11 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In view of the gap in the skills and knowledge necessary for secure OSS development, the lack of appropriate security competencies is clear. OSS developers or other participants do not traditionally receive formal education or training about software security [75]. Programmers make security errors because they are unaware that their code will be attacked, and have no knowledge of methods by which their code can be secured [76].…”

Section: Discussionmentioning

confidence: 99%

An empirical study of security culture in open source software communities

Wen

Kianpour

Kowalski

2019

Proceedings of the 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining

Self Cite

View full text Add to dashboard Cite

Open source software (OSS) is a core part of virtually all software applications today. Due to the rapidly growing impact of OSS on society and the economy, the security aspect has attracted researchers' attention to investigate this distinctive phenomenon. Traditionally, research on OSS security has often focus on technical aspects of software development. We argue that these aspects are important, however, technical security practice considering different social aspects of OSS development will assure the effectiveness and efficiency of the implementation of the tool. In this empirical study, we explore the current security culture in the OSS development phenomenon using a survey instrument. By performing a security cultural analysis with six dimensions: attitude, behavior, competency, subjective norms, governance and communication, this paper provides an in-depth insight into its influence on participants' security behaviors and decision-making. Measurements of security culture and the corresponding issues that need to be addressed in OSS communities were defined and discussed.

show abstract

Section: Discussionmentioning

confidence: 99%

An empirical study of security culture in open source software communities

Wen

Kianpour

Kowalski

2019

Proceedings of the 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining

Self Cite

View full text Add to dashboard Cite

show abstract

“…Flipout is an efficient method to improve variance reduction by implicitly sampling pseudo-independent stochastic weights for each training data and therefore decorrelating the gradients within a batch. For a more detailed description of the Flipout estimator, the reader is referred to Wen et al 49 A thorough description of the topology and training environment considered for both deterministic and Bayesian neural networks is showcased in Appendix A, providing details for each tested input monitoring setup. In general, the number of neurons included in the hidden layers of the BNNs is lower than the neurons specified for the deterministic counterparts.…”

Section: Bayesian Neural Networkmentioning

confidence: 99%

Section: Experimental Campaign: Probabilistic Virtual Load Monitoring...mentioning

confidence: 99%

Farm-wide virtual load monitoring for offshore wind structures via Bayesian neural networks

Hlaing,

Morato,

Santos

et al. 2023

Structural Health Monitoring

View full text Add to dashboard Cite

Offshore wind structures are exposed to a harsh marine environment and are subject to deterioration mechanisms throughout their operational lifetime. Even if the deterioration evolution of structural elements can be estimated through physics-based deterioration models, the uncertainties involved in the process hurdle the selection of lifecycle management decisions, e.g., lifetime extension. In this scenario, the collection of relevant information through an efficient monitoring system enables the reduction of uncertainties, ultimately driving more optimal lifecycle decisions. However, a full monitoring instrumentation implemented on all wind turbines in a farm may become unfeasible due to practical and economical constraints. Besides, certain load monitoring systems often become defective after a few years of marine environment exposure. Addressing the aforementioned concerns, a farm-wide virtual load monitoring scheme directed by a fleet-leader wind turbine offers an attractive solution. Fetched with data retrieved from a fully instrumented wind turbine, a model can be first trained and then deployed, yielding load predictions for non-fully monitored wind turbines, from which only standard data are available, e.g., supervisory control and data acquisition. During the deployment stage, the pretrained virtual monitoring model may, however, receive previously unseen monitoring data, leading to inaccurate load predictions. In this article, we propose a virtual load monitoring framework formulated via Bayesian neural networks (BNNs) and provide relevant implementation details needed for the construction, training, and deployment of BNN data-based virtual monitoring models. As opposed to their deterministic counterparts, BNNs intrinsically announce the uncertainties associated with generated load predictions and allow to detect inaccurate load estimations generated for non-fully monitored wind turbines. The proposed virtual load monitoring is thoroughly tested through an experimental campaign in an operational offshore wind farm and the results demonstrate the effectiveness of BNN models for “fleet-leader”-based farm-wide virtual monitoring.

show abstract

“…Hence, practitioners and researchers could use our methods to identify and evaluate the impact of any ecosystem's onboarding program. As a side note, the post-Covid-19 era fosters a culture of online collaboration that could disrupt the dynamics of in-person [59] events. Even though Rodeghero et al [60] studied onboarding during the Covid-19 pandemic at the project-level, it is still too early to understand the impact of this on the top-level SECO training events or the SECO onboarding process as a whole.…”

Section: Th R E a T S T O V A L Id It Ymentioning

confidence: 99%

Onboarding vs. Diversity, Productivity and Quality — Empirical Study of the OpenStack Ecosystem

Foundjem

Eghan

Adams

2021

2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Despite the growing success of open-source software ecosystems (SECOs), their sustainability depends on the recruitment and involvement of ever-larger contributors. As such, onboarding, i.e., the socio-technical adaptation of new contributors to a SECO, forms a significant aspect of a SECO's growth that requires substantial resources. Unfortunately, despite theoretical models and initial user studies to examine the potential benefits of onboarding, little is known about the process of SECO onboarding, nor about the socio-technical benefits and drawbacks of contributors' onboarding experience in a SECO. To address these, we first carry out an observational study of 72 new contributors during an OpenStack onboarding event to provide a catalog of teaching content, teaching strategies, onboarding challenges, and expected benefits. Next, we empirically validate the extent to which diversity, productivity, and quality benefits are achieved by mining code changes, reviews, and contributors' issues with(out) OpenStack onboarding experience. Among other findings, our study shows a significant correlation with increasing gender diversity (65% for both females and non-binary contributors) and patch acceptance rates (13.5%). Onboarding also has a significant negative correlation with the time until a contributor's first commit and bug-proneness of contributions.

show abstract

Learning secure programming in open source software communities

Cited by 15 publications

References 34 publications

An empirical study of security culture in open source software communities

An empirical study of security culture in open source software communities

Farm-wide virtual load monitoring for offshore wind structures via Bayesian neural networks

Onboarding vs. Diversity, Productivity and Quality — Empirical Study of the OpenStack Ecosystem

Contact Info

Product

Resources

About