Search

Suppose that you are developing a critical application that handles sensitive data. Access to the data should be limited, and data should be changed only under specific circumstances. Moreover, at any point in time you may be asked to provide an audit trail for the entire history of any piece of data, for example, the entire history of changes for a specific record. How will you make sure that you can provide the history as it happened, certain that it has not been tampered with in any way?

Examining the characteristics of software vulnerabilities and the code that contains them can lead to the development of more secure software. We present a dataset (∼1.4 GB) containing vulnerable source code files together with the corresponding, patched versions. Contrary to other existing vulnerability datasets, ours includes vulnerable files written in more than 40 programming languages. Each file is associated to (1) a Common Vulnerability Exposures identifier (CVE ID) and (2) the repository it came from. Further, our dataset can be the basis for machine learning applications that identify defects, as we show in specific examples. We also present a supporting dataset that contains commit messages derived from Git commits that serve as security patches. This dataset can be used to train ML models that in turn, can be used to detect security patch commits as we highlight in a specific use case.

Memory operations are critical to an application's reliability and performance. To reason about their correctness and track opportunities for optimisations, sophisticated instrumentation frameworks, such as Valgrind and Pin, have been developed. Both provide only limited facilities for analysing the collected data. This work presents a Valgrind's extension for examining a software applications’ dynamic memory profile through live interactive analysis with SQL. The Pico COllections Query Library (pico ql) module maps Valgrind's data structures that contain the instrumented application's memory operations metadata to a relational interface. Queries are type-safe and the module imposes only a trivial overhead when idle. The authors evaluate the proposed approach on ten applications and through a qualitative study. They find 900 kb of undefined bytes in bzip2 that account for 12% of its total memory use and a performance-critical code execution path in the Unix commands sort and uniq. The referenced functions are part of glibc and have been independently modified to boost the library's performance. The qualitative study has users rate the usefulness, usability, effort, correctness, and expressiveness of pico ql queries compared to Python scripts. The findings indicate that querying with pico ql incurs lower user effort.

Some of the most dangerous web attacks, such as Cross-Site Scripting and sql injection, exploit vulnerabilities in web applications that may accept and process data of uncertain origin without proper validation or filtering, allowing the injection and execution of dynamic or domain-specific language code. These attacks have been constantly topping the lists of various security bulletin providers despite the numerous countermeasures that have been proposed over the past 15 years. In this paper, we provide an analysis on various defense mechanisms against web code injection attacks. We propose a model that highlights the key weaknesses enabling these attacks, and that provides a common perspective for studying the available defenses. We then categorize and analyze a set of 41 previously proposed defenses based on their accuracy, performance, deployment, security, and availability characteristics. Detection accuracy is of particular importance, as our findings show that many defense mechanisms have been tested in a poor manner. In addition, we observe that some mechanisms can be bypassed by attackers with knowledge of how the mechanisms work. Finally, we discuss the results of our analysis, with emphasis on factors that may hinder the widespread adoption of defenses in practice.

People can exhibit their status by the consumption of particular goods or experiential purchases; this is known as “conspicuous consumption”; the practice is widespread and explains the market characteristics of a whole class of goods, Veblen goods, demand for which increase in tandem with their price. The value of such positional goods lies in their distribution among the population—the rarer they are, the more desirable they become. At the same time, higher income, often associated with higher status, has been studied in its relation to unethical behavior. Here we present research that shows how a particular Veblen good, illicit behavior, and wealth, combine to produce the display of illegality as a status symbol. We gathered evidence at a large, country-level, scale of a particular form of consumption of an illictly acquired good for status purposes. We show that in Greece, a developed middle-income country, where authorities cannot issue custom vanity license plates, people acquire distinguishing plate numbers that act as vanity plate surrogates. We found that such license plates are more common in cars with bigger engines and in luxury brands, and are therefore associated with higher value vehicles. This cannot be explained under the lawful procedures for allocating license plates and must therefore be the result of illegal activities, such as graft. This suggests a pattern of “conspicuous corruption”, where individuals break the law and use their gains as status symbols, knowing that the symbols hint at rule-breaking, as long as the unlawful practice cannot be incontestably established.

A model regarding the lifetime of individual source code lines or tokens can estimate maintenance effort, guide preventive maintenance, and, more broadly, identify factors that can improve the efficiency of software development. We present methods and tools that allow tracking of each line’s or token’s birth and death. Through them, we analyze 3.3 billion source code element lifetime events in 89 revision control repositories. Statistical analysis shows that code lines are durable, with a median lifespan of about 2.4 years, and that young lines are more likely to be modified or deleted, following a Weibull distribution with the associated hazard rate decreasing over time. This behavior appears to be independent from specific characteristics of lines or tokens, as we could not determine factors that influence significantly their longevity across projects. The programing language, and developer tenure and experience were not found to be significantly correlated with line or token longevity, while project size and project age showed only a slight correlation.

A shuffle argument is a cryptographic primitive for proving correct behaviour of mix-networks without leaking any private information. Several recent constructions of non-interactive shuffle arguments avoid the random oracle model but require the public key to be trusted.

We examine the use of the Java exception types in the Android platform’s Application Programming Interface (API) reference documentation and their impact on the stability of Android applications. We develop a method that automatically assesses an API’s quality regarding the exceptions listed in the API’s documentation. We statically analyze ten versions of the Android platform’s API (14–23) and 3539 Android applications to determine inconsistencies between exceptions that analysis can find in the source code and exceptions that are documented. We cross-check the analysis of the Android platform’s API and applications with crash data from 901,274 application execution failures (crashes). We discover that almost 10% of the undocumented exceptions that static analysis can find in the Android platform’s API source code manifest themselves in crashes. Additionally, we observe that 38% of the undocumented exceptions that developers use in their client applications to handle API methods also manifest themselves in crashes. These findings argue for documenting known might-thrown exceptions that lead to execution failures. However, a randomized controlled trial we run shows that relevant documentation improvements are ineffective and that making such exceptions checked is a more effective way for improving applications’ stability.

Context: An excessive number of code smells make a software system hard to evolve and maintain. Machine learning methods, in addition to metric-based and heuristic-based methods, have been recently applied to detect code smells; however, current methods are considered far from mature. Objective: First, explore the feasibility of applying deep learning models to detect smells without extensive feature engineering. Second, investigate the possibility of applying transfer-learning in the context of detecting code smells. Methods: We train smell detection models based on Convolution Neural Networks and Recurrent Neural Networks as their principal hidden layers along with autoencoder models. For the first objective, we perform training and evaluation on C# samples, whereas for the second objective, we train the models from C# code and evaluate the models over Java code samples and vice-versa. Results: We find it feasible to detect smells using deep learning methods though the models’ performance is smell-specific. Our experiments show that transfer-learning is definitely feasible for implementation smells with performance comparable to that of direct-learning. This work opens up a new paradigm to detect code smells by transfer-learning especially for the programming languages where the comprehensive code smell detection tools are not available.

Until relatively recently, the tools used to develop Web applications followed a well-established architecture called the LAMP stack. Recently, the MEAN stack has taken the Web developer world by storm and is replacing LAMP.

Embedded analytics and statistics for big data have emerged as an important topic across industries. As the volumes of data have increased, software engineers are called to support data analysis and applying some kind of statistics to them. This article provides an overview of tools and libraries for embedded data analytics and statistics, both stand-alone software packages and programming languages with statistical capabilities.

Tracking long-term progress in engineering and applied science allows us to take stock of things we have achieved, appreciate the factors that led to them, and set realistic goals for where we want to go. We formulate seven hypotheses associated with the long term evolution of C programming in the Unix operating system, and examine them by extracting, aggregating, and synthesising metrics from 66 snapshots obtained from a synthetic software configuration management repository covering a period of four decades. We found that over the years developers of the Unix operating system appear to have evolved their coding style in tandem with advancements in hardware technology, promoted modularity to tame rising complexity, adopted valuable new language features, allowed compilers to allocate registers on their behalf, and reached broad agreement regarding code formatting. The progress we have observed appears to be slowing or even reversing prompting the need for new sources of innovation to be discovered and followed.

As any empirical science, Software Engineering research should strive towards better research practices. Replication is regrettably not a priority for Software Engineering researchers and, moreover, not afforded by many published studies. Here we report our experience from our encounter with a recent paper in a agship Software Engineering conference. Our experience shows that current publication requirements do not guarantee replicability.

In many projects, testing consumes the single biggest amount of resources of all activities. Companies tend to collect test cases like stamps without clear strategy-just in case. Many companies suffer with insufficient quality, visibility and test progress management. This article introduces test management.

An overview of cloud computing helps developers get beyond the hype by characterizing its unique requirements, the ways to implement cloud services, and the ways to operate the cloud infrastructure. A comparison of major products is included.

"Software technology" will provide concise, hands-on information on hot software technologies early in their life cycle. Its objective is to promote sharing of technology experiences from a user perspective. We'll look at promising software components, technologies, and development tools and ask questions about their maturity, applications, readiness, and business cases. Early adopter experience will be highlighted, including how to deal with conflicting product development standards. Our vision is to interpret the software technology hype cycle and provide down-to-earth, useful information for practitioners. The inaugural column is on GUI programming for Microsoft Windows. Although this topic isn't new-we've struggled with it for decades-both Windows and its supporting GUI technologies are changing.

While the revolutionary cloud computing paradigm offers substantial benefits to businesses, recent data breaches and the lack of dedicated end-to-end security solutions refrain the rapid adoption of this technology. The TREDISEC project aims at increasing trust in cloud computing by designing new security primitives ensuring data security and user privacy and supporting the underlying storage and computation technology at the same time.

Interest in Web services has increased rapidly since their first appearance a few years ago. They are a key value-added feature of today's Internet, making it feasible to combine different applications and so generate new services based on existing applications. Feasibility, however, doesn't mean easy connectivity to all we can see and use on the Internet - in terms of either usability or software integration. The author introduces Web services and how to use SOAP to assemble such services. He presents an example built from scratch, lessons learned along the way, and a comparison of various SOAP implementation states of practice

Wikis are especially useful in distributed projects: many teams around the world use them to organize, track, and publish their work. Their flexibility frees a project manager from fretting about getting everything exactly right from the beginning. A wiki can and should change to respond to the project's needs as they arise. While wikis are always easy to change, wiki engines usually incorporate comprehensive versioning and change control for their content. More important than the particular wiki implementation, however, is being sure that a wiki really fits in the culture of the project or organization. It requires tolerance and openness.

Software evolves in small steps or versions. Often these versions are results of collaborations among different persons. At times we want to fall back to a previous version or compare different variants. Or, we need to trace changes to change requests. All these tasks relate to version control and show that tool support in this domain is indispensable, as it is with editors and compilers. The author describes available tools and shows why the CVS open source tool is so popular among practitioners

Detecting and correcting defects either during or close to the phase where they originate is key for any fast, cost-effective software development. Unit testing, performed by the code writer, is still the most popular technique. The author has summarized the experiences around JUnit, probably the most popular OSS tool for Java unit testing. JUnit is an open source Java library, Kent Beck and Erich Gamma created JUnit, deriving it from Beck's Smalltalk testing framework. Easy integration of coding and unit testing lies at the heart of Extreme Programming and the agile software development movement. In agile programming, software is constructed by implementing functionality incrementally, in short spurts of activity.

Examining software ecosystems can provide the research community with data regarding artifacts, processes, and communities. We present a dataset obtained from the Maven central repository ecosystem (approximately 265GB of data) by statically analyzing the repository to detect potential software bugs. For our analysis we used FindBugs, a tool that examines Java bytecode to detect numerous types of bugs. The dataset contains the metrics results that FindBugs reports for every project version (a JAR) included in the ecosystem. For every version we also stored specific metadata such as the JAR's size, its dependencies and others. Our dataset can be used to produce interesting research results, as we show in specific examples.

Zeus is an internet voting platform, in which all the steps of the voting process can be verified using well-established mathematical tools. It has been developed with the goal that the voters can be confident that their votes are counted correctly and their anonymity is guaranteed, without needing to trust the operators of Zeus that they do not behave improperly: the assurances provided by Zeus are at least as strong as those in traditional elections. Zeus has been used in more than 120 elections, involving more than 22000 voters, and is continuously in use. It has shown that it can be used when traditional elections cannot take place, due to hostile conditions, and is actively being developed and evolved.

Effective Web services demand careful synchronization on various abstraction levels. The Business Process Execution Language supports modeling and executing business processes from both the user and systems perspectives. In this way, Web services application developers can use BPEL to orchestrate service interactions in a global system view and to manage individual interactions based on outside events. More and more Web service providers are using BPEL to integrate their services independently of vendors and related programming languages. In this column, we introduce BPEL and presents some guidelines for using it in your Web services management.

Cloud computing, and cloud services in particular, offer the Research and Education sector huge opportunities to both maximise effectiveness and reduce the capital investment and development time to deliver results. By utilising shared and off-the-shelf services for commodity activities, the R&E community can refocus its design, development and support resources into those fields that cannot be easily provided by the commercial sector.Cloud computing empowers users to select and use the services they really want, in an easy and often economically attractive manner. The broad standardisation of service delivery offers substantial advantages with scalability and user acceptance. By using services that the users have had experience of outside the R&E community, training requirements can be minimised and personal efficiency can be improved.The scalability of cloud services also allows rapid expansion or contraction of capacity as the project requires with minimal penalties. This near-linear cost model allows easier budgeting and financial control.

The action required to stem the environmental and social implications of climate change depends crucially on how humankind shapes technology, economy, lifestyle and policy. With transport CO2 emissions accounting for about a quarter of the total, we examine the contribution of CO2 output by scientific travel. Thankfully for the reputation of the scientific community, CO2 emissions associated with the trips required to present a paper at a scientific conference account for just 0.003% of the yearly total. However, with CO2 emissions for a single conference trip amounting to 7% of an average individual’s total CO2 emissions, scientists should lead by example by demonstrating leadership in addressing the issue.

The modeling and simulation of the dynamic behavior of organizational systems is essential for understanding their current functionality and for supporting business process analysis and reengineering. The behavior of organizational systems is viewed here in terns of the behavior of their business processes. Multilevel Modified Petri Nets are used as the underlying formalism for modeling and simulating organizational systems behavior at various abstraction levels. Each level of abstraction corresponds to one or more levels of the involved part of the organizational hierarchy. The constructed models represent existing or redesigned business processes. Simulation and graphical animation are used for discovering problems in existing business processes as well as in the proposed solutions. The whole approach is supported by a development environment called ERMIS.

Pico ql is an open source c/c++ software whose scientific scope is real-time interactive analysis of in-memory data through sql queries. It exposes a relational view of a system’s or application’s data structures, which is queryable through sql. While the application or system is executing, users can input queries through a web-based interface or issue web service requests. Queries execute on the live data structures through the respective relational views. pico ql makes a good candidate for ad-hoc data analysis in applications and for diagnostics in systems settings. Applications of pico ql include the Linux kernel, the Valgrind instrumentation framework, a gis application, a virtual real-time observatory of stellar objects, and a source code analyser. Keywords: sql, Main memory data structures, Data analysis, Program data

We present a dataset of open source software developed mainly by enterprises rather than volunteers. This can be used to address known generalizability concerns, and, also, to perform research on open source business software development. Based on the premise that an enterprise's employees are likely to contribute to a project developed by their organization using the email account provided by it, we mine domain names associated with enterprises from open data sources as well as through white- and blacklisting, and use them through three heuristics to identify 17,264 enterprise GitHub projects. We provide these as a dataset detailing their provenance and properties. A manual evaluation of a dataset sample shows an identification accuracy of 89%. Through an exploratory data analysis we found that projects are staffed by a plurality of enterprise insiders, who appear to be pulling more than their weight, and that in a small percentage of relatively large projects development happens exclusively through enterprise insiders., 5 pages

JavaScript is one of the web's key building blocks. It is used by the majority of web sites and it is supported by all modern browsers. We present the first large-scale study of client-side JavaScript code over time. Specifically, we have collected and analyzed a dataset containing daily snapshots of JavaScript code coming from Alexa's Top 10000 web sites (~7.5 GB per day) for nine consecutive months, to study different temporal aspects of web client code. We found that scripts change often; typically every few days, indicating a rapid pace in web applications development. We also found that the lifetime of web sites themselves, measured as the time between JavaScript changes, is also short, in the same time scale. We then performed a qualitative analysis to investigate the nature of the changes that take place. We found that apart from standard changes such as the introduction of new functions, many changes are related to online configuration management. In addition, we examined JavaScript code reuse over time and especially the widespread reliance on third-party libraries. Furthermore, we observed how quality issues evolve by employing established static analysis tools to identify potential software bugs, whose evolution we tracked over time. Our results show that quality issues seem to persist over time, while vulnerable libraries tend to decrease.

Motivation: Even though many studies examine the energy efficiency of hardware and embedded systems, those that investigate the energy consumption of software applications are still limited, and mostly focused on mobile applications. As modern applications become even more complex and heterogeneous a need arises for methods that can accurately assess their energy consumption.Goal: Measure the energy consumption and run-time performance of commonly used programming tasks implemented in different programming languages and executed on a variety of platforms to help developers to choose appropriate implementation platforms.Method: Obtain measurements to calculate the Energy Delay Product, a weighted function that takes into account a task’s energy consumption and run-time performance. We perform our tests by calculating the Energy Delay Product of 25 programming tasks, found in the Rosetta Code Repository, which are implemented in 14 programming languages and run on three different computer platforms, a server, a laptop, and an embedded system.Results: Compiled programming languages are outperforming the interpreted ones for most, but not for all tasks. C, C#, and JavaScript are on average the best performing compiled, semi-compiled, and interpreted programming languages for the Energy Delay Product, and Rust appears to be well-placed for i/o-intensive operations, such as file handling. We also find that a good behaviour, energywise, can be the result of clever optimizations and design choices in seemingly unexpected programming languages.