When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2014

When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study

Amiangshu Bosu
  • Function : Author
  • PersonId : 989654
Jeffrey C. Carver
  • Function : Author
  • PersonId : 989655
Munawar Hafiz
  • Function : Author
  • PersonId : 989711
Patrick Hilley
  • Function : Author
  • PersonId : 989712
Derek Janni
  • Function : Author
  • PersonId : 989713

Abstract

We analyzed peer code review data of the Android Open Source Project (AOSP) to understand whether code changes that introduce security vulnerabilities, referred to as vulnerable code changes (VCC), occur at certain intervals. Using a systematic manual analysis process, we identified 60 VCCs. Our results suggest that AOSP developers were more likely to write VCCs prior to AOSP releases, while during the post-release period they wrote fewer VCCs.
Fichier principal
Vignette du fichier
978-3-642-55128-4_37_Chapter.pdf (4 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01373117 , version 1 (28-09-2016)

Licence

Attribution

Identifiers

Cite

Amiangshu Bosu, Jeffrey C. Carver, Munawar Hafiz, Patrick Hilley, Derek Janni. When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study. 10th IFIP International Conference on Open Source Systems (OSS), May 2014, San José, Costa Rica. pp.234-236, ⟨10.1007/978-3-642-55128-4_37⟩. ⟨hal-01373117⟩
111 View
69 Download

Altmetric

Share

Gmail Facebook X LinkedIn More