Paper Info
Title
Questions developers ask while diagnosing potential security vulnerabilities with static analysis
Abstract
Security tools can help developers answer questions about potential vulnerabilities in their code. A better understanding of the types of questions asked by developers may help toolsmiths design more effective tools. In this paper, we describe how we collected and categorized these questions by conducting an exploratory study with novice and experienced software developers. We equipped them with Find Security Bugs, a security-oriented static analysis tool, and observed their interactions with security vulnerabilities in an open-source system that they had previously contributed to. We found that they asked questions not only about security vulnerabilities, associated attacks, and fixes, but also questions about the software itself, the social ecosystem that built the software, and related resources and tools. For example, when participants asked questions about the source of tainted data, their tools forced them to make imperfect tradeoffs between systematic and ad hoc program navigation strategies.
Year
DOI
Venue
2015
10.1145/2786805.2786812
ESEC/SIGSOFT FSE
Keywords
Field
DocType
Developer questions, human factors, security, static analysis
Security through obscurity,Ask price,Computer security,Computer science,Static analysis,Software,Secure coding,Exploratory research,Vulnerability
Conference
Citations 
PageRank 
References 
21
0.83
21
Authors
5
Name
Order
Citations
PageRank
Justin Smith19711.74
Brittany Johnson21878.43
Emerson R. Murphy-hill3128474.35
Bill Chu411112.11
Heather Richter Lipford581854.15