An Anatomy of Security Conversations in Stack Overflow

Abstract

As software-intensive digital systems become an integral part of modern life, ensuring that these systems are developed to satisfy security and privacy requirements is an increasingly important societal concern. This paper examines how secure coding practice is supported on Stack Overflow. Although there are indications that on-line environments are not robust or accurate sources of security information, they are used by large numbers of developers. Findings demonstrate that developers use conversation within the site to actively connect with and tend to security problems, fostering knowledge, exchanging information and providing assistance to one another.

Understanding Privacy-Related Questions on Stack Overflow

“…Researchers have also studied the topics developers talk about; including analysis with natural language processing techniques (NLP) [5,16,18,56,71,76] and manual qualitative techniques [18,36,43,44,47,48,52,55,71]. For example, an analysis of questions about Puppet, a configuration language tool, shows a need to support Puppet syntax error finding [55].…”

“…It attracts a wide range of developers who ask questions about programming, security, and data management [18,56,76]. SO's dataset has been heavily used for research on such topics as: what factors makes it a successful Q&A platform [45], security issues developers face and how they interact and build knowledge around it [43,76], and the negative impact of SO code snippets in software security [2].…”

Taking the Middle Path: Learning About Security Through Online Social Interaction

“…The interactions and conversations we have observed within office settings [9] and comment streams on Stack Overflow [7], [8] suggest that secure coding practice is supported in both kinds of environment through personal networks of practice [14] that operate within larger environments. Online, in websites like Stack Overflow, such networks operate within the comment streams attached to question and answer posts.…”

“…It takes time to learn and understand good practices, and the shifting landscape of threats requires ongoing attention to ensure that mechanisms remain effective and up-to-date. Security tagged posts on Stack Overflow reflect this, and often remain active for months or even years after an answer is accepted [8]. Ongoing activity may be primarily curatorial-links might be kept up-to-date or added to dictionary entries or other documents, or the language of the question and answer posts might be refined for clarity.…”

“…Our larger research program is investigating ways to initiate and sustain secure software development practice. In a series of studies, we have shown how developers talk about security in Stack Overflow posts given the "security" tag [7] [8], and examined how security figures into practice within office settings [9]. The approach taken in these studies does not assess the quality of the information about security developers provide to one another, but rather seeks to understand more about how they engage with and guide one another in practice.…”