An investigation of security conversations in stack overflow

Abstract

Developers turn to Stack Overflow and other on-line sources to find solutions to security problems, but little is known about how they engage with and guide one another in these environments or the perceptions of software security this may encourage. This study joins recent calls to understand more about how developers use Internet sources to solve security problems. Using qualitative methods, a set of questions within the security channel of Stack Overflow were selected and examined for themes. Preliminary findings reveal more about this community of practitioners: who are the askers and commenters, how security questions are asked and how developers frame technical information using social and experience-based perceptions of security. CCS CONCEPTS • Security and privacy → Software security engineering; • Software and its engineering → Collaboration in software development; KEYWORDS secure software development, collaborative environments, empirical studies 1 INTRODUCTION Many real-world security vulnerabilities in software relate to a few known classes of attack such as code injection. A number of practices and technologies for detecting and preventing vulnerabilities in software are likewise established, such as input sanitisation and non-escaping strings. However, it is not clear why many professional software developers do not adopt these practices and technologies as a matter of course. Security is, in part, a social phenomenon. Peer interaction, experience of security failures, and an awareness about the impact of security failures on people's well-being influence the decisions individuals make about whether or not to be secure in their personal lives [10] and on the job [17]. Social interaction is also key to developers' motivation to work; characteristics of the feedback received Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s).

An Anatomy of Security Conversations in Stack Overflow

“…In contrast with findings given in the first study [10], interactions that occur within the answer comment streams were found to contain less evidence of proclamations or principles about what should be done in relation to security, The answer is depicted in blue, the question in orange. Individual dots around the center points represent commenters.…”

“…Having a higher reputation grants access to different opportunities for contribution. A search of questions within the meta help site and queries in the data explorer 10 made it apparent that reputation and status are important to developers on the site. For example, the meta help site for Stack Overflow consistently lists "How does reputation work" as one of the most frequently asked questions.…”

“…Data associated with the twenty highest scored questions given the tag "security" were extracted from the hosted version of the Stack Exchange data explorer data dump of 14 January 2018. As reported in the prior study [10], data were selected using the following criteria: 1) Evident need. Top-scored questions and accepted answers were chosen to form the set.…”

“…The first study examined how developers talk to one another in a set of comment streams for questions given the "security" tag in Stack Overflow. The prior analysis suggested that talk about security within Stack Overflow includes information about technical solutions to programming problems, but also statements about personal values and attitudes like responsibility, trust, and fear [10].…”

Talking About Security with Professional Developers

“…The design for the workshop grew out of observations made in early interactions with practitioners in a meetup 2 and a preliminary study of conversation in an on-line Q&A environment [11]. It should be noted that the first interaction did not include formal data collection; the second was conducted with approval of the first author's university ethics committee.…”