Understanding Privacy-Related Advice on Stack Overflow

Abstract

Privacy tasks can be challenging for developers, resulting in privacy frameworks and guidelines from the research community which are designed to assist developers in considering privacy features and applying privacy enhancing technologies in early stages of software development. However, how developers engage with privacy design strategies is not yet well understood. In this work, we look at the types of privacy-related advice developers give each other and how that advice maps to Hoepman’s privacy design strategies. We qualitatively analyzed 119 privacy-related accepted answers on Stack Overflow from the past five years and extracted 148 pieces of advice from these answers. We find that the advice is mostly around compliance with regulations and ensuring confidentiality with a focus on the inform, hide, control, and minimize of the Hoepman’s privacy design strategies. Other strategies, abstract, separate, enforce, and demonstrate, are rarely advised. Answers often include links to official documentation and online articles, highlighting the value of both official documentation and other informal materials such as blog posts. We make recommendations for promoting the under-stated strategies through tools, and detail the importance of providing better developer support to handle third-party data practices.

Embedding Privacy Into Design Through Software Developers: Challenges and Solutions

“…Returning to the example of an advertising library, many such libraries offer developers the ability to limit data collection, but finding the settings may involve going through multiple layers of settings or looking up what sample code function parameters actually do [12], [8]. Given the challenges, it is unsurprising that some developers opt to use more straightforward approaches such as feeding libraries random numbers instead of potentially sensitive data or finding ways to avoid using software from larger companies perceived as privacy-unfriendly [5], [13].…”

“…To further triangulate our data points and dig deeper into developers' privacy practices, in three studies, we analyzed a large set of privacy-related posts from Stack Overflow to gather viewpoints of a large pool of developers around privacy-related topics [5], [13], [15]. The results gave us an understanding of developers' privacy challenges and solutions in developers' words by analyzing their posts about privacy.…”

“…Yet, they do not provide information about how to write a privacy policy or what needs to be included. Developers are, therefore, often left with the need to comply with regulations and requirements of the app stores but without the knowledge of what needs to go into the privacy policies [5], [13].…”

“…Writing these documents may become even more challenging in cases where developers working in small teams might not have access to dedicated privacy experts or lawyers because of cost issues. One consequence for users is privacy policies that are hard to read, may not even talk about the app's privacy policies, and may lack several essential pieces of information [5], [13].…”

Charting App Developers’ Journey Through Privacy Regulation Features in Ad Networks

“…In addition to a detailed report, this system may have a checkbox that turns green when the app is compliant with a regulation. It would also reduce developers' efforts to check for third-party libraries because third parties can be one of the reasons for privacy implications though developers are not always aware of them [64,80].…”