Usage and attribution of Stack Overflow code snippets in GitHub projects

Abstract

Stack Overflow (SO) is the most popular question-and-answer website for software developers, providing a large amount of copyable code snippets. Using those snippets raises maintenance and legal issues. SO's license (CC BY-SA 3.0) requires attribution, i.e., referencing the original question or answer, and requires derived work to adopt a compatible license. While there is a heated debate on SO's license model for code snippets and the required attribution, little is known about the extent to which snippets are copied from SO without proper attribution. We present results of a large-scale empirical study analyzing the usage and attribution of non-trivial Java code snippets from SO answers in public GitHub (GH) projects. We followed three different approaches to triangulate an estimate for the ratio of unattributed usages and conducted two online surveys with software developers to complement our results. For the different sets of projects that we analyzed, the ratio of projects containing files with a reference to SO varied between 3.3% and 11.9%. We found that at most 1.8% of all analyzed repositories containing code from SO used the code in a way compatible with CC BY-SA 3.0. Moreover, we estimate that at most a quarter of the copied code snippets from SO are attributed as required. Of the surveyed developers, almost one half admitted copying code from SO without attribution and about two thirds were not aware of the license of SO code snippets and its implications.

Contextual Documentation Referencing on Stack Overflow

“…Xia et al [42] describe that it is common for developers to search for reusable code snippets on the web. In particular when developers want to copy such snippets into their projects, ATTRIBUTION links can be helpful to decide under which license the content can be used, a problem which many developers are not aware of [43].…”

Analyzing and Supporting Adaptation of Online Code Examples

“…This section describes the data collection pipeline. Due to the large portion of unattributed SO examples in GitHub [5,6,12], it is challenging to construct a complete set of reused code from SO to GitHub. To overcome this limitation, we apply four quality-control filters to underapproximate and overapproximate code examples reused from SO to GitHub, resulting in two complementary datasets.…”

“…Our work is motivated by the finding that developers often resort to online Q&A forums such as Stack Overflow [3]- [6]. Despite the wide usage of SO, most developers are not aware of the SO licensing terms nor attribute to the code reused from SO [5,6,12]. Only 1.8% of GitHub repositories containing code from SO follow the licensing policy properly [5].…”

“…As of July 2018, Stack Overflow has accumulated 26M answers to 16M programming questions. Copying code examples from Stack Overflow is common [5] and adapting them to fit a target program is recognized as a top barrier when reusing code from Stack Overflow [6]. SO examples are created for illustration purposes, which can serve as a good starting point.…”

“…When we use all four filters above, we find only 629 SO examples with GitHub counterparts. Recent studies find that very few developers explicitly attribute to the original SO post when reusing code from Stack Overflow [5,6,12]. Therefore, we use this resulting set of 629 SO examples as an underapproximation of SO code reuse and call it an adaptations dataset.…”