Vulnerably (mis) configured? Exploring 10 years of developers' Q&As on Stack Overflow

R May, C Biermann, XM Zerweck, K Ludwig… - Proceedings of the 18th …, 2024 - dl.acm.org
R May, C Biermann, XM Zerweck, K Ludwig, J Krüger, T Leich
Proceedings of the 18th International Working Conference on Variability …, 2024dl.acm.org
The increasing number of attacks exploiting system vulnerabilities in recent years underpins
the growing importance of security; especially for software comprising configuration options
that may cause unintended vulnerabilities. So, not surprisingly, developers discuss secure
software configurations extensively, for instance, via community-question-answering
systems like Stack Overflow. In this exploratory study, we analyzed 651 Stack Overflow posts
from 2013 until 2022 to investigate what vulnerabilities in the context of configuring software …
The increasing number of attacks exploiting system vulnerabilities in recent years underpins the growing importance of security; especially for software comprising configuration options that may cause unintended vulnerabilities. So, not surprisingly, developers discuss secure software configurations extensively, for instance, via community-question-answering systems like Stack Overflow. In this exploratory study, we analyzed 651 Stack Overflow posts from 2013 until 2022 to investigate what vulnerabilities in the context of configuring software developers discuss. We employed a manual data analysis and automated topic modeling using Latent Dirichlet Allocation to identify and classify relevant topics and contexts. Our results show that vulnerabilities in the context of configuring receive more and more interest, with most posts discussing issues related to faulty security configurations and dependencies causing vulnerabilities that could be or have actually been exploited. Overall, we contribute insights into configuration and security issues that developers experience in the real world. Such insights help researchers and practitioners understand and resolve these issues, thereby guiding future improvements.
ACM Digital Library
以上显示的是最相近的搜索结果。 查看全部搜索结果