@inbook {1626,
	title = {When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study},
	booktitle = {Open Source Software: Mobile Open Source Technologies},
	series = {IFIP Advances in Information and Communication Technology},
	volume = {427},
	year = {2014},
	pages = {234-236},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {

We analyzed peer code review data of the Android Open Source Project (AOSP) to understand whether code changes that introduce security vulnerabilities, referred to as vulnerable code changes (VCC), occur at certain intervals. Using a systematic manual analysis process, we identified 60 VCCs. Our results suggest that AOSP developers were more likely to write VCCs prior to AOSP releases, while during the post-release period they wrote fewer VCCs.
},
	keywords = {FOSS, open source, OSS, security, vulnerability},
	isbn = {978-3-642-55127-7},
	doi = {10.1007/978-3-642-55128-4_37},
	url = {http://dx.doi.org/10.1007/978-3-642-55128-4_37},
	author = {Bosu, Amiangshu and Carver, JeffreyC. and Hafiz, Munawar and Hilley, Patrick and Janni, Derek},
	editor = {Corral, Luis and Sillitti, Alberto and Succi, Giancarlo and Vlasenko, Jelena and Wasserman, AnthonyI.}
}
