@conference {Pletea:2014:SES:2597073.2597117,
	title = {Security and Emotion: Sentiment Analysis of Security Discussions on GitHub},
	booktitle = {Proceedings of the 11th Working Conference on Mining Software Repositories},
	series = {MSR 2014},
	year = {2014},
	pages = {348{\textendash}351},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Application security is becoming increasingly prevalent during software and especially web application development. Consequently, countermeasures are continuously being discussed and built into applications, with the goal of reducing the risk that unauthorized code will be able to access, steal, modify, or delete sensitive data. In this paper we gauged the presence and atmosphere surrounding security-related discussions on GitHub, as mined from discussions around commits and pull requests. First, we found that security related discussions account for approximately 10\% of all discussions on GitHub. Second, we found that more negative emotions are expressed in security-related discussions than in other discussions. These findings confirm the importance of properly training developers to address security concerns in their applications as well as the need to test applications thoroughly for security vulnerabilities in order to reduce frustration and improve overall project atmosphere.
},
	keywords = {github, mining challenge, msr challenge, security, sentiment analysis},
	isbn = {978-1-4503-2863-0},
	doi = {10.1145/2597073.2597117},
	url = {http://doi.acm.org/10.1145/2597073.2597117},
	attachments = {https://flosshub.org/sites/flosshub.org/files/pletea.pdf},
	author = {Pletea, Daniel and Vasilescu, Bogdan and Serebrenik, Alexander}
}
@inbook {1626,
	title = {When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study},
	booktitle = {Open Source Software: Mobile Open Source Technologies},
	series = {IFIP Advances in Information and Communication Technology},
	volume = {427},
	year = {2014},
	pages = {234-236},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {

We analyzed peer code review data of the Android Open Source Project (AOSP) to understand whether code changes that introduce security vulnerabilities, referred to as vulnerable code changes (VCC), occur at certain intervals. Using a systematic manual analysis process, we identified 60 VCCs. Our results suggest that AOSP developers were more likely to write VCCs prior to AOSP releases, while during the post-release period they wrote fewer VCCs.
},
	keywords = {FOSS, open source, OSS, security, vulnerability},
	isbn = {978-3-642-55127-7},
	doi = {10.1007/978-3-642-55128-4_37},
	url = {http://dx.doi.org/10.1007/978-3-642-55128-4_37},
	author = {Bosu, Amiangshu and Carver, JeffreyC. and Hafiz, Munawar and Hilley, Patrick and Janni, Derek},
	editor = {Corral, Luis and Sillitti, Alberto and Succi, Giancarlo and Vlasenko, Jelena and Wasserman, AnthonyI.}
}
@conference {Scacchi:2013:PSO:2486046.2486068,
	title = {Processes in Securing Open Architecture Software Systems},
	booktitle = {Proceedings of the 2013 International Conference on Software and System Process},
	series = {ICSSP 2013},
	year = {2013},
	pages = {126{\textendash}135},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Our goal is to identify and understand issues that arise in the development and evolution processes for securing open architecture (OA) software systems. OA software systems are those developed with a mix of closed source and open source software components that are configured via an explicit system architectural specification. Such a specification may serve as a reference model or product line model for a family of concurrently sustained OA system versions/variants. We employ a case study focusing on an OA software system whose security must be continually sustained throughout its ongoing development and evolution. We limit our focus to software processes surrounding the architectural design, continuous integration, release deployment, and evolution found in the OA system case study. We also focus on the role automated tools, software development support mechanisms, and development practices play in facilitating or constraining these processes through the case study. Our purpose is to identify issues that impinge on modeling (specification) and integration of these processes, and how automated tools mediate these processes, as emerging research problems areas for the software process research community. Finally, our study is informed by related research found in the prescriptive versus descriptive practice of these processes and tool usage in studies of conventional and open source software development projects.},
	keywords = {configuration, continuous software development, Open architecture, process integration, process modeling, security},
	isbn = {978-1-4503-2062-7},
	doi = {10.1145/2486046.2486068},
	url = {http://doi.acm.org/10.1145/2486046.2486068},
	attachments = {https://flosshub.org/sites/flosshub.org/files/Scacchi-Alspaugh-ICSSP13.pdf},
	author = {Walt Scacchi and Alspaugh, Thomas A.}
}
@conference {956,
	title = {Mining security changes in FreeBSD},
	booktitle = {2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)},
	year = {2010},
	pages = {90 - 93},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Cape Town, South Africa},
	abstract = {Current research on historical project data is rarely touching on the subject of security related information. Learning how security is treated in projects and which parts of a software are historically security relevant or prone to security changes can enhance the security strategy of a software project. We present a mining methodology for security related changes by modifying an existing method of software repository analysis. We use the gathered security changes to find out more about the nature of security in the FreeBSD project and we try to establish a link between the identified security changes and a tracker for security issues (security advisories). We give insights how security is presented in the FreeBSD project and show how the mined data and known security problems are connected.},
	keywords = {freebsd, msr challenge, security},
	isbn = {978-1-4244-6802-7},
	doi = {10.1109/MSR.2010.5463289},
	author = {Mauczka, Andreas and Schanes, Christian and Fankhauser, Florian and Bernhart, Mario and Grechenig, Thomas}
}
@conference {anbalagan2010towards,
	title = {Towards a bayesian approach in modeling the disclosure of unique security faults in open source projects},
	booktitle = {Software Reliability Engineering (ISSRE), 2010 IEEE 21st International Symposium on},
	year = {2010},
	pages = {101{\textendash}110},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Software security has both an objective and a subjective component. A lot of the information available about that today is focused on security vulnerabilities and their disclosure. It is less frequent that security breaches and failures rates are reported, even in open source projects. Disclosure of security problems can take several forms. A disclosure can be accompanied by a release of the fix for the problem, or not. The latter category can be further divided into {\textquotedblright}voluntary{\textquotedblright} and {\textquotedblright}involuntary{\textquotedblright} security issues. In widely used software there is also considerable variability in the operational profile under which the software is used. This profile is further modified by attacks on the software that may be triggered by security disclosures. Therefore a comprehensive model of software security qualities of a product needs to incorporate both objective measures, such as security problem disclosure, repair and, failure rates, as well as less objective metrics such as implied variability in the operational profile, influence of attacks, and subjective impressions of exposure and severity of the problems, etc. We show how a classical Bayesian model can be adapted for use in the security context. The model is discussed and assessed using data from three open source software project releases. Our results show that the model is suitable for use with a certain subset of disclosed security faults, but that additional work will be needed to identify appropriate shape and scaling functions that would accurately reflect end-user perceptions associated with security problems.},
	keywords = {security},
	url = {http://ai2-s2-pdfs.s3.amazonaws.com/edcf/0b13ae1e6317c7e31f6b8783f669b978ffb3.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/0b13ae1e6317c7e31f6b8783f669b978ffb3.pdf},
	author = {Anbalagan, Prasanth and Vouk, Mladen}
}
@article {schryen2009security,
	title = {Security of Open Source and Closed Source Software: An Empirical Comparison of Published Vulnerabilities},
	journal = {AMCIS 2009 Proceedings},
	year = {2009},
	pages = {387},
	abstract = {Reviewing literature on open source and closed source security reveals that the discussion is often determined by biased attitudes toward one of these development styles. The discussion specifically lacks appropriate metrics, methodology and hard data. This paper contributes to solving this problem by analyzing and comparing published vulnerabilities of eight open source software and nine closed source software packages, all of which are widely deployed. Thereby, it provides an extensive empirical analysis of vulnerabilities in terms of mean time between vulnerability disclosures, the development of disclosure over time, and the severity of vulnerabilities, and allows for validating models provided in the literature. The investigation reveals that (a) the mean time between vulnerability disclosures was lower for open source software in half of the cases, while the other cases show no differences, (b) in contrast to literature assumption, 14 out of 17 software packages showed a significant linear or piecewise linear correlation between time and the number of published vulnerabilities, and (c) regarding the severity of vulnerabilities, no significant differences were found between open source and closed source.},
	keywords = {closed source software, empirical comparison, open source software, security, Vulnerabilities},
	url = {http://epub.uni-regensburg.de/21296/1/Schryen_-_AMCIS_09_-_Security_of_open_source_and_closed_source_software_-_Web_version.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/Schryen_-_AMCIS_09_-_Security_of_open_source_and_closed_source_software_-_Web_version.pdf},
	author = {Schryen, Guido}
}
@article {hoepman2007increased,
	title = {Increased security through open source},
	journal = {Communications of the ACM},
	volume = {50},
	number = {1},
	year = {2007},
	pages = {79{\textendash}83},
	publisher = {ACM},
	abstract = {The last few years have shown a worldwide rise in the attention for, and
actual use of, open source software (OSS), most notably of the operating
system Linux and various applications running on top of it. Various major
companies and governments are adopting OSS. As a result, there are many
publications concerning its advantages and disadvantages. The ongoing discussions
cover a wide range of topics, such as Windows versus Linux, cost
issues, intellectual property rights, development methods, etc. Here we wish
to focus on security issues surrounding OSS. It has become a reasonably
well-established conviction within the computer security community that
publishing designs and protocols contributes to the security of systems built
on them. But should one go all the way and publish source code as well?
That is the fundamental question that we wish to address in this paper.},
	keywords = {security},
	url = {https://arxiv.org/pdf/0801.3924.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/0801.3924.pdf},
	author = {Hoepman, Jaap-Henk and Jacobs, Bart}
}
@inbook {anderson2005open,
	title = {Open and Closed Systems are Equivalent (that is, in an ideal world)},
	booktitle = {Perspectives on free and open source software},
	year = {2005},
	pages = {127-142},
	publisher = {MIT Press},
	organization = {MIT Press},
	abstract = {...In May 2002, I proved a controversial theorem [8]: that, under the standard assumptions of reliability growth theory, it does not matter whether the system is open or closed. Opening a system enables the attacker to discover vulnerabilities more quickly, but it helps the defenders exactly as much.
This caused consternation in some circles, as it was interpreted as a general claim that open systems are no better than closed ones. But that is not what the theorem implies. Most real systems will deviate in important ways from the assumptions of the standard reliability growth model, and it will often be the case that open systems (or closed systems) will be better in some particular application. My theorem lets people concentrate on the differences between open and closed systems that matter in a particular case.},
	keywords = {security},
	isbn = {9780262062466},
	url = {http://www.cl.cam.ac.uk/~rja14/Papers/toulousebook.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/toulousebook.pdf},
	author = {Anderson, Ross}
}
@conference {899,
	title = {Stopping spyware at the gate: a user study of privacy, notice and spyware},
	booktitle = {2005 Symposium on Usable Privacy and Security},
	year = {2005},
	month = {07/2005},
	pages = {43-52},
	publisher = {Association for Computing Machinery},
	organization = {Association for Computing Machinery},
	address = {Pittsburgh, PA},
	keywords = {agreement,, and, Aspects,, Design,, end, EULA,, Experimentation,, Factors,, Human, Legal, license, notice,, of, privacy,, security, service,, spyware,, terms, ToS,, usability,, user},
	isbn = {1-59593-178-3 },
	author = {N. Good and Dhamija, R. and J. Grossklags and D. Thaw and Aronowitz, S. and D. Mulligan and J. Konstan}
}
@article {swire2005theory,
	title = {A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems},
	journal = {Hous. L. Rev.},
	volume = {42},
	year = {2005},
	pages = {1333},
	publisher = {HeinOnline},
	abstract = {A previous article, {\textquotedblleft}A Model for When Disclosure Helps Security: What is
Different about Computer and Network Security?{\textquotedblright} proposed a model for
when disclosure helps or hurts security and provided reasons why computer
security is often different in this respect than physical security.
 This chapter provides a general approach for describing the incentives of actors to
disclose information about their software or systems. A chief point of this
chapter is that the incentives of disclosure depend on two largely independent
assessments: (i) the degree to which disclosure helps or hurts security},
	keywords = {security},
	attachments = {https://flosshub.org/sites/flosshub.org/files/KP21\%2003\%20Swire.pdf},
	author = {Swire, Peter P}
}
@article {Reinke2003707,
	title = {The availability of source code in relation to timely response to security vulnerabilities},
	journal = {Computers \& Security},
	volume = {22},
	number = {8},
	year = {2003},
	note = {"This paper considers the effects of proprietary software versus non-proprietary software in determining the speed with which a security fix is made available"
"The sources considered are the BugTraq mailing list (available at SecurityFocus.com), the CERT Coordination Center (www.cert.org), and Incidents.org (from the SANS Institute)"
Note that these lists are generic topical discussion lists and not the mailing lists OF a particular open source project.},
	pages = {707 - 724},
	abstract = {Once a vulnerability has been found in an application or service that runs on a computer connected to the Internet, fixing that exploit in a timely fashion is of the utmost importance. There are two parts to fixing vulnerability: a party acting on behalf of the application{\textquoteright}s vendor gives instructions to fix it or makes a patch available that can be downloaded; then someone using that information fixes the computer or application in question. This paper considers the effects of proprietary software versus non-proprietary software in determining the speed with which a security fix is made available, since this can minimize the amount of time that the computer system remains vulnerable.},
	keywords = {bugtraq, cert, email, email archives, mailing list, security, vulnerability},
	issn = {0167-4048},
	doi = {DOI: 10.1016/S0167-4048(03)00011-7},
	url = {http://www.sciencedirect.com/science/article/B6V8G-4B9CV31-C/2/a218fccfaef185af5c122f118b252703},
	author = {John Reinke and Hossein Saiedian}
}
@article {1877,
	title = {Software security for open-source systems},
	journal = {IEEE Security \& Privacy Magazine},
	volume = {1},
	year = {2003},
	month = {01/2003},
	pages = {38 - 45},
	abstract = {Debate over whether open-source software development leads to more or less secure software has raged for years. Neither is intrinsically correct: open-source software gives both attackers and defenders greater power over system security. Fortunately, several security-enhancing technologies for open-source systems can help defenders improve their security.
},
	keywords = {security},
	issn = {1540-7993},
	doi = {10.1109/MSECP.2003.1176994},
	author = {Cowan, C.}
}
@article {hansen2002open,
	title = {The Open Source approach{\textemdash}opportunities and limitations with respect to security and privacy},
	journal = {Computers \& Security},
	volume = {21},
	number = {5},
	year = {2002},
	pages = {461{\textendash}471},
	publisher = {Elsevier},
	abstract = {Today{\textquoteright}s software often does not even fulfil basic security or privacy requirements. Some people regard the open source paradigm as the solution to this problem. First, we carefully explain the security and privacy aspects of open source, which in particular offer the possibility for a dramatic increase in trustworthiness for and autonomy of the user. We show which expectations for an improvement of the software trustworthiness dilemma are realistic. Finally, we describe measures necessary for developing secure and trustworthy open source systems.},
	keywords = {security},
	url = {https://dud.inf.tu-dresden.de/literatur/HaKP_02OpenSource_0214.doc},
	attachments = {https://flosshub.org/sites/flosshub.org/files/HaKP_02OpenSource_0214.doc},
	author = {Hansen, Marit and K{\"o}hntopp, Kristian and Pfitzmann, Andreas}
}
@booklet {anderson2002security,
	title = {Security in open versus closed systems{\textemdash}the dance of Boltzmann, Coase and Moore},
	year = {2002},
	publisher = {Technical report, Cambridge University, England},
	abstract = {Some members of the open-source and free software com- munity argue that their code is more secure, because vulnerabilities are easier for users to find and fix. Meanwhile the proprietary vendor com- munity maintains that access to source code rather makes things easier for the attackers. In this paper, I argue that this is the wrong way to approach the interaction between security and the openness of design. I show first that under quite reasonable assumptions the security assur- ance problem scales in such a way that making it either easier, or harder, to find attacks, will help attackers and defendants equally. This model may help us focus on and understand those cases where some asymmetry is introduced.
However, there are more pressing security problems for the open source community. The interaction between security and openness is entangled with attempts to use security mechanisms for commercial advantage {\textendash} to entrench monopolies, to control copyright, and above all to control interoperability. As an example, I will discuss TCPA, a recent initiative by Intel and others to build DRM technology into the PC platform. Al- though advertised as providing increased information security for users, it appears to have more to do with providing commercial advantage for vendors, and may pose an existential threat to open systems.},
	keywords = {security},
	url = {http://www.cl.cam.ac.uk/~rja14/Papers/toulouse.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/toulouse.pdf},
	author = {Anderson, Ross}
}
@article {payne2002security,
	title = {On the security of open source software},
	journal = {Information systems journal},
	volume = {12},
	number = {1},
	year = {2002},
	pages = {61{\textendash}78},
	publisher = {Wiley Online Library},
	abstract = {With the rising popularity of so-called {\textquoteleft}open source{\textquoteright} software there has been increasing interest in both its various benefits and disadvantages. In particular, despite its prominent use in providing many aspects of the Internet{\textquoteright}s basic infrastructure, many still question the suitability of such software for the commerce-oriented Internet of the future. This paper evaluates the suitability of open source software with respect to one of the key attributes that tomorrow{\textquoteright}s Internet will require, namely security. It seeks to present a variety of arguments that have been made, both for and against open source security and analyses in relation to empirical evidence of system security from a previous study. The results represent preliminary quantitative evidence concerning the security issues surrounding the use and development of open source software, in particular relative to traditional proprietary software.},
	keywords = {security},
	attachments = {https://flosshub.org/sites/flosshub.org/files/Payne2002_ISJ12_SecurityOSS.pdf},
	author = {Payne, Christian}
}
@article {witten2001does,
	title = {Does open source improve system security?},
	journal = {IEEE Software},
	volume = {18},
	number = {5},
	year = {2001},
	pages = {57{\textendash}61},
	publisher = {IEEE},
	abstract = {An attacker
could examine
public source
code to find
flaws in a
system. So, is
source code
access a net
gain or loss for
security? The
authors
consider this
question from
several
perspectives
and tentatively
conclude that
having source
code available
should work in
favor of system
security.},
	keywords = {security},
	url = {https://pdfs.semanticscholar.org/71f6/01579ad1c373ed59a19eba0396f7f0cb7a0e.pdf},
	attachments = {https://flosshub.org/sites/flosshub.org/files/01579ad1c373ed59a19eba0396f7f0cb7a0e.pdf},
	author = {Witten, Brian and Landwehr, Carl and Caloyannides, Michael}
}
