@inbook {1626,
	title = {When Are OSS Developers More Likely to Introduce Vulnerable Code Changes? A Case Study},
	booktitle = {Open Source Software: Mobile Open Source Technologies},
	series = {IFIP Advances in Information and Communication Technology},
	volume = {427},
	year = {2014},
	pages = {234-236},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {

We analyzed peer code review data of the Android Open Source Project (AOSP) to understand whether code changes that introduce security vulnerabilities, referred to as vulnerable code changes (VCC), occur at certain intervals. Using a systematic manual analysis process, we identified 60 VCCs. Our results suggest that AOSP developers were more likely to write VCCs prior to AOSP releases, while during the post-release period they wrote fewer VCCs.
},
	keywords = {FOSS, open source, OSS, security, vulnerability},
	isbn = {978-3-642-55127-7},
	doi = {10.1007/978-3-642-55128-4_37},
	url = {http://dx.doi.org/10.1007/978-3-642-55128-4_37},
	author = {Bosu, Amiangshu and Carver, JeffreyC. and Hafiz, Munawar and Hilley, Patrick and Janni, Derek},
	editor = {Corral, Luis and Sillitti, Alberto and Succi, Giancarlo and Vlasenko, Jelena and Wasserman, AnthonyI.}
}
@article {Reinke2003707,
	title = {The availability of source code in relation to timely response to security vulnerabilities},
	journal = {Computers \& Security},
	volume = {22},
	number = {8},
	year = {2003},
	note = {"This paper considers the effects of proprietary software versus non-proprietary software in determining the speed with which a security fix is made available"
"The sources considered are the BugTraq mailing list (available at SecurityFocus.com), the CERT Coordination Center (www.cert.org), and Incidents.org (from the SANS Institute)"
Note that these lists are generic topical discussion lists and not the mailing lists OF a particular open source project.},
	pages = {707 - 724},
	abstract = {Once a vulnerability has been found in an application or service that runs on a computer connected to the Internet, fixing that exploit in a timely fashion is of the utmost importance. There are two parts to fixing vulnerability: a party acting on behalf of the application{\textquoteright}s vendor gives instructions to fix it or makes a patch available that can be downloaded; then someone using that information fixes the computer or application in question. This paper considers the effects of proprietary software versus non-proprietary software in determining the speed with which a security fix is made available, since this can minimize the amount of time that the computer system remains vulnerable.},
	keywords = {bugtraq, cert, email, email archives, mailing list, security, vulnerability},
	issn = {0167-4048},
	doi = {DOI: 10.1016/S0167-4048(03)00011-7},
	url = {http://www.sciencedirect.com/science/article/B6V8G-4B9CV31-C/2/a218fccfaef185af5c122f118b252703},
	author = {John Reinke and Hossein Saiedian}
}
@article {Hissam,
	title = {Trust and vulnerability in open source software},
	journal = {Software, {IEE} Proceedings -},
	volume = {149},
	number = {1},
	year = {2002},
	month = {02/2002},
	pages = {47{\textendash}51},
	chapter = {47},
	abstract = {Software plays an ever increasing role in the critical infrastructures that run our cities, manage our economies, and defend our nations. In 1999, the Presidents Information Technology Advisory Committee (PITAC) reported to the United States President the need for software components that are reliable, tested, modelled and secure supporting the development of predictably reliable and secure systems that underscore our critical infrastructures. Open source software (OSS) constitutes a viable source for software components. Some believe that OSS is more reliable and more secure than closed source software (CSS)-due to a phenomenon dubbed {\textquoteright}many eyeballs{\textquoteright}-but is this truly the case? Or does OSS give the cyber criminal an edge that he would likewise not have? We explore OSS from the perspective of the cyber criminal and discuss what the community of software developers and users alike can do to increase their trust in both open source software and closed source software},
	keywords = {closed source software, community of software developers, critical infrastructures, cyber criminal, open source software, PITAC, predictably reliable systems, predictably secure systems, software components, trust, users, vulnerability},
	issn = {1462-5970},
	doi = {10.1049/ip-sen:20020208},
	author = {Hissam, S. A. and Plakosh, D. and Weinstock, C.}
}
