-
S3C2 Summit 2024-03: Industry Secure Supply Chain Summit
Authors:
Greg Tystahl,
Yasemin Acar,
Michel Cukier,
William Enck,
Christian Kastner,
Alexandros Kapravelos,
Dominik Wermke,
Laurie Williams
Abstract:
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their supply chains to make them more robust against future threats. On March 7th, 2024 researchers from the Secure Software Supply Chain Center (S3C2) gathered 14 industry leaders, developers and consumers of the open source eco…
▽ More
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their supply chains to make them more robust against future threats. On March 7th, 2024 researchers from the Secure Software Supply Chain Center (S3C2) gathered 14 industry leaders, developers and consumers of the open source ecosystem to discuss the state of supply chain security. The goal of the summit is to share insights between companies and developers alike to foster new collaborations and ideas moving forward. Through this meeting, participants were questions on best practices and thoughts how to improve things for the future. In this paper we summarize the responses and discussions of the summit. The panel questions can be found in the appendix.
△ Less
Submitted 14 May, 2024;
originally announced May 2024.
-
Unusual isospectral factorizations of shape invariant Hamiltonians with Scarf II potential
Authors:
Yiğit Can Acar,
Lorena Acevedo,
Şengül Kuru
Abstract:
In this paper, we search the factorizations of the shape invariant Hamiltonians with Scarf II potential. We find two classes; one of them is the standard real factorization which leads us to a real hierarchy of potentials and their energy levels; the other one is complex and it leads us naturally to a hierarchy of complex Hamiltonians. We will show some properties of these complex Hamiltonians: th…
▽ More
In this paper, we search the factorizations of the shape invariant Hamiltonians with Scarf II potential. We find two classes; one of them is the standard real factorization which leads us to a real hierarchy of potentials and their energy levels; the other one is complex and it leads us naturally to a hierarchy of complex Hamiltonians. We will show some properties of these complex Hamiltonians: they are not parity-time (or PT) symmetric, but their spectrum is real and isospectral to the Scarf II real Hamiltonian hierarchy. The algebras for real and complex shift operators (also called potential algebras) are computed; they consist of $su(1,1)$ for each of them and the total potential algebra including both hierarchies is the direct sum $su(1,1)\oplus su(1,1)$.
△ Less
Submitted 7 January, 2024; v1 submitted 12 September, 2023;
originally announced September 2023.
-
"Make Them Change it Every Week!": A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication
Authors:
Jan H. Klemmer,
Marco Gutfleisch,
Christian Stransky,
Yasemin Acar,
M. Angela Sasse,
Sascha Fahl
Abstract:
Usable and secure authentication on the web and beyond is mission-critical. While password-based authentication is still widespread, users have trouble dealing with potentially hundreds of online accounts and their passwords. Alternatives or extensions such as multi-factor authentication have their own challenges and find only limited adoption. Finding the right balance between security and usabil…
▽ More
Usable and secure authentication on the web and beyond is mission-critical. While password-based authentication is still widespread, users have trouble dealing with potentially hundreds of online accounts and their passwords. Alternatives or extensions such as multi-factor authentication have their own challenges and find only limited adoption. Finding the right balance between security and usability is challenging for developers. Previous work found that developers use online resources to inform security decisions when writing code. Similar to other areas, lots of authentication advice for developers is available online, including blog posts, discussions on Stack Overflow, research papers, or guidelines by institutions like OWASP or NIST.
We are the first to explore developer advice on authentication that affects usable security for end-users. Based on a survey with 18 professional web developers, we obtained 406 documents and qualitatively analyzed 272 contained pieces of advice in depth. We aim to understand the accessibility and quality of online advice and provide insights into how online advice might contribute to (in)secure and (un)usable authentication. We find that advice is scattered and that finding recommendable, consistent advice is a challenge for developers, among others. The most common advice is for password-based authentication, but little for more modern alternatives. Unfortunately, many pieces of advice are debatable (e.g., complex password policies), outdated (e.g., enforcing regular password changes), or contradicting and might lead to unusable or insecure authentication. Based on our findings, we make recommendations for developers, advice providers, official institutions, and academia on how to improve online advice for developers.
△ Less
Submitted 26 November, 2023; v1 submitted 1 September, 2023;
originally announced September 2023.
-
S3C2 Summit 2023-06: Government Secure Supply Chain Summit
Authors:
William Enck,
Yasemin Acar,
Michel Cukier,
Alexandros Kapravelos,
Christian Kästner,
Laurie Williams
Abstract:
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supp…
▽ More
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supply chain security. On June 7, 2023, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 17 practitioners from 13 government agencies. The goal of the Summit was two-fold: (1) to share our observations from our previous two summits with industry, and (2) to enable sharing between individuals at the government agencies regarding practical experiences and challenges with software supply chain security. For each discussion topic, we presented our observations and take-aways from the industry summits to spur conversation. We specifically focused on the Executive Order 14028, software bill of materials (SBOMs), choosing new dependencies, provenance and self-attestation, and large language models. The open discussions enabled mutual sharing and shed light on common challenges that government agencies see as impacting government and industry practitioners when securing their software supply chain. In this paper, we provide a summary of the Summit.
△ Less
Submitted 13 August, 2023;
originally announced August 2023.
-
S3C2 Summit 2023-02: Industry Secure Supply Chain Summit
Authors:
Trevor Dunlap,
Yasemin Acar,
Michel Cucker,
William Enck,
Alexandros Kapravelos,
Christian Kastner,
Laurie Williams
Abstract:
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supp…
▽ More
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supply chain security. On February 22, 2023, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 17 practitioners from 15 companies. The goal of the Summit is to enable sharing between industry practitioners having practical experiences and challenges with software supply chain security and hel** to form new collaborations. We conducted six-panel discussions based upon open-ended questions regarding software bill of materials (SBOMs), malicious commits, choosing new dependencies, build and deploy,the Executive Order 14028, and vulnerable dependencies. The open discussions enabled mutual sharing and shed light on common challenges that industry practitioners with practical experience face when securing their software supply chain. In this paper, we provide a summary of the Summit. Full panel questions can be found in the appendix.
△ Less
Submitted 31 July, 2023;
originally announced July 2023.
-
S3C2 Summit 2202-09: Industry Secure Suppy Chain Summit
Authors:
Mindy Tran,
Yasemin Acar,
Michel Cucker,
William Enck,
Alexandros Kapravelos,
Christian Kastner,
Laurie Williams
Abstract:
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supp…
▽ More
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. The US government and industry are equally interested in enhancing software supply chain security. We conducted six panel discussions with a diverse set of 19 practitioners from industry. We asked them open-ended questions regarding SBOMs, vulnerable dependencies, malicious commits, build and deploy, the Executive Order, and standards compliance. The goal of this summit was to enable open discussions, mutual sharing, and shedding light on common challenges that industry practitioners with practical experience face when securing their software supply chain. This paper summarizes the summit held on September 30, 2022.
△ Less
Submitted 28 July, 2023;
originally announced July 2023.
-
"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments
Authors:
Sabrina Amft,
Sandra Höltervennhoff,
Nicolas Huaman,
Alexander Krause,
Lucy Simko,
Yasemin Acar,
Sascha Fahl
Abstract:
Multi-Factor Authentication is intended to strengthen the security of password-based authentication by adding another factor, such as hardware tokens or one-time passwords using mobile apps. However, this increased authentication security comes with potential drawbacks that can lead to account and asset loss. If users lose access to their additional authentication factors for any reason, they will…
▽ More
Multi-Factor Authentication is intended to strengthen the security of password-based authentication by adding another factor, such as hardware tokens or one-time passwords using mobile apps. However, this increased authentication security comes with potential drawbacks that can lead to account and asset loss. If users lose access to their additional authentication factors for any reason, they will be locked out of their accounts. Consequently, services that provide Multi-Factor Authentication should deploy procedures to allow their users to recover from losing access to their additional factor that are both secure and easy-to-use. In this work, we investigate the security and user experience of Multi-Factor Authentication recovery procedures, and compare their deployment to descriptions on help and support pages. We first evaluate the official help and support pages of 1,303 websites that provide Multi-Factor Authentication and collect documented information about their recovery procedures. Second, we select a subset of 71 websites, create accounts, set up Multi-Factor Authentication, and perform an in-depth investigation of their recovery procedure security and user experience. We find that many websites deploy insecure Multi-Factor Authentication recovery procedures and allowed us to circumvent and disable Multi-Factor Authentication when having access to the accounts' associated email addresses. Furthermore, we commonly observed discrepancies between our in-depth analysis and the official help and support pages, implying that information meant to aid users is often either incorrect or outdated. Based on our findings, we provide recommendations for best practices regarding Multi-Factor Authentication recovery.
△ Less
Submitted 19 September, 2023; v1 submitted 16 June, 2023;
originally announced June 2023.
-
Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations
Authors:
Tadayoshi Kohno,
Yasemin Acar,
Wulf Loh
Abstract:
The computer security research community regularly tackles ethical questions. The field of ethics / moral philosophy has for centuries considered what it means to be "morally good" or at least "morally allowed / acceptable". Among philosophy's contributions are (1) frameworks for evaluating the morality of actions -- including the well-established consequentialist and deontological frameworks -- a…
▽ More
The computer security research community regularly tackles ethical questions. The field of ethics / moral philosophy has for centuries considered what it means to be "morally good" or at least "morally allowed / acceptable". Among philosophy's contributions are (1) frameworks for evaluating the morality of actions -- including the well-established consequentialist and deontological frameworks -- and (2) scenarios (like trolley problems) featuring moral dilemmas that can facilitate discussion about and intellectual inquiry into different perspectives on moral reasoning and decision-making. In a classic trolley problem, consequentialist and deontological analyses may render different opinions. In this research, we explicitly make and explore connections between moral questions in computer security research and ethics / moral philosophy through the creation and analysis of trolley problem-like computer security-themed moral dilemmas and, in doing so, we seek to contribute to conversations among security researchers about the morality of security research-related decisions. We explicitly do not seek to define what is morally right or wrong, nor do we argue for one framework over another. Indeed, the consequentialist and deontological frameworks that we center, in addition to coming to different conclusions for our scenarios, have significant limitations. Instead, by offering our scenarios and by comparing two different approaches to ethics, we strive to contribute to how the computer security research field considers and converses about ethical questions, especially when there are different perspectives on what is morally right or acceptable.
△ Less
Submitted 4 August, 2023; v1 submitted 28 February, 2023;
originally announced February 2023.
-
Beyond the Boolean: How Programmers Ask About, Use, and Discuss Gender
Authors:
Elijah Bouma-Sims,
Yasemin Acar
Abstract:
Categorization via gender is omnipresent throughout society, and thus also computing; gender identity is often requested of users before they use software or web services. Despite this fact, no research has explored how software developers approach requesting gender disclosure from users. To understand how developers think about gender in software, we present an interview study with 15 software de…
▽ More
Categorization via gender is omnipresent throughout society, and thus also computing; gender identity is often requested of users before they use software or web services. Despite this fact, no research has explored how software developers approach requesting gender disclosure from users. To understand how developers think about gender in software, we present an interview study with 15 software developers recruited from the freelancing platform Upwork as well as Twitter. We also collected and categorized 917 threads that contained keywords relevant to gender from programming-related sub-forums on the social media service Reddit. 16 posts that discussed approaches to gender disclosure were further analyzed. We found that while some developers have an understanding of inclusive gender options, programmers rarely consider when gender data is necessary or the way in which they request gender disclosure from users. Our findings have implications for programmers, software engineering educators, and the broader community concerned with inclusivity.
△ Less
Submitted 10 February, 2023;
originally announced February 2023.
-
Digital Security -- A Question of Perspective. A Large-Scale Telephone Survey with Four At-Risk User Groups
Authors:
Franziska Herbert,
Steffen Becker,
Annalina Buckmann,
Marvin Kowalewski,
Jonas Hielscher,
Yasemin Acar,
Markus Dürmuth,
Yixin Zou,
M. Angela Sasse
Abstract:
This paper investigates the digital security experiences of four at-risk user groups in Germany, including older adults (70+), teenagers (14-17), people with migration backgrounds, and people with low formal education. Using computer-assisted telephone interviews, we sampled 250 participants per group, representative of region, gender, and partly age distributions. We examine their device usage, c…
▽ More
This paper investigates the digital security experiences of four at-risk user groups in Germany, including older adults (70+), teenagers (14-17), people with migration backgrounds, and people with low formal education. Using computer-assisted telephone interviews, we sampled 250 participants per group, representative of region, gender, and partly age distributions. We examine their device usage, concerns, prior negative incidents, perceptions of potential attackers, and information sources. Our study provides the first quantitative and nationally representative insights into the digital security experiences of these four at-risk groups in Germany. Our findings show that participants with migration backgrounds used the most devices, sought more security information, and reported more experiences with cybercrime incidents than other groups. Older adults used the fewest devices and were least affected by cybercrimes. All groups relied on friends and family and online news as their primary sources of security information, with little concern about their social circles being potential attackers. We highlight the nuanced differences between the four at-risk groups and compare them to the broader German population when possible. We conclude by presenting recommendations for education, policy, and future research aimed at addressing the digital security needs of these at-risk user groups.
△ Less
Submitted 12 September, 2023; v1 submitted 25 December, 2022;
originally announced December 2022.
-
A World Full of Privacy and Security (Mis)conceptions? Findings of a Representative Survey in 12 Countries
Authors:
Franziska Herbert,
Steffen Becker,
Leonie Schaewitz,
Jonas Hielscher,
Marvin Kowalewski,
M. Angela Sasse,
Yasemin Acar,
Markus Dürmuth
Abstract:
Misconceptions about digital security and privacy topics in the general public frequently lead to insecure behavior. However, little is known about the prevalence and extent of such misconceptions in a global context. In this work, we present the results of the first large-scale survey of a global population on misconceptions: We conducted an online survey with n = 12, 351 participants in 12 count…
▽ More
Misconceptions about digital security and privacy topics in the general public frequently lead to insecure behavior. However, little is known about the prevalence and extent of such misconceptions in a global context. In this work, we present the results of the first large-scale survey of a global population on misconceptions: We conducted an online survey with n = 12, 351 participants in 12 countries on four continents. By investigating influencing factors of misconceptions around eight common security and privacy topics (including E2EE, Wi-Fi, VPN, and malware), we find the country of residence to be the strongest estimate for holding misconceptions. We also identify differences between non-Western and Western countries, demonstrating the need for region-specific research on user security knowledge, perceptions, and behavior. While we did not observe many outright misconceptions, we did identify a lack of understanding and uncertainty about several fundamental privacy and security topics.
△ Less
Submitted 22 December, 2022; v1 submitted 20 December, 2022;
originally announced December 2022.
-
"We are a startup to the core": A qualitative interview study on the security and privacy development practices in Turkish software startups
Authors:
Dilara Keküllüoğlu,
Yasemin Acar
Abstract:
Security and privacy are often neglected in software development, and rarely a priority for developers. This insight is commonly based on research conducted by researchers and on developer populations living and working in the United States, Europe, and the United Kingdom. However, the production of software is global, and crucial populations in important technology hubs are not adequately studied…
▽ More
Security and privacy are often neglected in software development, and rarely a priority for developers. This insight is commonly based on research conducted by researchers and on developer populations living and working in the United States, Europe, and the United Kingdom. However, the production of software is global, and crucial populations in important technology hubs are not adequately studied. The software startup scene in Turkey is impactful, and comprehension, knowledge, and mitigations related to software security and privacy remain understudied. To close this research gap, we conducted a semi-structured interview study with 16 developers working in Turkish software startups. The goal of the interview study was to analyze if and how developers ensure that their software is secure and preserves user privacy. Our main finding is that developers rarely prioritize security and privacy, due to a lack of awareness, skills, and resources. We find that regulations can make a positive impact on security and privacy. Based on the study, we issue recommendations for industry, individual developers, research, educators, and regulators. Our recommendations can inform a more globalized approach to security and privacy in software development.
△ Less
Submitted 16 December, 2022;
originally announced December 2022.
-
Committed by Accident: Studying Prevention and Remediation Strategies Against Secret Leakage in Source Code Repositories
Authors:
Alexander Krause,
Jan H. Klemmer,
Nicolas Huaman,
Dominik Wermke,
Yasemin Acar,
Sascha Fahl
Abstract:
Version control systems for source code, such as Git, are key tools in modern software development environments. Many developers use online services, such as GitHub or GitLab, for collaborative software development. While software projects often require code secrets to work, such as API keys or passwords, they need to be handled securely within the project. Previous research and news articles have…
▽ More
Version control systems for source code, such as Git, are key tools in modern software development environments. Many developers use online services, such as GitHub or GitLab, for collaborative software development. While software projects often require code secrets to work, such as API keys or passwords, they need to be handled securely within the project. Previous research and news articles have illustrated that developers are blameworthy of committing code secrets, such as private encryption keys, passwords, or API keys, accidentally to public source code repositories. However, making secrets publicly available might have disastrous consequences, such as leaving systems vulnerable to attacks. In a mixed-methods study, we surveyed 109 developers and conducted 14 in-depth semi-structured interviews with developers which experienced secret leakage in the past. We find that 30.3% of our participants have encountered secret leakage in the past, and that developers are facing several challenges with secret leakage prevention and remediation. Based on our findings, we discuss challenges, e. g., estimating risks of leaked secrets, and needs of developers in remediating and preventing code secret leaks, e. g., low adoption requirements. We also give recommendations for developers and source code platform providers to reduce the risk of secret leakage.
△ Less
Submitted 14 November, 2022; v1 submitted 11 November, 2022;
originally announced November 2022.
-
"Please help share!": Security and Privacy Advice on Twitter during the 2022 Russian Invasion of Ukraine
Authors:
Juliane Schmüser,
Noah Wöhler,
Harshini Sri Ramulu,
Christian Stransky,
Dominik Wermke,
Sascha Fahl,
Yasemin Acar
Abstract:
The Russian Invasion of Ukraine in early 2022 resulted in a rapidly changing (cyber) threat environment. This changing environment incentivized the sharing of security advice on social media, both for the Ukrainian population, as well as against Russian cyber attacks at large. Previous research found a significant influence of online security advice on end users.
We collected 8,920 tweets posted…
▽ More
The Russian Invasion of Ukraine in early 2022 resulted in a rapidly changing (cyber) threat environment. This changing environment incentivized the sharing of security advice on social media, both for the Ukrainian population, as well as against Russian cyber attacks at large. Previous research found a significant influence of online security advice on end users.
We collected 8,920 tweets posted after the Russian Invasion of Ukraine and examined 1,228 in detail, including qualitatively coding 232 relevant tweets and 140 linked documents for security and privacy advice. We identified 221 unique pieces of advice which we divided into seven categories and 21 subcategories, and advice targeted at individuals or organizations. We then compared our findings to those of prior studies, finding noteworthy similarities. Our results confirm a lack of advice prioritization found by prior work, which seems especially detrimental during times of crisis. In addition, we find offers for individual support to be a valuable tool and identify misinformation as a rising threat in general and for security advice specifically.
△ Less
Submitted 24 August, 2022;
originally announced August 2022.
-
Pulse Index Modulation
Authors:
Sultan Aldirmaz-Colak,
Erdogan Aydin,
Yasin Celik,
Yusuf Acar,
Ertugrul Basar
Abstract:
Emerging systems such as Internet-of-things (IoT) and machine-to-machine (M2M) communications have strict requirements on the power consumption of used equipments and associated complexity in the transceiver design. As a result, multiple-input multiple-output (MIMO) solutions might not be directly suitable for these system due to their high complexity, inter-antenna synchronization (IAS) requireme…
▽ More
Emerging systems such as Internet-of-things (IoT) and machine-to-machine (M2M) communications have strict requirements on the power consumption of used equipments and associated complexity in the transceiver design. As a result, multiple-input multiple-output (MIMO) solutions might not be directly suitable for these system due to their high complexity, inter-antenna synchronization (IAS) requirement, and high inter-antenna interference (IAI) problems. In order to overcome these problems, we propose two novel index modulation (IM) schemes, namely pulse index modulation (PIM) and generalized PIM (GPIM) for single-input single-output (SISO) schemes. The proposed models use well-localized and orthogonal Hermite-Gaussian pulses for data transmission and provide high spectral efficiency owing to the Hermite-Gaussian pulse indices. Besides, it has been shown via analytical derivations and computer simulations that the proposed PIM and GPIM systems have better error performance and considerable signal-to-noise ratio (SNR) gain compared to existing spatial modulation (SM), quadrature SM (QSM), and traditional M-ary systems.
△ Less
Submitted 22 January, 2021;
originally announced January 2021.
-
A Large Scale Investigation of Obfuscation Use in Google Play
Authors:
Dominik Wermke,
Nicolas Huaman,
Yasemin Acar,
Brad Reaves,
Patrick Traynor,
Sascha Fahl
Abstract:
Android applications are frequently plagiarized or repackaged, and software obfuscation is a recommended protection against these practices. However, there is very little data on the overall rates of app obfuscation, the techniques used, or factors that lead to developers to choose to obfuscate their apps. In this paper, we present the first comprehensive analysis of the use of and challenges to s…
▽ More
Android applications are frequently plagiarized or repackaged, and software obfuscation is a recommended protection against these practices. However, there is very little data on the overall rates of app obfuscation, the techniques used, or factors that lead to developers to choose to obfuscate their apps. In this paper, we present the first comprehensive analysis of the use of and challenges to software obfuscation in Android applications. We analyzed 1.7 million free Android apps from Google Play to detect various obfuscation techniques, finding that only 24.92% of apps are obfuscated by the developer. To better understand this rate of obfuscation, we surveyed 308 Google Play developers about their experiences and attitudes about obfuscation. We found that while developers feel that apps in general are at risk of plagiarism, they do not fear theft of their own apps. Developers also self-report difficulties applying obfuscation for their own apps. To better understand this, we conducted a follow-up study where the vast majority of 70 participants failed to obfuscate a realistic sample app even while many mistakenly believed they had been successful. Our findings show that more work is needed to make obfuscation tools more usable, to educate developers on the risk of their apps being reverse engineered, their intellectual property stolen, their apps being repackaged and redistributed as malware and to improve the health of the overall Android ecosystem.
△ Less
Submitted 20 February, 2018; v1 submitted 8 January, 2018;
originally announced January 2018.
-
Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security
Authors:
Felix Fischer,
Konstantin Böttinger,
Huang Xiao,
Christian Stransky,
Yasemin Acar,
Michael Backes,
Sascha Fahl
Abstract:
Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-…
▽ More
Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown. We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day. To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9% contain at least one insecure code snippet.
△ Less
Submitted 9 October, 2017;
originally announced October 2017.
-
Resonant Production of Color Octet Muons at the Future Circular Collider Based Muon-Proton Colliders
Authors:
Yigit Can Acar,
Umit Kaya,
Bilgehan Baris Oner
Abstract:
We investigate the resonant production of color octet muons in order to explore the discovery potential of the FCC-based μp colliders. It is shown that search potential of μp colliders essentially surpass potential of the LHC and would exceed that of FCC pp collider.
We investigate the resonant production of color octet muons in order to explore the discovery potential of the FCC-based μp colliders. It is shown that search potential of μp colliders essentially surpass potential of the LHC and would exceed that of FCC pp collider.
△ Less
Submitted 4 June, 2018; v1 submitted 11 March, 2017;
originally announced March 2017.
-
FCC Based Lepton-Hadron and Photon-Hadron Colliders: Luminosity and Physics
Authors:
Y. C. Acar,
A. N. Akay,
S. Beser,
H. Karadeniz,
U. Kaya,
B. B. Oner,
S. Sultansoy
Abstract:
Construction of future electron-positron colliders (or dedicated electron linac) and muon colliders (or dedicated muon ring) tangential to Future Circular Collider (FCC) will give opportunity to utilize highest energy proton and nucleus beams for lepton-hadron and photon-hadron collisions. Luminosity values of FCC based ep, \mup, eA, \muA, \gammap and \gammaA colliders are estimated. Multi-TeV cen…
▽ More
Construction of future electron-positron colliders (or dedicated electron linac) and muon colliders (or dedicated muon ring) tangential to Future Circular Collider (FCC) will give opportunity to utilize highest energy proton and nucleus beams for lepton-hadron and photon-hadron collisions. Luminosity values of FCC based ep, \mup, eA, \muA, \gammap and \gammaA colliders are estimated. Multi-TeV center of mass energy ep colliders based on the FCC and linear colliders (LC) are considered in detail. Parameters of upgraded versions of the FCC proton beam are determined to optimize luminosity of electron-proton collisions kee** beam-beam effects in mind. Numerical calculations are performed using a currently being developed collision point simulator. It is shown that L_{ep}\sim10^{32}\,cm^{-2}s^{-1} can be achieved with LHeC-like upgrade of the FCC parameters.
△ Less
Submitted 16 May, 2017; v1 submitted 7 August, 2016;
originally announced August 2016.
-
Color Octet Electron Search Potential of the FCC Based e-p Colliders
Authors:
Y. C. Acar,
U. Kaya,
B. B. Oner,
S. Sultansoy
Abstract:
Resonant production of color octet electron, e_{8}, at the FCC based ep colliders has been analyzed. It is shown that e-FCC will cover much a wider region of e_{8} masses compared to the LHC. Moreover, with highest electron beam energy, e_{8} search potential of the e-FCC exceeds that of FCC pp collider. If e_{8} is discovered earlier by the FCC pp collider, e-FCC will give opportunity to handle v…
▽ More
Resonant production of color octet electron, e_{8}, at the FCC based ep colliders has been analyzed. It is shown that e-FCC will cover much a wider region of e_{8} masses compared to the LHC. Moreover, with highest electron beam energy, e_{8} search potential of the e-FCC exceeds that of FCC pp collider. If e_{8} is discovered earlier by the FCC pp collider, e-FCC will give opportunity to handle very important additional information. For example, compositeness scale can be probed up to hundreds TeV region.
△ Less
Submitted 31 October, 2016; v1 submitted 25 May, 2016;
originally announced May 2016.
-
Main Parameters of LCxFCC Based Electron-Proton Colliders
Authors:
Y. C. Acar,
U. Kaya,
B. B. Oner,
S. Sultansoy
Abstract:
Multi-TeV center of mass energy ep colliders based on the Future Circular Collider (FCC) and linear colliders (LC) are proposed and corresponding luminosity values are estimated. Parameters of upgraded versions of the FCC are determined to optimize luminosity of electron-proton collisions kee** beam-beam effects in mind. It is shown that L_{ep}\sim10^{32}\,cm^{-2}s^{-1} can be achieved with mode…
▽ More
Multi-TeV center of mass energy ep colliders based on the Future Circular Collider (FCC) and linear colliders (LC) are proposed and corresponding luminosity values are estimated. Parameters of upgraded versions of the FCC are determined to optimize luminosity of electron-proton collisions kee** beam-beam effects in mind. It is shown that L_{ep}\sim10^{32}\,cm^{-2}s^{-1} can be achieved with moderate upgrade of the FCC parameters.
△ Less
Submitted 9 February, 2016;
originally announced February 2016.
-
Resonant production of leptogluons at the FCC based lepton-hadron colliders
Authors:
Y. C. Acar,
U. Kaya,
B. B. Oner,
S. Sultansoy
Abstract:
Resonant production of leptogluons at the FCC based ep and \mup colliders have been analyzed. It is shown that e-FCC and μ-FCC will cover much wider region of e_{8} and μ_{8} masses than the LHC. While leptogluons with appropriate masses (if exist) will be discovered earlier by the FCC pp collider, lepton-proton colliders will give opportunity to handle very important additional information. For e…
▽ More
Resonant production of leptogluons at the FCC based ep and \mup colliders have been analyzed. It is shown that e-FCC and μ-FCC will cover much wider region of e_{8} and μ_{8} masses than the LHC. While leptogluons with appropriate masses (if exist) will be discovered earlier by the FCC pp collider, lepton-proton colliders will give opportunity to handle very important additional information. For example, compositeness scale can be probed up to multi-hundred TeV region.
△ Less
Submitted 18 November, 2015;
originally announced November 2015.
-
FCC based ep and $μ$p colliders
Authors:
Y. C. Acar,
U. Kaya,
B. B. Oner,
S. Sultansoy
Abstract:
Construction of future electron-positron colliders (or dedicated electron linac) and muon colliders close to Future Circular Collider will give opportunity to utilize highest energy proton and nucleus beams for lepton-hadron and photon-hadron collisions. In this paper we estimate main parameters of the FCC based ep and μp colliders.
Construction of future electron-positron colliders (or dedicated electron linac) and muon colliders close to Future Circular Collider will give opportunity to utilize highest energy proton and nucleus beams for lepton-hadron and photon-hadron collisions. In this paper we estimate main parameters of the FCC based ep and μp colliders.
△ Less
Submitted 12 January, 2016; v1 submitted 28 October, 2015;
originally announced October 2015.
