國立虎尾科技大學 |

Toward Secure Use of Open Source Dependencies.

Record Type:	Language materials, manuscript : Monograph/item
Title/Author:	Toward Secure Use of Open Source Dependencies./
Author:	Imtiaz, Nasif.
Description:	1 online resource (177 pages)
Notes:	Source: Dissertations Abstracts International, Volume: 85-05, Section: B.
Contained By:	Dissertations Abstracts International85-05B.
Subject:	Web studies. -
Online resource:	click for full text (PQDT)
ISBN:	9798380711999

Toward Secure Use of Open Source Dependencies.
Imtiaz, Nasif.

Toward Secure Use of Open Source Dependencies. - 1 online resource (177 pages)

Source: Dissertations Abstracts International, Volume: 85-05, Section: B.

Thesis (Ph.D.)--North Carolina State University, 2023.

Includes bibliographical references

Modern software extensively uses open source packages as upstream dependencies. While using the open source may be free, the downstream client projects must ensure their dependencies are secure. The goal of this dissertation is to aid software engineers in securely using open source dependencies.Managing open source security can be broadly characterized into two fronts: (a) reactive: when a vulnerability is discovered in a dependency, the clients should react to any potential threat; and (b) proactive: before pulling in new dependency code, the clients should make an informed decision about the security of the code. We work on both reactive and proactive open source security in this dissertation.On the reactivefront, we performed a comparative study of nine existing software composition analysis (SCA) tools that notify a client of dependency vulnerabilities. We find that the tools vary in their vulnerability reporting. The count of reported vulnerable dependencies ranges from 17 to 332 for Maven and 32 to 239 for npm projects across the studied tools. Similarly, the count of unique known vulnerabilities reported by the tools ranges from 36 to 313 for Maven and 45 to 234 for npm projects. Our manual analysis of the tools' results suggests that the accuracy of the vulnerability database is a key differentiator for SCA tools.Next, we empirically investigated 4,812 security releases from packages across seven ecosystems. Specifically, we studied (1) the time lag between fix and release; (2) how security fixes are documented in the release notes; (3) code change characteristics (size and semantic versioning) of the release; and (4) the time lag between the release and an advisory publication. We find a time lag between security fixes within open source packages and corresponding advisory publications, resulting in delayed notifications from SCA tools. The notification delay may occur even though we find the packages to typically document the security fixes in their release notes (61.5% of the time). Based on our findings, we recommend open source packages follow a standardized practice in announcing security fixes that can help automate the notification process to client projects.On the proactivefront, we work on building trust in dependency updates by identifying the authors and reviewers behind the changes within these updates. We implemented Depdive, an update audit tool for packages in Crates.io, npm, PyPI, and RubyGems registries.Depdive first (i) identifies the files and code changes that cannot be traced back to the package's source repository, i.e., phantom artifacts, and then (ii) measures what portion of changes in the update has passed through a code review process, i.e., code review coverage. We empirically evaluated Depdive over the most downloaded packages from the four registries. We find that phantom artifacts are not uncommon in the updates (20.1% of the analyzed updates had at least one phantom file). Further, we find only 11.0% of the updates to be fully code-reviewed, showing that even the most used packages introduce non-reviewed code in the software supply chain.Finally, we studied if a social network-based centrality rating for the authors and reviewers of package code can help client project developers review upstream changes.

Electronic reproduction.
Ann Arbor, Mich. :
ProQuest,
2024

Mode of access: World Wide Web

ISBN: 9798380711999Subjects--Topical Terms:

1148502
Web studies.
Index Terms--Genre/Form:

554714
Electronic books.

Toward Secure Use of Open Source Dependencies.
LDR:04522ntm a22003377 4500 001 1142999
005 20240513061042.5
006 m o d
007 cr mn ---uuuuu
008 250605s2023 xx obm 000 0 eng d
020 $a 9798380711999
035 $a (MiAaPQ)AAI30673762
035 $a (MiAaPQ)NCState_Univ18402041135
035 $a AAI30673762
040 $a MiAaPQ $b eng $c MiAaPQ $d NTU
100 1 $a Imtiaz, Nasif. $3 1467553
245 1 0 $a Toward Secure Use of Open Source Dependencies.
264 0 $c 2023
300 $a 1 online resource (177 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 85-05, Section: B.
500 $a Advisor: Williams, Laurie.
502 $a Thesis (Ph.D.)--North Carolina State University, 2023.
504 $a Includes bibliographical references
520 $a Modern software extensively uses open source packages as upstream dependencies. While using the open source may be free, the downstream client projects must ensure their dependencies are secure. The goal of this dissertation is to aid software engineers in securely using open source dependencies.Managing open source security can be broadly characterized into two fronts: (a) reactive: when a vulnerability is discovered in a dependency, the clients should react to any potential threat; and (b) proactive: before pulling in new dependency code, the clients should make an informed decision about the security of the code. We work on both reactive and proactive open source security in this dissertation.On the reactivefront, we performed a comparative study of nine existing software composition analysis (SCA) tools that notify a client of dependency vulnerabilities. We find that the tools vary in their vulnerability reporting. The count of reported vulnerable dependencies ranges from 17 to 332 for Maven and 32 to 239 for npm projects across the studied tools. Similarly, the count of unique known vulnerabilities reported by the tools ranges from 36 to 313 for Maven and 45 to 234 for npm projects. Our manual analysis of the tools' results suggests that the accuracy of the vulnerability database is a key differentiator for SCA tools.Next, we empirically investigated 4,812 security releases from packages across seven ecosystems. Specifically, we studied (1) the time lag between fix and release; (2) how security fixes are documented in the release notes; (3) code change characteristics (size and semantic versioning) of the release; and (4) the time lag between the release and an advisory publication. We find a time lag between security fixes within open source packages and corresponding advisory publications, resulting in delayed notifications from SCA tools. The notification delay may occur even though we find the packages to typically document the security fixes in their release notes (61.5% of the time). Based on our findings, we recommend open source packages follow a standardized practice in announcing security fixes that can help automate the notification process to client projects.On the proactivefront, we work on building trust in dependency updates by identifying the authors and reviewers behind the changes within these updates. We implemented Depdive, an update audit tool for packages in Crates.io, npm, PyPI, and RubyGems registries.Depdive first (i) identifies the files and code changes that cannot be traced back to the package's source repository, i.e., phantom artifacts, and then (ii) measures what portion of changes in the update has passed through a code review process, i.e., code review coverage. We empirically evaluated Depdive over the most downloaded packages from the four registries. We find that phantom artifacts are not uncommon in the updates (20.1% of the analyzed updates had at least one phantom file). Further, we find only 11.0% of the updates to be fully code-reviewed, showing that even the most used packages introduce non-reviewed code in the software supply chain.Finally, we studied if a social network-based centrality rating for the authors and reviewers of package code can help client project developers review upstream changes.
533 $a Electronic reproduction. $b Ann Arbor, Mich. : $c ProQuest, $d 2024
538 $a Mode of access: World Wide Web
650 4 $a Web studies. $3 1148502
655 7 $a Electronic books. $2 local $3 554714
690 $a 0646
690 $a 0796
710 2 $a ProQuest Information and Learning Co. $3 1178819
710 2 $a North Carolina State University. $3 845424
773 0 $t Dissertations Abstracts International $g 85-05B.
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=30673762 $z click for full text (PQDT)