A Qualitative Investigation of Insecure Code Propagation from Online Forums

No ratings

Presented at IEEESecDev 2019 by

Michelle Mazurek

Wei Bai

Omer Akgul

Research demonstrates that code snippets listed onprogramming-oriented online forums (e.g., Stack Overflow) –including snippets containing security mistakes – make theirway into production code. Prior work also shows that softwaredevelopers who reference Stack Overflow in their developmentcycle produce less secure code. While there are many plausibleexplanations for why developers propagate insecure code in thismanner, there is little or no empirical evidence. To addressthis question, we identify Stack Overflow code snippets thatcontain security errors and find clones of these snippets inopen source GitHub repositories. We then survey (n=133) andinterview (n=15) the authors of these GitHub repositories toexplore how and why these errors were introduced. We findthat some developers (perhaps mistakenly) trust their securityskills to validate the code they import, but the majority admitthey would need to learn more about security before theycould properly perform such validation. Further, although someprioritize functionality over security, others believe that ensuringsecurity is not, or should not be, their responsibility. Our resultshave implications for attempts to ameliorate the propagation ofthis insecure code.