Differences

This shows you the differences between two versions of the page.

--- vulnerability_discovery_models [2025/01/27 23:15] – fabio.massacci@unitn.it
+++ vulnerability_discovery_models [2025/01/28 00:47] (current) – fabio.massacci@unitn.it
@@ Line 17: / Line 17: @@
 Vulnerable dependencies are a known problem in today’s open-source software ecosystems because FOSS libraries are highly interconnected and developers do not always update their dependencies.
+You may want to read first a thematic analysis study ({{:research_activities:vulnerability-analysis:ccs-2020-aam.pdf|Accepted in CCS}}) in which we interviewed 25 developers all over the world provide some important insight in the choice of company to update or not update the software.
 In {{:research_activities:vulnerability-analysis:pashchenko-vuln4real.pdf |TSE 2020 Paper}} we show how to avoid the over-inflation problem of academic and industrial approaches for reporting vulnerable dependencies in FOSS software, and therefore, satisfy the needs of industrial practice for correct allocation of development and audit resources.