Reviewerly/exHarmony huggingface dataset:
Evaluation of Stakeholder Mapping and Personas for Sustainable Software Development

Sustainable software development is a major challenge in the software engineering industry. Software practitioners lack practical guidance or tools for integrating social sustainability in software development processes. This study proposes stakeholder mapping and the use of sustainability personas as a framework to guide software practitioners in making decisions that support socially sustainable software development. We will evaluate the effectiveness in a randomized controlled experiment with 104 final-year undergraduate computer science students who would select features to be included in the development of a software application. We aim to show how these interventions helps to improve software practitioners' perspective of social sustainability in software development.
Decentralizing Custodial Wallets with MFKDF

The average cryptocurrency user today faces a difficult choice between centralized custodial wallets, which are notoriously prone to spontaneous collapse, or cumbersome self-custody solutions, which if not managed properly can cause a total loss of funds. In this paper, we present a “best of both worlds” cryptocurrency wallet design that looks like, and inherits the user experience of, a centralized custodial solution, while in fact being entirely decentralized in design and implementation. In our design, private keys are not stored on any device, but are instead derived directly from a user's authentication factors, such as passwords, soft tokens (e.g., Google Authenticator), hard tokens (e.g., YubiKey), or out-of-band authentication (e.g., SMS). Public parameters (salts, one-time pads, etc.) needed to access the wallet can be safely stored in public view, such as on a public blockchain, thereby providing strong availability guarantees. Users can then simply “log in” to their decentralized wallet on any device using standard credentials and even recover from lost credentials, thereby providing the usability of a custodial wallet with the trust and security of a decentralized approach.
On ML-Based Program Translation: Perils and Promises

With the advent of new and advanced programming languages, it becomes imperative to migrate legacy software to new programming languages. Unsupervised Machine Learning-based Program Translation could play an essential role in such migration, even without a sufficiently sizeable reliable corpus of parallel source code. However, these translators are far from perfect due to their statistical nature. This work investigates unsupervised program translators and where and why they fail. With in-depth error analysis of such failures, we have identified that the cases where such translators fail follow a few particular patterns. With this insight, we develop a rule-based program mutation engine, which pre-processes the input code if the input follows specific patterns and post-process the output if the output follows certain patterns. We show that our code processing tool, in conjunction with the program translator, can form a hybrid program translator and significantly improve the state-of-the-art. In the future, we envision an end-to-end program translation tool where programming domain knowledge can be embedded into an ML-based translation pipeline using pre- and post-processing steps.
A Blockchain-Based Framework for Scalable and Trustless Delegation of Cyber Threat Intelligence

CTI sharing is increasingly used by organisations to strengthen security. The sensitivity of CTI has led to research on trust-based sharing, yet most existing CTI sharing approaches only support static trust-based decisions or centralised trust evaluation, limiting their scalability and lead to centralised risk. This paper proposes a blockchain-based CTI sharing framework that relies on trustless delegates for dynamic trust-based decision-making and decentralised trust evaluation. To facilitate trustless delegation, our proposal allows CTI producers to intentionally inject false data on a periodic basis into the system to audit the behaviour of delegates. Moreover, unlike existing approaches, delegates within our framework facilitate sharing of CTI directly with consumers such that scalable CTI sharing occurs. The results of a qualitative evaluation of the proposed framework's security show that it is resilient to common privacy and trust concerns. Moreover, a quantitative evaluation of a proof-of-concept prototype using Ethereum show that the proposed framework is scalable and cost-effective.
Enabling Analysis and Reasoning on Software Systems through Knowledge Graph Representation

This work presents a knowledge-representation-based approach for analysing software systems. Its main components are: a generic and extensible knowledge model, and a knowledge extractor tool that generates instance-level knowledge graphs from software repositories (currently Java). Our knowledge model can be used as a shared data-model in a software analysis pipeline. We illustrate the potential uses of our knowledge representation by performing experimental architecture recovery and identifying design pattern instance. We intend to use our ontology and extraction tool as a partial foundation for automated reasoning on software systems.
Farsighted Miners under Transaction Fee Mechanism EIP1559

We investigate the recent fee mechanism EIP1559 of the Ethereum network. Whereas previous studies have focused on myopic miners, we here focus on strategic miners in the sense of miners being able to reason about the future blocks. We derive expressions for optimal miner behavior (in terms of setting block sizes) in the case of 2-block foresight and varying degrees of hashing power. Results indicate that a sufficiently large mining pool will have enough hashing power to gain by strategic foresight. We further use a simulation study to examine the impact of both 2-block and 3-block foresight. In particular, the simulation study indicates that for realistic levels of hashing power, mining pools do not gain from being able to reason more than 2 blocks ahead. Moreover, even though the presence of strategic miners increase the variation in block sizes and potentially empty blocks, overall system throughput tend to increase slightly compared to myopic mining.
Examining Liquidity of Exchanges and Assets and the Impact of External Events in Centralized Crypto Markets: A 2022 Study

Most cryptocurrencies are bought and sold on centralized exchanges that manage supply and demand via an order book. Besides trading fees, the high liquidity of a market is the most relevant reason for choosing one exchange over the other. However, as the different liquidity measures rely on the order book, external events that cause people to sell or buy a cryptocurrency can significantly impact a market's liquidity. To investigate the effect of external events on liquidity, we measure various liquidity measures for nine different order books comprising three currency pairs across three exchanges covering the entire year 2022. The resulting multivariate time series is then analyzed using different correlations. From the results, we can infer that as a cryptocurrency's market capitalization and the exchange's trading volume increases, so does its liquidity. At the same time, only a moderate correlation of liquidity between exchanges can be observed. Furthermore, our statistical observations show that external events, particularly the events around FTX and the Terra Luna crash, caused significant changes in liquidity. However, depending on the exchange's size and the cryptocurrency's market cap, the liquidity took a shorter or longer time to recover.
Boosting Symbolic Execution for Heap-based Vulnerability Detection and Exploit Generation

Heap-based vulnerabilities such as buffer overflow and use after free are severe flaws in various software systems. Detecting heap-based vulnerabilities and demonstrating their severity via generating exploits for them are of critical importance. Existing symbolic execution-based approaches have shown their potential in the above tasks. However, they still have some fundamental limitations in path exploration, memory modeling, and environment modeling, which significantly impede existing symbolic execution engines from efficiently and effectively detecting and exploiting heap-based vulnerabilities. The objective of this thesis is to design and implement a boosted symbolic execution engine named HEAPX to facilitate the automatic detection and exploitation of heap-based vulnerabilities. Specifically, a new path exploration strategy, a new memory model, and a new environment modeling solution are expected to be designed in HEAPX, so that the new boosted symbolic execution engine can detect heap-based vulnerabilities and generate working exploits for them more efficiently and effectively.
LLD: A Low Latency Detection Solution to Thwart Cryptocurrency Pump &amp; Dumps

Pump and Dump schemes represent a threat to any market. While this issue has long been regulated in mature markets, in unregulated markets, such as crypto exchanges, this plague is very present, and even exacerbated by the low capitalizaton of many cryptocurrencies that represent the perfect target for such a fraudulent scheme. In this paper, we detail a Low Latency Detection solution (LLD) based on deep learning to automatically detect pump and dump activities on centralized cryptocurrency exchanges. We train a LSTM-based auto-encoder on BTC valuations, which can reliably be considered a proxy for regular trading-due to their larger capitalization. We use this auto-encoder to predict valuations on alt coins and use thresholding on a Gaussian tail condition to trigger detection. We argue that low latency detection is paramount for the practicality of such approaches. Unlike previous methods, our solution (LLD) detects the majority of pumps in less than five minutes (2.2 minutes on average) when using OHLCV data at one-minute resolution. In addition, we use social media data only to generate ground truths during testing. We show that in many cases a significant amount of the trade volume could have been saved had LLD been used to trigger trade suspension mechanisms. The idiosyncratic approach of our scheme, its sound rationale and viability, combined with the quality of achieved results-tested over an extensive experimental campaign-and the insights discussed in the paper also pave the way for further research in the field.
Model-Agnostic Syntactical Information for Pre-Trained Programming Language Models

Pre-trained Programming Language Models (PPLMs) achieved many recent states of the art results for many code-related software engineering tasks. Though some studies use data flow or propose tree-based models that utilize Abstract Syntax Tree (AST), most PPLMs do not fully utilize the rich syntactical information in source code. Still, the input is considered a sequence of tokens. There are two issues; the first is computational inefficiency due to the quadratic relationship between input length and attention complexity. Second, any syntactical information, when needed as an extra input to the current PPLMs, requires the model to be pre-trained from scratch, wasting all the computational resources already used for pre-training the current models. In this work, we propose Named Entity Recognition (NER) adapters, lightweight modules that can be inserted into Transformer blocks to learn type information extracted from the AST. These adapters can be used with current PPLMs such as CodeBERT, GraphCodeBERT, and CodeT5. We train the NER adapters using a novel Token Type Classification objective function (TTC). We insert our proposed work in CodeBERT, building CodeBERTER, and evaluate the performance on two tasks of code refinement and code summarization. CodeBERTER improves the accuracy of code refinement from 16.4 to 17.8 while using 20% of training parameter budget compared to the fully fine-tuning approach, and the BLEU score of code summarization from 14.75 to 15.90 while reducing 77% of training parameters compared to the fully fine-tuning approach.
Safe-DS: A Domain Specific Language to Make Data Science Safe

Due to the long runtime of Data Science (DS) pipelines, even small programming mistakes can be very costly, if they are not detected statically. However, even basic static type checking of DS pipelines is difficult because most are written in Python. Static typing is available in Python only via external linters. These require static type annotations for parameters or results of functions, which many DS libraries do not provide.In this paper, we show how the wealth of Python DS libraries can be used in a statically safe way via Safe-DS, a domain specific language (DSL) for DS. Safe-DS catches conventional type errors plus errors related to range restrictions, data manipulation, and call order of functions, going well beyond the abilities of current Python linters. Python libraries are integrated into Safe-DS via a stub language for specifying the interface of its declarations, and an API-Editor that is able to extract type information from the code and documentation of Python libraries, and automatically generate suitable stubs.Moreover, Safe-DS complements textual DS pipelines with a graphical representation that eases safe development by preventing syntax errors. The seamless synchronization of textual and graphic view lets developers always choose the one best suited for their skills and current task.We think that Safe-DS can make DS development easier, faster, and more reliable, significantly reducing development costs.
FlaPy: Mining Flaky Python Tests at Scale

Flaky tests obstruct software development, and studying and proposing mitigations against them has therefore become an important focus of software engineering research. To conduct sound investigations on test flakiness, it is crucial to have large, diverse, and unbiased datasets of flaky tests. A common method to build such datasets is by rerunning the test suites of selected projects multiple times and checking for tests that produce different outcomes. While using this technique on a single project is mostly straightforward, applying it to a large and diverse set of projects raises several implementation challenges such as (1) isolating the test executions, (2) supporting multiple build mechanisms, (3) achieving feasible run times on large datasets, and (4) analyzing and presenting the test outcomes. To address these challenges we introduce FlaPy, a framework for researchers to mine flaky tests in a given or automatically sampled set of Python projects by rerunning their test suites. FlaPy isolates the test executions using containerization and fresh execution environments to simulate real-world CI conditions and to achieve accurate results. By supporting multiple dependency installation strategies, it promotes diversity among the studied projects. FlaPy supports parallelizing the test executions using SLURM, making it feasible to scan thousands of projects for test flakiness. Finally, FlaPy analyzes the test outcomes to determine which tests are flaky and depicts the results in a concise table. A demo video of FlaPy is available at https://youtu.be/ejy-be-FvDY
SoK: Scalability Techniques for BFT Consensus

With the advancement of blockchain systems, many recent research works have proposed distributed ledger technology (DLT) that employs Byzantine fault-tolerant (BFT) consensus protocols to decide which block to append next to the ledger. Notably, BFT consensus can offer high performance, energy efficiency, and provable correctness properties, and it is thus considered a promising building block for creating highly resilient and performant blockchain infrastructures. Yet, a major ongoing challenge is to make BFT consensus applicable to large-scale environments. A large body of recent work addresses this challenge by developing novel ideas to improve the scalability of BFT consensus, thus opening the path for a new generation of BFT protocols tailored to the needs of blockchain. In this survey, we create a systematization of knowledge about the novel scalability-enhancing techniques that state-of-the-art BFT consensus protocols use. For our comparison, we closely analyze the efforts, assumptions, and trade-offs these protocols make.
Iterative Assessment and Improvement of DNN Operational Accuracy

Deep Neural Networks (DNN) are nowadays largely adopted in many application domains thanks to their human-like, or even superhuman, performance in specific tasks. However, due to unpredictable/unconsidered operating conditions, unexpected failures show up on field, making the performance of a DNN in operation very different from the one estimated prior to release.In the life cycle of DNN systems, the assessment of accuracy is typically addressed in two ways: offline, via sampling of operational inputs, or online, via pseudo-oracles. The former is considered more expensive due to the need for manual labeling of the sampled inputs. The latter is automatic but less accurate.We believe that emerging iterative industrial-strength life cycle models for Machine Learning systems, like MLOps, offer the possibility to leverage inputs observed in operation not only to provide faithful estimates of a DNN accuracy, but also to improve it through remodeling/retraining actions.We propose DAIC (DNN Assessment and Improvement Cycle), an approach which combines "low-cost" online pseudo-oracles and "high-cost" offline sampling techniques to estimate and improve the operational accuracy of a DNN in the iterations of its life cycle. Preliminary results show the benefits of combining the two approaches and integrating them in the DNN life cycle.
Zipline - A Fault-Proof Blocker Header Oracle

Zipline is a protocol for trustless relaying of sync committee attested block roots from an Ethereum beacon chain to the execution layer of another blockchain. These in turn can be used to prove transactions or state to support crosschain applications. Zipline's operation is similar to that of an optimistic rollup but rather than updating a blockchain state via transactions it updates a beacon chain light client state. Under normal operation Zipline is able to maintain an updated view of the beacon chain block roots with minimal execution. In the case of relayer fraud it borrows from state-of-the-art fault proving strategies to identify and revert fraudulent blocks under an honest minority assumption.
RIdiom: Automatically Refactoring Non-Idiomatic Python Code with Pythonic Idioms

Pythonic idioms are widely adopted in the Python community because of their advantages such as conciseness and performance. However, when Python programmers use pythonic idioms, they face many challenges such as being unaware of certain pythonic idioms or not knowing how to use them properly. Based on an analysis of 7,638 Python repositories on GitHub, we find that non-idiomatic Python code that can be refactored with pythonic idioms occurs frequently and widely. Unfortunately, there is no tool to automatically refactor such non-idiomatic code into idiomatic code. In this paper, we design and implement a tool called RIdiom to make Python code idiomatic with nine pythonic idioms. Python developers can not only refactor projects easily via a visual interface of the PyCharm plugin but also can refactor projects using the command line without relying on an integrated development environment. We test and review over 4,115 refactorings applied to 1,065 Python projects from GitHub, and submit 90 pull requests for the 90 randomly sampled refactorings to 84 projects. These evaluations confirm the high-accuracy, practicality and usefulness of our refactoring tool on real-world Python code. Demo Tool: https://github.com/idiomaticrefactoring/RIdiom Demo Video: https://youtu.be/KG-nXGR8DIA
Under the Bridge: Trolling and the Challenges of Recruiting Software Developers for Empirical Research Studies

Much of software engineering research focuses on tools, algorithms, and optimization of software. Recently, we, as a community, have come to acknowledge that there is a gap in meta-research and addressing the human-factors in software engineering research. Through meta research, we aim to deepen our understanding of online participant recruitment and human-subjects software engineering research. In this paper we motivate the need to consider the unique challenges that human studies pose in software engineering research. We present several challenges faced by our research team in several distinct research studies, how they affected research, and motivate how, as researchers, we can address these challenges. We present results from a pilot study and categorize issues faced into three broad categories including participant recruitment, community engagement, and data poisoning. We further discuss how we can address these challenges and outline the benefits a full-study could provide to the software engineering research community.
Can we Knapsack Software Defect Prediction? Nokia 5G Case

As software products become larger and more complex, the test infrastructure needed for quality assurance grows similarly, causing a constant increase in operational and maintenance costs. Although rising in popularity, most Artificial Intelligence (AI) and Machine Learning (ML) Software Defect Prediction (SDP) solutions address singular test phases. In contrast, the need to address the whole Software Development Life Cycle (SDLC) is rarely explored. Therefore in this paper, we define the problem of extending the SDP concept to the entire SDLC, as this may be one of the significant next steps for the field. Furthermore, we explore the similarity between the defined challenge and the widely known Multidimensional Knapsack Problem (MKP). We use Nokia's 5G wireless technology test process to illustrate the proposed concept. Resulting comparison validates the applicability of MKP to optimize the overall test cycle, which can be similarly relevant to any large-scale industrial software develonment process.
Improving Automatic C-to-Rust Translation with Static Analysis

While popular in system programming, C has been infamous for its poor language-level safety mechanisms, leading to critical bugs and vulnerabilities. C programs can still have memory and thread bugs despite passing type checking. To resolve this long-standing problem, Rust has been recently developed with rich safety mechanisms, including its notable ownership type system. It prevents memory and thread bugs via type checking. By rewriting legacy C programs in Rust, their developers can discover unknown bugs and avoid adding new bugs. However, the adaptation of Rust in legacy programs is still limited due to the high cost of manual C-to-Rust translation. Rust's safe features are semantically different from C's unsafe features and require programmers to precisely understand the behavior of their programs for correct rewriting. Existing C-to-Rust translators do not relieve this burden because they syntactically translate C features into unsafe Rust features, leaving further refactoring for programmers. In this paper, we propose the problem of improving the state-of-the-art C-to-Rust translation by automatically replacing unsafe features with safe features. Specifically, we identify two important unsafe features to be replaced: lock API and output parameters. We show our results on lock API and discuss plans for output parameters.