{"id":"https://openalex.org/W3156556445","doi":"https://doi.org/10.1145/3463274.3463331","title":"A Large-scale Study of Security Vulnerability Support on Developer Q&A Websites","display_name":"A Large-scale Study of Security Vulnerability Support on Developer Q&A Websites","publication_year":2021,"publication_date":"2021-06-18","ids":{"openalex":"https://openalex.org/W3156556445","doi":"https://doi.org/10.1145/3463274.3463331","mag":"3156556445"},"language":"en","primary_location":{"id":"doi:10.1145/3463274.3463331","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3463274.3463331","pdf_url":null,"source":{"id":"https://openalex.org/S4306418396","display_name":"Evaluation and Assessment in Software Engineering","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2008.04176","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Triet Huynh Minh Le","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Triet Huynh Minh Le","raw_affiliation_strings":["The University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Roland Croft","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Roland Croft","raw_affiliation_strings":["The University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":null,"display_name":"David Hin","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"David Hin","raw_affiliation_strings":["The University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"last","author":{"id":null,"display_name":"Muhammad Ali Babar","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Muhammad Ali Babar","raw_affiliation_strings":["The University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I5681781"],"apc_list":null,"apc_paid":null,"fwci":4.3474,"has_fulltext":false,"cited_by_count":20,"citation_normalized_percentile":{"value":0.95485837,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"109","last_page":"118"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5464000105857849,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5464000105857849,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13274","display_name":"Expert finding and Q&A systems","score":0.0982000008225441,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.07609999924898148,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.538100004196167},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.46709999442100525},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.45339998602867126},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.42660000920295715},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.37459999322891235},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.3467000126838684},{"id":"https://openalex.org/keywords/web-application-security","display_name":"Web application security","score":0.33739998936653137},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.3208000063896179},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.3061999976634979}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6218000054359436},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.538100004196167},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.46709999442100525},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46380001306533813},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.45339998602867126},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.43059998750686646},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.42660000920295715},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.37459999322891235},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.3467000126838684},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.34310001134872437},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3393999934196472},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.33739998936653137},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3292999863624573},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3208000063896179},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3061999976634979},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C2779955035","wikidata":"https://www.wikidata.org/wiki/Q4686785","display_name":"Advice (programming)","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.28690001368522644},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C3018587665","wikidata":"https://www.wikidata.org/wiki/Q7268696","display_name":"Qualitative analysis","level":3,"score":0.27469998598098755},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.27090001106262207},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C3019144022","wikidata":"https://www.wikidata.org/wiki/Q4124998","display_name":"Questions and answers","level":2,"score":0.2558000087738037},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.25119999051094055},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.25040000677108765}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3463274.3463331","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3463274.3463331","pdf_url":null,"source":{"id":"https://openalex.org/S4306418396","display_name":"Evaluation and Assessment in Software Engineering","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2008.04176","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2008.04176","pdf_url":"https://arxiv.org/pdf/2008.04176","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2008.04176","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2008.04176","pdf_url":"https://arxiv.org/pdf/2008.04176","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1971733255","https://openalex.org/W1972978214","https://openalex.org/W1987421874","https://openalex.org/W2025440555","https://openalex.org/W2038043464","https://openalex.org/W2056894403","https://openalex.org/W2093400716","https://openalex.org/W2104577574","https://openalex.org/W2123246351","https://openalex.org/W2492212292","https://openalex.org/W2511548333","https://openalex.org/W2748690817","https://openalex.org/W2759023773","https://openalex.org/W2767521898","https://openalex.org/W2781981343","https://openalex.org/W2895297154","https://openalex.org/W2925197115","https://openalex.org/W2938063707","https://openalex.org/W2953482317","https://openalex.org/W2954574984","https://openalex.org/W2955552127","https://openalex.org/W2962771808","https://openalex.org/W2980390258","https://openalex.org/W2981018312","https://openalex.org/W3009517030","https://openalex.org/W3018447383","https://openalex.org/W3023116132","https://openalex.org/W3091658513","https://openalex.org/W3100925971","https://openalex.org/W3141872514","https://openalex.org/W3163607216","https://openalex.org/W4288079617"],"related_works":[],"abstract_inverted_index":{"Context:":[0],"Developers":[1],"usually":[2,194],"seek":[3],"solutions":[4,104],"to":[5,38,58,99,105,150,181,209],"addressing":[6],"Security":[7,77,138],"Vulnerabilities":[8],"(SVs)":[9],"on":[10,27,217],"developer":[11],"Question":[12],"and":[13,43,76,86,123,134,190,198,207,213],"Answer":[14],"(Q&A)":[15],"websites.":[16],"However,":[17],"there":[18],"is":[19],"still":[20,165],"little":[21],"known":[22],"about":[23],"these":[24,45],"SV-specific":[25],"discussions":[26,42,46,146],"different":[28],"Q&A":[29,51,70,218],"sites.":[30,52,219],"Objective:":[31],"We":[32,54,80,93,109,141],"present":[33],"a":[34,96],"large-scale":[35],"empirical":[36],"study":[37],"understand":[39],"developers\u2019":[40],"SV":[41,65,113,145,159,182,215],"how":[44],"are":[47],"being":[48],"supported":[49],"by":[50],"Method:":[53],"use":[55],"topic":[56],"modeling":[57],"uncover":[59],"the":[60,83,101,121],"topics":[61,117,160],"of":[62,88,103,178],"71,329":[63],"curated":[64],"posts":[66],"from":[67,170],"two":[68],"large":[69],"sites,":[71],"namely":[72],"Stack":[73],"Overflow":[74],"(SO)":[75],"StackExchange":[78],"(SSE).":[79],"then":[81],"analyze":[82],"popularity,":[84],"difficulty,":[85],"level":[87],"expertise":[89],"for":[90,205],"each":[91],"topic.":[92],"also":[94,142],"perform":[95],"qualitative":[97],"analysis":[98],"identify":[100,110,174],"types":[102,177],"SV-related":[106],"questions.":[107],"Results:":[108],"13":[111],"main":[112],"discussion":[114],"topics.":[115],"Many":[116],"do":[118],"not":[119],"follow":[120],"distributions":[122],"trends":[124],"in":[125,184],"expert-based":[126],"security":[127],"sources,":[128],"e.g.,":[129],"Common":[130],"Weakness":[131],"Enumeration":[132],"(CWE)":[133],"Open":[135],"Web":[136],"Application":[137],"Project":[139],"(OWASP).":[140],"discover":[143],"that":[144],"attract":[147],"more":[148],"experts":[149],"answer":[151],"than":[152],"many":[153],"other":[154],"domains,":[155],"but":[156],"some":[157],"difficult":[158],"(e.g.,":[161],"Vulnerability":[162],"Scanning":[163],"Tools)":[164],"receive":[166],"quite":[167],"limited":[168],"support":[169,204],"experts.":[171],"Moreover,":[172],"we":[173],"seven":[175],"key":[176],"answers":[179],"given":[180],"questions,":[183],"which":[185],"SO":[186],"often":[187],"provides":[188],"code":[189],"instructions,":[191],"while":[192],"SSE":[193],"gives":[195],"experience-based":[196],"advice":[197],"explanations.":[199],"Conclusion:":[200],"Our":[201],"findings":[202],"provide":[203],"researchers":[206],"practitioners":[208],"effectively":[210],"acquire,":[211],"share":[212],"leverage":[214],"knowledge":[216]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":5}],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2021-04-26T00:00:00"}