{"id":"https://openalex.org/W4380568740","doi":"https://doi.org/10.1145/3593434.3593481","title":"Are security commit messages informative? Not enough!","display_name":"Are security commit messages informative? Not enough!","publication_year":2023,"publication_date":"2023-05-30","ids":{"openalex":"https://openalex.org/W4380568740","doi":"https://doi.org/10.1145/3593434.3593481"},"language":"en","primary_location":{"id":"doi:10.1145/3593434.3593481","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3593434.3593481","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3593434.3593481","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 27th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3593434.3593481","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5045058755","display_name":"Sofia Reis","orcid":"https://orcid.org/0000-0002-5690-2279"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I4387152517","display_name":"Instituto Superior T\u00e9cnico","ror":"https://ror.org/03db2by73","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103","https://openalex.org/I4387152517"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Sofia Reis","raw_affiliation_strings":["Instituto Superior T\u00e9cnico, U. Lisbon, Portugal and INESC-ID, Portugal"],"raw_orcid":"https://orcid.org/0000-0002-5690-2279","affiliations":[{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, U. Lisbon, Portugal and INESC-ID, Portugal","institution_ids":["https://openalex.org/I121345201","https://openalex.org/I4387152517"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030785658","display_name":"Rui Abreu","orcid":"https://orcid.org/0000-0003-3734-3157"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Rui Abreu","raw_affiliation_strings":["Faculty of Engineering of the University of Porto, Portugal and INESC-ID, Portugal"],"raw_orcid":"https://orcid.org/0000-0003-3734-3157","affiliations":[{"raw_affiliation_string":"Faculty of Engineering of the University of Porto, Portugal and INESC-ID, Portugal","institution_ids":["https://openalex.org/I121345201","https://openalex.org/I182534213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053134485","display_name":"Corina S. P\u0103s\u0103reanu","orcid":"https://orcid.org/0000-0002-5579-6961"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Corina Pasareanu","raw_affiliation_strings":["Carnegie Mellon University, USA"],"raw_orcid":"https://orcid.org/0000-0002-5579-6961","affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, USA","institution_ids":["https://openalex.org/I74973139"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"196","last_page":"199"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/commit","display_name":"Commit","score":0.8655695915222168},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7737740278244019},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.768039345741272},{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.6238008737564087},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5423830151557922},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.49928808212280273},{"id":"https://openalex.org/keywords/reputation","display_name":"Reputation","score":0.47694292664527893},{"id":"https://openalex.org/keywords/security-bug","display_name":"Security bug","score":0.43816742300987244},{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.4163534939289093},{"id":"https://openalex.org/keywords/security-through-obscurity","display_name":"Security through obscurity","score":0.41135311126708984},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.39384186267852783},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.3504387438297272},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.33060944080352783},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.31687605381011963},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.27439314126968384},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.07911381125450134}],"concepts":[{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.8655695915222168},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7737740278244019},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.768039345741272},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.6238008737564087},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5423830151557922},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.49928808212280273},{"id":"https://openalex.org/C48798503","wikidata":"https://www.wikidata.org/wiki/Q877546","display_name":"Reputation","level":2,"score":0.47694292664527893},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.43816742300987244},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.4163534939289093},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.41135311126708984},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.39384186267852783},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.3504387438297272},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.33060944080352783},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.31687605381011963},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.27439314126968384},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.07911381125450134},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3593434.3593481","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3593434.3593481","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3593434.3593481","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 27th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3593434.3593481","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3593434.3593481","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3593434.3593481","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 27th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4380568740.pdf","grobid_xml":"https://content.openalex.org/works/W4380568740.grobid-xml"},"referenced_works_count":6,"referenced_works":["https://openalex.org/W2620593348","https://openalex.org/W2785373701","https://openalex.org/W2963321189","https://openalex.org/W4210493608","https://openalex.org/W4220877452","https://openalex.org/W4312856222"],"related_works":["https://openalex.org/W3189065608","https://openalex.org/W2097628364","https://openalex.org/W2395987867","https://openalex.org/W2120086576","https://openalex.org/W2293678011","https://openalex.org/W2032098076","https://openalex.org/W3208699506","https://openalex.org/W1561562093","https://openalex.org/W2164920192","https://openalex.org/W2293554594"],"abstract_inverted_index":{"The":[0],"fast":[1],"distribution":[2],"and":[3,78,94,111,122,145,208],"deployment":[4],"of":[5,42,47,107,149,196],"security":[6,50,59,100,135,142,163,188,210,223],"patches":[7],"are":[8,144],"important":[9],"to":[10,64,74,103,114,141,172,192,205],"protect":[11],"users":[12],"against":[13],"cyberattacks.":[14],"These":[15],"fixes":[16,88],"can":[17,89,151],"be":[18,193],"detected":[19],"automatically":[20],"by":[21],"patch":[22,70,110,124,157],"management":[23,125],"triage":[24,158,177],"systems.":[25,159],"However,":[26,81],"previous":[27],"work":[28],"has":[29],"shown":[30],"that":[31,162,187],"automating":[32],"the":[33,58,99,105,119,174,180,197,222],"task":[34],"is":[35],"not":[36,82,168],"easy,":[37],"in":[38,49,57,98,118,155,165,221],"some":[39],"cases,":[40],"because":[41],"poor":[43],"documentation":[44,85],"or":[45],"lack":[46],"information":[48,150],"fixes.":[51],"For":[52],"many":[53],"years,":[54],"standard":[55,219],"practices":[56,204],"community":[60,101,121],"have":[61],"steered":[62],"engineers":[63],"provide":[65,169],"cryptic":[66],"commit":[67,136,189,211],"messages":[68,137,139,190,198,212],"(i.e.,":[69,138],"software":[71],"vulnerabilities":[72],"silently)":[73],"avoid":[75],"potential":[76],"attacks":[77],"reputation":[79],"damage.":[80],"providing":[83],"enough":[84,170],"on":[86],"vulnerability":[87],"hinder":[90],"trust":[91,117],"between":[92],"vendors":[93],"users.":[95],"Current":[96],"efforts":[97],"aim":[102],"increase":[104],"level":[106],"transparency":[108],"during":[109],"disclosing":[112],"times":[113],"help":[115],"build":[116],"development":[120],"make":[123],"processes":[126],"faster.":[127],"In":[128,183],"this":[129],"paper,":[130],"we":[131],"evaluate":[132],"how":[133,146],"informative":[134,207],"attached":[140],"fixes)":[143],"different":[147,153],"levels":[148],"affect":[152],"tasks":[154],"automated":[156,176],"We":[160],"observed":[161],"engineers,":[164],"general,":[166],"do":[167],"detail":[171],"enable":[173],"three":[175],"systems":[178],"at":[179],"same":[181],"time.":[182],"addition,":[184],"results":[185],"show":[186],"need":[191],"more":[194],"informative\u201456.7%":[195],"analyzed":[199],"were":[200],"documented":[201],"poorly.":[202],"Best":[203],"write":[206],"well-structured":[209],"(such":[213],"as":[214],"SECOM)":[215],"should":[216],"become":[217],"a":[218],"practice":[220],"community.":[224]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}