{"id":"https://openalex.org/W4411522858","doi":"https://doi.org/10.1145/3728977","title":"Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management","display_name":"Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management","publication_year":2025,"publication_date":"2025-06-22","ids":{"openalex":"https://openalex.org/W4411522858","doi":"https://doi.org/10.1145/3728977"},"language":"en","primary_location":{"id":"doi:10.1145/3728977","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728977","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728977","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3728977","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5047814742","display_name":"Lyuye Zhang","orcid":"https://orcid.org/0000-0003-3087-9645"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Lyuye Zhang","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-3087-9645","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100636729","display_name":"Jiahui Wu","orcid":"https://orcid.org/0000-0001-6758-4635"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Jiahui Wu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-6758-4635","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100319564","display_name":"Chengwei Liu","orcid":"https://orcid.org/0000-0003-1175-2753"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Chengwei Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1175-2753","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100713124","display_name":"Kaixuan Li","orcid":"https://orcid.org/0000-0002-3517-353X"},"institutions":[{"id":"https://openalex.org/I66867065","display_name":"East China Normal University","ror":"https://ror.org/02n96ep67","country_code":"CN","type":"education","lineage":["https://openalex.org/I66867065"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaixuan Li","raw_affiliation_strings":["East China Normal University, Singapore, China"],"raw_orcid":"https://orcid.org/0000-0002-3517-353X","affiliations":[{"raw_affiliation_string":"East China Normal University, Singapore, China","institution_ids":["https://openalex.org/I66867065"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079228450","display_name":"Xiaoyu Sun","orcid":"https://orcid.org/0000-0001-7434-0452"},"institutions":[{"id":"https://openalex.org/I118347636","display_name":"Australian National University","ror":"https://ror.org/019wvm592","country_code":"AU","type":"education","lineage":["https://openalex.org/I118347636"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Xiaoyu Sun","raw_affiliation_strings":["Australian National University, Canberra, Australia"],"raw_orcid":"https://orcid.org/0000-0001-7434-0452","affiliations":[{"raw_affiliation_string":"Australian National University, Canberra, Australia","institution_ids":["https://openalex.org/I118347636"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082037581","display_name":"Lida Zhao","orcid":"https://orcid.org/0009-0005-9832-8948"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Lida Zhao","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0009-0005-9832-8948","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100329466","display_name":"Chong Wang","orcid":"https://orcid.org/0000-0003-1424-6290"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Chong Wang","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1424-6290","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7300-9215","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.7257,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":{"value":0.95771118,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":"2","issue":"ISSTA","first_page":"2273","last_page":"2295"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6694114208221436},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.5263639092445374},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.516825258731842},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.5045996904373169},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.47578561305999756},{"id":"https://openalex.org/keywords/open-source-software","display_name":"Open source software","score":0.4732820689678192},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.39623743295669556},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.3878997564315796},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.38395097851753235},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2970065772533417},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.29619818925857544},{"id":"https://openalex.org/keywords/psychological-resilience","display_name":"Psychological resilience","score":0.08120018243789673}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6694114208221436},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.5263639092445374},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.516825258731842},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.5045996904373169},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.47578561305999756},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.4732820689678192},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.39623743295669556},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3878997564315796},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.38395097851753235},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2970065772533417},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.29619818925857544},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.08120018243789673},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3728977","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728977","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728977","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/201459","is_oa":true,"landing_page_url":"https://hdl.handle.net/10356/201459","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":{"id":"doi:10.1145/3728977","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728977","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728977","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Partnerships for the goals","id":"https://metadata.un.org/sdg/17","score":0.4300000071525574}],"awards":[{"id":"https://openalex.org/G554618108","display_name":null,"funder_award_id":"NCRP25- P04-TAICeN","funder_id":"https://openalex.org/F4320320709","funder_display_name":"National Research Foundation Singapore"},{"id":"https://openalex.org/G7575291067","display_name":null,"funder_award_id":"RG96/23","funder_id":"https://openalex.org/F4320320751","funder_display_name":"Ministry of Education - Singapore"},{"id":"https://openalex.org/G8982717833","display_name":null,"funder_award_id":"AISG2-GC-2023-008","funder_id":"https://openalex.org/F4320320709","funder_display_name":"National Research Foundation Singapore"},{"id":"https://openalex.org/G948224718","display_name":null,"funder_award_id":"AISG2-GC-2023-008","funder_id":"https://openalex.org/F4320320671","funder_display_name":"National Research Foundation"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320320709","display_name":"National Research Foundation Singapore","ror":"https://ror.org/03cpyc314"},{"id":"https://openalex.org/F4320320751","display_name":"Ministry of Education - Singapore","ror":"https://ror.org/01kcva023"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4411522858.pdf","grobid_xml":"https://content.openalex.org/works/W4411522858.grobid-xml"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W2079317829","https://openalex.org/W2766411424","https://openalex.org/W2795338679","https://openalex.org/W2808052182","https://openalex.org/W2897809085","https://openalex.org/W2911282308","https://openalex.org/W2974695716","https://openalex.org/W3173121933","https://openalex.org/W4221145571","https://openalex.org/W4221164274","https://openalex.org/W4236479186","https://openalex.org/W4254882388","https://openalex.org/W4285490485","https://openalex.org/W4299522686","https://openalex.org/W4308469411","https://openalex.org/W4308641648","https://openalex.org/W4319459165","https://openalex.org/W4378760032","https://openalex.org/W4384345626","https://openalex.org/W4384345738","https://openalex.org/W4388502396","https://openalex.org/W4388694846","https://openalex.org/W4389159189","https://openalex.org/W4391558518","https://openalex.org/W4394769265","https://openalex.org/W4403918533"],"related_works":["https://openalex.org/W922414892","https://openalex.org/W2185499427","https://openalex.org/W2393340519","https://openalex.org/W4298219515","https://openalex.org/W4376877853","https://openalex.org/W2147569372","https://openalex.org/W2371301679","https://openalex.org/W4200107511","https://openalex.org/W1493891899","https://openalex.org/W2161453659"],"abstract_inverted_index":{"In":[0],"the":[1,58,69,91,126,134,181,193,222],"rapidly":[2],"evolving":[3],"landscape":[4],"of":[5,75,93,118,130,142,169,209,224],"software":[6,13],"development,":[7],"addressing":[8],"security":[9],"vulnerabilities":[10],"in":[11,57,82,98,203],"open-source":[12,59],"(OSS)":[14],"has":[15],"become":[16],"critically":[17],"important.":[18],"However,":[19,46],"existing":[20],"research":[21,179],"and":[22,27,39,50,73,101,105,128,146,150,165,192],"tools":[23],"from":[24,121],"both":[25],"academia":[26],"industry":[28],"mainly":[29],"relied":[30],"on":[31,90,158],"limited":[32],"solutions,":[33],"such":[34],"as":[35],"vulnerable":[36],"version":[37],"adjustment":[38],"adopting":[40],"patches,":[41],"to":[42,67,124],"handle":[43],"identified":[44],"vulnerabilities.":[45],"far":[47],"more":[48],"flexible":[49],"diverse":[51,77],"countermeasures":[52],"have":[53],"been":[54],"actively":[55],"adopted":[56],"communities.":[60],"A":[61],"holistic":[62],"empirical":[63,116],"study":[64,89,108],"is":[65],"needed":[66],"explore":[68],"prevalence,":[70],"distribution,":[71],"preferences,":[72],"effectiveness":[74,149],"these":[76],"strategies.":[78],"To":[79],"this":[80,83,110,178],"end,":[81],"paper,":[84],"we":[85],"conduct":[86],"a":[87,114,139,155,200],"comprehensive":[88,115],"taxonomy":[92,141],"vulnerability":[94,205],"remediation":[95,131],"tactics":[96,132],"(RT)":[97],"OSS":[99,135],"projects":[100],"investigate":[102],"their":[103,148,190],"pros":[104],"cons.":[106],"This":[107],"addresses":[109],"oversight":[111],"by":[112,174,188,220],"conducting":[113],"analysis":[117],"21,187":[119],"issues":[120],"GitHub,":[122],"aiming":[123],"understand":[125],"range":[127],"efficacy":[129],"within":[133],"community.":[136],"We":[137],"developed":[138],"hierarchical":[140],"44":[143],"distinct":[144],"RT":[145],"evaluated":[147],"costs.":[151],"Our":[152],"findings":[153],"highlight":[154],"significant":[156],"reliance":[157],"community-driven":[159],"strategies,":[160],"like":[161],"using":[162],"alternative":[163],"libraries":[164],"bypassing":[166],"vulnerabilities,":[167],"44%":[168],"which":[170],"are":[171],"currently":[172],"unsupported":[173],"cutting-edge":[175],"tools.":[176],"Additionally,":[177],"exposes":[180],"community\u2019s":[182],"preferences":[183],"for":[184,195],"certain":[185],"fixing":[186,212],"approaches":[187],"analyzing":[189],"acceptance":[191],"reasons":[194],"rejection.":[196],"It":[197],"also":[198],"underscores":[199],"critical":[201],"gap":[202,214],"modern":[204],"databases,":[206],"where":[207],"54%":[208],"CVEs":[210],"lack":[211],"suggestions\u2014a":[213],"that":[215],"can":[216],"be":[217],"significantly":[218],"mitigated":[219],"leveraging":[221],"93%":[223],"actionable":[225],"solutions":[226],"provided":[227],"through":[228],"GitHub":[229],"issues.":[230]},"counts_by_year":[{"year":2025,"cited_by_count":3}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}