Context Matters: Qualitative Insights into Developers’ Approaches and Challenges with Software...
summary
Paper reports results from 16 semi-structured interviews with developers who use SCA and finds one clear claim: context matters — alerts are too generic, vulnerability impact and exploitability are often indeterminate, and deployment choices (CI gating vs manual scans) trade noise for automation. Participants cite tools like GitHub Dependabot and Black Duck, note large orgs build custom preprocessing tooling (it reduces noise but increases maintenance), and recommend combining SCA with SAST, reachability analysis, and infrastructure/context signals.
AI-written summary · about
chapters (8)
- 0:00Software composition analysis
- 2:36Why use SCA tools
- 9:20SCA tool challenges
- 17:55Deploying SCA tools
- 21:27Acting on SCA results
- 28:03Improving SCA with context
- 33:24Summary
- 35:35Q&A
related talks
16mContext Matters: Qualitative Insights into Developers' Approaches and...
28mWhy Developers Struggle with AppSec
27mDevelopers Struggle with Application Security (and How to Make ...)
57mQuantifiable Quality: The New Standard of Secure Code
40mDevSecOps Guide to Bulletproof Your Development Workflow
49mPragmatic Approaches To Building Secure Software
56mTune your Toolbox for Velocity and Value
37mDevSecOps Guide to Bulletproof Your Development Workflow