Do Certain Types Of Developers Or Teams Write More Secure Code?
summary
Research claims: static analyzers individually find about ~14% of known vulnerabilities per tool and require aggregation; retrospective and concurrent studies use static findings, CVEs, timecards and instrumented environments; repositories show files with nine or more developers: Linux 16× Chromium 68× Apache 117× increased vulnerability likelihood; metrics like unfocused contribution and interactive churn correlate with more findings; late‑night commits and excessive hours track higher bug/security defect rates; DARPA-funded work studies proprietary code and direct human-factor measures.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:23Anita Damico
- 1:16Outline
- 2:01Software Vulnerability
- 2:25How long does it take to discover software vulnerabilities
- 3:26Static application security testing tools
- 4:19Human factors
- 6:44Software engineering
- 7:02Research methods
- 9:18DARPA
- 9:51Retrospective
- 11:19Timecards
- 11:59Concurrent Analysis
- 13:54The Question
- 14:12Predictors
- 14:37Dramatic Pause
- 14:49Colocation vs Distributed Teams
- 16:42Human Circadian Rhythm
- 19:10Unfocused Contribution
- 21:00Number Of Developers
- 23:52The bystander effect
- 24:28Not all research agrees
- 25:31Developer experience
- 26:16Minor contributors
- 26:57Day job
- 28:23Interactive churn
- 30:58Lessons from other domains
- 31:30Fatigue
- 32:43Death
- 34:05Culture
- 35:47Conclusion
related talks
43mHuman factors that influence secure software development
43mWhich Developers and Teams Are More Likely to Write Vulnerable Software?
14mThe State of Open Source Vulnerabilities Management in 2019
53mFlipping the Script on Application Security
05mWhy Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools
19mFlipping the script on application security
45mBringing Security Testing To Development: How To Enable Developers To Act As Security Experts
59mTeam of 30 million: Reducing Software Vulnerability at a Global Scale