Search

GitHub provides developers with a practical way to distribute source code and collaboratively work on common projects. To enhance account security and privacy, GitHub allows its users to manage access permissions, review audit logs, and enable two-factor authentication. However, despite the endless effort, the platform still faces various issues related to the privacy of its users. This paper presents an empirical study delving into the GitHub ecosystem. Our focus is on investigating the utilization of privacy settings on the platform and identifying various types of sensitive information disclosed by users. Leveraging a dataset comprising 6,132 developers, we report and analyze their activities by means of comments on pull requests. Our findings indicate an active engagement by users with the available privacy settings on GitHub. Notably, we observe the disclosure of different forms of private information within pull request comments. This observation has prompted our exploration into sensitivity detection using a large language model and BERT, to pave the way for a personalized privacy assistant. Our work provides insights into the utilization of existing privacy protection tools, such as privacy settings, along with their inherent limitations. Essentially, we aim to advance research in this field by providing both the motivation for creating such privacy protection tools and a proposed methodology for personalizing them., Comment: The paper has been peer-reviewed and accepted for publication with the Empirical Software Engineering journal (https://link.springer.com/journal/10664)

In the GitHub ecosystem, workflows are used as an effective means to automate development tasks and to set up a Continuous Integration and Delivery (CI/CD pipeline). GitHub Actions (GHA) have been conceived to provide developers with a practical tool to create and maintain workflows, avoiding reinventing the wheel and cluttering the workflow with shell commands. Properly leveraging the power of GitHub Actions can facilitate the development processes, enhance collaboration, and significantly impact project outcomes. To expose actions to search engines, GitHub allows developers to assign them to one or more categories manually. These are used as an effective means to group actions sharing similar functionality. Nevertheless, while providing a practical way to execute workflows, many actions have unclear purposes, and sometimes they are not categorized. In this work, we bridge such a gap by conceptualizing Gavel, a practical solution to increasing the visibility of actions in GitHub. By leveraging the content of README.MD files for each action, we use Transformer--a deep learning algorithm--to assign suitable categories to the action. We conducted an empirical investigation and compared Gavel with a state-of-the-art baseline. The experimental results show that our proposed approach can assign categories to GitHub actions effectively, thus outperforming the state-of-the-art baseline., Comment: The paper has been peer-reviewed and accepted for publication in the Proceedings of the 18th International Symposium on Empirical Software Engineering and Measurement (ESEM 2024)

Software engineering (SE) activities have been revolutionized by the advent of pre-trained models (PTMs), defined as large machine learning (ML) models that can be fine-tuned to perform specific SE tasks. However, users with limited expertise may need help to select the appropriate model for their current task. To tackle the issue, the Hugging Face (HF) platform simplifies the use of PTMs by collecting, storing, and curating several models. Nevertheless, the platform currently lacks a comprehensive categorization of PTMs designed specifically for SE, i.e., the existing tags are more suited to generic ML categories. This paper introduces an approach to address this gap by enabling the automatic classification of PTMs for SE tasks. First, we utilize a public dump of HF to extract PTMs information, including model documentation and associated tags. Then, we employ a semi-automated method to identify SE tasks and their corresponding PTMs from existing literature. The approach involves creating an initial mapping between HF tags and specific SE tasks, using a similarity-based strategy to identify PTMs with relevant tags. The evaluation shows that model cards are informative enough to classify PTMs considering the pipeline tag. Moreover, we provide a mapping between SE tasks and stored PTMs by relying on model names., Comment: Accepted at The International Conference on Evaluation and Assessment in Software Engineering (EASE), 2024 edition

Persistent homology (PH) is a powerful mathematical method to automatically extract relevant insights from images, such as those obtained by high-resolution imaging devices like electron microscopes or new-generation telescopes. However, the application of this method comes at a very high computational cost, that is bound to explode more because new imaging devices generate an ever-growing amount of data. In this paper we present PixHomology, a novel algorithm for efficiently computing $0$-dimensional PH on 2D images, optimizing memory and processing time. By leveraging the Apache Spark framework, we also present a distributed version of our algorithm with several optimized variants, able to concurrently process large batches of astronomical images. Finally, we present the results of an experimental analysis showing that our algorithm and its distributed version are efficient in terms of required memory, execution time, and scalability, consistently outperforming existing state-of-the-art PH computation tools when used to process large datasets.

We introduce a theory of relative tangency for projective algebraic varieties. The dual variety $X_Z^\vee$ of a variety $X$ relative to a subvariety $Z$ is the set of hyperplanes tangent to $X$ at a point of $Z$. We also introduce the concept of polar classes of $X$ relative to $Z$. We explore the duality of varieties of low rank matrices relative to special linear sections. In this framework, we study the critical points of the Euclidean Distance function from a data point to $X$, lying on $Z$. The locus where the number of such conditional critical points is positive is called the ED data locus of $X$ given $Z$. The generic number of such critical points defines the conditional ED degree of $X$ given $Z$. We show the irreducibility of ED data loci, and we compute their dimensions and degrees in terms of relative characteristic classes., Comment: 40 pages, 4 figures

IoT systems complexity and susceptibility to failures pose significant challenges in ensuring their reliable operation Failures can be internally generated or caused by external factors impacting both the systems correctness and its surrounding environment To investigate these complexities various modeling approaches have been proposed to raise the level of abstraction facilitating automation and analysis FailureLogic Analysis FLA is a technique that helps predict potential failure scenarios by defining how a components failure logic behaves and spreads throughout the system However manually specifying FLA rules can be arduous and errorprone leading to incomplete or inaccurate specifications In this paper we propose adopting testing methodologies to improve the completeness and correctness of these rules How failures may propagate within an IoT system can be observed by systematically injecting failures while running test cases to collect evidence useful to add complete and refine FLA rules

While specifying an IoT-based system, software developers have to face a set of challenges, spanning from selecting the hardware components to writing the actual source code. Even though dedicated development environments are in place, a nonexpert user might struggle with the over-choice problem in selecting the proper component. By combining MDE and recommender systems, this paper proposes an initial prototype, called ResyDuo, to assist Arduino developers by providing two different artifacts, i. e. , hardware components and software libraries. In particular, we make use of a widely adopted collaborative filtering algorithm by collecting relevant information by means of a dedicated data model. ResyDuo can retrieve hardware components by using tags or existing Arduino projects stored on the ProjectHub repository. Then, the system can eventually retrieve corresponding software libraries based on the identified hardware devices. ResyDuo is equipped with a web-based interface that allows users to easily select and configure the under-developing Arduino project. To assess ResyDuos performances, we run the ten-fold crossvalidation by adopting the grid search strategy to optimize the hyperparameters of the CF-based algorithm. The conducted evaluation shows encouraging results even though there is still room for improvement in terms of the examined metrics.

Since its launch in November 2022, ChatGPT has gained popularity among users, especially programmers who use it as a tool to solve development problems. However, while offering a practical solution to programming problems, ChatGPT should be mainly used as a supporting tool (e.g., in software education) rather than as a replacement for the human being. Thus, detecting automatically generated source code by ChatGPT is necessary, and tools for identifying AI-generated content may need to be adapted to work effectively with source code. This paper presents an empirical study to investigate the feasibility of automated identification of AI-generated code snippets, and the factors that influence this ability. To this end, we propose a novel approach called GPTSniffer, which builds on top of CodeBERT to detect source code written by AI. The results show that GPTSniffer can accurately classify whether code is human-written or AI-generated, and outperforms two baselines, GPTZero and OpenAI Text Classifier. Also, the study shows how similar training data or a classification context with paired snippets helps to boost classification performances.

The Consumer Financial Protection Bureau defines the notion of payoff amount as the amount that has to be payed at a particular time in order to completely pay off the debt, in case the lender intends to pay off the loan early, way before the last installment is due (CFPB 2020). This amount is well-understood for loans at compound interest, but much less so when simple interest is used. Recently, Aretusi and Mari (2018) have proposed a formula for the payoff amount for loans at simple interest. We assume that the payoff amounts are established contractually at time zero, whence the requirement that no arbitrage may arise this way The first goal of this paper is to study this new formula and derive it within a model of a loan market in which loans are bought and sold at simple interest, interest rates change over time, and no arbitrage opportunities exist. The second goal is to show that this formula exhibits a behaviour rather different from the one which occurs when compound interest is used. Indeed, we show that, if the installments are constant and if the interest rate is greater than a critical value (which depends on the number of installments), then the sequence of the payoff amounts is increasing before a certain critical time, and will start decreasing only thereafter. We also show that the critical value is decreasing as a function of the number of installments. For two installments, the critical value is equal to the golden section. The third goal is to introduce a more efficient polynomial notation, which encodes a basic tenet of the subject: Each amount of money is embedded in a time position (to wit: The time when it is due). The model of a loan market we propose is naturally linked to this new notation.

Recommender systems for software engineering (RSSEs) assist software engineers in dealing with a growing information overload when discerning alternative development solutions. While RSSEs are becoming more and more effective in suggesting handy recommendations, they tend to suffer from popularity bias, i.e., favoring items that are relevant mainly because several developers are using them. While this rewards artifacts that are likely more reliable and well-documented, it would also mean that missing artifacts are rarely used because they are very specific or more recent. This paper studies popularity bias in Third-Party Library (TPL) RSSEs. First, we investigate whether state-of-the-art research in RSSEs has already tackled the issue of popularity bias. Then, we quantitatively assess four existing TPL RSSEs, exploring their capability to deal with the recommendation of popular items. Finally, we propose a mechanism to defuse popularity bias in the recommendation list. The empirical study reveals that the issue of dealing with popularity in TPL RSSEs has not received adequate attention from the software engineering community. Among the surveyed work, only one starts investigating the issue, albeit getting a low prediction performance., Comment: 13 pages, To be appeared in the 20th Mining Software Repository Proceedings

Over the years, Software Quality Engineering has increased interest, demonstrated by significant research papers published in this area. Determining when a software artifact is qualitatively valid is tricky, given the impossibility of providing an objective definition valid for any perspective, context, or stakeholder. Many quality model solutions have been proposed that reference specific quality attributes in this context. However, these approaches do not consider the context in which the artifacts will operate and the stakeholder's perspective who evaluate its validity. Furthermore, these solutions suffer from the limitations of being artifact-specific and not extensible. In this paper, we provide a generic and extensible mechanism that makes it possible to aggregate and prioritize quality attributes. The user, taking into account his perspective and the context in which the software artifact will operate, is guided in defining all the criteria for his quality model. The management of these criteria is then facilitated through Multi-Criteria Decision Making (MCDM). In addition, we present the PRETTEF model, a concrete instance of the proposed approach for assessing and selecting MVC frameworks., Comment: 8 pages -- 3rd International Workshop on Model-Driven Engineering for Software Architecture (MDE4SA 2023)

We introduce numerical algebraic geometry methods for computing lower bounds on the reach, local feature size, and the weak feature size of the real part of an equidimensional and smooth algebraic variety using the variety's defining polynomials as input. For the weak feature size, we also show that non-quadratic complete intersections generically have finitely many geometric bottlenecks, and describe how to compute the weak feature size directly rather than a lower bound in this case. In all other cases, we describe additional computations that can be used to determine feature size values rather than lower bounds. We also present homology inference experiments that combine persistent homology computations with implemented versions of our feature size algorithms, both with globally dense samples and samples that are adaptively dense with respect to the local feature size.

We explore the maximum likelihood degree of a homogeneous polynomial $F$ on a projective variety $X$, $\mathrm{MLD}_F(X)$, which generalizes the concept of Gaussian maximum likelihood degree. We show that $\mathrm{MLD}_F(X)$ is equal to the count of critical points of a rational function on $X$, and give different geometric characterizations of it via topological Euler characteristic, dual varieties, and Chern classes., Comment: 25 pages, 1 figure. Final revised version. The main results were extended to the non-smooth case. To appear in SIAM Journal on Applied Algebra and Geometry

We have conducted a NanoSIMS-based search for presolar material in samples recently returned from C-type asteroid Ryugu as part of JAXA's Hayabusa2 mission. We report the detection of all major presolar grain types with O- and C-anomalous isotopic compositions typically identified in carbonaceous chondrite meteorites: 1 silicate, 1 oxide, 1 O-anomalous supernova grain of ambiguous phase, 38 SiC, and 16 carbonaceous grains. At least two of the carbonaceous grains are presolar graphites, whereas several grains with moderate C isotopic anomalies are probably organics. The presolar silicate was located in a clast with a less altered lithology than the typical extensively aqueously altered Ryugu matrix. The matrix-normalized presolar grain abundances in Ryugu are 4.8$^{+4.7}_{-2.6}$ ppm for O-anomalous grains, 25$^{+6}_{-5}$ ppm for SiC grains and 11$^{+5}_{-3}$ ppm for carbonaceous grains. Ryugu is isotopically and petrologically similar to carbonaceous Ivuna-type (CI) chondrites. To compare the in situ presolar grain abundances of Ryugu with CI chondrites, we also mapped Ivuna and Orgueil samples and found a total of SiC grains and 6 carbonaceous grains. No O-anomalous grains were detected. The matrix-normalized presolar grain abundances in the CI chondrites are similar to those in Ryugu: 23 $^{+7}_{-6}$ ppm SiC and 9.0$^{+5.3}_{-4.6}$ ppm carbonaceous grains. Thus, our results provide further evidence in support of the Ryugu-CI connection. They also reveal intriguing hints of small-scale heterogeneities in the Ryugu samples, such as locally distinct degrees of alteration that allowed the preservation of delicate presolar material., Comment: 12 pages, 3 figures, 2 tables. Published in ApJL

GitHub is the world's largest host of source code, with more than 150M repositories. However, most of these repositories are not labeled or inadequately so, making it harder for users to find relevant projects. There have been various proposals for software application domain classification over the past years. However, these approaches lack a well-defined taxonomy that is hierarchical, grounded in a knowledge base, and free of irrelevant terms. This work proposes GitRanking, a framework for creating a classification ranked into discrete levels based on how general or specific their meaning is. We collected 121K topics from GitHub and considered $60\%$ of the most frequent ones for the ranking. GitRanking 1) uses active sampling to ensure a minimal number of required annotations; and 2) links each topic to Wikidata, reducing ambiguities and improving the reusability of the taxonomy. Our results show that developers, when annotating their projects, avoid using terms with a high degree of specificity. This makes the finding and discovery of their projects more challenging for other users. Furthermore, we show that GitRanking can effectively rank terms according to their general or specific meaning. This ranking would be an essential asset for developers to build upon, allowing them to complement their annotations with more precise topics. Finally, we show that GitRanking is a dynamically extensible method: it can currently accept further terms to be ranked with a minimum number of annotations ($\sim$ 15). This paper is the first collective attempt to build a ground-up taxonomy of software domains., Comment: 11 pages, 6 figures, 3 tables

Model Driven Engineering (MDE) has been widely applied in software development, aiming to facilitate the coordination among various stakeholders. Such a methodology allows for a more efficient and effective development process. Nevertheless, modeling is a strenuous activity that requires proper knowledge of components, attributes, and logic to reach the level of abstraction required by the application domain. In particular, metamodels play an important role in several paradigms, and specifying wrong entities or attributes in metamodels can negatively impact on the quality of the produced artifacts as well as other elements of the whole process. During the metamodeling phase, modelers can benefit from assistance to avoid mistakes, e.g., getting recommendations like meta-classes and structural features relevant to the metamodel being defined. However, suitable machinery is needed to mine data from repositories of existing modeling artifacts and compute recommendations. In this work, we propose MemoRec, a novel approach that makes use of a collaborative filtering strategy to recommend valuable entities related to the metamodel under construction. Our approach can provide suggestions related to both metaclasses and structured features that should be added in the metamodel under definition. We assess the quality of the work with respect to different metrics, i.e., success rate, precision, and recall. The results demonstrate that MemoRec is capable of suggesting relevant items given a partial metamodel and supporting modelers in their task., Comment: Accepted for publication at the International Journal on Software and Systems Modeling (SoSyM)