6 citations · 8 across the 8 of their papers we have counts for
8 papers
The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse
Ranindya Paramitha, Christian Kästner, Laurie Williams
Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, as…
The Rising Cost of Trust: Practitioners' Trust Signals, Controls, and Responses in the Software Supply Chain
Ranindya Paramitha, Siri Paidipalli, Laurie Williams +1
The software supply chain is becoming more complex, and AI is reshaping its threat landscape, e.g., raising concerns about the quality of AI-generated dependencies. Seen through th…
CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages
Imranur Rahman, Jill Marley, Ranindya Paramitha +1
Dependency resolution at a specified point in time in the past can provide insight into software evolution in software ecosystems and facilitate the design of dynamic metrics (e.g.…
Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches
Ranindya Paramitha, Yuan Feng, Fabio Massacci
Vulnerability datasets used for ML testing implicitly contain retrospective information. When tested on the field, one can only use the labels available at the time of training and…
Forecasting the risk of software choices: A model to foretell security vulnerabilities from library dependencies and source code evolution
Carlos E. Budde, Ranindya Paramitha, Fabio Massacci
Software security mainly studies vulnerability detection: is my code vulnerable today? This hinders risk estimation, so new approaches are emerging to forecast the occurrence of fu…
Cross-ecosystem categorization: A manual-curation protocol for the categorization of Java Maven libraries along Python PyPI Topics
Ranindya Paramitha, Yuan Feng, Fabio Massacci +1
Context: Software of different functional categories, such as text processing vs. networking, has different profiles in terms of metrics like security and updates. Using popularity…
How Quickly Do Development Teams Update Their Vulnerable Dependencies?
Imranur Rahman, Ranindya Paramitha, Nusrat Zahan +2
Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To a…
On the acceptance by code reviewers of candidate security patches suggested by Automated Program Repair tools
Aurora Papotti, Ranindya Paramitha, Fabio Massacci
Background: Testing and validation of the semantic correctness of patches provided by tools for Automated Program Repairs (APR) has received a lot of attention. Yet, the eventual a…