65 citations · 489 across the 70 of their papers we have counts for
70 papers
A Bird's-Eye View on Security Considerations in RFCs
Jukka Ruohonen, Qusai Ramadan
Request for comments (RFCs) are Internet standards, memorandums, and related technical documents about core Internet protocols made via and released by the Internet Engineering Tas…
A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System
Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari
The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries.…
Digital Sovereignty as a Quality Attribute for Software Architectures
Jukka Ruohonen, Justin Stark, Scott Wilkie +1
Digital sovereignty (DS) is an increasingly important concept and political agenda throughout the world, including in the European Union (EU). However, the concept is also regretta…
Empirical Derivations from an Evolving Test Suite
Jukka Ruohonen, Abhishek Tiwari
The paper presents a longitudinal empirical analysis of the automated, continuous, and virtualization-based software test suite of the NetBSD operating system. The longitudinal per…
Towards Systematic Specification and Verification of Fairness Requirements: A Position Paper
Qusai Ramadan, Jukka Ruohonen, Abhishek Tiwari +2
Decisions suggested by improperly designed software systems might be prone to discriminate against people based on protected characteristics, such as gender and ethnicity. Previous…
Vulnerability Patching Across Software Products and Software Components: A Case Study of Red Hat's Product Portfolio
Jukka Ruohonen, Sani Abdullahi, Abhishek Tiwari
Motivated by software maintenance and the more recent concept of security debt, the paper presents a time series analysis of vulnerability patching of Red Hat's products and compon…
A Rapid Review Regarding the Concept of Legal Requirements in Requirements Engineering
Jukka Ruohonen
Out of a personal puzzlement, recent peer review comments, and demonstrable confusion in the existing literature, the paper presents a rapid review of the concept of legal requirem…
Snaps: Bloated and Outdated?
Jukka Ruohonen, Qusai Ramadan
Snap is an alternative software packaging system developed by Canonical and provided by default in the Ubuntu Linux distribution. Given the heterogeneity of various Linux distribut…
An Alignment Between the CRA's Essential Requirements and the ATT&CK's Mitigations
Jukka Ruohonen, Eun-Young Kang, Qusai Ramadan
The paper presents an alignment evaluation between the mitigations present in the MITRE's ATT&CK framework and the essential cyber security requirements of the recently introduced…
Tracing Vulnerability Propagation Across Open Source Software Ecosystems
Jukka Ruohonen, Qusai Ramadan
The paper presents a traceability analysis of how over 84 thousand vulnerabilities have propagated across 28 open source software ecosystems. According to the results, the propagat…
A Time Series Analysis of Malware Uploads to Programming Language Ecosystems
Jukka Ruohonen, Mubashrah Saddiqa
Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a probl…
From Cyber Security Incident Management to Cyber Security Crisis Management in the European Union
Jukka Ruohonen, Kalle Rindell, Simone Busetti
Incident management is a classical topic in cyber security. Recently, the European Union (EU) has started to consider also the relation between cyber security incidents and cyber s…
A Scenario Analysis of Ethical Issues in Dark Patterns and Their Research
Jukka Ruohonen, Jani Koskinen, Søren Harnow Klausen +1
Context: Dark patterns are user interface or other software designs that deceive or manipulate users to do things they would not otherwise do. Even though dark patterns have been u…
A Mapping Analysis of Requirements Between the CRA and the GDPR
Jukka Ruohonen, Kalle Hjerppe, Eun-Young Kang
A new Cyber Resilience Act (CRA) was recently agreed upon in the European Union (EU). The paper examines and elaborates what new requirements the CRA entails by contrasting it with…
The Popularity Hypothesis in Software Security: A Large-Scale Replication with PHP Packages
Jukka Ruohonen, Qusai Ramadan
There has been a long-standing hypothesis that a software's popularity is related to its security or insecurity in both research and popular discourse. There are also a few empiric…
Early Perspectives on the Digital Europe Programme
Jukka Ruohonen, Paul Timmers
A new Digital Europe Programme (DEP), a funding instrument for development and innovation, was established in the European Union (EU) in 2021. The paper makes an empirical inquiry…
On Algorithmic Fairness and the EU Regulations
Jukka Ruohonen
The short paper discusses algorithmic fairness by focusing on non-discrimination and a few important laws in the European Union (EU). In addition to the EU laws addressing discrimi…
A Time Series Analysis of Assertions in the Linux Kernel
Jukka Ruohonen
Assertions are a classical and typical software development technique. These are extensively used also in operating systems and their kernels, including the Linux kernel. The paper…
SoK: The Design Paradigm of Safe and Secure Defaults
Jukka Ruohonen
In security engineering, including software security engineering, there is a well-known design paradigm telling to prefer safe and secure defaults. The paper presents a systematiza…
A Systematic Literature Review on the NIS2 Directive
Jukka Ruohonen
The second network and information security (NIS2) directive was enacted in the European Union (EU) in late 2022. It deals particularly with European critical infrastructures, enla…
Vulnerability Coordination Under the Cyber Resilience Act
Jukka Ruohonen, Paul Timmers
The Cyber Resilience Act (CRA) of the European Union (EU) imposes many new cyber security requirements practically to all network-enabled information technology products, whether h…
An Overview of Cyber Security Funding for Open Source Software
Jukka Ruohonen, Gaurav Choudhary, Adam Alami
Many open source software (OSS) projects need more human resources for maintenance, improvements, and sometimes even their survival. These needs allegedly apply even to vital OSS p…
Fast Fixes and Faulty Drivers: An Empirical Analysis of Regression Bug Fixing Times in the Linux Kernel
Jukka Ruohonen, Adam Alami
Regression bugs refer to situations in which something that worked previously no longer works currently. Such bugs have been pronounced in the Linux kernel. The paper focuses on re…
An Empirical Study of Vulnerability Handling Times in CPython
Jukka Ruohonen
The paper examines the handling times of software vulnerabilities in CPython, the reference implementation and interpreter for the today's likely most popular programming language,…