Human factors that influence secure software development
summary
Retrospective analyses across four repositories find concrete predictors: unfocused contribution increases vulnerabilities (developers editing many files correlates with more publicly disclosed flaws), context switching and long hours raise static-analysis findings, and verbose commit comments predict weaker files. Team metrics show large effects—files with 7–15× more contributors and commits from nine+ authors are far more likely to harbor vulnerabilities; interactive churn is 5–11× higher in vulnerable files. Research produces tools and datasets (Code Pulse, Attack Surface Detector) and wins DARPA follow‑on funding.
AI-written summary · about
chapters (14)
- 0:00Intro
- 3:07Part 1 Human Factors
- 10:44What we found
- 16:53Time of day
- 19:17Environmental effects
- 25:39Work thus far
- 30:59Open floor plans
- 32:46Popups
- 33:55DevOps
- 34:15Motivation
- 35:45Bias
- 36:56Quality issues
- 40:27Commit comments
- 42:29Conclusion
related talks
43mDo Certain Types Of Developers Or Teams Write More Secure Code?
43mWhich Developers and Teams Are More Likely to Write Vulnerable Software?
45mExemplars, Laggards, & The Cautious: A Data-driven Look At High-velocity Software...
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
19mFlipping the script on application security
57mUsing developer-centric data to predict, prioritize, and improve App Security Outcomes
53mFlipping the Script on Application Security
15mAn Ethnographic Understanding of Software (In)Security and a Co-Creation Model