Write, Read, or Fix? Exploring Alternative Methods for Secure Development Studies
summary
Remote study with 112 Python programmers compares three methods—write, read, fix—on two short encryption tasks using assigned libraries and a browser-based platform built by Joe Lewis. Write (35 participants) reveals statistically significant security differences between the two crypto APIs and documentation-driven mistakes; read (37) finds more diverse and even eight out‑of‑scope vulnerabilities; fix (40) focuses on passing tests so 31 of 40 stop after the provided tests and miss key bugs. Read and fix cut time, frustration, and dropouts.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:14Code writing challenges
- 3:00Code review as alternative
- 3:42Write read fix methods
- 5:05Study design
- 6:27Participant flow
- 7:32Data analysis
- 8:36Study results
- 12:09Read fix advantages
- 12:30Conclusion
related talks
05mCode Reviewing as Methodology for Online Security Studies with Developers - A Case
43mDo Certain Types Of Developers Or Teams Write More Secure Code?
47mFootguns and factorisation: how to make users of your cryptographic library successful
15mAn Ethnographic Understanding of Software (In)Security and a Co-Creation Model
43mHuman factors that influence secure software development
20mSecurity Initiatives in Community Driven Projects: Looking Ahead with Python and Rust
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
30mTopics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ...