2021/07/28 by Roland Croft, Croft, Roland, Yongzheng Xie +7 · 1 citation
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Software Engineering (cs.SE) #Software Engineering Research #Software Engineering Techniques and Practices
paper · pdf · doi:10.48550/arxiv.2107.13723
openalex publication_date 2021/07/28 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
Given programming languages can provide different types and levels of\nsecurity support, it is critically important to consider security aspects while\nselecting programming languages for developing software systems. Inadequate\nconsideration of security in the choice of a programming language may lead to\npotential ramifications for secure development. Whilst theoretical analysis of\nthe supposed security properties of different programming languages has been\nconducted, there has been relatively little effort to empirically explore the\nactual security challenges experienced by developers. We have performed a\nlarge-scale study of the security challenges of 15 programming languages by\nquantitatively and qualitatively analysing the developers' discussions from\nStack Overflow and GitHub. By leveraging topic modelling, we have derived a\ntaxonomy of 18 major security challenges for 6 topic categories. We have also\nconducted comparative analysis to understand how the identified challenges vary\nregarding the different programming languages and data sources. Our findings\nsuggest that the challenges and their characteristics differ substantially for\ndifferent programming languages and data sources, i.e., Stack Overflow and\nGitHub. The findings provide evidence-based insights and understanding of\nsecurity challenges related to different programming languages to software\nprofessionals (i.e., practitioners or researchers). The reported taxonomy of\nsecurity challenges can assist both practitioners and researchers in better\nunderstanding and traversing the secure development landscape. This study\nhighlights the importance of the choice of technology, e.g., programming\nlanguage, in secure software engineering. Hence, the findings are expected to\nmotivate practitioners to consider the potential impact of the choice of\nprogramming languages on software security.\n