Code Review Research Articles

Review of historical plumbing codes for lead service line inventories in the United States

ABSTRACT Inventorying and replacing lead service lines (LSLs) is a national priority in the United States (US), with records review conducted as a first step. Among other records, historical plumbing codes can provide cutoff dates for LSL allowance in the US. This work identified and reviewed historical national plumbing codes for mention of lead for drinking water pipe and found that lead pipe was permissible for service lines by the Basic Plumbing Code until 1978, the Uniform Plumbing Code until 1988, and the Southern Standard Plumbing Code until 1977/78. Overall, identifying pertinent code titles over time and obtaining them was challenging because those records were not readily available. Once obtained, interpreting the code language also proved challenging. Terminology initially reflected sanitary systems before drinking water systems were incorporated, and code editions through the years reorganized the content and specific mentions of lead in service lines within text. This review focused on model plumbing codes, which are then adopted at the state or local level, typically with modifications that also need to be understood. Two practical examples of service line inventory development were also summarized. These examples highlighted placing different emphasis on plumbing code review.

Comparison of Claudin-4, BerEP4, Carcinoembryonic Antigen and MOC31 in Serous Fluids Metastases Demonstrate High Sensitivity of Claudin-4 at Low Cellularity.

Claudin-4 has been described as a highly sensitive immunocytochemical marker for detection of metastatic carcinoma cells in effusion cytology specimens. This study aims to challenge the performance of claudin-4 in different types of malignancies and low cellularity specimens, by comparison with other markers in a large cohort of carcinomatous effusion specimens. Cell block preparations from peritoneal and pleural fluid specimens were retrieved, with malignant (carcinoma) diagnoses confirmed by review of hospital diagnosis code and pathology reports. Claudin-4, BerEP4, CEA, and MOC31 immunocytochemistry were performed and scored by expression proportion and intensity. Tumor cellularity was assessed for subgroup analysis of low cellularity specimens. Totally 147 specimens (70 pleural, 77 peritoneal) of 68 lung, 62 breast, 9 gynecological, and 7 gastrointestinal carcinomas were retrieved. The average proportion expression of claudin-4 was highest (89.6%, vs. CEA 40.5%, BerEp4 18.6%, MOC31 16.8%) and the percentage of strong expression was highest for claudin-4 (72.1%). Expression levels of claudin-4 were consistently higher than other markers in subgroups of all primary sites. The difference was more significant for low cellularity specimens. High (≥50%) proportion expression was seen for 96.61% of cases for claudin-4 (vs. BerEp4 8.77%, CEA 46.55%, MOC31 8.77%, p < 0.001). These factors contributed to a low concordance between claudin-4 and BerEp4, CEA and MOC31 (K = 0.010-0.043). Claudin-4 is more sensitive than CEA, BerEp4 and MOC31, suitable for low cellularity specimens of most types of metastatic carcinoma and is a robust immunocytochemical marker for carcinoma that can be used solitarily.

Don’t forget to change these functions! recommending co-changed functions in modern code review

Context:Code review is effective and widely used, yet still time-consuming. Especially, in large-scale software systems, developers may forget to change other related functions that must be changed together (aka. co-changes). This may increase the number of review iterations and reviewing time, thus delaying the code review process. Based on our analysis of 66 projects from five open-source systems, we find that there are 16%–33% of code reviews where at least one function must be co-changed, but was not initially changed. Objectives:This study aims to propose an approach to recommend co-changed functions in the context of modern code review, which could reduce reviewing time and iterations and help developers identify functions that need to be changed together. Methods:We propose CoChangeFinder, a novel method that employs a Graph Neural Network (GNN) to recommend co-changed functions for newly submitted code changes. Then, we conduct a quantitative and qualitative evaluation of CoChangeFinder with 66 studied large-scale open-source software projects. Results:Our evaluation results show that our CoChangeFinder outperforms the state-of-the-art approach, achieving 3.44% to 40.45% for top-k accuracy, 2.00% to 26.07% for Recall@k, and 0.04 to 0.21 for mean average precision better than the baseline approach. In addition, our CoChangeFinder demonstrates the capacity to pinpoint the functions related to logic changes. Conclusion:Our CoChangeFinder outperforms the baseline approach (i.e., TARMAQ) in recommending co-changed functions during the code review process. Based on our findings, CoChangeFinder could help developers save their time and effort, reduce review iterations, and enhance the efficiency of the code review process.

On the acceptance by code reviewers of candidate security patches suggested by Automated Program Repair tools

ObjectiveWe investigated whether (possibly wrong) security patches suggested by Automated Program Repairs (APR) for real world projects are recognized by human reviewers. We also investigated whether knowing that a patch was produced by an allegedly specialized tool does change the decision of human reviewers.MethodWe perform an experiment with n=72\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$n= 72$$\\end{document} Master students in Computer Science. In the first phase, using a balanced design, we propose to human reviewers a combination of patches proposed by APR tools for different vulnerabilities and ask reviewers to adopt or reject the proposed patches. In the second phase, we tell participants that some of the proposed patches were generated by security-specialized tools (even if the tool was actually a ‘normal’ APR tool) and measure whether the human reviewers would change their decision to adopt or reject a patch.ResultsIt is easier to identify wrong patches than correct patches, and correct patches are not confused with partially correct patches. Also patches from APR Security tools are adopted more often than patches suggested by generic APR tools but there is not enough evidence to verify if ‘bogus’ security claims are distinguishable from ‘true security’ claims. Finally, the number of switches to the patches suggested by security tool is significantly higher after the security information is revealed irrespective of correctness.LimitationsThe experiment was conducted in an academic setting, and focused on a limited sample of popular APR tools and popular vulnerability types.

MULTICR: Predicting Merged and Abandoned Code Changes in Modern Code Review Using Multi-Objective Search

Modern Code Review (MCR) is an essential process in software development to ensure high-quality code. However, developers often spend considerable time reviewing code changes before being merged into the main code base. Previous studies attempted to predict whether a code change was going to be merged or abandoned soon after it was submitted to improve the code review process. However, these approaches require complex cost-sensitive learning, which makes their adoption challenging since it is difficult for developers to understand the main factors behind the models’ predictions. To address this issue, we introduce in this paper, MULTICR, a multi-objective search-based approach that uses Multi-Objective Genetic Programming (MOGP) to learn early code review prediction models as IF-THEN rules. MULTICR evolves predictive models while maximizing the accuracy of both merged and abandoned classes, eliminating the need for misclassification cost estimation. To evaluate MULTICR, we conducted an empirical study on 146,612 code reviews from Eclipse, LibreOffice, and Gerrithub. The obtained results show that MULTICR outperforms existing baselines in terms of Mathew correlation coefficient (MCC) and F1 scores while learning less complex models compared to decision trees. Our experiments showed also how MULTICR allows identifying the main factors related to abandoned code reviews as well as their associated thresholds, making it a promising approach for early code review prediction with notable performance and interoperability. Additionally, we qualitatively evaluate MULTICR by conducting a user study through semi-structured interviews involving 10 practitioners from different organizations. The obtained results indicate that 90% of the participants find that MULTICR is useful and can help them to improve the code review process. Additionally, the learned IF-THEN rules of MULTICR are transparent.

EvaluateXAI: A framework to evaluate the reliability and consistency of rule-based XAI techniques for software analytics tasks

The advancement of machine learning (ML) models has led to the development of ML-based approaches to improve numerous software engineering tasks in software maintenance and evolution. Nevertheless, research indicates that despite their potential successes, ML models may not be employed in real-world scenarios because they often remain a black box to practitioners, lacking explainability in their reasoning. Recently, various rule-based model-agnostic Explainable AI (XAI) techniques, such as PyExplainer and LIME, have been employed to explain the predictions of ML models in software analytics tasks. In this paper, we assess the ability of these techniques, particularly the state-of-the-art PyExplainer and LIME, to generate reliable and consistent explanations for ML models across various software analytics tasks, including Just-in-Time (JIT) defect prediction, clone detection, and the classification of useful code review comments. Our manual investigations find inconsistencies and anomalies in the explanations generated by these techniques. Therefore, we design a novel framework: Evaluation of Explainable AI (EvaluateXAI), along with granular-level evaluation metrics, to automatically assess the effectiveness of rule-based XAI techniques in generating reliable and consistent explanations for ML models in software analytics tasks. After conducting in-depth experiments involving seven state-of-the-art ML models trained on five datasets and six evaluation metrics, we find that none of the evaluation metrics reached 100%, indicating the unreliability of the explanations generated by XAI techniques. Additionally, PyExplainer and LIME failed to provide consistent explanations for 86.11% and 77.78% of the experimental combinations, respectively. Therefore, our experimental findings emphasize the necessity for further research in XAI to produce reliable and consistent explanations for ML models in software analytics tasks.

Debunking the Myths of Code Velocity: The Elusive Search for Speed

We demonstrate that no empirical evidence supports long-held beliefs related to code velocity. The best-known pragmatic way to increase code velocity is to periodically nudge engineers to unblock the code review process. The industry needs to revisit the Modern Code Review process in light of the availability of various tools and techniques that analyze and prevalidate the proposed code changes. The code review bots are coming.

Effective Teaching through Code Reviews: Patterns and Anti-patterns

Effective Teaching through Code Reviews: Patterns and Anti-patterns

Rethinking AI code generation: a one-shot correction approach based on user feedback

Code generation has become an integral feature of modern IDEs, gathering significant attention. Notable approaches like GitHub Copilot and TabNine have been proposed to tackle this task. However, these tools may shift code writing tasks towards code reviewing, which involves modification from users. Despite the advantages of user feedback, their responses remain transient and lack persistence across interaction sessions. This is attributed to the inherent characteristics of generative AI models, which require explicit re-training for new data integration. Additionally, the non-deterministic and unpredictable nature of AI-powered models limits thorough examination of their unforeseen behaviors. We propose a methodology named One-shot Correction to mitigate these issues in natural language to code translation models with no additional re-training. We utilize decomposition techniques to break down code translation into sub-problems. The final code is constructed using code snippets of each query chunk, extracted from user feedback or selectively generated from a generative model. Our evaluation indicates comparable or improved performance compared to other models. Moreover, the methodology offers straightforward and interpretable approaches, which enable in-depth examination of unexpected results and facilitate insights for potential enhancements. We also illustrate that user feedback can substantially improve code translation models without re-training. Ultimately, we develop a preliminary GUI application to demonstrate the utility of our methodology in simplifying customization and assessment of suggested code for users.

Improving the Learning of Code Review Successive Tasks with Cross-Task Knowledge Distillation

Improving the Learning of Code Review Successive Tasks with Cross-Task Knowledge Distillation

Coding Review: Preparticipation Physical Evaluations

Coding Review: Preparticipation Physical Evaluations

Distilling Quality Enhancing Comments From Code Reviews to Underpin Reviewer Recommendation

Distilling Quality Enhancing Comments From Code Reviews to Underpin Reviewer Recommendation

Method level static source code analysis on behavioral change impact analysis in software regression testing

Though a myriad of changes take place in a software system during maintenance, behavioral changes carry the bulk of the reasons of software modifications. In assessing the impact of the changes made in software, static source code analysis plays a key role. However, static source code analysis can be a little complex depending on the reason for the expedition. Despite the work done so far, little focus has been made on the potential of changed methods analysis during static source code analysis in assessing the impact of the changes made in a software system. We propose and investigate a static source code analysis technique that would generate information on the modified methods in the source code. This study analyzes four aThough a myriad of changes take place in a software system during maintenance, behavioral changes carry the bulk of the reasons for software modifications. In assessing the impact of the changes made in the software, static source code analysis can be a little complex depending on the reason for the expedition. Despite the works done so far, little focus has been directed on the potential of changed methods during static source code analysis, in assessing the impact of the changes made in software. This study investigates a method-level static source code analysis technique that would generate information on the methods affected by changes made in the software. The work analyzed three Java projects. The results indicate an improvement in leveraging on the knowledge of edited methods in change impact assessment during regression testing. The approach enhances code review efforts in light of assessing operational behavior impacted by the changes made.Java projects and shows that an analysis of the changed methods reveals the level of regression testing that ought to be conducted for the changes made.

지하공간에서 건설 공사를 위한 법제 고찰

The necessity for construction projects in underground spaces is gradually increasing. Currently, since there is no special law governing underground spaces, the Civil Code is applied. However, the Civil Code does not present a legal concept for underground spaces or deep strata. Therefore, there has been ongoing debate on whether the effect of land ownership under the Civil Code is recognized or excluded in deep strata. The “Deep Strata Act (Draft)” proposed in September 2020 mainly stipulates that when constructing or managing transportation facilities in deep strata, it is permissible to use the deep strata underground, and in such cases, compensation for the land as prescribed by the “Land Compensation Act” is not required, nor is it necessary to establish a separate superficies under the Civil Code. This premise implies that ownership rights do not extend below the boundary depth. However, simply limiting private ownership rights for public projects could lead to essential infringements on property rights, which necessitates considering the relationship between ownership and superficies under the Civil Code, as well as compensation for losses, when enacting special laws. Particularly, unlike the Japanese Civil Code, Article 212 of the Korean Civil Code includes an abstract provision of “legitimate interest,” making it difficult to adopt the Japanese Deep Strata Act as is. Under the current legal system, construction projects in deep strata require individual assessments of the scope of ownership, as well as the establishment of separate superficies and compensation for losses. Nevertheless, for the efficiency of construction projects in deep strata, it is believed that not only the enactment of special laws but also a legal review of the Civil Code and other legal principles is necessary.

An Overview of Git

Git is a distributed version control system used in software development that tracks modifications made to source code. Git, as opposed to centralized version control systems, enables several developers to collaborate independently on a single project by letting them maintain separate local repositories that are synchronized with a remote repository. Repositories, which hold the project's files and change history, are essential to Git's operation. A commit in a repository is a snapshot of the project at that specific point in time; each commit is distinguished by a distinct hash and is accompanied by an explanation message. Branches allow developers to work independently on various features or fixes. While other branches are used for development, the stable code is usually found in the main branch, also known as main (formerly master). Rebasing and merging are two ways that changes from branches can be merged into the main branch, each with a distinct function for preserving project history. A local copy of a repository is created by cloning it, and local changes are synchronized with a remote repository through pushing and pulling. The staging area serves as a buffer where modifications are made prior to commit. To manage and review these changes, use commands like `git add`, `git commit`, `git status`, and `git log`. Submodules, cherry-pick, and Git hooks are examples of advanced features that provide more customization and control. Well-known Git hosting services, such as GitHub, GitLab, and Bitbucket, offer platforms for code review, repository management, and tool integration, which promote collaborative development. Gaining proficiency with Git greatly improves development processes by facilitating effective teamwork and code management.

Generative Ai in Software Development : an Overview and Evaluation of Modern Coding Tools

Generative AI has significantly transformed software development by leveraging advanced machine learning models to automate coding tasks, generate code, and enhance productivity. This paper provides an overview and evaluation of modern AI-powered coding tools, including GitHub Copilot, OpenAI Codex, DeepCode, Amazon CodeGuru, TabNine, Kite, and IntelliCode, which use large language models (LLMs) to offer real-time code suggestions, automated error detection, and intelligent code completions. Despite their benefits, these tools face challenges related to accuracy, contextual understanding, security, privacy, and ethical considerations, necessitating thorough review and testing of AI-generated code by developers. The integration of AI in coding also raises concerns about proprietary information protection and ethical implications such as job displacement. This paper explores the capabilities, applications, and limitations of current generative AI tools, highlighting their impact on software development and discussing future directions. Emphasis is placed on the need for improved model training, enhanced contextual understanding, secure AI training methods, and ethical AI usage. By addressing these challenges, the industry can maximize the potential of generative AI, creating more accurate, reliable, and ethically sound tools that support a collaborative and innovative software development environment.

Persepsi Mahasiswa Fakultas Hukum Universitas Nusa Cendana Terhadap Penghinaan Citra Tubuh (Body Shaming) di Lingkungan Kampus dan Media Sosial

The purpose of this study is to analyze the perceptions of students of the Faculty of Law, Nusa Cendana University about body shaming in the campus environment and social media and how the regulation of criminal acts of body shaming in review of the Criminal Code and Laws outside the Criminal Code. This research method is an empirical juridical approach, namely research whose data is obtained through efforts to investigate existing realities in social life. The results of this study are that the perceptions of students are very diverse, most students know about body shaming, many students have been victims of body shaming, and some are often the perpetrators of body shaming. The acts of body shaming that are experienced form the thoughts of some students to fight back but more choose to remain silent. This thought causes a response where some students choose to shut down and close themselves, some become insecure and others choose to withdraw from their social environment. According to most students, body shaming is a dangerous thing. The regulation of the criminal offense of body shaming in terms of the Criminal Code, the relevant article is Article 315 of the Criminal Code and if it is reviewed from laws outside the Criminal Code, the relevant articles are Article 27 Paragraph (3) of the ITE Law, Article 5 of the TPKS Law and Permendikbud Ristek No.30 of 2021.

Toward effective secure code reviews: an empirical study of security-related coding weaknesses

Identifying security issues early is encouraged to reduce the latent negative impacts on the software systems. Code review is a widely-used method that allows developers to manually inspect modified code, catching security issues during a software development cycle. However, existing code review studies often focus on known vulnerabilities, neglecting coding weaknesses, which can introduce real-world security issues that are more visible through code review. The practices of code reviews in identifying such coding weaknesses are not yet fully investigated. To better understand this, we conducted an empirical case study in two large open-source projects, OpenSSL and PHP. Based on 135,560 code review comments, we found that reviewers raised security concerns in 35 out of 40 coding weakness categories. Surprisingly, some coding weaknesses related to past vulnerabilities, such as memory errors and resource management, were discussed less often than the vulnerabilities. Developers attempted to address raised security concerns in many cases (39%-41%), but a substantial portion was merely acknowledged (30%-36%), and some went unfixed due to disagreements about solutions (18%-20%). This highlights that coding weaknesses can slip through code review even when identified. Our findings suggest that reviewers can identify various coding weaknesses leading to security issues during code reviews. However, these results also reveal shortcomings in current code review practices, indicating the need for more effective mechanisms or support for increasing awareness of security issue management in code reviews.

Implementing Continuous Integration and Deployment Strategy: Cloversy.id RESTful API Development

The software development cycle involves testing and deployment stages that can be laborious and time consuming, especially in collaborative projects that involve several developers. Implementing Continuous Integration (CI) and Continuous Delivery (CD) offers a solution to streamline this process. This study presents a case study of the Cloversy.id RESTful API project, highlighting challenges encountered during development and the implementation of a new system using GitHub Actions as the DevOps tool. The research resulted in the adoption of a new system, which replaces the conventional practices previously employed by the Cloversy.id development team. Using flow charts, the study meticulously mapped out the development flow, pinpointing bottlenecks and areas for optimization within the cycle. In particular, the implementation of a CI/CD pipeline resulted in a notable improvement, with a 35% increase in speed for CI and a remarkable 39% enhancement for CD. GitHub Actions played a pivotal role in automating critical tasks, reducing the reliance on manual intervention, and minimizing the dependency on team leaders. The platform's features, including detailed logs and email notifications, empowered team leaders and developers alike to take informed actions swiftly. Furthermore, the study highlights the novelty of integrating CI / CD considering factors such as branching strategy, code review practices, testing methodologies, deployment methods, and infrastructure.

Demystifying code snippets in code reviews: a study of the OpenStack and Qt communities and a practitioner survey

Demystifying code snippets in code reviews: a study of the OpenStack and Qt communities and a practitioner survey