Long-term Professionals Research Articles

Blindspots in Python and Java APIs Result in Vulnerable Code

Blindspots in APIs can cause software engineers to introduce vulnerabilities, but such blindspots are, unfortunately, common. We study the effect APIs with blindspots have on developers in two languages by replicating a 109-developer, 24-Java-API controlled experiment. Our replication applies to Python and involves 129 new developers and 22 new APIs. We find that using APIs with blindspots statistically significantly reduces the developers’ ability to correctly reason about the APIs in both languages, but that the effect is more pronounced for Python. Interestingly, for Java, the effect increased with complexity of the code relying on the API, whereas for Python, the opposite was true. This suggests that Python developers are less likely to notice potential for vulnerabilities in complex code than in simple code, whereas Java developers are more likely to recognize the extra complexity and apply more care, but are more careless with simple code. Whether the developers considered API uses to be more difficult, less clear, and less familiar did not have an effect on their ability to correctly reason about them. Developers with better long-term memory recall were more likely to correctly reason about APIs with blindspots, but short-term memory, processing speed, episodic memory, and memory span had no effect. Surprisingly, professional experience and expertise did not improve the developers’ ability to reason about APIs with blindspots across both languages, with long-term professionals with many years of experience making mistakes as often as relative novices. Finally, personality traits did not significantly affect the Python developers’ ability to reason about APIs with blindspots, but less extroverted and more open developers were better at reasoning about Java APIs with blindspots. Overall, our findings suggest that blindspots in APIs are a serious problem across languages, and that experience and education alone do not overcome that problem, suggesting that tools are needed to help developers recognize blindspots in APIs as they write code that uses those APIs.

Reading the Bodies of Early American Seafarers

I N one of his poignant vignettes, Herman Melville recorded the declining years of a man who had spent his entire working life at sea. Landsmen and women who encountered Daniel Orme were impressed by the features that defined him as a sailor, his moody and tanned complexion, his scars, the darned Guernsey frock he wore, and the crucifix tattooed on his chest. Interpreting these wens and knobs and distortions of the bark as the measure of the man, Melville was fascinated by the ways in which this lifelong seafarer defined himself, and was defined by others, by his very body.1 Few American seafarers were long-term professionals like Orme. Seeking youthful adventure and income, attempting to escape obligations, problems, and debts, or despairing of employment ashore, many men signed up for an occasional voyage but spent the greater part of their adult lives on land.2 Historians have found it difficult to learn about the before-the-mast career seamen who were at the heart of the maritime community, for when they appear in such records as tax lists and militia rolls, it is all but impossible to