Open Source Projects Research Articles

Taxonomy of inline code comment smells

Code comments play a vital role in source code comprehension and software maintainability. It is common for developers to write comments to explain a code snippet, and commenting code is generally considered a good practice in software engineering. However, low-quality comments can have a detrimental effect on software quality or be ineffective for code understanding. This study aims to create a taxonomy of inline code comment smells and determine how frequently each smell type occurs in software projects. We conducted a multivocal literature review to define the initial taxonomy of inline comment smells. Afterward, we manually labeled 2447 inline comments from eight open-source projects where half of them were Java, and another half were Python projects. We created a taxonomy of 11 inline code comment smell types and found out that the smells exist in both Java and Python projects with varying degrees. Moreover, we conducted an online survey with 41 software practitioners to learn their opinions on these smells and their impact on code comprehension and software maintainability. The survey respondents generally agreed with the taxonomy; however, they reported that some smell types might have a positive effect on code comprehension in certain scenarios. We also opened pull requests and issues fixing the comment smells in the sampled projects, where we got a 27% acceptance rate. We share our manually labeled dataset online and provide implications for software engineering practitioners, researchers, and educators.

Cultivating Community Health and Well-being in Open Source: Mitigating Burnout and Prioritizing Mental Health

Purpose: This whitepaper addresses the critical but often overlooked mental health challenges within open-source communities, including stress and burnout. The collaborative spirit of open-source communities has undoubtedly accelerated technological innovation, but the mental well-being of their contributors is frequently neglected. The objective is to uncover the root causes of these mental health issues and evaluate their impact, thereby underscoring the need for supportive and inclusive community practices.
 Methodology: This paper uses the ‘Mixed methods’ research approach, analyzing data from industry surveys and extracting insights from personal narratives and experiences documented by contributors in blogs and forums. This comprehensive strategy allows for a detailed exploration of mental health within the open-source environment, facilitating the identification of key stress factors and mental health challenges associated with community participation.
 Findings: The investigation reveals a direct link between the operational dynamics of open-source projects and the prevalence of mental health problems among participants. Key stressors include high expectations regarding workload, the predominantly volunteer nature of contributions, social isolation, and a lack of formal support structures. Additionally, the study highlights a significant lack of awareness of these issues and the availability of intervention strategies, further increasing the risk of burnout and stress among community members.
 Unique Contribution to Theory, Practice, and Policy: This paper makes a novel contribution to understanding mental health in open-source communities by merging analytical data with qualitative insights from contributor narratives. It offers recommendations for a wide range of stakeholders, from contributors to leaders and policymakers, to cultivate a culture that supports mental well-being, diversity, and sustainability. This paper presents a comprehensive blueprint for nurturing healthier, more resilient open-source communities.

Predicting the Number of Software Faults using Deep Learning

The software testing phase requires considerable time, effort, and cost, particularly when there are many faults. Thus, developers focus on the evolution of Software Fault Prediction (SFP) to predict faulty units in advance, therefore, improving software quality significantly. Forecasting the number of faults in software units can efficiently direct software testing efforts. Previous studies have employed several machine learning models to determine whether a software unit is faulty. In this study, a new, simple deep neural network approach that can adapt to the type of input data was designed, utilizing Convolutional Neural Networks (CNNs) and Multi-Layer Perceptron (MLP), to predict the number of software faults. Twelve open-source software project datasets from the PROMISE repository were used for testing and validation. As data imbalance can negatively impact prediction accuracy, the new version of synthetic minority over-sampling technique (SMOTEND) was used to resolve data imbalance. In experimental results, a lower error rate was obtained for MLP, compared to CNN, reaching 0.195, indicating the accuracy of this prediction model. The proposed approach proved to be effective when compared with two of the best machine learning models in the field of prediction. The code will be available on GitHub.

Code Comments: A Way of Identifying Similarities in the Source Code

This study investigates whether analyzing the code comments available in the source code can effectively reveal functional similarities within software. The authors explore how both machine-readable comments (such as linter instructions) and human-readable comments (in natural language) can contribute towards measuring the code similarity. For the former, the work is relying on computing the cosine similarity over the one-hot encoded representation of the machine-readable comments, while for the latter, the focus is on detecting similarities in English comments, using threshold-based computations against the similarity measurements obtained using models based on Levenshtein distances (for form-based matches), Word2Vec (for contextual word representations), as well as deep learning models, such as Sentence Transformers or Universal Sentence Encoder (for semantic similarity). For evaluation, this research has analyzed the similarities between different source code versions of the open-source code editor, VSCode, based on existing ESlint-specific directives, as well as applying natural language processing techniques on incremental releases of Kubernetes, an open-source system for automating containerized application management. The experiments outlines the potential for detecting code similarities solely based on comments, and observations indicate that models like Universal Sentence Encoder are providing a favorable balance between recall and precision. This research is integrated into Project Martial, an open-source project for automatic assistance in detecting plagiarism in software.

Commit-Level Software Change Intent Classification Using a Pre-Trained Transformer-Based Code Model

Software evolution is driven by changes made during software development and maintenance. While source control systems effectively manage these changes at the commit level, the intent behind them are often inadequately documented, making understanding their rationale challenging. Existing commit intent classification approaches, largely reliant on commit messages, only partially capture the underlying intent, predominantly due to the messages’ inadequate content and neglect of the semantic nuances in code changes. This paper presents a novel method for extracting semantic features from commits based on modifications in the source code, where each commit is represented by one or more fine-grained conjoint code changes, e.g., file-level or hunk-level changes. To address the unstructured nature of code, the method leverages a pre-trained transformer-based code model, further trained through task-adaptive pre-training and fine-tuning on the downstream task of intent classification. This fine-tuned task-adapted pre-trained code model is then utilized to embed fine-grained conjoint changes in a commit, which are aggregated into a unified commit-level vector representation. The proposed method was evaluated using two BERT-based code models, i.e., CodeBERT and GraphCodeBERT, and various aggregation techniques on data from open-source Java software projects. The results show that the proposed method can be used to effectively extract commit embeddings as features for commit intent classification and outperform current state-of-the-art methods of code commit representation for intent categorization in terms of software maintenance activities undertaken by commits.

Benchtop mesoSPIM: a next-generation open-source light-sheet microscope for cleared samples

In 2015, we launched the mesoSPIM initiative, an open-source project for making light-sheet microscopy of large cleared tissues more accessible. Meanwhile, the demand for imaging larger samples at higher speed and resolution has increased, requiring major improvements in the capabilities of such microscopes. Here, we introduce the next-generation mesoSPIM (“Benchtop”) with a significantly increased field of view, improved resolution, higher throughput, more affordable cost, and simpler assembly compared to the original version. We develop an optical method for testing detection objectives that enables us to select objectives optimal for light-sheet imaging with large-sensor cameras. The improved mesoSPIM achieves high spatial resolution (1.5 µm laterally, 3.3 µm axially) across the entire field of view, magnification up to 20×, and supports sample sizes ranging from sub-mm up to several centimeters while being compatible with multiple clearing techniques. The microscope serves a broad range of applications in neuroscience, developmental biology, pathology, and even physics.

Повышение эффективности работы в проектах Open Sourse на основе архитектурного анализа (на примере проекта Сахана)

The paper presents a methodology for entering an open source project using architectural analysis to develop programming skills and volunteer activities using architectural analysis. The relevance is due to the difficulty of entering into joint projects. As a method for solving this problem, it is proposed to use architectural analysis according to the C4 model. Using the example of the Sahana EDEN software project from the source code repository, the application of this method is described. Interest in this project is due to both its humanitarian goal and the large number of active participants, which makes it a significant example of intellectual volunteering. For each step of the architectural analysis, a detailed description of the results is presented - context, container and component diagrams. An analysis of the repository of an open source project should begin with an overview of the project structure and a study of the description, open questions, rules for making changes, current problems and technical debt. The importance of assessing one's own capabilities through studying the project's coding standards, problems and technical debt is substantiated. The conducted research showed that project work with open source software allows one to improve programming skills in practice, gain experience in joint activities and production communications, which allows us to recommend the comprehensive use of open source projects as an important educational activity for students.

VulMPFF: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives

Source code vulnerabilities are one of the significant threats to software security. Existing deep learning-based detection methods have proven their effectiveness. However, most of them extract code information on a single intermediate representation of code (IRC), which often fails to extract multiple information hidden in the code fully, significantly limiting their performance. To address this problem, we propose VulMPFF, a vulnerability detection method that fuses code features under multiple perspectives. It extracts IRC from three perspectives: code sequence, lexical and syntactic relations, and graph structure to capture the vulnerability information in the code, which effectively realizes the complementary information of multiple IRCs and improves vulnerability detection performance. Specifically, VulMPFF extracts serialized abstract syntax tree as IRC from code sequence, lexical and syntactic relation perspective, and code property graph as IRC from graph structure perspective, and uses Bi-LSTM model with attention mechanism and graph neural network with attention mechanism to learn the code features from multiple perspectives and fuse them to detect the vulnerabilities in the code, respectively. We design a dual-attention mechanism to highlight critical code information for vulnerability triggering and better accomplish the vulnerability detection task. We evaluate our approach on three datasets. Experiments show that VulMPFF outperforms existing state-of-the-art vulnerability detection methods (i.e., Rats, FlawFinder, VulDeePecker, SySeVR, Devign, and Reveal) in Acc and F1 score, with improvements ranging from 14.71% to 145.78% and 152.08% to 344.77%, respectively. Meanwhile, experiments in the open-source project demonstrate that VulMPFF has the potential to detect vulnerabilities in real-world environments.

Can You Give Me a Lift?

Static Analysis (SA) is the practice of examining computer program source code for errors or vulnerabilities outside the compiler’s capabilities. To carry out Static Analysis on computer programs, various tools exist that parse and examine each line for known issues. These tools do not compile the program, nor do they run the program. Instead, they analyse the source code directly and infer properties about the program without executing it - thus “static” analysis. Static analysis is not new. Early UNIX contained a program called “lint” for static analysis; a tool that has now existed since the late 1970s (Johnson 1978). Increasingly, however, modern static analysis practices indicate a more focused intent; find cybersecurity weaknesses. At the 22nd European Conference on Cyber Warfare and Security, the authors presented the background of Intermediate Representations (IRs) and described how this “middleware” representation can be utilized for static analysis of source code for cybersecurity weaknesses. By examining an IR, potential flaws in the source code can be located. When utilizing the IR as opposed to the original high-level language, the static analysis process becomes independent of the original source language; if several languages such as C, Rust, and others all compile into the same IR, static analysis of the IR allows the analysis process to no longer be tied to the high-level language grammar or syntax. The previous paper implemented a literature survey of available IR analysis tools to discover prior work; the authors have subsequently advanced the research and are actively using an IR framework, LLVM, for vulnerability analysis. In this research, source code in a high-level language is first compiled to LLVM and the resulting IR is used for analysis. This approach uses a “code-to-IR” SA analysis preparation paradigm. At the same time, there is the potential for binary “lifters” to be used. These tools “lift” an executable program – binary machine instructions – back to LLVM. In this way, the paradigm can also be reversed such that static analysis of LLVM can be performed on source code compiled into LLVM, or on executable programs in the field that are “lifted”. This begs: how effective are these “lifters”? In this work, the authors present experiences in installation and operation of several binary “lifters” available as open-source projects. Some are supported better than others, some operate better than others, and some don’t operate at all. Those that do lead to the follow-up: Is the “lifted” code suitable for static analysis, or is it too obfuscated relative to the original program? This paper describes just that – our efforts and results in locating a binary “lifter” suitable for bringing executable program test cases back to LLVM for analysis by the cybersecurity vulnerability tool concurrently under development.

An empirical study of just-in-time-defect prediction using various machine learning techniques

The goal of defect specificity is to pinpoint defective program components (such as faulty files, problematic procedures, or troublesome lines of code) based on defect symptoms, such as event logs or program spectrum. However, the problem is revealed and adverse effects are introduced when one experiences the defect indications. Consequently, one difficult task is to determine whether one can find buggy program before the signs of the defect manifests itself. Just-in-time defect prediction (JIT-DP) is a particular category of Software Defect Prediction (SDP) that includes this type of early detection of flawed changes to a software programs. This paper presents a novel five-phase JIT-DP framework that classifies the newly committed change as either a buggy change or a clean change relying on the project's historical data regarding the executed changes. The distinctive aspect of the model is that it uses the Chunk Balancing Algorithm (CBA) as a novel way of handling the Class Imbalance Problem (CIP) rather than utilizing conventional data re-sampling techniques. The experimental study uses 10 open-source projects with an average of 23,989 modifications to train the JIT-DP model. The research study examines the JIT-DP model's prediction abilities from both Within Project (WP) and Cross Project (CP) scenarios. The findings show that for within project setup, Logistic Regression (LR) outperforms among all other classifiers with the highest accuracy, TPR, and FPR as 0.85, 0.847, and 0.207, respectively. The model provides comparable prediction findings with an average accuracy of 0.90 for all seven testing samples when it was trained using commit logs from related six Java projects under CP context. However, taking into account the larger training pool of commit records in the former scenario, the model in the CP context (3.740 s) lags behind in terms of training and classification time periods when compared to the results of WI (0.984 s).

Cross-Project Defect Prediction Using Transfer Learning with Long Short-Term Memory Networks

With the increasing number of software projects, within-project defect prediction (WPDP) has already been unable to meet the demand, and cross-project defect prediction (CPDP) is playing an increasingly significant role in the area of software engineering. The classic CPDP methods mainly concentrated on applying metric features to predict defects. However, these approaches failed to consider the rich semantic information, which usually contains the relationship between software defects and context. Since traditional methods are unable to exploit this characteristic, their performance is often unsatisfactory. In this paper, a transfer long short-term memory (TLSTM) network model is first proposed. Transfer semantic features are extracted by adding a transfer learning algorithm to the long short-term memory (LSTM) network. Then, the traditional metric features and semantic features are combined for CPDP. First, the abstract syntax trees (AST) are generated based on the source codes. Second, the AST node contents are converted into integer vectors as inputs to the TLSTM model. Then, the semantic features of the program can be extracted by TLSTM. On the other hand, transferable metric features are extracted by transfer component analysis (TCA). Finally, the semantic features and metric features are combined and input into the logical regression (LR) classifier for training. The presented TLSTM model performs better on the f-measure indicator than other machine and deep learning models, according to the outcomes of several open-source projects of the PROMISE repository. The TLSTM model built with a single feature achieves 0.7% and 2.1% improvement on Log4j-1.2 and Xalan-2.7, respectively. When using combined features to train the prediction model, we call this model a transfer long short-term memory for defect prediction (DPTLSTM). DPTLSTM achieves a 2.9% and 5% improvement on Synapse-1.2 and Xerces-1.4.4, respectively. Both prove the superiority of the proposed model on the CPDP task. This is because LSTM capture long-term dependencies in sequence data and extract features that contain source code structure and context information. It can be concluded that: (1) the TLSTM model has the advantage of preserving information, which can better retain the semantic features related to software defects; (2) compared with the CPDP model trained with traditional metric features, the performance of the model can validly enhance by combining semantic features and metric features.

Learning from Very Little Data: On the Value of Landscape Analysis for Predicting Software Project Health

When data is scarce, software analytics can make many mistakes. For example, consider learning predictors for open source project health (e.g., the number of closed pull requests in 12 months time). The training data for this task may be very small (e.g., 5 years of data, collected every month means just 60 rows of training data). The models generated from such tiny datasets can make many prediction errors. Those errors can be tamed by a landscape analysis that selects better learner control parameters. Our niSNEAK tool (a) clusters the data to find the general landscape of the hyperparameters, then (b) explores a few representatives from each part of that landscape. niSNEAK is both faster and more effective than prior state-of-the-art hyperparameter optimization algorithms (e.g., FLASH, HYPEROPT, OPTUNA). The configurations found by niSNEAK have far less error than other methods. For example, for project health indicators such as C = number of commits, I = number of closed issues, and R = number of closed pull requests, niSNEAK ’s 12-month prediction errors are {I=0%, R=33% C=47%}, whereas other methods have far larger errors of {I=61%,R=119% C=149%}. We conjecture that niSNEAK works so well since it finds the most informative regions of the hyperparameters, then jumps to those regions. Other methods (that do not reflect over the landscape) can waste time exploring less informative options. Based on the preceding, we recommend landscape analytics (e.g., niSNEAK ) especially when learning from very small datasets. This article only explores the application of niSNEAK to project health. That said, we see nothing in principle that prevents the application of this technique to a wider range of problems. To assist other researchers in repeating, improving, or even refuting our results, all our scripts and data are available on GitHub at https://github.com/zxcv123456qwe/niSneak.

TinyGS vs. SatNOGS: A Comparative Analysis of Open-Source Satellite Ground Station Networks

In recent years, two of the largest open-source ground station (GS) networks capable of enabling Earth–satellite communication have emerged: TinyGS and SatNOGS. These open-source projects enable anyone to build their own GS inexpensively and easily, integrate into a GS network, and receive data from satellites listed in the database. Additionally, it enables satellite developers to add satellites to the databases of these projects and take advantage of this GS network to receive data from the satellites. This article introduces the TinyGS and SatNOGS projects and conducts a comparative analysis between them. Generally, the TinyGS project seems to have simpler implementation as well as lower associated costs. In a deeper analysis, it was observed that on the 29 July 2023, the TinyGS project had a higher number of online GSs and a more favorable geographic distribution. On the other hand, the SatNOGS project managed to communicate and decode a larger number of satellites up to 29 July 2023. Additionally, in both projects, it was noted that frequencies between 436 and 437 had the highest number of satellites with decoded data. Ultimately, the choice between these projects depends on critical parameters defined by the reader.

Evaluating the effectiveness of a security flaws prevention tool

Context:Securing code is crucial for all software stakeholders. Nevertheless, state-of-the-art tools are imperfect and tend to miss critical errors, resulting in zero-day vulnerabilities. Thus, there is a need for alternatives to mitigate such issues. Objective:We aim to facilitate an effective identification mechanism of security flaws in the early stages of development. Method:Following our analysis of the root causes of vulnerabilities and examining existing code analyzers, we devise a new Rule-Based Security Flaws Prevention (RbSFP) tool. The tool is based on a set of allow-list rules and consists of the following stages: (1) AST creation based on the source code and marking critical code areas; (2) Context-based code analysis that further validates the code; (3) Results’ normalization to suggest alerts and warnings. To evaluate the RbSFP tool, we utilized two complementary evaluations. The first refers to the tool’s ability to detect security flaws compared to competing tools by executing them on open-source projects. The second refers to evaluating the tool’s usability and efficiency via a controlled experiment. Results:We found that the outcomes were of better quality when using the RbSFP tool, and the differences were statistically significant. Thus, utilizing the new approach and tool has a significant impact as it can eliminate root causes for security flaws at the early stages of development. Conclusion:Using an allow-list-based approach can reduce security flaws in the code. However, further analysis and evaluation are needed to provide a more comprehensive solution.

Application of Weighted Combinations of Activation Functions to Defect Prediction in Software Development

Software defect prediction (SDP) method aims to identify potential bugs in programs or defective modules in software projects. SDP method can greatly help developers allocate needed testing- and debugging-efforts. Presently, SDP is typically divided into two procedures: extracting features from source code and building a classification model using machine learning methods, such as support vector machine, decision tree, and neural networks, to build a classifier for defect prediction. However, there are still some limitations for SDP. For example, machine learning models require a fixed input size, but the size of each program is mostly inconsistent. Activation functions play an essential role in the training of artificial neural networks, but every kind of activation function has its own particular strengths and inherent constraints. The main purpose of this article is to propose a general framework of combining different activation functions with given weights to improve the effectiveness of SDP. We construct 41 kinds of defect prediction models by deep belief networks (DBNs) built with double-weighted or triple-weighted combination of six most commonly used activation functions to improve the predictions. In the experiment of this study, some real data from open-source projects are selected to evaluate the performance of our proposed weighted combination methods. It is found experimentally that the weighted combinations methods can enhance the accuracy of SDP. It is also noticed that our proposed weighted combination scheme is not restricted to the DBN or a particular kind of activation functions.

Known Vulnerabilities of Open Source Projects: Where Are the Fixes?

Known Vulnerabilities of Open Source Projects: Where Are the Fixes?

Prevalence and severity of design anti-patterns in open source programs—A large-scale study

Context:Design anti-patterns can be symptoms of problems that lead to long-term maintenance difficulty. How should development teams prioritize their treatment? Which ones are more severe and deserve more attention? Does the impact of anti-patterns and general maintenance efforts differ with different programming languages? Objective:In this study, we assess the prevalence and severity of anti-patterns in different programming languages and the impact of dynamic typing in Python, as well as the impact scopes of prevalent anti-patterns that manifest the violation of design principles. Method:We conducted a large-scale study of anti-patterns using 1717 open-source projects written in Java, C/C++, and Python. For the 288 Python projects, we extracted both explicit and dynamic dependencies and compared how the detected anti-patterns and maintenance costs changed. Finally, we removed anti-patterns involving five or fewer files to assess the impact of trivial anti-patterns. Results:The results reveal that 99.55% of these projects contain anti-patterns. Modularity Violation – frequent co-changes among seemingly unrelated files – is most prevalent (detected in 83.54% of all projects) and costly (incurred 61.55% of maintenance effort on average). Unstable Interface and Crossing, caused by influential but unstable files, although not as prevalent, tend to incur severe maintenance costs. Duck typing in Python incurs more anti-patterns, and the churn spent on Python files multiplies that of C/C++ and Java files. Several prevalent anti-patterns have a large portion of trivial instances, meaning that these common symptoms are usually not harmful. Conclusion:Implicit and visible dependencies are the most expensive to maintain, and dynamic typing in Python exacerbates the issue. Influential but unstable files need to be monitored and rectified early to prevent the accumulation of high maintenance costs. The violations of design principles are widespread, but many are not high-maintenance.

Vector Accelerator Unit for Caravel

Caravel is an open-source project developed by Efabless for creating custom System-on-Chips (SoCs). It includes the design of a configurable chip, development tools, and documentation. The Caravel SoC includes a RISC-V with the Instruction Set Architecture RV32I. One of the key features of Caravel is its open-source nature. In this article, the Vector Accelerator Unit for the Caravel SoC template is presented to increase the RISC-V capabilities, allowing parallel data processing through 14 vector operations. The accelerator is based on 4 Arithmetic Logic Units connected directly to the RISC-V through Logic Analyzer port and the General-Purpose Input/Output (GPIO) port. The total area of this accelerator is less than 20% of the User Project Wrapper area allowing the user to implement their custom designs in 8.4256 mm.

Triact package for R: analyzing the lying behavior of cows from accelerometer data.

Accelerometers are sensors proven to be useful to analyze the lying behavior of cows. For reasons of algorithm transparency and control, researchers often prefer to use their own data analysis scripts rather than proprietary software. We developed the triact R package that assists animal scientists in analyzing the lying behavior of cows from raw data recorded with a triaxial accelerometer (manufacturer agnostic) attached to a hind leg. In a user-friendly workflow, triact allows the determination of common measures for lying behavior including total lying duration, the number of lying bouts, and the mean duration of lying bouts. Further capabilities are the description of lying laterality and the calculation of proxies for the level of physical activity of the cow. In this publication we describe the functionality of triact and the rationales behind the implemented algorithms. The triact R package is developed as an open-source project and freely available via the CRAN repository.

TeReKG: A temporal collaborative knowledge graph framework for software team recommendation

Successful software development requires a cohesive team with the right mix of technical skills and the ability to collaborate effectively. However, forming a software team that can execute tasks with precision and efficiency requires a deep understanding of each member’s competence, experience, and cooperation history. Previously, automated software team selection has evaluated technical skills, cohesion, and cooperation history. However, the previous method had some limitations. Particularly, local features directly calculated from team members were subjective to the researchers’ views, and the method ignored the temporal aspect of open-source software development. To overcome these limitations, this paper proposes a knowledge-graph software team recommendation framework called TeReKG. This framework encapsulates temporal collaboration patterns and uses a temporal knowledge graph to encode software collaboration history, technical abilities, task dependencies, and project structure. TeReKG was against state-of-the-art team recommendation algorithms using three popular open-source software projects: Moodle, Apache, and Atlassian. The evaluation results show that TeReKG outperforms the state-of-the-art baselines in both single-role and team recommendation tasks. These findings demonstrate that knowledge graph embedding can be effectively utilized in automated recommendation tasks in software engineering. Additionally, this highlights the potential for knowledge graphs to capture global information that can benefit various software development applications, including impact prediction of software repositories, code clone detection, and source code retrieval.