一句话：通过 88,416 个 PR 样本揭示不安全依赖更新遍布长尾生态，并提出六项研究议程。
第三方依赖可能成为恶意代码注入的入口，但现有工业与研究举措主要关注生态中最关键、被依赖最多的库，长尾依赖的安全风险尚不明确。本文提出在整个软件生态中推广更安全实践的愿景，并报告初步实证数据：从 88,416 个 pull request（PR）中抽取三个代表性样本，识别出运行时可能带来风险的“不安全依赖更新”。结果表明，这类更新并不局限于高影响力库，长尾生态同样面临威胁。为引起对长尾的关注，作者提出包含六个关键研究问题的研究议程，涵盖如何防范此类不安全活动，并为顶级库之外的整个生态建立最佳实践。
A risk in adopting third-party dependencies into an application is their potential to serve as a doorway for malicious code to be injected (most often unknowingly). While many initiatives from both industry and research communities focus on the most critical dependencies (i.e., those most depended upon within the ecosystem), little is known about whether the rest of the ecosystem suffers the same fate. Our vision is to promote and establish safer practises throughout the ecosystem. To motivate our vision, in this paper, we present preliminary data based on three representative samples from a population of 88,416 pull requests (PRs) and identify unsafe dependency updates (i.e., any pull request that risks being unsafe during runtime), which clearly shows that unsafe dependency updates are not limited to highly impactful libraries. To draw attention to the long tail, we propose a research agenda comprising six key research questions that further explore how to safeguard against these unsafe activities. This includes developing best practises to address unsafe dependency updates not only in top-tier libraries but throughout the entire ecosystem.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{Wattanakriengkrai23,
title = {Lessons from the Long Tail: Analysing Unsafe Dependency Updates across Software Ecosystems},
author = {Supatsara Wattanakriengkrai and Raula Gaikovina Kula and Christoph Treude and Kenichi Matsumoto},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3613086}
}