Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns

Using thematic analysis in psychology

Virginia Braun and Victoria Clarke. 2006 · 2006

Earlier work this paper cites.

Answering the call for a standard reliability measure for coding data

Andrew F Hayes and Klaus Krippendorff. 2007 · 2007

Earlier work this paper cites.

The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research

Erin Kenneally and David Dittrich. 2012 · 2012

Earlier work this paper cites.

Basics of qualitative research: Techniques and procedures for developing grounded theory

Juliet Corbin and Anselm Strauss. 2014 · 2014

Earlier work this paper cites.

Thematic analysis

Victoria Clarke, Virginia Braun, and Nikki Hayfield. 2015 · 2015

Earlier work this paper cites.

“…No one Can Hack My Mind”: Comparing Expert and Non-Expert Security Practices. In Proc. 11th Symposium On Usable Privacy and Security (SOUPS’15) . USENIX, 327–346

Iulia Ion, Rob Reeder, and Sunny Consolvo. 2015 · 2015

Earlier work this paper cites.

You Get Where You’re Looking For: The Impact of Information Sources on Code Security. In 2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 289–305

Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L Mazurek, and Christian Stransky. 2016 · 2016

Earlier work this paper cites.

What security questions do developers ask? a large-scale study of stack overflow posts

Xin-Li Yang, David Lo, Xin Xia, Zhi-Yuan Wan, and Jian-Ling Sun. 2016 · 2016

Earlier work this paper cites.

How Internet Resources Might Be Helping You Develop Faster but Less Securely

Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. 2017a · 2017

Earlier work this paper cites.

Developers Need Support Too: A Survey of Security Advice for Software Developers. In 2017 IEEE Cybersecurity Development (SecDev) . IEEE, 22–26

Yasemin Acar, Christian Stransky, Dominik Wermke, Charles Weir, Michelle L Mazurek, and Sascha Fahl. 2017b · 2017

Earlier work this paper cites.

Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security. In 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 121–136

Felix Fischer, Konstantin Böttinger, Huang Xiao, Christian Stransky, Yasemin Acar, Michael Backes, and Sascha Fahl. 2017 · 2017

Earlier work this paper cites.

Why Do Developers Get Password Storage Wrong?: A Qualitative Usability Study. In Proc. 24th ACM Conference on Computer and Communication Security (CCS’17) . ACM, 311–328

Alena Naiakshina, Anastasia Danilova, Christian Tiefenau, Marco Herzog, Sergej Dechand, and Matthew Smith. 2017 · 2017

Earlier work this paper cites.

152 Simple Steps to Stay Safe Online: Security Advice for Non-Tech-Savvy Users

Robert W. Reeder, Iulia Ion, and Sunny Consolvo. 2017 · 2017

Earlier work this paper cites.

Replication: No One Can Hack My Mind Revisiting a Study on Expert and Non-Expert Security Practices and Advice. In Proc. 15th Symposium on Usable Privacy and Security (SOUPS’19) . USENIX, 117–136

Karoline Busse, Julia Schäfer, and Matthew Smith. 2019 · 2019

Earlier work this paper cites.

How Reliable is the Crowdsourced Knowledge of Security Implementation?. In Proc. IEEE/ACM 41st International Conference on Software Engineering (ICSE’19) . IEEE, 536–547

Mengsu Chen, Felix Fischer, Na Meng, Xiaoyin Wang, and Jens Grossklags. 2019 · 2019

Earlier work this paper cites.

Exploring How Privacy and Security Factor into IoT Device Purchase Behavior. In Proc. 2019 CHI Conference on Human Factors in Computing Systems (CHI ’19) . ACM, 1–12

Pardis Emami-Naeini, Henry Dixon, Yuvraj Agarwal, and Lorrie Faith Cranor. 2019 · 2019

Earlier work this paper cites.

Stack Overflow Considered Helpful! Deep Learning Security Nudges Towards Stronger Cryptography. In Proc. 28th Usenix Security Symposium (SEC’19) . USENIX, 339–356

Felix Fischer, Huang Xiao, Ching-Yu Kao, Yannick Stachelscheid, Benjamin Johnson, Danial Razar, Paul Fawkesley, Nat Buckley, Konstantin Böttinger, Paul Muntean, and Jens Grossklags. 2019 · 2019

Earlier work this paper cites.

Mentions of Security Vulnerabilities on Reddit, Twitter and GitHub. In IEEE/WIC/ACM International Conference on Web Intelligence (WI ’19) . ACM, 200–207

Sameera Horawalavithana, Abhishek Bhattacharjee, Renhao Liu, Nazim Choudhury, Lawrence O. Hall, and Adriana Iamnitchi. 2019 · 2019

Earlier work this paper cites.

Reliability and Inter-Rater Reliability in Qualitative Research: Norms and Guidelines for CSCW and HCI Practice

Nora McDonald, Sarita Schoenebeck, and Andrea Forte. 2019 · 2019

Earlier work this paper cites.

"It’s a scavenger hunt": Usability of Websites’ Opt-Out and Data Deletion Choices. In Proc. 2020 CHI Conference on Human Factors in Computing Systems (CHI ’20) . ACM, 1–12

Hana Habib, Sarah Pearman, Jiamin Wang, Yixin Zou, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub. 2020 · 2020

Earlier work this paper cites.

A Comprehensive Quality Evaluation of Security and Privacy Advice on the Web. In Proc. 29th USENIX Security Symposium (SEC’20) . USENIX, 89–108

Elissa M. Redmiles, Noel Warford, Amritha Jayanti, Aravind Koneru, Sean Kross, Miraida Morales, Rock Stevens, and Michelle L. Mazurek. 2020 · 2020

Earlier work this paper cites.

Building and Validating a Scale for Secure Software Development Self-Efficacy. In Proc. 2020 CHI Conference on Human Factors in Computing Systems (CHI ’20) . ACM, 1–20

Daniel Votipka, Desiree Abrokwa, and Michelle L. Mazurek. 2020 · 2020

Earlier work this paper cites.

ACM Publications Policy on Research Involving Human Participants and Subjects

ACM Publications Board. 2021 · 2021

Earlier work this paper cites.

A worked example of Braun and Clarke’s approach to reflexive thematic analysis

David Byrne. 2021 · 2021

Earlier work this paper cites.

Do you really code? Designing and Evaluating Screening Questions for Online Surveys with Programmers. In Proc. 43rd International Conference on Software Engineering (ICSE ’21) . IEEE, 537–548

Anastasia Danilova, Alena Naiakshina, Stefan Horstmann, and Matthew Smith. 2021 · 2021

Earlier work this paper cites.

The Effect of Google Search on Software Security: Unobtrusive Security Interventions via Content Re-Ranking. In Proc. 28th ACM Conference on Computer and Communication Security (CCS’21) . ACM, 3070–3084

Felix Fischer, Yannick Stachelscheid, and Jens Grossklags. 2021 · 2021

Earlier work this paper cites.

GitHub Copilot: Your AI Pair Programmer

GitHub. 2021 · 2021

Earlier work this paper cites.

Mining Reddit as a New Source for Software Requirements. In 2021 IEEE 29th International Requirements Engineering Conference (RE) . IEEE, 128–138

Tahira Iqbal, Moniba Khan, Kuldar Taveter, and Norbert Seyff. 2021 · 2021

Earlier work this paper cites.

How Developers Talk About Personal Data and What It Means for User Privacy: A Case Study of a Developer Forum on Reddit

Tianshi Li, Elizabeth Louie, Laura Dabbish, and Jason I. Hong. 2021 · 2021

Cited alongside, same era.

OpenAI Codex

OpenAI. 2021 · 2021

Cited alongside, same era.

Taking Flight with Copilot: Early insights and opportunities of AI-powered pair-programming tools

Christian Bird, Denae Ford, Thomas Zimmermann, Nicole Forsgren, Eirini Kalliamvakou, Travis Lowdermilk, and Idan Gazit. 2022 · 2022

Cited alongside, same era.

‘A starting point for your journey, not a map’: Nikki Hayfield in conversation with Virginia Braun and Victoria Clarke about thematic analysis

Virginia Braun, Victoria Clarke, and Nikki Hayfield. 2022 · 2022

Cited alongside, same era.

Ai-driven development is here: Should you worry?

Neil A Ernst and Gabriele Bavota. 2022 · 2022

Cited alongside, same era.

Generative AI Degrades Online Communities

Gordon Burtch, Dokyun Lee, and Zhichen Chen. 2024 · 2024

Closest in time.

AI hallucinates software packages and devs download them – even if potentially poisoned with malware

Thomas Claburn. 2024 · 2024

Closest in time.

About GitHub Copilot Enterprise

Copilot. 2024 · 2024

Closest in time.

Focus: Google, one of AI’s biggest backers, warns own staff about chatbots

Jeffrey Dastin and Anna Tong. 2023 · 2024

Closest in time.

Copilot amplifies insecure codebases by replicating vulnerabilities in your projects

Randall Degges. 2024 · 2024

Closest in time.

Vulnerability Detection with Code Language Models: How Far Are We?

Original

Yangruibo Ding, Yanjun Fu, Omniyyah Ibrahim, Chawin Sitawarin, Xinyun Chen, Basel Alomair, David Wagner, Baishakhi Ray, and Yizheng Chen. 2024 · 2024