Security Developer Studies with GitHub Users: Exploring a Convenience Sample
Security Developer Studies with GitHub Users: Exploring a Convenience Sample
复制标题
安全开发人员与 GitHub 用户的研究：探索便捷示例
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
S. Fahl
中科院分区：
文献类型：
--
作者：
Y. Acar;Christian Stransky;Dominik Wermke;Michelle L. Mazurek;S. Fahl
可用的安全社区越来越多地考虑如何改善最终用户的安全决策，还为包括系统管理员和软件开发人员在内的信息技术专业人员来改善这些专业人员。最终用户更普遍地，他们的数字有限，地理位置集中，并被指责为更高的补偿。 （在某些方面）可以方便地用于在线研究。 github用户每个完成相同的安全性编程任务。安全性和功能都与参与者的自我报告的经验有关，但是与参与者作为学生的自我报告的地位，作为专业开发人员的状态或安全背景相关的统计学上没有显着的差异。在招募便利样本作为安全开发人员研究中的专业开发人员时，如何考虑有效性。
The usable security community is increasingly considering how to improve security decision-making not only for end users, but also for information technology professionals, including system administrators and software developers. Re-cruiting these professionals for user studies can prove challenging, as, relative to end users more generally, they are limited in numbers, geographically concentrated, and accus-tomed to higher compensation. One potential approach is to recruit active GitHub users, who are (in some ways) conveniently available for online studies. However, it is not well understood how GitHub users perform when working on security-related tasks. As a first step in addressing this question, we conducted an experiment in which we recruited 307 active GitHub users to each complete the same security-relevant programming tasks. We compared the results in terms of functional correctness as well as security, finding differences in performance for both security and functionality related to the participant’s self-reported years of experience, but no statistically significant differences related to the participant’s self-reported status as a student, status as a professional developer, or security background. These results provide initial evidence for how to think about validity when recruiting convenience samples as substitutes for professional developers in security developer studies.