TWC: Small: Empirical Evaluation of the Usability and Security Implications of Application Programming Interface Design

这个项目的目标是收集关于编程语言和库设计中安全性和可用性之间权衡的经验证据。尽管众所周知，设计不良的接口会导致缺陷率和软件漏洞的增加，但目前很少有具体的指导，告诉设计人员哪些精确的语言和库特性使程序员或多或少可能编写易受攻击的代码。此外，现有的指导很少是基于经验的。该项目将针对两个问题制定基于经验的指导。首先，C编程语言的ISO/IEC标准化工作组目前正在评估向该语言添加并发性的多个建议，该项目将产生数据，为他们的决策过程提供信息。其次，通过评估使用可变性的影响，该项目将提供可能影响未来编程语言和库设计方式的数据。这个项目包括三个部分。第一阶段是分析代码中的缺陷，这些缺陷使用了正在考虑的C并发api的草案版本，以及可比较的Java数据库中与并发相关的缺陷。在第二和第三阶段，有2到5年经验的程序员将被要求使用竞争性的界面设计完成任务。第一组实验将评估相互竞争的C和c++并行语言扩展，以确定哪种语言和库特性更有可能产生安全的代码。特别地，调查人员将测量程序员产生没有安全相关缺陷的并发代码的能力，例如使用不同的库的“数据竞争”和“检查时间到使用时间”错误。然后，研究人员将在此工作的基础上评估在使用不变性来减少并发代码中漏洞的可能性时安全性和可用性之间的权衡。通过这两个实验，该项目将通过开发一种方法来经验评估库和语言设计如何影响训练有素的专业程序员在实施过程中无意中引入安全漏洞的频率，从而推进网络安全科学。

The objective of this project is to gather empirical evidence on the tradeoffs between security and usability in programming language and library design. Although it is well known that poorly-designed interfaces can lead to increased defect rates and software vulnerabilities, there is currently little specific guidance to designers on what precise language and library features make programmers more or less likely to write vulnerable code. Furthermore, little of the existing guidance is empirically based. The project will develop empirically-based guidance on two issues. First, the ISO/IEC standardization working group for the C programming language is currently evaluating multiple proposals for adding concurrency to the language, and this project will produce data to inform their decision-making process. Second, by evaluating the impact of the use of mutability, the project will provide data that may influence how future programming languages and libraries are designed. The project involves three parts. The first phase is an analysis of flaws in code that uses the draft versions of the C concurrency APIs under consideration as well as comparable Java databases on concurrency-related flaws. In the second and third phases, programmers who have between 2 and 5 years of experience will be asked to complete tasks using competing interface designs. The first set of experiments will evaluate competing C and C++ parallel language extensions to determine which language and library features are more likely to result in secure code. Specifically, the investigators will measure the programmers' ability to produce concurrent code free from security-related defects, such as "data races" and "time-of-check-to-time-of-use" errors using the different libraries. The investigators will then build upon this work to evaluate tradeoffs between security and usability when using immutability to reduce the likelihood of vulnerabilities in concurrent code. Through these two experiments, the project will advance the science of cybersecurity by developing a methodology for empirically evaluating how library and language design affect the frequency with which trained professional programmers inadvertently introduce security vulnerabilities during implementation.