Can I read Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management on EtoBox?

Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management by Zhang, Lyuye; Wu, Jiahui; Liu, Chengwei; Li, Kaixuan; Sun, Xiaoyu; Zhao, Lida; Wang, Chong; Liu, Yang is a scholarly article available to read on EtoBox.

What is Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management about?

In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software (OSS) has become critically important. However, existing research and tools from both academia and industry mainly relied on limited solutions, such as vulnerable version adjustment and adopting patches, to handle identified vulnerabilities. However, far more flexible and diverse countermeasures have been actively adopted in the open-source communities. A holistic empirical study is needed to explore the prevalence, distribution, preferences, and effectiveness of these diverse strategies. To this end, in this paper, we conduct a comprehensive study on the taxonomy of vulnerability remediation tactics (RT) in OSS projects and investigate their pros and cons. This study addresses this oversight by conducting a comprehensive empirical analysis of 21,187 issues from GitHub, aiming to understand the range and efficacy of remediation tactics within the OSS community. We developed a hierarchical taxonomy of 44 distinct RT and evaluated their effectiveness and costs. Our findings highlight a significant reliance on community-driven strategies, like using alternative librar

Author

Zhang, Lyuye; Wu, Jiahui; Liu, Chengwei; Li, Kaixuan; Sun, Xiaoyu; Zhao, Lida; Wang, Chong; Liu, Yang

Published

2025

Language

EN