Raúl Pardo

Context: Free and Open Source Software (FOSS) communities’ sustainability, meaning to remain operational without signs of weakening or interruptions to its development, is fundamental for the resilience and continuity of society’s digital infrastructure. Many of our digital services and products either leverage or entirely rely on FOSS somewhere in their software stack. However, FOSS sustainability is a multifaceted concept, and the impact of its decline on community products is less known. Objective: In this study, we sought to understand how the different aspects of FOSS sustainability impact software quality from a developmental trajectory perspective. Specifically, we aim to investigate whether and how incubation of FOSS projects or bypassing incubation correlates with software quality outcomes. Method: We selected 342 FOSS projects from the Apache Software Foundation that have either graduated, retired, or bypassed their incubator program (development trajectory phases specific for Apache FOSS projects). We used 16 sustainability metrics to examine their impact on eight software quality metrics (defect density, code coverage, medium risk complexity, very high risk complexity, number of large files, very large function size count, code duplication percentage, and most complex function LOC). We analyzed the decline in the sustainability metrics and their relationship with our selected software quality metrics using Bayesian data analysis, which incorporates probability distributions to represent the regression coefficients and intercepts. Results: We found that our selected sustainability metrics exhibit distinct relationships with software quality across different project trajectories. Graduated projects demonstrated the strongest sustainability-software quality (SWQ) relationship. In contrast, retired projects exhibited weaker relationships, despite receiving similar governance support during incubation. Bypassed projects, while not outperforming graduated ones, showed comparable sustainability-SWQ relationships. Conclusion: While structured incubation strengthens sustainability and SWQ in graduated projects, retired projects struggle to maintain strong sustainability-SWQ relationships, indicating that additional factors internal and specific to projects influence sustainability. This effect was evident among bypassed projects; their self-reliant sustainability practices yielded stronger sustainability-software quality (SWQ) compared to the retired ones.

In object-oriented languages software developers rely on thread-safe classes to implement concurrent applications. However, determining whether a class is thread-safe is a challenging task. This paper presents a highly scalable method to analyze thread-safety in Java classes. We provide a definition of thread-safety for Java classes founded on the correctness principle of the Java memory model, data race freedom. We devise a set of properties for Java classes that are proven to ensure thread-safety. We encode these properties in the static analysis tool CodeQL to automatically analyze Java source code. We perform an evaluation on the top 1000 GitHub repositories. The evaluation comprises 3632865 Java classes; with 1992 classes annotated as @ThreadSafe from 71 repositories. These repositories include highly popular software such as Apache Flink (24.6k stars), Facebook Fresco (17.1k stars), PrestoDB (16.2k starts), and gRPC (11.6k starts). Our queries detected thousands of thread-safety errors. The running time of our queries is below 2 minutes for repositories up to 200k lines of code, 20k methods, 6000 fields, and 1200 classes. We have submitted a selection of detected concurrency errors as PRs, and developers positively reacted to these PRs. We have submitted our CodeQL queries to the main CodeQL repository, and they are currently in the process of becoming available as part of GitHub actions. The results demonstrate the applicability and scalability of our method to analyze thread-safety in real-world code bases.

Data anonymization methods gain legal importance as data collection and analysis are expanding dramatically in data management and statistical research. Yet applying anonymization, or understanding how well a given analytics program hides sensitive information, is non-trivial. Privug is a method to quantify privacy risks of data analytics programs by analyzing their source code. The method uses probability distributions to model attacker knowledge and Bayesian inference to update said knowledge based on observable outputs. Currently, Privug is equipped with approximate Bayesian inference methods (such as Markov Chain Monte Carlo), and an exact Bayesian inference method based on multivariate Gaussian distributions. This paper introduces a privacy risk analysis engine based on Gaussian mixture models that combines exact and approximate inference. It extends the multivariate Gaussian engine by supporting exact inference in programs with continuous and discrete distributions as well as if-statements. Furthermore, the engine allows for approximating attacker knowledge that is not normally distributed. We evaluate the method by analyzing privacy risks in programs to release public statistics, differential privacy mechanisms, randomized response and attribute generalization. Finally, we show that our engine can be used to analyze programs involving thousands of sensitive records.

Free and Open Source Software (FOSS) communities' sustainability, meaning to remain operational without signs of weakening or interruptions to its development, is fundamental for the resilience and continuity of society's digital infrastructure. Many digital services and products either leverage or entirely rely on FOSS in their software stack. FOSS sustainability is a multifaceted concept, and the impact of its decline on community products is less known. In this study, we sought to understand how the different aspects of FOSS sustainability impact software quality from a life-cycle perspective. Specifically, we investigate whether and how support and incubation of FOSS projects or bypassing incubation correlate with software quality outcomes. We selected 342 FOSS projects from the Apache Software Foundation that have either graduated, retired, or bypassed their incubator program. We used 16 sustainability metrics to examine their impact on eight software quality metrics. Using Bayesian data analysis, we found that our selected sustainability metrics exhibit distinct relationships with software quality across different project trajectories. Graduated projects showed the strongest sustainability-software quality (SWQ) relationship, both during and post-incubation. In contrast, retired projects showed weaker relationships, despite receiving similar governance support. Bypassed projects, while not outperforming graduated ones, showed comparable sustainability-SWQ relationships. While structured incubation strengthens sustainability and SWQ in graduated projects, retired projects struggle to maintain strong sustainability-SWQ relationships, indicating that additional factors internal and specific to projects influence sustainability. This effect was evident among bypassed projects; their self-reliant sustainability practices yielded stronger sustainability-SWQ compared to the retired ones.

Whereas the semantics of probabilistic languages has been extensively studied, specification languages for their properties have received less attention -- with the notable exception of recent and on-going efforts by Joost-Pieter Katoen and collaborators. In this paper, we revisit probabilistic dynamic logic (pDL), a specification logic for programs in the probabilistic guarded command language (pGCL) of McIver and Morgan. Building on dynamic logic, pDL can express both first-order state properties and probabilistic reachability properties. In this paper, we report on work in progress towards a deductive proof system for pDL. This proof system, in line with verification systems for dynamic logic such as KeY, is based on forward reasoning by means of symbolic execution.