Mahzabin Tamanna

Reusable software libraries, frameworks, and components, such as those provided by open source ecosystems and third-party suppliers, accelerate digital innovation. However, recent years have shown almost exponential growth in attackers leveraging these software artifacts to launch software supply chain attacks. Past well-known software supply chain attacks include the SolarWinds, log4j, and xz utils incidents. Supply chain attacks are considered to have three major attack vectors: through vulnerabilities and malware accidentally or intentionally injected into open source and third-party dependencies/components/containers ; by infiltrating the build infrastructure during the build and deployment processes; and through targeted techniques aimed at the humans involved in software development, such as through social engineering. Plummeting trust in the software supply chain could decelerate digital innovation if the software industry reduces its use of open source and third-party artifacts to reduce risks. This article contains perspectives and knowledge obtained from intentional outreach with practitioners to understand their practical challenges and from extensive research efforts. We then provide an overview of current research efforts to secure the software supply chain. Finally, we propose a future research agenda to close software supply chain attack vectors and support the software industry.

Developers rely on open-source packages and must review dependencies to safeguard against vulnerable or malicious upstream code. A careful review of all dependencies changes often does not occur in practice. Therefore, developers need signals to inform of dependency changes that require additional examination, particularly measures for contributor reputation. The goal of this study is to help developers prioritize dependency review efforts by analyzing contributor reputation measures as a signal in the Rust ecosystem. We use network centrality measures to proxy contributor reputation using collaboration activity. We employ a mixed method methodology from the top 1,644 packages in the Rust ecosystem to build a network of 6,949 developers, survey 285 developers, and model 5 centrality measures. Through our survey, we find that only 24% of respondents often review dependencies before adding or updating a package, mentioning difficulties in the review process and signals are therefore employed. Particularly, 51% of respondents often consider contributor reputation when reviewing dependencies. We further explore contributor reputation through network centrality measures employing multivariate mixed-effect linear regression models. We find that the closeness centrality measure is a significant factor in explaining how developers choose to review dependencies. Yet, centrality measures alone do not account for how developers choose to review dependencies. We recommend the Rust ecosystem implement a contributor reputation badge based on our modeled coefficients to complement developers’ dependency review efforts.

Construction Hazard Prevention through Design (CHPtD) is recognized as a pivotal strategy for enhancing workplace safety. Despite its theoretical potential, practical implementation faces challenges, particularly regarding designers' familiarity with field-level operations and hazard recognition. This study aims to investigate whether ChatGPT can address these challenges by assisting in hazard recognition during CHPtD sessions. The research utilized a randomized controlled experiment to assess ChatGPT as an intervention in supporting hazard recognition during CHPtD sessions. The study involves 162 civil and construction engineering student participants, representing future professionals. Participants engaged in hazard recognition during CHPtD sessions either with or without the assistance of ChatGPT. Participants who utilized ChatGPT during CHPtD sessions demonstrated a significant improvement in hazard recognition, identifying approximately 40% more hazards compared to those who did not use ChatGPT. These findings underscore the efficacy of ChatGPT in supporting CHPtD efforts. The results highlight the practical utility of harnessing ChatGPT in CHPtD sessions to enhance hazard recognition and ultimately promote workplace safety. By leveraging ChatGPT, designers and engineers can better anticipate and mitigate potential hazards during the design phase, thus creating a safer working environment for field workers. This research contributes to addressing the challenges associated with implementing CHPtD by introducing ChatGPT as a valuable tool to support hazard recognition. By demonstrating the effectiveness of ChatGPT in enhancing hazard identification during CHPtD sessions, this study offers a novel approach to promoting the adoption of CHPtD and advancing workplace safety initiatives.