arXiv subjects

Jukka Ruohonen

Publications and source records attributed to Jukka Ruohonen.

At least 19 recordsLinked to original sources

arXiv2026

A Bird's-Eye View on Security Considerations in RFCs

Request for comments (RFCs) are Internet standards, memorandums, and related technical documents about core Internet protocols made via and released by the Internet Engineering Task Force (IETF). In the early 1990s each RFC was required to have a section for security considerations. The present work examines these sections. According to the empirical results, (1) over 90% of the RFCs sampled have discussed security explicitly in these sections, (2) although mandatory security requirements have only seldom-if ever-been imposed. Furthermore, (3) the RFC-to-RFC reference network specific to the security consideration sections is sparse, although a few RFCs and their security consideration sections are heavily referenced. In addition, (4) the volume of references peaked during a period from circa mid-1990s to mid-2010s. Regarding the topics discussed in the sections, (5) these do not represent general security issues, such as spoofing or eavesdropping; rather, the topics mostly reflect distinct security issues specific to distinct protocols. With the exceptions of network security in general, security specifications, and routing, (6) also the longitudinal evolution of the topics is protocol-specific. As the subject matter has not been previously examined, these empirical results fill a gap in the standardization literature.

cs.CR↗

arXiv2026

A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System

The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already before their introductions in official releases. The adoption rates have also steadily grown; a linear trend provides a coarse but sensible heuristic. Although particularly programs residing in /usr/bin and /usr/sbin have been modified to use the system calls, the sizes of programs and libraries do not correlate well with the amounts of pledge and unveil system calls invoked. Regarding the pledges made, standard input and output operations have frequently been requested, although the full fine-grained arsenal offered by pledge has generally been utilized in OpenBSD. The same observation is seen in that particularly read operations to given paths have frequently been unveiled. All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.

cs.SE↗

arXiv2026

Digital Sovereignty as a Quality Attribute for Software Architectures

Digital sovereignty (DS) is an increasingly important concept and political agenda throughout the world, including in the European Union (EU). However, the concept is also regrettably vague. With this critical point in mind, the paper presents an analysis of digital sovereignty as a quality attribute for software architectures in the context of cloud computing and the EU's policy frameworks for it. The analysis reveals that DS can be sharpened analytically by conceptualizing it as a quality attribute. The analysis further demonstrates how DS satisfies many of the classical properties of quality attributes for software architectures, including their measurability and validation, the trade-offs they involve, and the scenario-based methodology commonly used for analyzing them.

cs.SE↗

arXiv2026

Undefined Behavior in C and C++: An Experiment With Desktop Use Cases

Undefined behavior is idiomatic to C and C++ programming; such behavior is a use of an erroneous program construct for which the languages impose no requirements, such as integer overflows. The paper presents an empirical experiment seeking to probe the extent of undefined behavior executing underneath typical desktop use of a Linux distribution. The analysis is based on an undefined behavior sanitizer implemented in a compiler. According to the results, undefined behavior is common. By completing 59 simple experimental tasks, nearly 11 thousand unique undefined behavior warnings were generated by 32 unique programs and libraries written in C or C++. Of these warnings, most were associated with the Mesa graphics library and generated by interacting with graphical user interfaces. Merely logging into the GNOME desktop environment generated over 500 unique warnings. Of all warnings, the clear majority was about virtual table pointers. The associated stack traces were also lengthy in general. With these and other results, the paper contributes to the empirical literature on C and C++.

cs.SE↗

arXiv2026

Compliance as Code: A Study of Linux Distributions and Beyond

Compliance as code is an emerging idea about automating compliance through programmed compliance controls and checks. Given scant existing research thus far, the paper presents an empirical analysis of a compliance as code project addressing open source software (OSS) projects and products. The dataset examined covers a little over 1,500 unique compliance rules designed and implemented for 14 Linux distribution releases from five vendors. According to the results, (1) the coverage of the rules varies across the five vendors. Then, (2) the brief rationales provided for the rules do not exhibit statistical similarities but the short code snippets for these do show similarities to some extent. Furthermore, (3) as many as 24 controls are covered from over 10 different organizations, among them governmental agencies, standardization organizations, and non-profit associations. Finally, (4) the rules can be mapped to the essential cyber security requirements of the Cyber Resilience Act (CRA), although only modest agreement exists among the three authors regarding individual mappings. This observation supports an argument that the compliance as code project studied could be updated with new compliance checks. Given that also operating systems are in the CRA's scope when used in a network-connected product, such an updating would have also practical relevance in the nearby future.

cs.SE↗

arXiv2026

The Baby Steps of the European Union Vulnerability Database: An Empirical Inquiry

A new European Union Vulnerability Database (EUVD) was introduced via a legislative act in 2022. The paper examines empirically the meta-data content of the new EUVD. According to the results, actively exploited vulnerabilities archived to the EUVD have been rather severe, having had also high exploitation prediction scores. In both respects they have also surpassed vulnerabilities coordinated by European public authorities. Regarding the European authorities, the Spanish public authority has been particularly active. With the exceptions of Finland, Poland, and Slovakia, other authorities have not engaged thus far. Also the involvement of the European Union's own cyber security agency has been limited. These points notwithstanding, European coordination and archiving to the EUVD exhibit a strong growth trend. With these results, the paper makes an empirical contribution to the ongoing work for better understanding European cyber security governance and practice.

cs.CR↗

arXiv2025

Empirical Derivations from an Evolving Test Suite

The paper presents a longitudinal empirical analysis of the automated, continuous, and virtualization-based software test suite of the NetBSD operating system. The longitudinal period observed spans from the initial roll out of the test suite in the early 2010s to late 2025. According to the results, the test suite has grown continuously, currently covering over ten thousand individual test cases. Failed test cases exhibit overall stability, although there have been shorter periods marked with more frequent failures. A similar observation applies to build failures, failures of the test suite to complete, and installation failures, all of which are also captured by the NetBSD's testing framework. Finally, code churn and kernel modifications do not provide longitudinally consistent statistical explanations for the failures. Although some periods exhibit larger effects, including particularly with respect to the kernel modifications, the effects are small on average. Even though only in an exploratory manner, these empirical observations contribute to efforts to draw conclusions from large-scale and evolving software test suites.

cs.SE↗

arXiv2025

Towards Systematic Specification and Verification of Fairness Requirements: A Position Paper

Decisions suggested by improperly designed software systems might be prone to discriminate against people based on protected characteristics, such as gender and ethnicity. Previous studies attribute such undesired behavior to flaws in algorithmic design or biased data. However, these studies ignore that discrimination is often the result of a lack of well-specified fairness requirements and their verification. The fact that experts' knowledge about fairness is often implicit makes the task of specifying precise and verifiable fairness requirements difficult. In related domains, such as security engineering, knowledge graphs have been proven to be effective in formalizing knowledge to assist requirements specification and verification. To address the lack of formal mechanisms for specifying and verifying fairness requirements, we propose the development of a knowledge graph-based framework for fairness. In this paper, we discuss the challenges, research questions, and a road map towards addressing the research questions.

cs.SE↗

arXiv2025

Vulnerability Patching Across Software Products and Software Components: A Case Study of Red Hat's Product Portfolio

Motivated by software maintenance and the more recent concept of security debt, the paper presents a time series analysis of vulnerability patching of Red Hat's products and components between 1999 and 2024. According to the results based on segmented regression analysis, the amounts of vulnerable products and components have not been stable; a linear trend describes many of the series well. Nor do the amounts align well with trends characterizing vulnerabilities in general. There are also visible breakpoints indicating that the linear trend is not universally applicable and that the growing security debt may be stabilizing.

cs.SE↗

arXiv2025

A Rapid Review Regarding the Concept of Legal Requirements in Requirements Engineering

Out of a personal puzzlement, recent peer review comments, and demonstrable confusion in the existing literature, the paper presents a rapid review of the concept of legal requirements (LRs) in requirements engineering (RE) research. According to reviewing results, a normative understanding of LRs has often been present, although proper definitions and conceptual operationalizations are lacking. Some papers also see LRs as functional and others as non-functional requirements. Legal requirements are often characterized as being vague and complex, requiring a lot of effort to elicit, implement, and validate. These characterizations supposedly correlate with knowledge gaps among requirements engineers. LRs are also seen to often change and overlap. They may be also prioritized. According to the literature, they seem to be also reluctantly implemented, often providing only a minimal baseline for other requirements. With these and other observations, the review raises critical arguments about apparent knowledge gaps, including a lack of empirical evidence backing the observations and enduring conceptual confusion.

cs.SE↗

arXiv2025

Risks and Compliance with the EU's Core Cyber Security Legislation

The European Union (EU) has long favored a risk-based approach to regulation. Such an approach is also used in recent cyber security legislation enacted in the EU. Risks are also inherently related to compliance with the new legislation. Objective: The paper investigates how risks are framed in the EU's five core cyber security legislative acts, whether the framings indicate convergence or divergence between the acts and their risk concepts, and what qualifying words and terms are used when describing the legal notions of risks. Method : The paper's methodology is based on qualitative legal interpretation and taxonomy-building. Results: The five acts have an encompassing coverage of different cyber security risks, including but not limited to risks related to technical, organizational, and human security as well as those not originating from man-made actions. Both technical aspects and assets are used to frame the legal risk notions in many of the legislative acts. A threat-centric viewpoint is also present in one of the acts. Notable gaps are related to acceptable risks, non-probabilistic risks, and residual risks. Conclusion: The EU's new cyber security legislation has significantly extended the risk-based approach to regulations. At the same time, complexity and compliance burden have increased. With this point in mind, the paper concludes with a few practical takeaways about means to deal with compliance and research it.

cs.CR↗

arXiv2025

Snaps: Bloated and Outdated?

Snap is an alternative software packaging system developed by Canonical and provided by default in the Ubuntu Linux distribution. Given the heterogeneity of various Linux distributions and their various releases, Snap allows an interoperable delivery of software directly to users. However, concerns and criticism have also been frequently expressed. Regarding this criticism, the paper shows that currently distributed snap packages are indeed on average bloated in terms of their sizes and outdated in terms updating frequencies. With these empirical observations, this short paper contributes to the research domain of software packaging, software packages, and package managers.

cs.SE↗

arXiv2025

An Alignment Between the CRA's Essential Requirements and the ATT&CK's Mitigations

The paper presents an alignment evaluation between the mitigations present in the MITRE's ATT&CK framework and the essential cyber security requirements of the recently introduced Cyber Resilience Act (CRA) in the European Union. In overall, the two align well with each other. With respect to the CRA, there are notable gaps only in terms of data minimization, data erasure, and vulnerability coordination. In terms of the ATT&CK framework, gaps are present only in terms of threat intelligence, training, out-of-band communication channels, and residual risks. The evaluation presented contributes to narrowing of a common disparity between law and technical frameworks.

cs.CR↗

arXiv2025

Tracing Vulnerability Propagation Across Open Source Software Ecosystems

The paper presents a traceability analysis of how over 84 thousand vulnerabilities have propagated across 28 open source software ecosystems. According to the results, the propagation sequences have been complex in general, although GitHub, Debian, and Ubuntu stand out. Furthermore, the associated propagation delays have been lengthy, and these do not correlate well with the number of ecosystems involved in the associated sequences. Nor does the presence or absence of particularly ecosystems in the sequences yield clear, interpretable patterns. With these results, the paper contributes to the overlapping knowledge bases about software ecosystems, traceability, and vulnerabilities.

cs.SE↗

arXiv2025

A Time Series Analysis of Malware Uploads to Programming Language Ecosystems

Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a problem. To this end, the paper examines the previously overlooked longitudinal aspects of software ecosystem security, focusing on malware uploaded to six popular programming language ecosystems. The dataset examined is based on the new Open Source Vulnerabilities (OSV) database. According to the results, records about detected malware uploads in the database have recently surpassed those addressing vulnerabilities in packages distributed in the ecosystems. In the early 2025 even up to 80% of all entries in the OSV have been about malware. Regarding time series analysis of malware frequencies and their shares to all database entries, good predictions are available already by relatively simple autoregressive models using the numbers of ecosystems, security advisories, and media and other articles as predictors. With these results and the accompanying discussion, the paper improves and advances the understanding of the thus far overlooked longitudinal aspects of ecosystems and malware.

cs.CR↗

arXiv2025

From Cyber Security Incident Management to Cyber Security Crisis Management in the European Union

Incident management is a classical topic in cyber security. Recently, the European Union (EU) has started to consider also the relation between cyber security incidents and cyber security crises. These considerations and preparations, including those specified in the EU's new cyber security laws, constitute the paper's topic. According to an analysis of the laws and associated policy documents, (i) cyber security crises are equated in the EU to large-scale cyber security incidents that either exceed a handling capacity of a single member state or affect at least two member states. For this and other purposes, (ii) the new laws substantially increase mandatory reporting about cyber security incidents, including but not limited to the large-scale incidents. Despite the laws and new governance bodies established by them, however, (iii) the working of actual cyber security crisis management remains unclear particularly at the EU-level. With these policy research results, the paper advances the domain of cyber security incident management research by elaborating how European law perceives cyber security crises and their relation to cyber security incidents, paving the way for many relevant further research topics with practical relevance, whether theoretical, conceptual, or empirical.

cs.CR↗

arXiv2025

A Scenario Analysis of Ethical Issues in Dark Patterns and Their Research

Context: Dark patterns are user interface or other software designs that deceive or manipulate users to do things they would not otherwise do. Even though dark patterns have been under active research for a long time, including particularly in computer science but recently also in other fields such as law, systematic applied ethical assessments have generally received only a little attention. Objective: The present work evaluates ethical concerns in dark patterns and their research in software engineering and closely associated disciplines. The evaluation is extended to cover not only dark patterns themselves but also the research ethics and applied ethics involved in studying, developing, and deploying them. Method: A scenario analysis is used to evaluate six theoretical dark pattern scenarios. The ethical evaluation is carried out by focusing on the three main branches of normative ethics; utilitarianism, deontology, and virtue ethics. In terms of deontology, the evaluation is framed and restricted to the laws enacted in the European Union. Results: The evaluation results indicate that dark patterns are not universally morally bad. That said, numerous ethical issues with practical relevance are demonstrated and elaborated. Some of these may have societal consequences. Conclusion: Dark patterns are ethically problematic but not always. Therefore, ethical assessments are necessary. The two main theoretical concepts behind dark patterns, deception and manipulation, lead to various issues also in research ethics. It can be recommended that dark patterns should be evaluated on case-by-case basis, considering all of the three main branches of normative ethics in an evaluation. Analogous points apply to legal evaluations, especially when considering that the real or perceived harms caused by dark patterns cover both material and non-material harms to natural persons.

cs.SE↗

arXiv2025

A Mapping Analysis of Requirements Between the CRA and the GDPR

A new Cyber Resilience Act (CRA) was recently agreed upon in the European Union (EU). The paper examines and elaborates what new requirements the CRA entails by contrasting it with the older General Data Protection Regulation (GDPR). According to the results, there are overlaps in terms confidentiality, integrity, and availability guarantees, data minimization, traceability, data erasure, and security testing. The CRA's seven new essential requirements originate from obligations to (1) ship products without known exploitable vulnerabilities and (2) with secure defaults, to (3) provide security patches typically for a minimum of five years, to (4) minimize attack surfaces, to (5) develop and enable exploitation mitigation techniques, to (6) establish a software bill of materials (SBOM), and to (7) improve vulnerability coordination, including a mandate to establish a coordinated vulnerability disclosure policy. With these results and an accompanying discussion, the paper contributes to requirements engineering research specialized into legal requirements, demonstrating how new laws may affect existing requirements.

cs.SE↗