arXiv subjects

Jukka Ruohonen

Publications and source records attributed to Jukka Ruohonen.

At least 37 records · Page 2Linked to original sources

arXiv2025

Vulnerability Patching Across Software Products and Software Components: A Case Study of Red Hat's Product Portfolio

Motivated by software maintenance and the more recent concept of security debt, the paper presents a time series analysis of vulnerability patching of Red Hat's products and components between 1999 and 2024. According to the results based on segmented regression analysis, the amounts of vulnerable products and components have not been stable; a linear trend describes many of the series well. Nor do the amounts align well with trends characterizing vulnerabilities in general. There are also visible breakpoints indicating that the linear trend is not universally applicable and that the growing security debt may be stabilizing.

cs.SE↗

arXiv2025

A Time Series Analysis of Assertions in the Linux Kernel

Assertions are a classical and typical software development technique. These are extensively used also in operating systems and their kernels, including the Linux kernel. The paper fills a gap in existing knowledge by empirically examining the longitudinal evolution of assertion use in the Linux kernel. According to the results, the use of assertions that cause a kernel panic has slightly but not substantially decreased from the kernel's third to the sixth release series. At the same time, the use of softer assertion variants has increased; these do not cause a panic by default but instead produce warnings. With these time series results, the paper contributes to the existing but limited empirical knowledge base about operating system kernels and their long-term evolution.

cs.SE↗

arXiv2025

Tracing Vulnerability Propagation Across Open Source Software Ecosystems

The paper presents a traceability analysis of how over 84 thousand vulnerabilities have propagated across 28 open source software ecosystems. According to the results, the propagation sequences have been complex in general, although GitHub, Debian, and Ubuntu stand out. Furthermore, the associated propagation delays have been lengthy, and these do not correlate well with the number of ecosystems involved in the associated sequences. Nor does the presence or absence of particularly ecosystems in the sequences yield clear, interpretable patterns. With these results, the paper contributes to the overlapping knowledge bases about software ecosystems, traceability, and vulnerabilities.

cs.SE↗

arXiv2025

A Rapid Review Regarding the Concept of Legal Requirements in Requirements Engineering

Out of a personal puzzlement, recent peer review comments, and demonstrable confusion in the existing literature, the paper presents a rapid review of the concept of legal requirements (LRs) in requirements engineering (RE) research. According to reviewing results, a normative understanding of LRs has often been present, although proper definitions and conceptual operationalizations are lacking. Some papers also see LRs as functional and others as non-functional requirements. Legal requirements are often characterized as being vague and complex, requiring a lot of effort to elicit, implement, and validate. These characterizations supposedly correlate with knowledge gaps among requirements engineers. LRs are also seen to often change and overlap. They may be also prioritized. According to the literature, they seem to be also reluctantly implemented, often providing only a minimal baseline for other requirements. With these and other observations, the review raises critical arguments about apparent knowledge gaps, including a lack of empirical evidence backing the observations and enduring conceptual confusion.

cs.SE↗

arXiv2025

Risks and Compliance with the EU's Core Cyber Security Legislation

The European Union (EU) has long favored a risk-based approach to regulation. Such an approach is also used in recent cyber security legislation enacted in the EU. Risks are also inherently related to compliance with the new legislation. Objective: The paper investigates how risks are framed in the EU's five core cyber security legislative acts, whether the framings indicate convergence or divergence between the acts and their risk concepts, and what qualifying words and terms are used when describing the legal notions of risks. Method : The paper's methodology is based on qualitative legal interpretation and taxonomy-building. Results: The five acts have an encompassing coverage of different cyber security risks, including but not limited to risks related to technical, organizational, and human security as well as those not originating from man-made actions. Both technical aspects and assets are used to frame the legal risk notions in many of the legislative acts. A threat-centric viewpoint is also present in one of the acts. Notable gaps are related to acceptable risks, non-probabilistic risks, and residual risks. Conclusion: The EU's new cyber security legislation has significantly extended the risk-based approach to regulations. At the same time, complexity and compliance burden have increased. With this point in mind, the paper concludes with a few practical takeaways about means to deal with compliance and research it.

cs.CR↗

arXiv2025

Snaps: Bloated and Outdated?

Snap is an alternative software packaging system developed by Canonical and provided by default in the Ubuntu Linux distribution. Given the heterogeneity of various Linux distributions and their various releases, Snap allows an interoperable delivery of software directly to users. However, concerns and criticism have also been frequently expressed. Regarding this criticism, the paper shows that currently distributed snap packages are indeed on average bloated in terms of their sizes and outdated in terms updating frequencies. With these empirical observations, this short paper contributes to the research domain of software packaging, software packages, and package managers.

cs.SE↗

arXiv2025

An Empirical Study of Vulnerability Handling Times in CPython

The paper examines the handling times of software vulnerabilities in CPython, the reference implementation and interpreter for the today's likely most popular programming language, Python. The background comes from the so-called vulnerability life cycle analysis, the literature on bug fixing times, and the recent research on security of Python software. Based on regression analysis, the associated vulnerability fixing times can be explained very well merely by knowing who have reported the vulnerabilities. Severity, proof-of-concept code, commits made to a version control system, comments posted on a bug tracker, and references to other sources do not explain the vulnerability fixing times. With these results, the paper contributes to the recent effort to better understand security of the Python ecosystem.

cs.CR↗

arXiv2025

What Do We Know About the Psychology of Insider Threats?

Insider threats refer to threats originating from people inside organizations. Although such threats are a classical research topic, the systematization of existing knowledge is still limited particularly with respect to non-technical research approaches. To this end, this paper presents a systematic literature review on the psychology of insider threats. According to the review results, the literature has operated with multiple distinct theories but there is still a lack of robust theorization with respect to psychology. The literature has also considered characteristics of a person, his or her personal situation, and other more or less objective facts about the person. These are seen to correlate with psychological concepts such as personality traits and psychological states of a person. In addition, the review discusses gaps and limitations in the existing research, thus opening the door for further psychology research.

cs.CR↗

arXiv2025

The Potential of Citizen Platforms for Requirements Engineering of Large Socio-Technical Software Systems

Participatory citizen platforms are innovative solutions to digitally better engage citizens in policy-making and deliberative democracy in general. Although these platforms have been used also in an engineering context, thus far, there is no existing work for connecting the platforms to requirements engineering. The present paper fills this notable gap. In addition to discussing the platforms in conjunction with requirements engineering, the paper elaborates potential advantages and disadvantages, thus paving the way for a future pilot study in a software engineering context. With these engineering tenets, the paper also contributes to the research of large socio-technical software systems in a public sector context, including their implementation and governance.

cs.SE↗

arXiv2025

A Scenario Analysis of Ethical Issues in Dark Patterns and Their Research

Context: Dark patterns are user interface or other software designs that deceive or manipulate users to do things they would not otherwise do. Even though dark patterns have been under active research for a long time, including particularly in computer science but recently also in other fields such as law, systematic applied ethical assessments have generally received only a little attention. Objective: The present work evaluates ethical concerns in dark patterns and their research in software engineering and closely associated disciplines. The evaluation is extended to cover not only dark patterns themselves but also the research ethics and applied ethics involved in studying, developing, and deploying them. Method: A scenario analysis is used to evaluate six theoretical dark pattern scenarios. The ethical evaluation is carried out by focusing on the three main branches of normative ethics; utilitarianism, deontology, and virtue ethics. In terms of deontology, the evaluation is framed and restricted to the laws enacted in the European Union. Results: The evaluation results indicate that dark patterns are not universally morally bad. That said, numerous ethical issues with practical relevance are demonstrated and elaborated. Some of these may have societal consequences. Conclusion: Dark patterns are ethically problematic but not always. Therefore, ethical assessments are necessary. The two main theoretical concepts behind dark patterns, deception and manipulation, lead to various issues also in research ethics. It can be recommended that dark patterns should be evaluated on case-by-case basis, considering all of the three main branches of normative ethics in an evaluation. Analogous points apply to legal evaluations, especially when considering that the real or perceived harms caused by dark patterns cover both material and non-material harms to natural persons.

cs.SE↗

arXiv2025

SoK: The Design Paradigm of Safe and Secure Defaults

In security engineering, including software security engineering, there is a well-known design paradigm telling to prefer safe and secure defaults. The paper presents a systematization of knowledge (SoK) of this paradigm by the means of a systematic mapping study and a scoping review of relevant literature. According to the mapping and review, the paradigm has been extensively discussed, used, and developed further since the late 1990s. Partially driven by the insecurity of the Internet of things, the volume of publications has accelerated from the circa mid-2010s onward. The publications reviewed indicate that the paradigm has been adopted in numerous different contexts. It has also been expanded with security design principles not originally considered when the paradigm was initiated in the mid-1970s. Among the newer principles are an "off by default" principle, various overriding and fallback principles, as well as those related to the zero trust model. The review also indicates problems developers and others have faced with the paradigm.

cs.CR↗

arXiv2025

Early Perspectives on the Digital Europe Programme

A new Digital Europe Programme (DEP), a funding instrument for development and innovation, was established in the European Union (EU) in 2021. The paper makes an empirical inquiry into the projects funded through the DEP. According to the results, the projects align well with the DEP's strategic focus on cyber security, artificial intelligence, high-performance computing, innovation hubs, small- and medium-sized enterprises, and education. Most of the projects have received an equal amount of national and EU funding. Although national origins of participating organizations do not explain the amounts of funding granted, there is a rather strong tendency for national organizations to primarily collaborate with other national organizations. Finally, information about the technological domains addressed and the economic sectors involved provides decent explanatory power for statistically explaining the funding amounts granted. With these results and the accompanying discussion, the paper contributes to the timely debate about innovation, technology development, and industrial policy in Europe.

cs.CY↗

arXiv2024

On Algorithmic Fairness and the EU Regulations

The short paper discusses algorithmic fairness by focusing on non-discrimination and a few important laws in the European Union (EU). In addition to the EU laws addressing discrimination explicitly, the discussion is based on the EU's recently enacted regulation for artificial intelligence (AI) and the older General Data Protection Regulation (GDPR). Through a theoretical scenario analysis, on one hand, the paper demonstrates that correcting discriminatory biases in AI systems can be legally done under the EU regulations. On the other hand, the scenarios also illustrate some practical scenarios from which legal non-compliance may follow. With these scenarios and the accompanying discussion, the paper contributes to the algorithmic fairness research with a few legal insights, enlarging and strengthening also the growing research domain of compliance in AI engineering.

cs.CY↗

arXiv2024

Fast Fixes and Faulty Drivers: An Empirical Analysis of Regression Bug Fixing Times in the Linux Kernel

Regression bugs refer to situations in which something that worked previously no longer works currently. Such bugs have been pronounced in the Linux kernel. The paper focuses on regression bug tracking in the kernel by considering the time required to fix regression bugs. The dataset examined is based on the regzbot automation framework for tracking regressions in the Linux kernel. According to the results, (i) regression bug fixing times have been faster than previously reported; between 2021 and 2024, on average, it has taken less than a month to fix regression bugs. It is further evident that (ii) device drivers constitute the most prone subsystem for regression bugs, and also the fixing times vary across the kernel's subsystems. Although (iii) most commits fixing regression bugs have been reviewed, tested, or both, the kernel's code reviewing and manual testing practices do not explain the fixing times. Likewise, (iv) there is only a weak signal that code churn might contribute to explaining the fixing times statistically. Finally, (v) some subsystems exhibit strong effects for explaining the bug fixing times statistically, although overall statistical performance is modest but not atypical to the research domain. With these empirical results, the paper contributes to the efforts to better understand software regressions and their tracking in the Linux kernel.

cs.SE↗

arXiv2024

Crisis Communication in the Face of Data Breaches

Data breaches refer to unauthorized accesses to data. Typically but not always, data breaches are about cyber crime. An organization facing such a crime is often also in a crisis situation. Therefore, organizations should prepare also for data breaches in their crisis management procedures. These procedures should include also crisis communication plans. To this end, this paper examines data breach crisis communication strategies and their practical executions. The background comes from the vibrant crisis communication research domain. According to a few qualitative case studies from Finland, the conventional wisdom holds well; the successful cases indicate communicating early, taking responsibility, offering an apology, and notifying public authorities. The unsuccessful cases show varying degrees of the reverse, including shifting of blame, positioning of an organization as a victim, and failing to notify public authorities. With these qualitative insights, the paper contributes to the research domain by focusing specifically on data breach crises, their peculiarities, and their management, including with respect to European regulations that have been neglected in existing crisis communication research.

cs.CR↗

arXiv2024

The Incoherency Risk in the EU's New Cyber Security Policies

The European Union (EU) has been pursuing new cyber security policies in recent years. This paper presents a short reflection of four such policies. The focus is on potential incoherency, meaning a lack of integration, divergence between the member states, institutional dysfunction, and other related problems that should be at least partially avoidable by sound policy-making. According to the results, the four policies have substantially increased the complexity of the EU's cyber security framework. In addition, there are potential problems with trust, divergence between industry sectors and different technologies, bureaucratic conflicts, and technical issues, among other things. With these insights, the paper not only contributes to the study of EU policies but also advances the understanding of cyber security policies in general.

cs.CR↗

arXiv2024

An Exploratory Case Study on Data Breach Journalism

This paper explores the novel topic of data breach journalism and data breach news through the case of databreaches.net, a news outlet dedicated to data breaches and related cyber crime. Motivated by the issues in traditional crime news and crime journalism, the case is explored by the means of text mining. According to the results, the outlet has kept a steady publishing pace, mainly focusing on plain and short reporting but with generally high-quality source material for the news articles. Despite these characteristics, the news articles exhibit fairly strong sentiments, which is partially expected due to the presence of emotionally laden crime and the long history of sensationalism in crime news. The news site has also covered the full scope of data breaches, although many of these are fairly traditional, exposing personal identifiers and financial details of the victims. Also hospitals and the healthcare sector stand out. With these results, the paper advances the study of data breaches by considering these from the perspective of media and journalism.

cs.CR↗

arXiv2024

Mysterious and Manipulative Black Boxes: A Qualitative Analysis of Perceptions on Recommender Systems

Recommender systems are used to provide relevant suggestions on various matters. Although these systems are a classical research topic, knowledge is still limited regarding the public opinion about these systems. Public opinion is also important because the systems are known to cause various problems. To this end, this paper presents a qualitative analysis of the perceptions of ordinary citizens, civil society groups, businesses, and others on recommender systems in Europe. The dataset examined is based on the answers submitted to a consultation about the Digital Services Act (DSA) recently enacted in the European Union (EU). Therefore, not only does the paper contribute to the pressing question about regulating new technologies and online platforms, but it also reveals insights about the policy-making of the DSA. According to the qualitative results, Europeans have generally negative opinions about recommender systems and the quality of their recommendations. The systems are widely seen to violate privacy and other fundamental rights. According to many Europeans, these also cause various societal problems, including even threats to democracy. Furthermore, existing regulations in the EU are commonly seen to have failed due to a lack of proper enforcement. Numerous suggestions were made by the respondents to the consultation for improving the situation, but only a few of these ended up to the DSA.

cs.HC↗