arXiv subjects

Matteo Esposito

Publications and source records attributed to Matteo Esposito.

45 records · Page 3Linked to original sources

arXiv2024

The Dual-Edged Sword of Technical Debt: Benefits and Issues Analyzed Through Developer Discussions

Background. Technical debt (TD) has long been one of the key factors influencing the maintainability of software products. It represents technical compromises that sacrifice long-term software quality for potential short-term benefits. Objective. This work is to collectively investigate the practitioners' opinions on the various perspectives of TD from a large collection of articles. We find the topics and latent details of each, where the sentiments of the detected opinions are also considered. Method. For such a purpose, we conducted a grey literature review on the articles systematically collected from three mainstream technology forums. Furthermore, we adopted natural language processing techniques like topic modeling and sentiment analysis to achieve a systematic and comprehensive understanding. However, we adopted ChatGPT to support the topic interpretation. Results. In this study, 2,213 forum posts and articles were collected, with eight main topics and 43 sub-topics identified. For each topic, we obtained the practitioners' collective positive and negative opinions. Conclusion. We identified 8 major topics in TD related to software development. Identified challenges by practitioners include unclear roles and a lack of engagement. On the other hand, active management supports collaboration and mitigates the impact of TD on the source code.

cs.SE↗

arXiv2024

In Search of Metrics to Guide Developer-Based Refactoring Recommendations

Context. Source code refactoring is a well-established approach to improving source code quality without compromising its external behavior. Motivation. The literature described the benefits of refactoring, yet its application in practice is threatened by the high cost of time, resource allocation, and effort required to perform it continuously. Providing refactoring recommendations closer to what developers perceive as relevant may support the broader application of refactoring in practice and drive prioritization efforts. Aim. In this paper, we aim to foster the design of a developer-based refactoring recommender, proposing an empirical study into the metrics that study the developer's willingness to apply refactoring operations. We build upon previous work describing the developer's motivations for refactoring and investigate how product and process metrics may grasp those motivations. Expected Results. We will quantify the value of product and process metrics in grasping developers' motivations to perform refactoring, thus providing a catalog of metrics for developer-based refactoring recommenders to use.

cs.SE↗

arXiv2024

Early Career Developers' Perceptions of Code Understandability. A Study of Complexity Metrics

Context. Code understandability is fundamental. Developers need to understand the code they are modifying clearly. A low understandability can increase the amount of coding effort, and misinterpreting code impacts the entire development process. Ideally, developers should write clear and understandable code with the least effort. Aim. Our work investigates whether the McCabe Cyclomatic Complexity or the Cognitive Complexity can be a good predictor for the developers' perceived code understandability to understand which of the two complexities can be used as criteria to evaluate if a piece of code is understandable. Method. We designed and conducted an empirical study among 216 early career developers with professional experience ranging from one to four years. We asked them to manually inspect and rate the understandability of 12 Java classes that exhibit different levels of Cyclomatic and Cognitive Complexity. Results. Our findings showed that while the old-fashioned McCabe Cyclomatic Complexity and the most recent Cognitive Complexity are modest predictors for code understandability when considering the complexity perceived by early-career developers, they are not for problem severity. Conclusions. Based on our results, early-career developers should not be left alone when performing code-reviewing tasks due to their scarce experience. Moreover, low complexity measures indicate good understandability, but having either CoC or CyC high makes understandability unpredictable. Nevertheless, there is no evidence that CyC or CoC are indicators of early-career perceived severity.Future research efforts will focus on expanding the population to experienced developers to confront whether seniority influences the predictive power of the chosen metrics.

cs.SE↗

arXiv2024

6GSoft: Software for Edge-to-Cloud Continuum

In the era of 6G, developing and managing software requires cutting-edge software engineering (SE) theories and practices tailored for such complexity across a vast number of connected edge devices. Our project aims to lead the development of sustainable methods and energy-efficient orchestration models specifically for edge environments, enhancing architectural support driven by AI for contemporary edge-to-cloud continuum computing. This initiative seeks to position Finland at the forefront of the 6G landscape, focusing on sophisticated edge orchestration and robust software architectures to optimize the performance and scalability of edge networks. Collaborating with leading Finnish universities and companies, the project emphasizes deep industry-academia collaboration and international expertise to address critical challenges in edge orchestration and software architecture, aiming to drive significant advancements in software productivity and market impact.

cs.SE↗

arXiv2024

$Classi|Q\rangle$ Towards a Translation Framework To Bridge The Classical-Quantum Programming Gap

Quantum computing, albeit readily available as hardware or emulated on the cloud, is still far from being available in general regarding complex programming paradigms and learning curves. This vision paper introduces $Classi|Q\rangle$, a translation framework idea to bridge Classical and Quantum Computing by translating high-level programming languages, e.g., Python or C++, into a low-level language, e.g., Quantum Assembly. Our idea paper serves as a blueprint for ongoing efforts in quantum software engineering, offering a roadmap for further $Classi|Q\rangle$ development to meet the diverse needs of researchers and practitioners. $Classi|Q\rangle$ is designed to empower researchers and practitioners with no prior quantum experience to harness the potential of hybrid quantum computation. We also discuss future enhancements to $Classi|Q\rangle$, including support for additional quantum languages, improved optimization strategies, and integration with emerging quantum computing platforms.

cs.SE↗

arXiv2024

QCSHQD: Quantum computing as a service for Hybrid classical-quantum software development: A Vision

Quantum Computing (QC) is transitioning from theoretical frameworks to an indispensable powerhouse of computational capability, resulting in extensive adoption across both industrial and academic domains. QC presents exceptional advantages, including unparalleled processing speed and the potential to solve complex problems beyond the capabilities of classical computers. Nevertheless, academic researchers and industry practitioners encounter various challenges in harnessing the benefits of this technology. The limited accessibility of QC resources for classical developers, and a general lack of domain knowledge and expertise, represent insurmountable barrier, hence to address these challenges, we introduce a framework- Quantum Computing as a Service for Hybrid Classical-Quantum Software Development (QCSHQD), which leverages service-oriented strategies. Our framework comprises three principal components: an Integrated Development Environment (IDE) for user interaction, an abstraction layer dedicated to orchestrating quantum services, and a service provider responsible for executing services on quantum computer. This study presents a blueprint for QCSHQD, designed to democratize access to QC resources for classical developers who want to seamless harness QC power. The vision of QCSHQD paves the way for groundbreaking innovations by addressing key challenges of hybridization between classical and quantum computers.

cs.SE↗

arXiv2024

Leveraging Large Language Models for Preliminary Security Risk Analysis: A Mission-Critical Case Study

Preliminary security risk analysis (PSRA) provides a quick approach to identify, evaluate and propose remeditation to potential risks in specific scenarios. The extensive expertise required for an effective PSRA and the substantial ammount of textual-related tasks hinder quick assessments in mission-critical contexts, where timely and prompt actions are essential. The speed and accuracy of human experts in PSRA significantly impact response time. A large language model can quickly summarise information in less time than a human. To our knowledge, no prior study has explored the capabilities of fine-tuned models (FTM) in PSRA. Our case study investigates the proficiency of FTM to assist practitioners in PSRA. We manually curated 141 representative samples from over 50 mission-critical analyses archived by the industrial context team in the last five years.We compared the proficiency of the FTM versus seven human experts. Within the industrial context, our approach has proven successful in reducing errors in PSRA, hastening security risk detection, and minimizing false positives and negatives. This translates to cost savings for the company by averting unnecessary expenses associated with implementing unwarranted countermeasures. Therefore, experts can focus on more comprehensive risk analysis, leveraging LLMs for an effective preliminary assessment within a condensed timeframe.

cs.SE↗

arXiv2024

An Extensive Comparison of Static Application Security Testing Tools

Context: Static Application Security Testing Tools (SASTTs) identify software vulnerabilities to support the security and reliability of software applications. Interestingly, several studies have suggested that alternative solutions may be more effective than SASTTs due to their tendency to generate false alarms, commonly referred to as low Precision. Aim: We aim to comprehensively evaluate SASTTs, setting a reliable benchmark for assessing and finding gaps in vulnerability identification mechanisms based on SASTTs or alternatives. Method: Our SASTTs evaluation is based on a controlled, though synthetic, Java codebase. It involves an assessment of 1.5 million test executions, and it features innovative methodological features such as effort-aware accuracy metrics and method-level analysis. Results: Our findings reveal that SASTTs detect a tiny range of vulnerabilities. In contrast to prevailing wisdom, SASTTs exhibit high Precision while falling short in Recall. Conclusions: The paper suggests that enhancing Recall, alongside expanding the spectrum of detected vulnerability types, should be the primary focus for improving SASTTs or alternative approaches, such as machine learning-based vulnerability identification solutions.

cs.SE↗

arXiv2022

Weighing Cosmic Structures with Clusters of Galaxies and the Intergalactic Medium

We present an analysis aimed at combining cosmological constraints from number counts of galaxy clusters identified through the Sunyaev-Zeldovich effect, obtained with the South Pole Telescope (SPT), and from Lyman-$α$ spectra obtained with the MIKE/HIRES and X-shooter spectrographs. The SPT cluster analysis relies on mass calibration based on weak lensing measurements, while the Lyman-$α$ analysis is built over a suite of hydrodynamical simulations for the extraction of mock spectra. The resulting constraints exhibit a tension ($\sim 3.3σ$) between the low $σ_8$ values preferred by the low-redshift cluster data, $σ_8=0.74 ^{+0.03}_{-0.04}$, and the higher one preferred by the high-redshift Lyman-$α$ data, $σ_8=0.91 ^{+0.03}_{-0.03}$. We present a detailed analysis in order to understand the origin of this tension and, in particular, to establish whether it arises from systematic uncertainties related to the assumptions underlying the analyses of cluster counts and/or Lyman-$α$ forest. We found this tension to be robust with respect to the choice of modeling of the IGM, even when including possible systematics from unaccounted sub-Damped Lyman-$α$ (DLA) and Lyman-limit systems (LLS) in the Lyman-$α$ data. We conclude that to solve this tension from the SPT side would require a large bias on the cluster mass estimate, or from the Lyman-$α$ side large unaccounted errors on the Lyman-$α$ mean fluxes, respectively. Our results have important implications for future analyses based on cluster number counts from future large photometric surveys (e.g. Euclid and LSST) and on larger samples of high-redshift quasar spectra (e.g. DESI and WEAVE surveys). If confirmed at the much higher statistical significance reachable by such surveys, this tension could represent a significant challenge for the standard $Λ$CDM paradigm.

astro-ph.CO↗