{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:34:51Z","timestamp":1791459291045,"version":"4.3.4"},"reference-count":23,"publisher":"Association for Computing Machinery (ACM)","issue":"9","license":[{"start":{"date-parts":[[2019,8,21]],"date-time":"2019-08-21T00:00:00Z","timestamp":1566345600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2019,8,21]]},"abstract":"<jats:p>Software reuse is finally here but comes with risks.<\/jats:p>","DOI":"10.1145\/3347446","type":"journal-article","created":{"date-parts":[[2019,8,23]],"date-time":"2019-08-23T12:00:08Z","timestamp":1566561608000},"page":"36-43","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":57,"title":["Surviving software dependencies"],"prefix":"10.1145","volume":"62","author":[{"given":"Russ","family":"Cox","sequence":"first","affiliation":[{"name":"Google"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,8,21]]},"reference":[{"key":"e_1_2_1_1_1","series-title":"Nov. 2018","volume-title":"Details about the event-stream incident. The npm Blog","author":"Baldwin A.","unstructured":"Baldwin , A. Details about the event-stream incident. The npm Blog ( Nov. 2018 ); https:\/\/bit.ly\/2DRjySJ Baldwin, A. Details about the event-stream incident. The npm Blog (Nov. 2018); https:\/\/bit.ly\/2DRjySJ"},{"key":"e_1_2_1_2_1","unstructured":"Cox R. Go & Versioning 2018; https:\/\/research.swtch.com\/vgo.  Cox R. Go & Versioning 2018; https:\/\/research.swtch.com\/vgo."},{"key":"e_1_2_1_3_1","series-title":"May 2018","volume-title":"The principles of versioning in Go. GopherCon Singapore","author":"Cox R.","unstructured":"Cox , R. The principles of versioning in Go. GopherCon Singapore ( May 2018 ); https:\/\/www.youtube.com\/watch?v=F8nrpe0XWRg. Cox, R. The principles of versioning in Go. GopherCon Singapore (May 2018); https:\/\/www.youtube.com\/watch?v=F8nrpe0XWRg."},{"key":"e_1_2_1_4_1","series-title":"Mar. 2010","volume-title":"RE2: A principled approach to regular expression matching. Google Open Source Blog","author":"Cox R.","unstructured":"Cox , R. RE2: A principled approach to regular expression matching. Google Open Source Blog ( Mar. 2010 ); https:\/\/bit.ly\/2XoLFzC. Cox, R. RE2: A principled approach to regular expression matching. Google Open Source Blog (Mar. 2010); https:\/\/bit.ly\/2XoLFzC."},{"key":"e_1_2_1_5_1","series-title":"Jan. 2012","volume-title":"Regular expression matching with a trigram index or how Google Code Search worked. Swtch.com","author":"Cox R.","unstructured":"Cox , R. Regular expression matching with a trigram index or how Google Code Search worked. Swtch.com ( Jan. 2012 ); https:\/\/swtch.com\/~rsc\/regexp\/regexp4.html. Cox, R. Regular expression matching with a trigram index or how Google Code Search worked. Swtch.com (Jan. 2012); https:\/\/swtch.com\/~rsc\/regexp\/regexp4.html."},{"key":"e_1_2_1_6_1","unstructured":"Facebook. Infer: A tool to detect bugs in Java and C\/ C++\/Objective-C code before it ships; https:\/\/fbinfer.com\/.  Facebook. Infer: A tool to detect bugs in Java and C\/ C++\/Objective-C code before it ships; https:\/\/fbinfer.com\/."},{"key":"e_1_2_1_7_1","volume-title":"GNU General Public License, version 1","author":"Project","year":"1989","unstructured":"GNU Project . GNU General Public License, version 1 , 1989 ; https:\/\/www.gnu.org\/licenses\/old-licenses\/gpl-1.0.html. GNU Project. GNU General Public License, version 1, 1989; https:\/\/www.gnu.org\/licenses\/old-licenses\/gpl-1.0.html."},{"key":"e_1_2_1_8_1","volume-title":"Go 1 and the future of Go programs","author":"Go Project","year":"2013","unstructured":"Go Project . Go 1 and the future of Go programs , 2013 ; https:\/\/golang.org\/doc\/go1compat. Go Project. Go 1 and the future of Go programs, 2013; https:\/\/golang.org\/doc\/go1compat."},{"key":"e_1_2_1_9_1","unstructured":"Google Open Source. Using third-party licenses; https:\/\/opensource.google.com\/docs\/thirdparty\/licenses\/#banned.  Google Open Source. Using third-party licenses; https:\/\/opensource.google.com\/docs\/thirdparty\/licenses\/#banned."},{"key":"e_1_2_1_10_1","unstructured":"Hipp D. R. How SQLite is tested; https:\/\/www.sqlite.org\/testing.html.  Hipp D. R. How SQLite is tested; https:\/\/www.sqlite.org\/testing.html."},{"key":"e_1_2_1_11_1","series-title":"May 2018","volume-title":"Open-sourcing gVisor, a sandboxed container runtime. Google Cloud","author":"Lacasse N.","unstructured":"Lacasse , N. , Open-sourcing gVisor, a sandboxed container runtime. Google Cloud ( May 2018 ); http:\/\/bit.ly\/2wzA84D. Lacasse, N., Open-sourcing gVisor, a sandboxed container runtime. Google Cloud (May 2018); http:\/\/bit.ly\/2wzA84D."},{"key":"e_1_2_1_12_1","series-title":"Aug. 2009","volume-title":"Chromium's seccomp sandbox. ImperialViolet","author":"Langley A.","year":"2009","unstructured":"Langley , A. Chromium's seccomp sandbox. ImperialViolet ( Aug. 2009 ); https:\/\/www.imperialviolet.org\/ 2009 \/08\/26\/seccomp.html. Langley, A. Chromium's seccomp sandbox. ImperialViolet (Aug. 2009); https:\/\/www.imperialviolet.org\/2009\/08\/26\/seccomp.html."},{"key":"e_1_2_1_13_1","unstructured":"National Institute of Standards and Technology. National Vulnerability Database---Search and Statistics; https:\/\/nvd.nist.gov\/vuln\/search.  National Institute of Standards and Technology. National Vulnerability Database---Search and Statistics; https:\/\/nvd.nist.gov\/vuln\/search."},{"key":"e_1_2_1_14_1","unstructured":"Pike R. Go Proverbs 2015; https:\/\/go-proverbs.github.io\/.  Pike R. Go Proverbs 2015; https:\/\/go-proverbs.github.io\/."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1155\/2005\/962135"},{"key":"e_1_2_1_16_1","series-title":"Apr. 2014","volume-title":"Testing Chromium: ThreadSanitizer v2, a next-gen data race detector. Chromium Blog","author":"Potapenko A.","unstructured":"Potapenko , A. Testing Chromium: ThreadSanitizer v2, a next-gen data race detector. Chromium Blog ( Apr. 2014 ); http:\/\/bit.ly\/2WN29o0. Potapenko, A. Testing Chromium: ThreadSanitizer v2, a next-gen data race detector. Chromium Blog (Apr. 2014); http:\/\/bit.ly\/2WN29o0."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2854146"},{"key":"e_1_2_1_18_1","series-title":"Sept. 2008","volume-title":"Multi-process architecture. Chromium Blog","author":"Reis C.","year":"2008","unstructured":"Reis , C. Multi-process architecture. Chromium Blog ( Sept. 2008 ); https:\/\/blog.chromium.org\/ 2008 \/09\/multi-process-architecture.html. Reis, C. Multi-process architecture. Chromium Blog (Sept. 2008); https:\/\/blog.chromium.org\/2008\/09\/multi-process-architecture.html."},{"key":"e_1_2_1_19_1","unstructured":"SpotBugs: Find bugs in Java programs; https:\/\/spotbugs.github.io\/.  SpotBugs: Find bugs in Java programs; https:\/\/spotbugs.github.io\/."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/358198.358210"},{"key":"e_1_2_1_21_1","volume-title":"115th Congress (Dec. 2018)","author":"U.S. House of Representatives Committee on Oversight and Government Reform.","unstructured":"U.S. House of Representatives Committee on Oversight and Government Reform. The Equifax Data Breach, Majority Staff Report , 115th Congress (Dec. 2018) ; http:\/\/bit.ly\/2Gf53IJ. U.S. House of Representatives Committee on Oversight and Government Reform. The Equifax Data Breach, Majority Staff Report, 115th Congress (Dec. 2018); http:\/\/bit.ly\/2Gf53IJ."},{"key":"e_1_2_1_22_1","series-title":"Mar. 2016","volume-title":"A single Node of failure. LWN.net","author":"Willis N.","unstructured":"Willis , N. A single Node of failure. LWN.net ( Mar. 2016 ); https:\/\/lwn.net\/Articles\/681410\/. Willis, N. A single Node of failure. LWN.net (Mar. 2016); https:\/\/lwn.net\/Articles\/681410\/."},{"key":"e_1_2_1_23_1","volume-title":"C++ standing document","author":"Winters T.","year":"2018","unstructured":"Winters , T. SD-8: Standard library compatibility , C++ standing document , 2018 ; http:\/\/bit.ly\/2QNhT5k. Winters, T. SD-8: Standard library compatibility, C++ standing document, 2018; http:\/\/bit.ly\/2QNhT5k."}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3347446","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3347446","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T19:05:46Z","timestamp":1750273546000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3347446"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,8,21]]},"references-count":23,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2019,8,21]]}},"alternative-id":["10.1145\/3347446"],"URL":"https:\/\/doi.org\/10.1145\/3347446","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"value":"0001-0782","type":"print"},{"value":"1557-7317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,8,21]]},"assertion":[{"value":"2019-08-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}