{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T03:56:47Z","timestamp":1784606207324,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,9,21]],"date-time":"2020-09-21T00:00:00Z","timestamp":1600646400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Cybersecurity Education, Research and Outreach Center (CEROC) at Tennessee Tech. University"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,9,21]]},"DOI":"10.1145\/3417113.3422153","type":"proceedings-article","created":{"date-parts":[[2021,1,22]],"date-time":"2021-01-22T17:46:50Z","timestamp":1611337610000},"page":"13-18","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Vulnerability discovery strategies used in software projects"],"prefix":"10.1145","author":[{"given":"Farzana Ahamed","family":"Bhuiyan","sequence":"first","affiliation":[{"name":"Department of Computer Science"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Akond","family":"Rahman","sequence":"additional","affiliation":[{"name":"Department of Computer Science"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Morrison","sequence":"additional","affiliation":[{"name":"IBM"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,1,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.5555\/3133461"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180180"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2011.18"},{"key":"e_1_3_2_1_4_1","volume-title":"Verifiability Package for Paper. https:\/\/figshare.com\/s\/eaac5aeea283239f2c56. [Online","author":"Bhuiyan Farzana Ahamed","year":"2020"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.5555\/579090"},{"key":"e_1_3_2_1_6_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1275400. [Online","author":"Perry Brandon","year":"2020"},{"key":"e_1_3_2_1_7_1","unstructured":"C. Evans and C. Palmer. 2011. Public Key Pinning Extension for HTTP. https:\/\/tools.ietf.org\/html\/draft-ietf-websec-key-pinning-01. [Online; accessed 15-Feb-2020].  C. Evans and C. Palmer. 2011. Public Key Pinning Extension for HTTP. https:\/\/tools.ietf.org\/html\/draft-ietf-websec-key-pinning-01. [Online; accessed 15-Feb-2020]."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338947"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106285"},{"key":"e_1_3_2_1_10_1","volume-title":"Chrome infrastructure. https:\/\/chromium.googlesource.com\/infra\/infra\/+\/master\/appengine\/monorail\/doc\/api.md. [Online","year":"2020"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1177\/001316446002000104"},{"key":"e_1_3_2_1_12_1","unstructured":"Benjamin F Crabtree and William L Miller. 1999. Doing qualitative research. sage publications.  Benjamin F Crabtree and William L Miller. 1999. Doing qualitative research. sage publications."},{"key":"e_1_3_2_1_13_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=916580. [Online","author":"Gohman Dan","year":"2020"},{"key":"e_1_3_2_1_14_1","volume-title":"The Importance of Learning From Hackers. https:\/\/www.securityweek.com\/importance-learning-hackers. [Online","author":"Danelle Au.","year":"2020"},{"key":"e_1_3_2_1_15_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-0829. [Online","author":"National Vulnerability Database. 2015. NVD-CVE-2015-0829.","year":"2020"},{"key":"e_1_3_2_1_16_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-5262. [Online","author":"National Vulnerability Database. 2016. NVD-CVE-2016-5262.","year":"2020"},{"key":"e_1_3_2_1_17_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-5824. [Online","author":"National Vulnerability Database. 2016. NVD-CVE-2016-5824.","year":"2020"},{"key":"e_1_3_2_1_18_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-7761. [Online","author":"National Vulnerability Database. 2017. NVD-CVE-2017-7761.","year":"2020"},{"key":"e_1_3_2_1_19_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-7792. [Online","author":"National Vulnerability Database. 2017. NVD-CVE-2017-7792.","year":"2020"},{"key":"e_1_3_2_1_20_1","volume-title":"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-5158. [Online","author":"National Vulnerability Database. 2018. NVD-CVE-2018-5158.","year":"2020"},{"key":"e_1_3_2_1_21_1","volume-title":"The Platform for Open Innovation and Collaboration. https:\/\/www.eclipse.org\/. [Online","year":"2020"},{"key":"e_1_3_2_1_22_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=961512. [Online","author":"Akhgari Ehsan","year":"2020"},{"key":"e_1_3_2_1_23_1","volume-title":"Strategies to find software vulnerabilities: what are the categories? https:\/\/www.reddit.com\/r\/cybersecurity\/comments\/egflzj\/strategies_to_find_software_vulnerabilities_what\/. [Online","year":"2020"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2010.5463340"},{"key":"e_1_3_2_1_25_1","volume-title":"How to Think Like a Hacker. https:\/\/www.darkreading.com\/vulnerabilities---threats\/how-to-think-like-a-hacker\/a\/d-id\/1335989. [Online","author":"Vigna Giovanni","year":"2020"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/2486788.2486840"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2020.106314"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338941"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.2307\/2529310"},{"key":"e_1_3_2_1_30_1","volume-title":"Software Security: Building Security In","author":"McGraw Gary","year":"2018"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2013.70"},{"key":"e_1_3_2_1_32_1","volume-title":"Mozilla Foundation Security Advisory 2014-19. https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2014-19\/. [Online","year":"2020"},{"key":"e_1_3_2_1_33_1","volume-title":"Mozilla Foundation Security Advisory 2015-13. https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2015-13\/. [Online","year":"2020"},{"key":"e_1_3_2_1_34_1","volume-title":"Bugzilla Main Page. https:\/\/bugzilla.mozilla.org\/home. [Online","year":"2020"},{"key":"e_1_3_2_1_35_1","volume-title":"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/WebRTC_API. [Online","author":"Network Mozilla Developer","year":"2020"},{"key":"e_1_3_2_1_36_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1065909. [Online","author":"Nishimura Muneaki","year":"2020"},{"key":"e_1_3_2_1_37_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1277475. [Online","author":"Bug","year":"2020"},{"key":"e_1_3_2_1_38_1","volume-title":"Openstack - Build the future of Open Infrastructure. https:\/\/www.openstack.org\/. [Online","year":"2020"},{"key":"e_1_3_2_1_39_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1128939. [Online","author":"Bug","year":"2020"},{"key":"e_1_3_2_1_40_1","volume-title":"PHP Bug Tracking System. https:\/\/bugs.php.net\/. [Online","author":"PHP.","year":"2020"},{"key":"e_1_3_2_1_41_1","volume-title":"Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). https:\/\/tools.ietf.org\/html\/rfc6979. [Online","author":"Pornin T.","year":"2020"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3314058.3317294"},{"key":"e_1_3_2_1_43_1","volume-title":"The coding manual for qualitative researchers","author":"Saldana Johnny"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-011-9190-8"},{"key":"e_1_3_2_1_45_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1368652. [Online","author":"Smith Tyson","year":"2020"},{"key":"e_1_3_2_1_46_1","volume-title":"http:\/\/www.valgrind.org\/. [Online","author":"Home Valgrind","year":"2020"},{"key":"e_1_3_2_1_47_1","volume-title":"https:\/\/www.w3docs.com\/learn-html\/html-marquee-tag.html. [Online","author":"Tag HTML","year":"2020"},{"key":"e_1_3_2_1_48_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1125025. [Online","author":"Bug","year":"2020"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/IECON.2014.7049035"},{"key":"e_1_3_2_1_50_1","volume-title":"https:\/\/wiki.mozilla.org\/SecurityEngineering\/Public_Key_Pinning. [Online","author":"Wiki Mozilla","year":"2020"},{"key":"e_1_3_2_1_51_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1215648. [Online","author":"Palant Wladimir","year":"2020"},{"key":"e_1_3_2_1_52_1","volume-title":"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1452075. [Online","author":"Palant Wladimir","year":"2020"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786852"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2949275"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2010.32"}],"event":{"name":"ASE '20: 35th IEEE\/ACM International Conference on Automated Software Engineering","location":"Virtual Event Australia","acronym":"ASE '20","sponsor":["SIGAI ACM Special Interest Group on Artificial Intelligence","SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS"]},"container-title":["Proceedings of the 35th IEEE\/ACM International Conference on Automated Software Engineering Workshops"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3417113.3422153","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3417113.3422153","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:48:12Z","timestamp":1750193292000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3417113.3422153"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,9,21]]},"references-count":55,"alternative-id":["10.1145\/3417113.3422153","10.1145\/3417113"],"URL":"https:\/\/doi.org\/10.1145\/3417113.3422153","relation":{},"subject":[],"published":{"date-parts":[[2020,9,21]]},"assertion":[{"value":"2021-01-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}