Author

Zadia Codabux

43 papers · 2009–2026

2009peak 7 in 20232026

Frequent co-authors

Papers

showing 1–25 of 43 RSS

Managing technical debt: An industrial case study

Zadia Codabux, Byron J. Williams

Information Systems · May 2013 · cited 89× · DOI ↗ · more like this ·

Technical debt is the consequence of trade-offs made during software development to ensure speedy releases. The research community lacks rigorously evaluated guidelines to help practitioners characterize, manage and prioritize debt. This paper describes a study conducted with an industrial partner during their implementation of Agile development practices for a large software development division within the company. The report contains our initial findings based on ethnographic observations and semi-structured interviews. The goal is to identify the best practices regarding managing technical debt so that the researchers and the practitioners can further evaluate these practices to extend their knowledge of the technical debt metaphor. We determined that the developers considered their own taxonomy of technical debt based on the type of work they were assigned and their personal…

The Correspondence Between Software Quality Models and Technical Debt Estimation Approaches

Isaac Griffith, Derek Reimanis, Clemente Izurieta +3 more

Information Systems · September 2014 · cited 36× · DOI ↗ · more like this ·

Technical debt has recently become a major concern in the software industry. While it has been shown that technical debt has an adverse effect on the quality of a software system, there has been little work to explore this relationship. Further, with the growing number of approaches to estimate the technical debt principal of a software system, there is a dearth of work to empirically validate the relationship between technical debt scores produced by practical tools against established theoretical quality models. We conducted a case study across 10 releases of 10 open source systems in order to evaluate three proposed methods of technical debt principal estimation. The evaluation compares each technique against an external quality model. We found that only one estimation technique had a strong correlation to the quality attributes reusability and understand ability. In a multiple…

Technical Debt in the Peer-Review Documentation of R Packages: a rOpenSci Case Study

Zadia Codabux, Melina Vidoni, Fatemeh H. Fard

cs.SE · 16 Mar 2021 · cited 27× · arXiv ↗ · more like this ·

Context: Technical Debt is a metaphor used to describe code that is "not quite right." Although TD studies have gained momentum, TD has yet to be studied as thoroughly in non-Object-Oriented (OO) or scientific software such as R. R is a multi-paradigm programming language, whose popularity in data science and statistical applications has amplified in recent years. Due to R's inherent ability to expand through user-contributed packages, several community-led organizations were created to organize and peer-review packages in a concerted effort to increase their quality. Nonetheless, it is well-known that most R users do not have a technical programming background, being from multiple disciplines. Objective: The goal of this study is to investigate TD in the peer-review documentation of R packages led by rOpenSci. Method: We collected over 5000 comments from 157 packages that had been…

Self-admitted technical debt in R: detection and causes

Rishab Sharma, Ramin Shahbazi, Fatemeh H. Fard +2 more

Information Systems · Automated Software Engineering · 25 Aug 2022 · cited 25× · DOI ↗ · more like this ·

Abstract Self-Admitted Technical Debt (SATD) is primarily studied in Object-Oriented (OO) languages and traditionally commercial software. However, scientific software coded in dynamically-typed languages such as R differs in paradigm, and the source code comments’ semantics are different (i.e., more aligned with algorithms and statistics when compared to traditional software). Additionally, many Software Engineering topics are understudied in scientific software development, with SATD detection remaining a challenge for this domain. This gap adds complexity since prior works determined SATD in scientific software does not adjust to many of the keywords identified for OO SATD, possibly hindering its automated detection. Therefore, we investigated how classification models (traditional machine learning, deep neural networks, and deep neural Pre-Trained Language Models (PTMs))…

Toward Understanding the Impact of Refactoring on Program Comprehension

Giulia Sellitto, Emanuele Iannone, Zadia Codabux +4 more

Information Systems · 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · March 2022 · cited 22× · DOI ↗ · more like this ·

Software refactoring is the activity associated with developers changing the internal structure of source code without modifying its external behavior. The literature argues that refactoring might have beneficial and harmful implications for software maintainability, primarily when performed without the support of automated tools. This paper continues the narrative on the effects of refactoring by exploring the dimension of program comprehension, namely the property that describes how easy it is for developers to understand source code. We start our investigation by assessing the basic unit of program comprehension, namely program readability. Next, we set up a large-scale empirical investigation – conducted on 156 open-source projects – to quantify the impact of refactoring on program readability. First, we mine refactoring data and, for each commit involving a…

Technical debt prioritization using predictive analytics

Zadia Codabux, Byron J. Williams

Information Systems · 14 May 2016 · cited 22× · DOI ↗ · more like this ·

Recently, Technical Debt (TD) has gained popularity in the Software Engineering community to describe design decisions that allow software development teams to achieve short term benefits such as expedited release of code. Technical debt accrued should be managed to avoid the disastrous consequences of these temporary workarounds. Management of technical debt involve documenting the debt item in the backlog including some type of quantification in terms of person-hours or story points for example. Subsequently, the debt items are prioritized and addressed. Developers or project managers face problems to decide which debt is higher priority or more "problematic" and which one needs to be addressed first. This decision-making process is not standardized and is currently context dependent in most organizations. This paper bridge this gap by proposing a framework which makes use of a…

An empirical assessment of technical debt practices in industry

Zadia Codabux, Byron J. Williams, Gary L. Bradshaw +1 more

Information Systems · Journal of Software Evolution and Process · 25 Aug 2017 · cited 21× · DOI ↗ · more like this ·

Abstract Context Technical debt refers to the consequences of taking shortcuts when developing software. These consequences can impede the software growth and have financial implications. The software engineering research community needs to explore technical debt further from a practitioner standpoint. Objective This study gathers insights from practitioners on key components of technical debt such as its definition, characterization, consequences, benefits, and how it is communicated. Method We conducted semi‐structured interviews with a convenience sample of 17 practitioners and a survey of 67 participants. Results Despite the lack of consensus, we identified the most commonly accepted definition, method to measure technical debt (as person hours), and method to reduce debt (by allocating time in iterations to address the debt). Defects were also identified as type of debt and the…

Rubbing salt in the wound? A large-scale investigation into the effects of refactoring on security

Emanuele Iannone, Zadia Codabux, Valentina Lenarduzzi +2 more

Information Systems · Empirical Software Engineering · 24 May 2023 · cited 11× · DOI ↗ · more like this ·

Abstract Software refactoring is a behavior-preserving activity to improve the source code quality without changing its external behavior. Unfortunately, it is often a manual and error-prone task that may induce regressions in the source code. Researchers have provided initial compelling evidence of the relation between refactoring and defects, yet little is known about how much it may impact software security. This paper bridges this knowledge gap by presenting a large-scale empirical investigation into the effects of refactoring on the security profile of applications. We conduct a three-level mining software repository study to establish the impact of 14 refactoring types on (i) security-related metrics, (ii) security technical debt, and (iii) the introduction of known vulnerabilities. The study covers 39 projects and a total amount of 7,708 refactoring commits. The key results show…

Do Words Have Power? Understanding and Fostering Civility in Code Review Discussion

Md Shamimur Rahman, Zadia Codabux, Chanchal K. Roy

Law · Proceedings of the ACM on software engineering. · 12 Jul 2024 · cited 7× · DOI ↗ · more like this ·

Modern Code Review (MCR) is an integral part of the software development process where developers improve product quality through collaborative discussions. Unfortunately, these discussions can sometimes become heated by the presence of inappropriate behaviors such as personal attacks, insults, disrespectful comments, and derogatory conduct, often referred to as incivility. While researchers have extensively explored such incivility in various public domains, our understanding of its causes, consequences, and courses of action remains limited within the professional context of software development, specifically within code review discussions. To bridge this gap, our study draws upon the experience of 171 professional software developers representing diverse development practices across different geographical regions. Our findings reveal that more than half of these developers <mml:math…

Large Language Model vs. Stack Overflow in Addressing Android Permission Related Challenges

Sahrima Jannat Oishwee, Natalia Stakhanova, Zadia Codabux

Signal Processing · 15 Apr 2024 · cited 7× · DOI ↗ · more like this ·

The Android permission system regulates access to sensitive mobile device resources such as camera and location. To access these resources, third-party developers need to request permissions. However, the Android permission system is complex and fast-evolving, presenting developers with numerous challenges surrounding compatibility issues, misuse of permissions, and vulnerabilities related to permissions. Our study aims to explore whether Large Language Models (LLMs) can serve as a reliable tool to assist developers in using Android permissions correctly and securely, thereby reducing the risks of misuse and security vulnerabilities in apps. In our study, we analyzed 1,008 Stack Overflow questions related to Android permissions and their accepted answers. In parallel, we generate answers to these questions using a popular LLM tool, ChatGPT. We focused on how well the ChatGPT's responses…

Exploring Technical Debt in Security Questions on Stack Overflow

Joshua Aldrich Edbert, Sahrima Jannat Oishwee, Shubhashis Karmakar +2 more

cs.SE · 21 Jul 2023 · cited 7× · arXiv ↗ · more like this ·

Background: Software security is crucial to ensure that the users are protected from undesirable consequences such as malware attacks which can result in loss of data and, subsequently, financial loss. Technical Debt (TD) is a metaphor incurred by suboptimal decisions resulting in long-term consequences such as increased defects and vulnerabilities if not managed. Although previous studies have studied the relationship between security and TD, examining their intersection in developers' discussion on Stack Overflow (SO) is still unexplored. Aims: This study investigates the characteristics of security-related TD questions on SO. More specifically, we explore the prevalence of TD in security-related queries, identify the security tags most prone to TD, and investigate which user groups are more aware of TD. Method: We mined 117,233 security-related questions on SO and used a…

The Relationship between Traceable Code Patterns and Code Smells

Zadia Codabux, Kazi Zakia Sultana, Byron J. Williams

Information Systems · Proceedings/Proceedings of the ... International Conference on Software Engineering and Knowledge Engineering · 5 Jul 2017 · cited 7× · DOI ↗ · more like this ·

Context: It is important to maintain software quality as a software system evolves. Managing code smells in source code contributes towards quality software. While metrics have been used to pinpoint code smells in source code, we present an empirical study on the correlation of code smells with class-level (micro pattern) and methodlevel (nano-pattern) traceable patterns of code. Objective: This study explores the relationship between code smells and class-level and method-level structural code constructs. Method: We extracted micro patterns at the class level and nano-patterns at the method level from three versions of Apache Tomcat and PersonalBlog and Roller from Standford SecuriBench and compared their distributions in code smell versus non-code smell classes and methods.Result: We found that DataM anager, Record and Outline micro patterns are more frequent in classes having code…

An exploratory study on the relationship of smells and design issues with software vulnerabilities

Sahrima Jannat Oishwee, Zadia Codabux, Natalia Stakhanova

Information Systems · 7 Nov 2022 · cited 5× · DOI ↗ · more like this ·

Software vulnerabilities are one of the leading causes of the loss of confidential data resulting in financial damages in the industry. As a result, software companies strive to discover potential vulnerabilities before the software is deployed. While traditionally, software metrics have been widely used to uncover vulnerabilities, more recent studies have been looking at code smells to detect vulnerabilities. This preliminary study explores the relationship between smells, design issues, and software vulnerabilities. As smells and design issues are indicators of potential problems in the software, establishing a relationship with vulnerabilities can be helpful for vulnerability prediction. In this study, we analyzed 561 versions of nine open-source software by exploring the smells and design issues in the vulnerable and non-vulnerable classes. We found that some smells and design…

On the Benefits of the Accelerate Metrics: An Industrial Survey at Vendasta

Francesco Lomio, Zadia Codabux, Dale Birtch +2 more

Computer Networks and Communications · 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · March 2022 · cited 5× · DOI ↗ · more like this ·

The popularity of the Accelerate metrics is increasing in the industry. The Accelerate metrics are four key metrics to evaluate the software delivery performance: lead time for changes, deployment frequency, mean time to recover, change fail rate. However, their benefits in monitoring the development process performance of microservice-based systems have not been evaluated. In this study, we analyze the case of Vendasta, a Canadian company that migrated to microservices two years ago and adopted the Accelerate metrics to monitor their development process. Our goal is to understand whether these metrics are beneficial in the microservices context from the practitioners' point of view. Therefore, we surveyed employees from different teams and obtained 62 responses. Our results show that the Accelerate metrics provide a good overview of the process issues and are particularly…

A Preliminary Study on Common Programming Mistakes that Lead to Buffer Overflow Vulnerability

Giovanni George, Jeremiah Kotey, Megan Ripley +2 more

Artificial Intelligence · July 2021 · cited 5× · DOI ↗ · more like this ·

When vulnerabilities are exploited, the impact can be insignificant or detrimental, depending on the attack’s nature. Research found that buffer overflow is one of the most widespread and frequently reported vulnerabilities that result in system crashes. This study investigates the frequent errors in the source code of production software that lead to buffer overflow such that its causes can be determined. The findings of the study can help guide developers to avoid these programming errors. Therefore, our study’s primary objective is to analyze vulnerable code components of software repositories and extract the developers’ frequent programming mistakes that have resulted in a buffer overflow attack. Sixteen vulnerable code components and relevant resolutions were selected from three popular and well-known systems: Android, Eclipse, and Red Hat, to be analyzed. The results show that…

The Relationship Between Code Smells and Traceable Patterns — Are They Measuring the Same Thing?

Zadia Codabux, Kazi Zakia Sultana, Byron J. Williams

Information Systems · International Journal of Software Engineering and Knowledge Engineering · November 2017 · cited 5× · DOI ↗ · more like this ·

It is important to maintain software quality as a software system evolves. Managing code smells in source code contributes towards quality software. While metrics have been used to pinpoint code smells in source code, we present an empirical study on the correlation of code smells with class-level (micro pattern) and method-level (nano-pattern) traceable code patterns. This study explores the relationship between code smells and class-level and method-level structural code constructs. We extracted micro patterns at the class level and nano-patterns at the method level from three versions of Apache Tomcat, three versions of Apache CXF and two J2EE web applications namely PersonalBlog and Roller from Stanford SecuriBench and then compared their distributions in code smell versus noncode smell classes and methods. We found that Immutable and Sink micro patterns are more frequent in classes…

A catalog of metrics at source code level for vulnerability prediction: A systematic mapping study

Zadia Codabux, Kazi Zakia Sultana, Md. Naseef-Ur-Rahman Chowdhury

Information Systems · Journal of Software Evolution and Process · 17 Nov 2023 · cited 4× · DOI ↗ · more like this ·

Abstract Industry practitioners assess software from a security perspective to reduce the risks of deploying vulnerable software. Besides following security best practice guidelines during the software development life cycle, predicting vulnerability before roll‐out is crucial. Software metrics are popular inputs for vulnerability prediction models. The objective of this study is to provide a comprehensive review of the source code‐level security metrics presented in the literature. Our systematic mapping study started with 1451 studies obtained by searching the four digital libraries from ACM, IEEE, ScienceDirect, and Springer. After applying our inclusion/exclusion criteria as well as the snowballing technique, we narrowed down 28 studies for an in‐depth study to answer four research questions pertaining to our goal. We extracted a total of 685 code‐level metrics. For each study, we…

An Experience Report on Technical Debt in Pull Requests: Challenges and Lessons Learned

Shubhashis Karmakar, Zadia Codabux, Melina Vidoni

Information Systems · 7 Sep 2022 · cited 4× · DOI ↗ · more like this ·

Background: GitHub is a collaborative platform for global software development, where Pull Requests (PRs) are essential to bridge code changes with version control. However, developers often trade software quality for faster implementation, incurring Technical Debt (TD). When developers undertake reviewers’ roles and evaluate PRs, they can often detect TD instances, leading to either PR rejection or discussions. Aims: We investigated whether Pull Request Comments (PRCs) indicate TD by assessing three large-scale repositories: Spark, Kafka, and React. Method: We combined manual classification with automated detection using machine learning and deep learning models. Results: We classified two datasets and found that 37.7 and 38.7% of PRCs indicate TD, respectively. Our best model achieved F1 = 0.85 when classifying TD during the validation phase. Conclusions: We faced several challenges…

Are Large Language Models a Threat to Programming Platforms? An Exploratory Study

Md Mustakim Billah, Palash Ranjan Roy, Zadia Codabux +1 more

cs.SE · 9 Sep 2024 · cited 3× · arXiv ↗ · more like this ·

Competitive programming platforms like LeetCode, Codeforces, and HackerRank evaluate programming skills, often used by recruiters for screening. With the rise of advanced Large Language Models (LLMs) such as ChatGPT, Gemini, and Meta AI, their problem-solving ability on these platforms needs assessment. This study explores LLMs' ability to tackle diverse programming challenges across platforms with varying difficulty, offering insights into their real-time and offline performance and comparing them with human programmers. We tested 98 problems from LeetCode, 126 from Codeforces, covering 15 categories. Nine online contests from Codeforces and LeetCode were conducted, along with two certification tests on HackerRank, to assess real-time performance. Prompts and feedback mechanisms were used to guide LLMs, and correlations were explored across different scenarios. LLMs, like ChatGPT…

AES CCMP Algorithm with N-Way Interleaved Cipher Block Chaining

Zadia Codabux-Rossan, M. Razvi Doomun

cs.CR · 17 Aug 2012 · cited 2× · arXiv ↗ · more like this ·

Nowadays, the increased use of battery-powered mobile appliances and the urge to access time-sensitive data anytime anywhere has fuelled a high demand for wireless networks. However, wireless networks are susceptible to intrusion and security problems. There is an inherent need to secure the wireless data communication to ensure the confidentiality, authenticity, integrity and non repudiation of the data being exchanged. On the other hand, the computation and the resultant energy consumption to achieve sufficient security can be high. Encryption algorithms are generally computationally intensive, and consume a significant amount of computing resources (such as CPU time, memory, and battery power). Considering the limited resources on wireless devices, it is crucial that security protocols be implemented efficiently. This manuscript focuses on how energy consumption is impacted by the…

AES CCMP Algorithm with N-Way Interleaved Chiper Block Chaining

Zadia Codabux-Rossan, M. Razvi Doomun

Artificial Intelligence · University of Mauritius Research Journal · 2009 · cited 2× · OpenAlex ↗ · more like this ·

Manifesto from Dagstuhl Perspectives Workshop 24452 -- Reframing Technical Debt

Paris Avgeriou, Ipek Ozkaya, Heiko Koziolek +2 more

cs.SE · 19 May 2025 · cited 1× · arXiv ↗ · more like this ·

This is the Dagstuhl Perspectives Workshop 24452 manifesto on Reframing Technical Debt. The manifesto begins with a one-page summary of Values, Beliefs, and Principles. It then elaborates on each Value, Belief, and Principle to explain their rationale and clarify their meaning. Subsequently, the paper describes the current landscape of Technical Debt Management methods and tools and explains why the current practice is inadequate and where current research falls short. The current landscape is organized into five major topics: Technical Debt as Value-Creation, Tooling, Data Collection, the role of Architecture, and Socio-Technical Aspects. Finally, the paper outlines a roadmap to realize the stated principles, with concrete milestones to be addressed by researchers, software practitioners, and tool vendors. The manifesto is signed by the workshop participants.

Teaching Mining Software Repositories

Zadia Codabux, Fatemeh Fard, Roberto Verdecchia +3 more

cs.SE · 3 Jan 2025 · cited 1× · arXiv ↗ · more like this ·

Mining Software Repositories (MSR) has become a popular research area recently. MSR analyzes different sources of data, such as version control systems, code repositories, defect tracking systems, archived communication, deployment logs, and so on, to uncover interesting and actionable insights from the data for improved software development, maintenance, and evolution. This chapter provides an overview of MSR and how to conduct an MSR study, including setting up a study, formulating research goals and questions, identifying repositories, extracting and cleaning the data, performing data analysis and synthesis, and discussing MSR study limitations. Furthermore, the chapter discusses MSR as part of a mixed method study, how to mine data ethically, and gives an overview of recent trends in MSR as well as reflects on the future. As a teaching aid, the chapter provides tips for educators…

Integrating Feedback From Application Reviews Into Software Development

Omar Abdelaziz, Zadia Codabux, Kevin A. Schneider

Information Systems · 3 Dec 2024 · cited 1× · DOI ↗ · more like this ·

In application (app) development, effectively harnessing user feedback is crucial for enhancing app quality and user feedback. However, the vast and unstructured nature of user reviews often complicates these efforts, posing challenges in accurately capturing and integrating this feedback into the development processes. We automate the classification of issues in app reviews and examine how these issues correlate with code quality metrics (code smells and bug reports) and development activities (additions, deletions, and time to merge in pull requests). We aim to provide evidence-based guidance for effectively prioritizing and addressing user feedback. Employing a Mining Software Repositories (MSR) approach, we gathered and analyzed reviews from seven open-source Android apps. We evaluated the efficacy of three machine learning models-Support Vector Machines (SVM), BERT, and a…

Decoding Android Permissions: A Study of Developer Challenges and Solutions on Stack Overflow

Sahrima Jannat Oishwee, Zadia Codabux, Natalia Stakhanova

Signal Processing · 15 Oct 2024 · cited 1× · DOI ↗ · more like this ·

Background: The Android permission system is a set of controls to regulate access to sensitive data and platform resources (e.g., cameras). The fast-evolving nature of Android permissions and inadequate documentation result in numerous challenges for third-party developers. Aims: This study investigates the permission-related challenges developers face and the solutions provided to resolve them on the crowdsourcing platform Stack Overflow. Method: We conducted qualitative and quantitative analyses on 3,327 permission-related questions and 3,271 corresponding answers. Results: We found that most questions are related to non-evolving SDK permissions that remain constant across various Android versions, emphasizing the lack of documentation. We also classify developers’ challenges into several categories: Documentation-Related, Problems with Dependencies, Debugging, Conceptual…