IDE Support for Cloud-Based Static Analyses
| dc.contributor.author | Luo, Linghui | |
| dc.contributor.author | Bodden, Eric | |
| dc.contributor.editor | Grunske, Lars | |
| dc.contributor.editor | Siegmund, Janet | |
| dc.contributor.editor | Vogelsang, Andreas | |
| dc.date.accessioned | 2022-01-19T12:56:53Z | |
| dc.date.available | 2022-01-19T12:56:53Z | |
| dc.date.issued | 2022 | |
| dc.description.abstract | We present a user study with developers at Amazon Web Services on their expectations of IDE support for cloud-based static analyses. The paper was originally presented at ESEC/FSE 2021. Many companies are providing Static Application Security Testing (SAST) tools as a service. These tools fit well into CI/CD, because CI/CD allows time for deep static analyses on large code bases and prevents vulnerabilities in the early stages of the development lifecycle. In CI/CD, the SAST tools usually run in the cloud and provide findings via a web interface. Recent studies show that developers prefer seeing the findings of these tools directly in their IDEs. Most tools with IDE integration run lightweight static analyses and can give feedback at coding time, but SAST tools take longer to run and usually are not able to do so. Can developers interact directly with a cloud-based SAST tool that is typically used in CI/CD through their IDE? We conducted a user study to explore how such IDE support should be designed. Through this study we identified the key design elements expected by developers and investigated whether an IDE solution fits better into developers’ workflow in comparison to a web-based solution. | en |
| dc.identifier.doi | 10.18420/se2022-ws-019 | |
| dc.identifier.isbn | 978-3-88579-714-2 | |
| dc.identifier.pissn | 1617-5468 | |
| dc.identifier.uri | https://dl.gi.de/handle/20.500.12116/37971 | |
| dc.language.iso | en | |
| dc.publisher | Gesellschaft für Informatik e.V. | |
| dc.relation.ispartof | Software Engineering 2022 | |
| dc.relation.ispartofseries | Lecture Notes in Informatics (LNI) - Proceedings, Volume P-320 | |
| dc.subject | IDE integration | |
| dc.subject | Static analysis | |
| dc.subject | Cloud service | |
| dc.subject | SAST tools | |
| dc.subject | Security testing | |
| dc.title | IDE Support for Cloud-Based Static Analyses | en |
| dc.type | Text/Conference Paper | |
| gi.citation.endPage | 63 | |
| gi.citation.publisherPlace | Bonn | |
| gi.citation.startPage | 61 | |
| gi.conference.date | 21.-25. Feburar 2022 | |
| gi.conference.location | Berlin/Virtuell | |
| gi.conference.sessiontitle | Wissenschaftliches Hauptprogramm |
Dateien
Originalbündel
1 - 1 von 1