This post proposes a metaphor for software engineering: software fatigue. First I’ll talk briefly about the role of metaphor in software engineering, and then I’ll talk about the proposed metaphor. Metaphors in software engineering In “Metaphors We Live By”, Lakoff & Johnson argue that humans use metaphor to understand unfamiliar topics. Through a metaphor…

This is a brief for the research paper “Exploiting Input Sanitization for Regex Denial of Service”, published at ICSE 2022. This work was led by my students Efe Barlas and Xin Du. The full paper is here. They also wrote this brief, which I have lightly edited. In this article…

This is a brief for the research paper “Low-Power Multi-Camera Object Re-Identification using Hierarchical Neural Networks”, published in the 2021 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED’21). This brief was authored by the paper’s lead author, Abhinav Goel. The goal of this paper was to develop an…

This is a brief for the research paper “A Replication of ‘DeepBugs: A Learning Approach to Name-based Bug Detection’”, published in the artifact track of ESEC/FSE 2021 [0]. This paper resulted from a course project in my course ECE 595: Advanced Software Engineering at Purdue University. Original paper In 2018, Pradel &…

Follow-up note on 19 May 2021: This post was written concurrent with discussions across the cybersecurity research community. Since then: The authors withdrew their paper; the conference chairs described significant changes for the next edition of the conference; the Linux community issued a statement. There is also a related comment…

Advice for aspiring software engineers — Power tools are helpful — but use them safely. This blog post describes an anti-pattern in how some aspiring software engineers use the Internet. My observations are my own, and I have made little effort to connect them to scientific studies. Nevertheless, I hope they are helpful to someone. The Internet Anti-Pattern As…

This is a brief for the research paper Using Selective Memoization to Defeat Regular Expression Denial of Service (REDOS), published at IEEE S&P 2021. I led the work, with help from Francisco Servant and Dongyoon Lee. In this article I use the word “regex” as shorthand for “regular expression”. Summary Attackers…

Why you should measure the cost of your GraphQL queries, and how you should do it. — This is a brief for the research paper A Principled Approach to GraphQL Query Cost Analysis, published at ESEC/FSE 2020. Alan Cha led the work, with help from Erik Wittern, Guillaume Baudart, me, Louis Mandel, and Jim Laredo. Most of these authors are affiliated with IBM Research or IBM’s product…

Introduction This post is intended as a “technical two-pager” to summarize a security vulnerability called Regex-based Denial of Service (AKA Regex DoS, ReDoS). There are a variety of write-ups about ReDoS, but I’m not aware of a good one-stop-shop with a higher-level treatment of all aspects of the subject. I have…