JavaScript cross-platform frameworks are becoming increasingly popular. They help developers easily and conveniently build cross-platform applications while just needing only one JavaScript codebase. Recent security reports showed several high-profile cross-platform applications (e.g., Slack, Microsoft Teams, and Github Atom) suffered injection issues, which were often introduced by Cross-site Scripting (XSS) or embedded untrusted remote content like ads. These injections open security holes for remote web attackers, and cause serious security risks, such as allowing injected malicious code to run arbitrary local executables in victim devices (referred to as XRCE attacks). However, until now, XRCE vectors and behaviors and the root cause of XRCE were rarely studied and understood. Although the cross-platform framework developers and community responded quickly by offering multiple security features and suggestions, these mitigations were empirically proposed with unknown effectiveness.

Mobile application (app) stores have lowered the barriers to app market entry, leading to an accelerated and unprecedented pace of mobile software production. To survive in such a highly competitive and vibrant market, release engineering decisions should be driven by a systematic analysis of the complex interplay between the user, system, and market components of the mobile app ecosystem. To demonstrate the feasibility and value of such analysis, in this paper, we present a case study on the rise and fall of Yik Yak, one of the most popular social networking apps at its peak. In particular, we identify and analyze the design decisions that led to the downfall of Yik Yak and track rival apps' attempts to take advantage of this failure. We further perform a systematic in-depth analysis to identify the main user concerns in the domain of anonymous social networking apps and model their relations to the core features of the domain. Such a model can be utilized by app developers to devise sustainable release engineering strategies that can address urgent user concerns and maintain market viability.

Video coding tutorials enable expert and noviceprogrammers to visually observe real developers write, debug, and execute code. Previous research in this domain has focusedon helping programmers find relevant content in coding tutorialvideos as well as understanding the motivation and needs ofcontent creators. In this paper, we focus on the link connectingprogrammers creating coding videos with their audience. Morespecifically, we analyze user comments on YouTube codingtutorial videos. Our main objective is to help content creators toeffectively understand the needs and concerns of their viewers, thus respond faster to these concerns and deliver higher-qualitycontent. A dataset of 6000 comments sampled from 12 YouTubecoding videos is used to conduct our analysis. Important userquestions and concerns are then automatically classified andsummarized. The results show that Support Vector Machinescan detect useful viewers' comments on coding videos with anaverage accuracy of 77%. The results also show that SumBasic, an extractive frequency-based summarization technique withredundancy control, can sufficiently capture the main concernspresent in viewers' comments.

Twitter enables large populations of end-users of software to publicly share their experiences and concerns about software systems in the form of micro-blogs. Such data can be collected and classified to help software developers infer users' needs, detect bugs in their code, and plan for future releases of their systems. However, automatically capturing, classifying, and presenting useful tweets is not a trivial task. Challenges stem from the scale of the data available, its unique format, diverse nature, and high percentage of irrelevant information and spam. Motivated by these challenges, this paper reports on a three-fold study that is aimed at leveraging Twitter as a main source of software user requirements. The main objective is to enable a responsive, interactive, and adaptive data-driven requirements engineering process. Our analysis is conducted using 4,000 tweets collected from the Twitter feeds of 10 software systems sampled from a broad range of application domains. The results reveal that around 50% of collected tweets contain useful technical information. The results also show that text classifiers such as Support Vector Machines and Naive Bayes can be very effective in capturing and categorizing technically informative tweets. Additionally, the paper describes and evaluates multiple summarization strategies for generating meaningful summaries of informative software-relevant tweets.