Abstract Design Thinking techniques have been widely used in software requirements elicitation to understand the necessities of stakeholders and end‐users. However, there is a lack of evidence of their effectiveness when applied to guide the development process of a system targeting vulnerable populations. What are the implications of using Design Thinking techniques to elicit requirements in a community of former inmates—and what would be the benefits of and challenges in this deployment? In this paper, we report our experience of using Design Thinking for requirements elicitation of a mobile application customized for the former inmates of the Brazilian prison system and their families. We applied techniques such as Brainstorming, Stakeholder Mapping, Personas Creation, Rapid Ethnography, and Interviews to obtain relevant data and create several prototypes. These techniques contribute to the development of an uncommon application that aims to help the reintegration process of former inmates into society. Our results validate the initial hypothesis that such techniques, when applied to a sensitive context, assist product development that meets the end‐users' needs by creating a higher quality product. The main limitation of the research was the lack of access to low‐literacy end‐users and/or former inmates without previous experience using mobile devices.

Requirements elicitation is a fundamental step in a software development process since it is at this stage that the software begins to be designed. In some situations, the problems related to the failure of the software development project are due to an incomplete requirements elicitation, resulting in solutions that do not understand all the necessary functionalities or do not incorporate innovation. Despite the various techniques offered by Requirements Engineering, situations such as the growing application market and the need for innovation further increase the importance of understanding the user’s different needs. In this paper, we investigated how the journey map and personas techniques are being used in requirements elicitation in both the literature and the industry, along with the advantages, disadvantages and challenges of using these techniques. We conducted systematic literature review to identify the personas and journey map techniques used in requirements elicitation in the literature and industry. In addition, we conducted a survey with 52 practitioners (software developers, users and managers) to investigate their perceptions of the use of journey maps and personas techniques in the requirements elicitation phase. Twenty-four primary studies were identified that address journey map and personas techniques in software requirements elicitation. In addition, most respondents stated that using these techniques facilitates understanding the requirements, providing better integration, collaboration and leveling of knowledge among the members of the software development teams. Our findings allow us to conclude that most of the software developers, users and managers that participated in the survey consider that the journey map and personas techniques are effective in helping understand the software requirements to be developed by the development teams.

Misuse of cryptographic (crypto) APIs is a noteworthy cause of security vulnerabilities. For this reason, static analyzers were recently proposed for detecting crypto API misuses. They differ in strengths and weaknesses, and they might miss bugs. Motivated by the inherent limitations of static analyzers, this article reports on a study of runtime verification (RV) as a dynamic-analysis-based alternative for crypto API misuse detection. RV monitors program runs against formal specifications; it was shown to be effective and efficient for amplifying the bug-finding ability of software tests. We focus on the popular JCA crypto API and write 22 RV specifications based on expert-validated rules in a static analyzer. We monitor these specifications while running tests in five benchmarks. Lastly, we compare the accuracy of our RV-based approach, RVSec, with those of three state-of-the-art crypto API misuses detectors: CogniCrypt, CryptoGuard, and CryLogger. Results show that RVSec has higher accuracy in four benchmarks and is on par with CryptoGuard in the fifth. Overall, RVSec achieves an average${\boldsymbol{F}}_{1}$measure of 95%, compared with 83%, 78%, and 86% for CogniCrypt, CryptoGuard, and CryLogger, respectively. We highlight the strengths and limitations of these tools and show that RV is effective for detecting crypto API misuses. We also discuss how static and dynamic analysis can complement each other for detecting crypto API misuses.

Context: The use of Creativity and Design Thinking (C&DT) techniques favor the generation of new ideas based on the needs of users and stakeholders, and can support software developers during the process of requirements elicitation. Objectives: In this work, we aim to identify C&DT techniques to perform requirements elicitation proposed in the literature and in the industry and investigate the perception of software developers about using these techniques. Methods: We conducted a systematic literature review (SLR) to identify the C&DT techniques in the literature and a regional survey with software development teams from several companies in Brazil to identify which techniques found in the literature are currently being used by organizations. The survey also investigated the level of knowledge that software developers have regarding the C&DT techniques, and whether they agree that the use of these techniques can help to achieve a more effective process of requirements elicitation. Results: In the SLR, we identified 86 C&DT techniques that support requirement elicitation activities. In the survey, most developers outlined that C&DT techniques facilitate requirements elicitation and stated that they have more knowledge and usage experience with DT techniques than creativity techniques. The most used DT techniques mentioned by survey participants were: interview, brainstorming, uses cases, activity analysis, user story, and rapid prototyping, whereas for creativity techniques were: analogies, creativity workshops, focus group, questions list, clarification, none and combining ideas. Conclusions: The results showed that despite the existence of a large number of techniques in the literature, the developers’ lack of knowledge about these techniques makes them not used in the industry. However, the developers’ responses showed that the use of C&DT techniques helps to make requirements elicitation more effective.

The Brazilian General Data Protection Law (LGPD) implementation has impacted activities carried out by the software development teams. Due to it, developers had to become aware of the existing techniques and tools to carry out privacy requirements elicitation. Extending our previous work, we have investigated the actions taken by organizations regarding the LGPD, specifically in software development, considering the perception of agile development teams after two years of the LGPD implementation. In addition, we also investigated the perception of an agile team regarding the practices, techniques, and tools previously cited by practitioners as potential solutions for use in this context, along with techniques already in use in the current context. We have conducted a systematic literature review (SLR) and selected 36 primary studies. Furthermore, we have conducted a survey with 53 IT practitioners and semi-structured interviews with ten practitioners. The LGPD principles are known by most agile teams and are being implemented by the organizations, although the existing tools to support privacy requirements elicitation are still underused by agile teams. Moreover, agile teams consider that software requirements and software construction are the most impacted areas of knowledge by the LGPD, and most of them use user stories in privacy requirements elicitation. Our findings reveal that agile teams and Brazilian organizations are more concerned with user data privacy issues after the LGPD became effective. However, agile teams still face challenges in privacy requirements elicitation.

Context: The Database Systems (DS) subject is a significant subject in Computer Science and Engineering-related undergraduate programs, as it supplies knowledge and abilities required for professional practice within the software industry. Teaching DS principles, concepts, and practices and relating them to real-world scenarios is challenging, particularly in social isolation circumstances due to Covid-19. Moreover, teaching resources can pose additional setbacks for teachers and students who are unfamiliar with remote learning. Purpose: This study investigates the DS students' perception regarding the methodology and teaching practices adopted by the teacher during the social isolation period. Method: We conducted a survey with the DS subject students to investigate their perception regarding the teaching methodology adopted, the challenges, and their motivation during this period of social isolation. Results: Our findings revealed that most students have adequate study conditions, i.e., a suitable environment for studying at home and the necessary equipment to attend online classes and perform the subject's practical tasks. Moreover, 79% of the students felt motivated to study the subject remotely, and more than 74% of the students endorsed the teaching methodology adopted by the teacher.

Context: The implementation of the Brazilian General Data Protection Law (LGPD) may impact activities carried out by the software development teams. It is necessary for developers to know the existing techniques and tools to carry out privacy requirements elicitation. Objectives: In this research, we investigated the perception of agile software development team members from different organizations, regarding the impact that LGPD will have on the activities of the software development process. Methods: We conducted an online survey and a systematic literature review to identify the techniques, methodologies and tools used in the literature to perform privacy requirements elicitation in the context of Agile Software Development (ASD). In addition, we also investigated the perception of an agile team from a Federal Public Administration organization regarding the impacts of the obligation to develop software in accordance with the LGPD. Results: Our findings reveal that agile teams know the concepts related to data privacy legislation, but they do not use the techniques proposed in the literature to perform privacy requirements elicitation. In addition, agile teams face problems with outdated software requirements specifications and stakeholders’ lack of knowledge regarding data privacy. Conclusions: Agile teams need to improve their knowledge on privacy requirements.

This paper presents an analysis of data from the National Fund of Education Development (FNDE) in relation to the teachers in its database, relating them according to the demographic density of each region, the number of teachers from the Brazilian Capitals who have courses graduate, specialization, master's and doctoral degrees and the percentages of the Development index of basic education of the students (IDEB) of the respective regions. The goal is to analyze if the academic qualification of the teachers impact on the IDEB of the schools students of the regions with more representative indexes. In our verification we used the Apriori association algorithm to identify and analyze the data set to collect the results. The results demonstrate that the maximum academic qualification of male teachers is mostly of specialization, whereas female teachers in most of the regions have a specialization and master's degree course. Furthermore, it was possible to verify that the region with the highest IDEB is the South region with 6.27%, the region with the highest number of teachers with a master degree (4.2%) and a doctor (0.5%). The Central West region has an IDEB of 6.20% and the professors have the majority of the undergraduate course (56.7%) and specialization (31.9%). It is possible to affirm with the results obtained that the regions with the highest IDEB are the regions with the highest level of training by the teachers.