Background: The Android permission system is a set of controls to regulate access to sensitive data and platform resources (e.g., cameras). The fast-evolving nature of Android permissions and inadequate documentation result in numerous challenges for third-party developers. Aims: This study investigates the permission-related challenges developers face and the solutions provided to resolve them on the crowdsourcing platform Stack Overflow. Method: We conducted qualitative and quantitative analyses on 3,327 permission-related questions and 3,271 corresponding answers. Results: We found that most questions are related to non-evolving SDK permissions that remain constant across various Android versions, emphasizing the lack of documentation. We also classify developers’ challenges into several categories: Documentation-Related, Problems with Dependencies, Debugging, Conceptual Understanding, and Implementation Issues. Conclusions: Our study indicates the need for clear, consistent documentation to guide the use of permissions and reduce developer misunderstandings, which can lead to potential misuse of Android permissions.

The Android permission system regulates access to sensitive mobile device resources such as camera and location. To access these resources, third-party developers need to request permissions. However, the Android permission system is complex and fast-evolving, presenting developers with numerous challenges surrounding compatibility issues, misuse of permissions, and vulnerabilities related to permissions. Our study aims to explore whether Large Language Models (LLMs) can serve as a reliable tool to assist developers in using Android permissions correctly and securely, thereby reducing the risks of misuse and security vulnerabilities in apps. In our study, we analyzed 1,008 Stack Overflow questions related to Android permissions and their accepted answers. In parallel, we generate answers to these questions using a popular LLM tool, ChatGPT. We focused on how well the ChatGPT's responses align with the accepted answers on Stack Overflow. Our findings show that above 50% of ChatGPT's answers align with Stack Overflow's accepted answers. ChatGPT offers better-aligned responses for challenges related to Documentation and Conceptual Understanding, while it provides less aligned answers for Debugging-related issues. In addition, we found that ChatGPT provides more consistent answers for 73.27% questions. Our study demonstrates the potential for using LLMs such as ChatGPT as a supporting tool to help developers navigate Android permission-related problems.

Background: Software security is crucial to ensure that the users are protected from undesirable consequences such as malware attacks which can result in loss of data and, subsequently, financial loss. Technical Debt (TD) is a metaphor incurred by suboptimal decisions resulting in long-term consequences such as increased defects and vulnerabilities if not managed. Although previous studies have studied the relationship between security and TD, examining their intersection in developers' discussion on Stack Overflow (SO) is still unexplored. Aims: This study investigates the characteristics of security-related TD questions on SO. More specifically, we explore the prevalence of TD in security-related queries, identify the security tags most prone to TD, and investigate which user groups are more aware of TD. Method: We mined 117,233 security-related questions on SO and used a deep-learning approach to identify 45,078 security-related TD questions. Subsequently, we conducted quantitative and qualitative analyses of the collected security-related TD questions, including sentiment analysis. Results: Our analysis revealed that 38% of the security questions on SO are security-related TD questions. The most recurrent tags among the security-related TD questions emerged as “security” and “encryption.” The latter typically have a neutral sentiment, are lengthier, and are posed by users with higher reputation scores. Conclusions: Our findings reveal that developers implicitly discuss TD, suggesting developers have a potential knowledge gap regarding the TD metaphor in the security domain. Moreover, we identified the most common security topics mentioned in TD-related posts, providing valuable insights for developers and researchers to assist developers in prioritizing security concerns in order to minimize TD and enhance software security.