Many studies consider the relation between individual aspects of the software engineering process and bug-introduction, e.g., software testing and code review. These studies typically only identify correlations between their set of variables without accounting for interactions with external variables, such as confounding factors. Within this study, we provide a broad empirical view on practices of software development and their relation to bug-introducing changes to enable future work on causal relations between those aspects. We consider the bugs, the type of change that introduced the bug, aspects of the build process, code review, software tests, and any other discussion related to the bug that we can identify. We use a qualitative approach that first describes variables of the development process and then groups the variables based on their relations. From these groups, we deduce how their (pairwise) interactions affect bug-introducing changes. We found multiple relevant relations within the development process of bug-introducing changes. Logical groups of variables and their relations provide a framework for discovering areas of interest regarding intermediate effects in the process and confounders towards bug-introduction. Software engineering practices applied during the development of bug-introducing changes are interdependent. This work lays the foundation to understand why bugs are introduced using causal modeling, discovery, and inference.

Machine learning (ML) is nowadays widely used for different purposes and with several disciplines. From self-driving cars to automated medical diagnosis, machine learning models extensively support users’ daily activities, and software engineering tasks are no exception. Not embracing good ML practices may lead to pitfalls that hinder the performance of an ML system and potentially lead to unexpected results. Despite the existence of documentation and literature about ML best practices, many non-ML experts turn towards gray literature like blogs and Q&A systems when looking for help and guidance when implementing ML systems. To better aid users in distilling relevant knowledge from such sources, we propose a recommender system that recommends ML practices based on the user’s context. As a first step in creating a recommender system for machine learning practices, we implemented Idaka. A tool that provides two different approaches for retrieving/generating ML best practices: i) an information retrieval (IR) engine and ii) a large language model. The IR-engine uses BM25 as the algorithm for retrieving the practices, and a large language model, in our case Alpaca. The platform has been designed to allow comparative studies of best practices retrieval tools. Idaka is publicly available at GitHub: https://bit.ly/idaka. Video: https://youtu.be/cEb-AhIPxnM

Mobile apps are distributed via online markets allowing practitioners to reach users worldwide; on the other side, users select what apps are more suitable for their preferences from a large set of apps offering similar features and capabilities. To facilitate that selection process, the distribution markets have different mechanisms, such as comments, ratings, and top-listed apps, including a curated list. As it is well known, apps stores metadata can provide insights for new, popular features or fixing existing bugs, as reported in previous works. However, to the best of our knowledge, app store data have not been used to identify possible predominant characteristics of successful apps using as a reference the aforementioned top lists. Thus, in this paper, we present a study that analyzes the metadata of apps belonging to Google Play top lists during 30 weeks in 4 countries to distill features of successful apps. Unfortunately, our results suggest that apps store metadata from top list apps do not provide enough information to identify those features.

Deep learning (DL) techniques are on the rise in the software engineering research community. More and more approaches have been developed on top of DL models, also due to the unprecedented amount of software-related data that can be used to train these models. One of the recent applications of DL in the software engineering domain concerns the automatic detection of software vulnerabilities. While several DL models have been developed to approach this problem, there is still limited empirical evidence concerning their actual effectiveness especially when compared with shallow machine learning techniques. In this paper, we partially fill this gap by presenting a large-scale empirical study using three vulnerability datasets and five different source code representations (i.e., the format in which the code is provided to the classifiers to assess whether it is vulnerable or not) to compare the effectiveness of two widely used DL-based models and of one shallow machine learning model in (i) classifying code functions as vulnerable or non-vulnerable (i.e., binary classification), and (ii) classifying code functions based on the specific type of vulnerability they contain (or "clean", if no vulnerability is there). As a baseline we include in our study the AutoML utility provided by the Google Cloud Platform. Our results show that the experimented models are still far from ensuring reliable vulnerability detection, and that a shallow learning classifier represents a competitive baseline for the newest DL-based models.

The amount of Android apps available for download is constantly increasing, exerting a continuous pressure on developers to publish outstanding apps. Google Play (GP) is the default distribution channel for Android apps, which provides mobile app users with metrics to identify and report apps quality such as rating, amount of downloads, previous users comments, etc. In addition to those metrics, GP presents a set of top charts that highlight the outstanding apps in different categories. Both metrics and top app charts help developers to identify whether their development decisions are well valued by the community. Therefore, app presence in these top charts is a valuable information when understanding the features of top-apps. In this paper we present Hall-of-Apps, a dataset containing top charts' apps metadata extracted (weekly) from GP, for 4 different countries, during 30 weeks. The data is presented as (i) raw HTML files, (ii) a MongoDB database with all the information contained in app's HTML files (e.g., app description, category, general rating, etc.), and (iii) data visualizations built with the D3.js framework. A first characterization of the data along with the urls to retrieve it can be found in our online appendix: https://bit.ly/2uIkXs8. Dataset: https://bit.ly/2Wu9qsn