The application of the General Data Protection Regulation (GDPR) has significantly affected privacy requirements elicitation, modelling, and verification in Software Engineering (SE). One of the affected areas is requirements visualisation through modelling diagrams, which plays a crucial role in ensuring privacy compliance, as functional system requirements should be integrated with GDPR-based privacy requirements. We present a systematic literature review on how SE diagrams have been employed to capture and integrate GDPR-based privacy requirements into software system design. The study aims to identify the existing research landscape, existing gaps, and directions for future work. Following a rigorous search protocol and addressing two research questions, 18 primary studies published between 2017 and 2025 were selected, analysed, and categorised based on (i) the diagram types used, and (ii) the GDPR principles or rights addressed. The findings highlight the need for inter-diagram integration, full lifecycle traceability mechanisms, tool support, and automated compliance checking.

Background: Soft skills, such as the ability to communicate effectively and efficiently or work in a team, are important for software engineering practitioners. Understanding which soft skills are necessary for software professionals can assist in staff recruitment, training, and curriculum development. Various previous works have explored soft skills in job adverts in different contexts (i.e. based on what employers ask for). Aims: In this work, we rely on a study performed in New Zealand, and conduct a similar analysis in Cyprus to explore soft skills for the software industry in a different country in a different continent. Method: A manual analysis of 689 job adverts has been used to analyze job adverts from 2023 and 2024. Qualitative analysis and descriptive statistics were mainly employed for analysis purposes. Results: We have found 36 soft skills, whereas between 2023 and 2024 there are slight differences in the number of skills present per job advert. We also encountered differences in soft skills presence based on the job position category and the company size. Conclusion: The results confirm the existing findings concerning the most in demand soft skills, showing that the software industry needs are global. Nevertheless, there are differences in the soft skills popularity. The results can be used for improving job adverts concerning listing soft skills and performing curricula updates.

Bibliometric studies analyze existing research pub-lications and assist in better understanding a research area. Concerning the area of Software Engineering, many works on analysis of research topics and citations exist but additional data have not been analyzed. In this paper, we present a preliminary work toward a funding analysis in top Software Engineering conferences. We have chosen ICSE, ESEC/FSE and ASE and cover all years since the first proceedings of each conference. We have relied our analysis on data collected from Scopus, whereas we have gathered the funding sources using a combination of automated and manual analysis. Our results show that funding comes from a large number of funding agencies but a small number of them is linked with a large number of publications. Our future research agenda includes the consideration of more venues.

Software developers are social creatures: they communicate, collaborate, and promote their work in a variety of channels. Twitter, GitHub, Stack Overflow, and other platforms offer developers opportunities to network and exchange ideas. Researchers analyze content on these sites to learn about trends and topics in software engineering. However, insight mined from the text of Stack Overflow questions or GitHub issues is highly focused on detailed and technical aspects of software development. In this paper, we present a relatively new online community for software developers called DEV. On DEV users write long-form posts about their experiences, preferences, and working life in software, zooming out from specific issues and files to reflect on broader topics. About 50,000 users have posted over 140,000 articles related to software development. In this work, we describe the content of posts on DEV using a topic model, showing that developers discuss a rich variety and mixture of social and technical aspects of software development. We show that developers use DEV to promote themselves and their work: 83% link their profiles to their GitHub profiles and 56% to their Twitter profiles. 14% of users pin specific GitHub repos in their profiles. We argue that DEV is emerging as an important hub for software developers, and a valuable source of insight for researchers to complement data from platforms like GitHub and Stack Overflow.

Open source software is widely used in the software industry and the academia. Licenses applied to open source software provide the terms for its further use and distribution. Decisions regarding licensing for new software systems are essential for the system's future use. In this paper, we introduce findOSSLicense, a license recommender that guides users into choosing the appropriate open source license for their software under creation. We also introduce our license modeling concept that is used in the recommendation process. The license modeling captures the properties usually found in existing open source licenses following an analysis performed on license texts. The recommendation process of findOSSLicense is based on a hybrid recommender that uses constraint-based, content-based and collaborative filtering giving also space for flexibility in the use of the system by its end-users who can adapt some system properties. User input, but also external sources of information including existing open source projects, are considered for the creation of the recommendations, whereas licenses used in third party software employed in the software are examined on a limited basis. findOSSLicense has been evaluated with the participation of users of various expertise.

Many web and Internet of Things systems are based on user preferences and needs, in order to provide personalization. Such systems introduce privacy challenges due to the dramatic increase of data collection, whereas there is often a trade-off between the user privacy and the usability of the system. In the literature, various approaches have been followed to give users the possibility to define their privacy preferences. In this paper, we present an overview of different languages and techniques used for user privacy preferences modeling in different domains, along with systems that adopt these languages and consider users' privacy preferences. The approaches are categorized based on a taxonomy extended from a previous work, and their characteristics are compared. This study draws some conclusions on the adoption state of user-centric privacy management, whereas it aims to serve as an outline for further research efforts that are required towards an extensive implementation of privacy mechanisms in web environments, pervasive computing and the Internet of Things.

Free and open source software has gained a lot of momentum in the industry and the research community. Open source licenses determine the rules, under which the open source software can be further used and distributed. Previous works have examined the usage of open source licenses in the framework of specific projects or online social coding platforms, examining developers specific licensing views for specific software. However, the questions practitioners ask about licenses and licensing as captured in Question and Answer websites also constitute an important aspect toward understanding practitioners general licenses and licensing concerns. In this paper, we investigate open source license discussions using data from the Software Engineering, Open Source and Law Stack Exchange sites that contain relevant data. We describe the process used for the data collection and analysis, and discuss the main results that can be useful for developers, educators and license authors. Our results indicate that clarifications about specific licenses and specific license terms are required.

The notion of processing purpose , as set out in the EU General Data Protection Regulation (GDPR), comprises a crucial part of a software system’s privacy policy. Processing purposes are meant to characterize the usage of personal data within a system. In this work, we propose a formal type language for defining purposes as the communication exchanges between a system’s entities, based on session types enhanced with privacy notions. In order to provide software engineers with the means to easily define processing purposes, we encode the formal language syntax to a UML-based domain model and we present DiálogoP, a tool that supports the graphical model definition and subsequently translates it into formal language definitions.

Testing is an important phase of every software system, as it can reveal defects early and contribute to achieving high software quality. In this process of quality assurance, organizations are usually relying on one testing technique. However, a combination of techniques may prove more beneficial to the organization, as it might give the chance to discover a larger number of defects early. In order to examine the above, in the current work we present a survey on the use of system testing methodologies. We have gathered data from 252 individuals that reveal current trends in testing, such as whether requirements are used in the test case definition and whether the testing techniques used are affected by parameters, such as years of experience, whereas we examine the combination of smoke testing and regression testing. We also demonstrate an industrial use case, where this combination was applied, reducing the number of defects identified by the customer.

Since the adoption of the EU General Data Protection Regulation (GDPR) in May 2018, designing software systems that conform to the GDPR principles has become vital. Modeling languages can be a facilitator for this process, following the principles of model-driven development. In this paper, we present our work on the usage of a π-calculus-based language for modeling and reasoning about the GDPR provisions of 1) lawfulness of processing by providing consent, 2) consent withdrawal, and 3) right to erasure. A static analysis method based on type checking is proposed to validate that a model conforms to associated privacy requirements. This is the first step towards a rigorous Privacy-By-Design methodology for analyzing and validating a software system model against the GDPR. A use case is presented to discuss and illustrate the framework.

The European Union General Data Protection Regulation (GDPR) governs personal data processing, aiming to ensure privacy in all systems handling such data. All systems that process personal data, including software systems are legally obliged to comply to all articles of the GDPR applicable to them. In this paper, the case study of an e-Learning software platform, namely the INFORM platform and its compliance to relevant articles of the GDPR is presented. The e-Learning platform was developed with the objective to host the educational material developed under the JUSTICE EU-funded project INFORM, targeting judiciary, court staff and legal practitioners, in order to provide free and open distance access to the content. In particular, the paper demonstrates the compliance of the platform with the articles and principles of: Data Minimisation, Lawfulness of Processing, Right to Erasure, Right of Access, Right to Data Portability, Right to Rectification and Security of Processing. By applying these articles, conformance to the provision for Data Protection by design is also achieved; the platform's software development process integrates the articles of the GDPR early in the development steps, from the specification and design phases. We show how the design process progressed and demonstrate the corresponding functionality within the e-Learning platform. The paper extracts a list of lessons learned and conclusions on software GDPR compliance.

Mobile applications are often granted access to various data available on the mobile device. Android applications provide the notion of permissions to let the developers define the data their applications require to function properly. However, through accessing these data, applications may gain direct or indirect access to sensitive user data. In this paper, we address the detection of privacy vulnerabilities in mobile applications in Android via an analysis that is based mainly on the use of Android permissions. Different aspects of the application are analyzed in order to draw conclusions offering an aggregated view of permission analysis in the form of a penalty score, a feature that is missing in previous approaches that analyze permission use in Android. Our work is supported by a web application prototype of App Privacy Analyzer that allows users to upload an application and view the respective analysis results comparing them with other applications uploaded in previous uses of the system. This approach can be useful for security and privacy analysts and developers that wish to examine the privacy vulnerability level of their Android applications, but also for end users with technical expertise. We have used the tool for the analysis of 800 Android applications and are discussing the results the observed permission use.

Software repositories and Question & Answer sites constitute promising and ever-increasing sources of information for software analytics and for the identification of the role of the human factor in software engineering. Empirical evidence suggests that studying the human factor in software-related issues is multifaceted. Although analyses on different levels of developer networks have been performed, there is no existing work that moves beyond developer technical skills to take into account other important factors that might affect development work, such as personality and non-technical skills. For this reason, in this work we propose an approach that aims at finding links between badges – a sort of gamification awarded for developer's participation – personality traits, and interpersonal skills from Stack Overflow developers' community. The Generalized Linear Models (GLM) approach is adopted in order to examine the effects of personality traits and interpersonal skills on the non-technical awarded badges. Experimental results from the application of the proposed framework revealed statistically significant effects of both personality traits and interpersonal skills on the award gamification process.

As the provision of services and the use of personal data expands, the need for services to explicitly detail what personal data a service handles and in which manner becomes paramount in order to achieve a fully transparent, ethical and personalized user experience. Services usually require access to sensitive information and may distribute this information to third parties. Service consumers need to be informed about the ways their data are used and about the actors involved in this process. Universal service descriptions that can be used to cover any business service are required to provide interoperability. In this paper, we describe our work on the privacy module for the Linked Unified Service Description Language (USDL). We expand the language by introducing a new module that allows the specification of privacy properties for business services. We have considered recent advances in data protection for its creation and provide a method, accompanied by a software tool, to examine the validity of privacy policy descriptions with Linked USDL Privacy module.

Software Engineering education requires exposing students to real-world problems providing a framework to simulate real-world conditions. For this purpose, computer science students usually work in teams with each member undertaking a specific role. In this paper, we are discussing our experiences when adopting a different approach to teaching software engineering courses. In an attempt to provide students the possibility to develop different skills at each education level, we brought together undergraduate and postgraduate students in the same team with postgraduates adopting the role of a software project manager. Different roles were assigned to the undergraduate students in the team by the project manager, but all students worked towards the same goal. We present in this paper the approach followed and how we applied it, we discuss the exchange of skills among the team members, and finally, a discussion is provided on the lessons learned from our side and the students' point of view.

Open source software is nowadays widely used and any open source software must carry a prominent license. However, the legal, natural language text of open source licenses is not always easy to interpret and an extensive manual analysis of the text may be required, in order to fully understand its content. Existing approaches present license content based on such manual interpretation. In this paper, we propose an automated license term extraction system (FOSS-LTE) for the identification of the license terms from a specific license text and the creation of a representation of these terms divided into rights, obligations and additional conditions. We present the process employed for the creation of the license term extraction system using NLP techniques and we evaluate its accuracy on a set of sentences from available licenses collected for this purpose.

Software engineers are using a variety of social platforms, where they participate in open source software projects and respond to other developers that ask for help on specific issues. This presence of developers in different platforms is a mirror of their hands-on experience and expertise in different technologies and programming languages and a useful source of information for their own use but also for potential employers. In this work, we present our approach, Expertise Analyzer, that gathers diverse user-relevant activities in one location. Our approach introduces a number of metrics that summarize the experience and expertise of software engineers and can prove useful for giving a merged view of all developer interactions.

Contributions to open source software provide evidence about developers' expertise and roles. Moreover, information about developers' activity can assist in identifying their competencies in software technologies. Existing project-centric approaches benefit the needs of expert identification within a project, but provide a limited view of developers' expertise. In this paper, we identify contributors' expertise and roles by considering their contribution history across multiple projects according to different technologies. Firstly, we identify terms related to software technologies and employ information from GitHub to extract contributors' activity on specific technologies. Secondly, we present four contributor roles: developer, technical leader, bug fixer and bug contributor. We study the contribution history of 2,973 users of GitHub and reveal trends in contributions in open source software that can be exploited by employers for identifying experts or by practitioners for showcasing their expertise in various technologies.

Open Source software is widely used from end-users, software engineers and researchers. The license that accompanies such software is very important for its further use and distribution. However, engineers and researchers are many times not able to choose the appropriate license based on the purpose of the product under development due to the lack of sufficient information on the specifics of each license. In this work, we are addressing the above issue by introducing findOSSLicense that recommends appropriate licenses to users. We are employing a hybrid recommendation using constraint-based, content-based and collaborative approaches. Licenses are recommended based on user needs, on the licenses found in similar open source projects and on the licenses used by similar users. A three-phase process that considers different sources of information is used. We have evaluated findOSSLicense using its initial set of users. The results demonstrate the usefulness of findOSSLicense in the license guiding process.

Social coding platforms provide a means for software developers to acquire hands-on development experience. Their source code contributions can be used to showcase their expertise and skills in specific areas of software development to the community and potential employers. Therefore, quantifying developers' expertise based on their overall development activity can be used to provide a clear view of their experience and competencies, that is otherwise scattered across different software projects. In this paper we propose an approach that extracts developers' expertise in different programming languages. Our approach measures developers' commit activity on GitHub by considering both the quantity and the continuity of their contributions in isolated projects through time. We evaluate the generated developers' expertise profiles against recognized answering activity in Stack Overflow via a dataset of users that are active both in GitHub and Stack Overflow.

Licensing decisions for new Open Source Software are not always straightforward. However, the license that accompanies the software is important as it largely affects its subsequent distribution and reuse. License information for software products is captured - among other data - in the Software Package Data Exchange (SPDX) files. The SPDX specification is gaining popularity in the software industry and has been adopted by many organizations internally. In this demonstration paper, we present our tool for the validation of SPDX files regarding proper license use. Software packages described in SPDX format are examined in order to detect license violations that may occur when a product combines different software sources that carry different and potentially contradicting licenses. The SPDX License Validation Tool (SLVT) gives the opportunity to check the compatibility of one or more SPDX files. The evaluation performed on a number of software packages demonstrates its usefulness for drawing conclusions on license use, revealing violations in some of the test projects.

A variety of methodologies in software processes exist nowadays with the Agile software development having gained significant ground since the introduction of the Agile manifesto in 2001. Scrum is a representative Agile development method employed in the software industry. Since trends come and go, it is vital to see where they stand in the real world. In order to gain an insight into how Scrum is viewed nowadays, we have conducted an online study on the current state of the adoption of Scrum. The study targeted in demonstrating where the success or failure success factors of Scrum lie and in viewing Scrum properties in comparison to heavyweight approaches. This paper presents the results of the study that constitute an instructive view into the above aspects of Scrum development.

Web services are considered reusable elements that can be exploited stand-alone or as part of wider, generic or domain-specific, applications. With a vast variety of Web Services being offered by service providers, annotation techniques that add tags to services automatically are frequently exploited with the aim of retrieving relevant services faster. Tagging of Web Services at finer levels of granularity can assist in drawing more detailed conclusions, making their use easier. In this paper, we go beyond global Web Service tagging by proposing a classification technique for the annotation of Web Service sections. The process focuses on port type, operation and message sections of the service description. Service information as offered through WSDL and the provider and user descriptions is considered. The initial evaluation results demonstrate the efficiency of the approach in providing annotations at these different service levels.

Personalization or privacy control? is a question one frequently asks himself/herself nowadays with the wide spread of service provision for users on the move. The right to protect intimacy or the right of privacy is a permanent and genuine right of any person. Context-awareness, offering to users services that react proactively to user environment and service conditions, although desirable, breaks into the private sphere. In the Internet world Web Services are usually employed as building blocks in such context-aware applications. In this paper, the reflection of user privacy preferences in the provision of context-aware Web Services is addressed. A user privacy preferences language for context-aware Web Service environments, namely Consumer Privacy Language (CPL), is proposed along with an adaptation mechanism for SOAP messages. The adaptation remains transparent to the end-user, who can profit from Web Services offering both context- and privacy-awareness.

Model matching has been applied to different fields of Model Driven Engineering research and usually concerns models depicting the same information in order to detect their evolution process or elements on which model migration is needed. In the current paper a different approach is followed by comparing models that depend on each other on a more specific basis: matching for Web Service models using dependencies on context information is addressed. The models follow the notation of an appropriate Web Service metamodel that captures Web Service properties. The models are represented as typed attributed graphs and their comparison is performed on an introduced variant of the Similarity Flooding algorithm, which is usually applied on schema matching. The application of the matching process is demonstrated through a number of constructed and existing Web Service description graphs extracted from online service registries.

Context-awareness is gaining wide importance, especially when targeting pervasive environments, whereas Web Services are often exploited as building blocks of context-aware applications because of their interoperability properties. In this framework, Web Services can be used as business services requiring context data for their functionality, but also as context sources offering access to context information. Combining the development of context-aware Web Services with Model-Driven Engineering techniques requires the identification and matching of appropriate context models with Web Service models. In this paper, a new ongoing research direction is presented, which refers to model transformation for allowing the identification of appropriate context sources and ensuring their compatibility with Web Services. Matchmaking principles between Web Service and context models are examined in order to extract a reasoning mechanism on context adaptation compatibility. In specific, the principles of graph transformation are mainly exploited.

As the number of available web services increases, the development of web applications that integrate existing web services becomes more and more popular. This class of web applications can be seen as the composition of web services around a user interface flow. In this paper, the application of model-driven techniques for the development of such user-centric web applications is presented. An approach for the modeling of the application using UML class and state transition diagrams and the transformation to appropriate platform specific code is presented. The service design is based on the introduced UML profiles, whereas on code level frameworks implementing the Model-View- Controller architectural pattern are targeted. © 2008 ACM.

Context-awareness constitutes an important aspect in mobile environments, especially when user-centric services are considered. However, user and service related data as part of context information are sensitive and their disclosure should not be performed unconditionally. In this paper a Privacy-aware Context Profile (PCP) in UML notation that takes into account privacy and quality, as well as other functional and non-functional properties is presented. The profile can be exploited in the application design phase leading to the model-driven development of context-aware applications for different context domains.

Mobile and pervasive computing is gaining significant importance in the latest years. Context-awareness constitutes an essential aspect - almost a requirement - of mobile services in these environments. In this paper, we propose an architecture that supports the development and provision of context-aware services. The described approach provides means for the context adaptation of software components exposed as Web services independently of their specific implementation allowing for added flexibility concerning the adaptation itself or whether it is performed at all. As the service logic is clearly separated from the context adaptation, the same principle can be applied to composite Web services. Specifically, we show that different services and context sources can be combined to provide a Web application separating completely the application logic from the context adaptation. Context plugins loaded on runtime are responsible for invoking the right context sources to retrieve the necessary context information and complete the service adaptation to context.