141 lines
26 KiB
Markdown
141 lines
26 KiB
Markdown
type:: [[REVIEWS]]
|
||
tags::
|
||
year:: 2024
|
||
venue:: [[JSS]]
|
||
full-title:: Toward A Prioritization Approach for Third-Party Software Library Updates
|
||
date-start:: [[04-06-2024]] - 21:31
|
||
date-submitted:: [[24-06-2024]]
|
||
external-links::
|
||
status:: [[DONE]]
|
||
deadline-submission:: [[28-05-2024]]
|
||
file:: [[@JSSOFTWARE-D-24-00320_reviewer.pdf]]
|
||
parent::
|
||
todoist:: https://app.todoist.com/app/task/jssoftware-d-24-00320-6V8WPJmgFvWwwwq8
|
||
|
||
- ### [[Highlights]]
|
||
-
|
||
- # Annotazioni
|
||
- (24/6/2024, 15:54:07)
|
||
- - “software developers struggle to manage the dependencies between third-party libraries for many reasons,such as unknown update efforts and the lack of awareness about related security issues.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=JZTJIG8V)) #5fb236
|
||
- - “TPL update prioritization approach, which providesvaluable insights for mobile app developers to help improve the decision-making process” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=7AN7G647)) #5fb236
|
||
- - “a case study” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=Q6BKWCNE)) #ffd400
|
||
- *Case study or questionnaire?*
|
||
- - “bot’s resultsuseful” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=Y5CXB8L4)) #ff6666
|
||
- - “quick and easy-to-implement features” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=HDIHJQCH)) #a28ae5
|
||
- - “security vulnerabilities” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=KQ9GPWKG)) #5fb236
|
||
- - “high maintenance efforts” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=2GRIDFK7)) #5fb236
|
||
- - “Recently” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=65MGTG74)) #ffd400
|
||
- *You use recently referring a paper 0f 3-4 years ago. Overall, the authors should consider most recent works. They have missing relevant papers coming from the editions 2022 and 2022 of top SE venues.*
|
||
- - “developers' responsiveness” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=2LRYIULX)) #5fb236
|
||
- - “duration of the response when developers receive notifications” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=TYHUBCH3)) #a28ae5
|
||
- - “recent empirical studies” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=BXNRX7UD)) #ffd400
|
||
- *2020?*
|
||
- - “dependencies migration a practice requiring dedicated time and effort” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 8](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=8&annotation=ELX96Q2A)) #a28ae5
|
||
- - “Therefore, we aim to help software developers prioritize and make betterdecisions regarding TPLs update process. Accordingly, the approach may boost software quality and helpdevelopers dedicate maintenance efforts based on their needs” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=DJZTW5FV)) #5fb236
|
||
- - “This research aims to propose an approach that can help mobile app developers prioritize third-partysoftware libraries in their software for the update process.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=5MBNTLF9)) #ffd400
|
||
- *So, is a tool what you are proposing?*
|
||
- - “Propose metrics” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=F23KAIN8)) #a28ae5
|
||
- - “Build a chatbot” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=NXLMEXXD)) #a28ae5
|
||
- - “set of metrics” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=NTMUCN2H)) #a28ae5
|
||
- - “prioritization approach” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=447FWNNF)) #a28ae5
|
||
- - “Developing A chatbot” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=IDHPW4K5)) #ff6666
|
||
- - “Several studies investigated software third-party library updates in mobile applications from different perspectives, such as developers' responsiveness to the update, types of software updates, motivations behind updating TPLs, and reasons behind update delay/ignorance” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=G33AND9A)) #5fb236
|
||
- - “2752 apps and investigated the technical lag between library releases.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=5AX9VF9N)) #5fb236
|
||
- - “developers seldom update TPLs” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=KVTC6IRR)) #5fb236
|
||
- - “developers may downgrade to an older version due to incompatibility issues” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 9](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=9&annotation=FI45MKKK)) #5fb236
|
||
- - “DeepLib can recommend the appropriate library next version for either a single library or a set of libraries.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 10](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=10&annotation=7SMHYFU2)) #5fb236
|
||
- - “those tools do not cover the update from one version to another for the same library.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 11](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=11&annotation=6QP7DAAV)) #5fb236
|
||
- - “TPL update prioritization” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 11](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=11&annotation=RNRP7SMQ)) #ffd400
|
||
- *What's the issue that authors want to address with TPL update prioritization?*
|
||
- - “app developers prioritize TPLs' updates” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 11](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=11&annotation=E9EZVK4B)) #5fb236
|
||
- - “first” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 12](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=12&annotation=LVUHS4YZ)) #ffd400
|
||
- *updated first with respect to what?
|
||
- what's the criteria that authors wanted to meet?*
|
||
- - “factors” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 12](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=12&annotation=94B7MV7E)) #e56eee
|
||
- - “Compatibility, Accessibility, Update Effort, Business Value, and Security.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 12](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=12&annotation=6X5QL6Q2)) #e56eee
|
||
- - “TPL updates process and conducting a validation survey,” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 13](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=13&annotation=XTP83S85)) #a28ae5
|
||
- - “we focused more on the metrics that can be automatically measured” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 13](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=13&annotation=YIMAIZRZ)) #a28ae5
|
||
- - “Analytical Hierarchy Process (AHP)” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 13](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=13&annotation=7GGZ89GV)) #5fb236
|
||
- - “Simple Additive Weighting” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 13](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=13&annotation=6DLVYH38)) #5fb236
|
||
- - “However, for security, since it is a combination of real numbers (vulnerabilities and unnecessary permissions) instead of percentages as other factors, we handle it separately; if a library has security threats, we give it the highest priority over the other libraries” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=WB4D886K)) #ffd400
|
||
- *To check later how this security aspect is managed later.*
|
||
- - “value” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=UWQNZUL3)) #ff6666
|
||
- - “AHP method to obtain weight for each category” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=XH4UYBJP)) #a28ae5
|
||
- - “SAW method to multiply each category value by its weight (obtained from AHP) and sum those values to generate the ranking value for each library.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=YIFBLJYP)) #5fb236
|
||
- - “chatbot” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=PEIUD5DB)) #ffd400
|
||
- *to check if details about its implementation have been given.*
|
||
- - “AHP” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=ABHXTKAQ)) #5fb236
|
||
- *AHP to obtain the wight for each category.*
|
||
- - “SAW” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=5HZX2H7X)) #a28ae5
|
||
- *THis is for calculating rangking values for each category.*
|
||
- - “We performed evaluation sessions in two phases to ensure that the proposed metrics and the prioritization approach were helpful and suitable.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=JY32HVX6)) #ffd400
|
||
- *what does it mean?*
|
||
- - “MCQ” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=ZED9DUJ4)) #ffd400
|
||
- *CHeck what is MCQ*
|
||
- - “first section of the survey discusses the developers' industry background” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=FC2W37Z9)) #5fb236
|
||
- - “second section targets the behavior of third-party libraries” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=XULJ2BX9)) #5fb236
|
||
- - “Always, Often, Sometimes, Rarely, and Never.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=J8I5BEA4)) #a28ae5
|
||
- - “users who have worked” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=99CDQB57)) #5fb236
|
||
- - “individuals who identified themselves as developers on GitHub” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=GY76E9J3)) #5fb236
|
||
- - “280 and 232 emails to contributors and individuals, respectively.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 14](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=14&annotation=NWZ6N2RK)) #5fb236
|
||
- - “60% of the developers have five years of experience or below, 35% are between six and ten years, and 5.5%” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 15](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=15&annotation=VJVKY5EJ)) #ffd400
|
||
- *Numbers are not consistent with the content of Table 3.*
|
||
- - “57% and 53% at the individuals' level, respectively” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 16](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=16&annotation=GBB8PHZ4)) #ffd400
|
||
- *why two percentages?*
|
||
- - “compatibility, conflicts between TPLs, update's complexity, the library's GitHub status, and others” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 19](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=19&annotation=32B8CULV)) #a28ae5
|
||
- - “67% of our participants consider TPL updates' prioritization challenging” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 19](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=19&annotation=SXTGF3RH)) #ffd400
|
||
- *Such a conclusion is not evident.*
|
||
- - “details of the TPLs update prioritization.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 19](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=19&annotation=VBTB6GQZ)) #a28ae5
|
||
- - “overview of each category and what factors fall under it, whereas Table 6 contains the high-level definition of each category.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 19](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=19&annotation=GF9FIJEJ)) #a28ae5
|
||
- - “5.1.1 Compatibility” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 20](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=20&annotation=JDEMKKZS)) #a28ae5
|
||
- - “Compatibility” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 20](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=20&annotation=9EKB2TLW)) #a28ae5
|
||
- - “API stability, which indicates compatibility if a client can compile to the new API change.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 20](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=20&annotation=YPATNYY8)) #a28ae5
|
||
- - “gap between the installed release and the target release” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 20](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=20&annotation=6KR8V88R)) #a28ae5
|
||
- - “ratio of recently reported issues” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 20](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=20&annotation=7HY8FYC5)) #a28ae5
|
||
- - “Accessibility” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 21](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=21&annotation=V7PXI4S7)) #a28ae5
|
||
- - “migration effort is one of the developers' main concerns while managing dependencies in their projects and making related decisions” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 22](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=22&annotation=S7IWRNMI)) #a28ae5
|
||
- - “After proposing a set of metrics and classifying them into five categories, we used AHP and SAW methods to build our prioritization model [30][31].” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 23](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=23&annotation=P739E9PA)) #a28ae5
|
||
- - “last two related to library extraction and rankin” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 24](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=24&annotation=6JRWN2ZU)) #5fb236
|
||
- - “each library's official releases from the Maven website [45] and then check if the installed release number from the Gradle file is available in the official releases;” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 25](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=25&annotation=TLVIR4XL)) #5fb236
|
||
- - “After we extract and confirm TPLs, we collect the required resources to calculate the metrics. First, we download the library's files (jar and aar) and the release metadata from the Maven website [45]; this is required to calculate SFS, MSS, UD, and UPC metrics as they depend on the source code of the library, except for UD metric, which requires only releases' dates. We use the RevAPI website tool [46] to check the difference between the two Maven library releases. RevAPI tool [46] shows the difference between two APIs in terms of changes and their severities; we consider "BREAKING" and "POTENTIALLY_BREAKING" as breaking changes and others as non-breaking changes to calculate the BCR metric. Unfortunately, the RevAPI tool [46] sometimes fails to get the API difference for a library; in that case, we ignore the BCR metric for that library and calculate compatibility as of DD and UD metrics only. Figure 8 shows the process of calculating compatibility metrics.” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 26](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=26&annotation=DQNNC8RE)) #ffd400
|
||
- *This phase needs more detail especially because it seems there is a disassembly operation, which is performed to get the source code of the libraries under analysis.*
|
||
- - “three case studies” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 30](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=30&annotation=BINJRABV)) #ffd400
|
||
- *Can you comment on the representativeness of these thee repositories?*
|
||
- - “for each metric; they were given only each factor's (metric) definition and its value, and each evaluator evaluated at least two projects” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 30](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=30&annotation=LT2RWM3E)) #ffd400
|
||
- *What's the goal of this? Just to double check the values of the metrics?*
|
||
- - “After that, we asked seven evaluators to solve those tasks based on the given library without using the Chatbot, which was considered the baseline in our work” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 31](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=31&annotation=K8KD7N5D)) #ffd400
|
||
- *We might have some threats to validity here related to the expertise level of each evaluator.*
|
||
- - “e asked the participants to measure the time needed for each task” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 32](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=32&annotation=F8RL9RRB)) #ffd400
|
||
- *Can you say something more on the tasks you asked to be performed?*
|
||
- - “The results clearly show that the bot is significantly faster than the baseline,” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 32](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=32&annotation=AYDRQL5G)) #ffd400
|
||
- *So the implemented tool calculate metrics faster than humans. Is this the kind of feedback auhtors wanted to get?*
|
||
- - “participants were unable to solve it” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 33](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=33&annotation=BBL6NTT9)) #5fb236
|
||
- - “Based on reported issues to the library, can you determine the percentage of closed issues in the last quarter?” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 35](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=35&annotation=47AYF7TX)) #ffd400
|
||
- *What is the goal of asking evaluators to calculate the percentage of closed issues in the last quarter? Is this to test the correctenes of the developed metrics?*
|
||
- - “2018” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 38](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=38&annotation=ZYHJQBP4)) #ffd400
|
||
- - “May 04, 2022” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 41](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=41&annotation=D65D9AM8)) #ffd400
|
||
- - “2023” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 41](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=41&annotation=6JNT2IK4)) #ffd400
|
||
- - “[58] “Renovatebot.”” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 42](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=42&annotation=GURDAKNE)) #ffd400
|
||
- - “[59] “OWASP Dependency-Check .”” ([“JSSOFTWARE-D-24-00320_reviewer.pdf”, p. 42](zotero://select/library/items/AUC6ZP72)) ([pdf](zotero://open-pdf/library/items/L9JTAQSZ?page=42&annotation=8MIWDAX2)) #ffd400
|
||
- ### [[Comments]]
|
||
-
|
||
- The paper presents an approach supporting the management of third-party libraries of software systems. In particular, the authors propose a TPL update prioritization approach, aiming to assist mobile app developers in improving their decision-making process. The study includes a survey of practitioners to understand TPL update behaviors, identifying five TPL categories: Compatibility, Accessibility, Update Effort, Business Value, and Security. Metrics are proposed for each category, and the Analytical Hierarchy Process (AHP) and Simple Additive Weighting (SAW) methods are used to rank the libraries for updates. The approach is automated via a chatbot, and a case study with seven participants shows the chatbot's usefulness and efficiency.
|
||
- The paper is about an interesting topic, and I appreciate that the authors have already worked on improving the paper to address concerns raised during the first review round. I have some concerns about the current version of the manuscripts that are related to some presentation issues, and to limitations of the shown evalutions. In particular,
|
||
- In different places in the paper, the authors use "recently" or "recent" to refer to documents from 3-4 years ago. Overall, the authors should consider the most recent works. They need relevant papers, e.g., from the editions 2022 and 2023 of top SE venues.
|
||
- Even though Table 1 supports the TPLs categories and factors, the descriptive text of the table does not motivate the importance of the library prioritizations
|
||
- Some metric definitions need to be improved. For instance, the security metric presented in Sec. 5.1.5 is based on the number of security threats related to the library of interest. Unfortunately, the sources of such a number are not clear.
|
||
- The text in Sec 4.2 is inconsistent with the numbers shown in Tab. 3. I suggest revising the whole section, mainly because the sentence "we found that 67% of our participants consider TPL updates' prioritization challenging." is not supported by the previous discussions.
|
||
- Page 19 needs to be revised and detailed because a disassembly operation is performed to get the source code of the libraries under analysis.
|
||
- The evaluation presented in Section 6 is based on 3 GitHub repositories. Can you comment on the representativeness of these thee repositories?
|
||
- Section 6.1 needs to be clarified. What's the goal of the metric evaluation? Is it to double-check the values of the given metrics? Even comparing the time needed by the evaluators and those by the approach implementation is not relevant.
|
||
- According to the discussion on page 25, the implemented tool calculates metrics faster than humans. Is this the kind of feedback authors wanted to get?
|
||
- What is the goal of asking evaluators to calculate the percentage of closed issues in the last quarter? Is this to test the correctness of the developed metrics? A similar comment can be given for the other tasks shown in Tab. 14.
|
||
- ### [[REVIEWS/Notes]]
|
||
- ### YELLOW CONCERNS
|
||
background-color:: yellow
|
||
- {{query (and [[ffd400]] [[JSSOFTWARE-D-24-00320]] )}}
|
||
collapsed:: true
|
||
- ### ❓️Questions
|
||
- {{query (and [[question]] [[JSSOFTWARE-D-24-00320]] )[[question]]}}
|
||
query-table:: true
|
||
query-properties:: [:block] |