A Quantitative Analysis into the Economics of Correcting Software Bugs
Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from “Lines of Code per day” as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as “Lines of clean, simple, correct, well-documented code per day”, but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.
KeywordsSoftware Development Life Cycle Model Checking Software Verification Empirical studies
Unable to display preview. Download preview PDF.
- 1.Anderson., R.: Why information security is hard, an economic perspective. In: 17th Annual Computer Security Applications Conf., New Orleans, LA (December 2001)Google Scholar
- 2.Carman, D.W., Dolinsky, A.A., Lyu, M.R., Yu, J.S.: Software Reliability Engineering Study of a Large-Scale Telecommunications System. In: Proc. Sixth Int’l Symp. Software Reliability Eng., pp. 350–359 (1995)Google Scholar
- 3.Connell, C.: It’s Not About Lines of Code, http://www.developer.com/java/other/article.php/988641 (viewed March 15, 2010)
- 5.Kaaniche, K., Kanoun, K.: Reliability of a Telecommunications System. In: Proc. Seventh Int’l Symp. Software Reliability Eng., pp. 207–212 (1996)Google Scholar
- 8.Mills, H.D.: Top-down programming in large systems. In: Rustin, R. (ed.) Debugging Techniques in Large Systems. Prentice-Hall, Englewoods Cliffs (1971)Google Scholar
- 10.Cobb, C.W., Douglas, P.H.: A theory of production. American Economic Review 18(1), 139–165 (1928); Supplement, Papers and Proceedings of the Fortieth Annual Meeting of the American Economic Association (1928)Google Scholar
- 11.Bayes, T.: An essay towards solving a problem in the doctrine of chances. Philosophical Transactions of the Royal Society 53, 370–418 (1763)Google Scholar
- 12.Bacon, D.F., Chen, Y., Parkes, D., Rao, M.: A market-based approach to software evolution. Paper Presented at the Proceeding of the 24th ACM SIGPLAN Conference Companion on Object Oriented Programming Systems languages and Applications (2009)Google Scholar
- 13.Sestoft, P.: Systematic software testing IT University of Copenhagen, Denmark1 Version 2, 2008-02-25 (2008)Google Scholar
- 14.Wright, C.S.: The not so Mythical IDS Man-Month: Or Brooks and the rule of information security. In: ISSRE (2010)Google Scholar