Search papers, labs, and topics across Lattice.
This paper investigates the evolution and characteristics of "util" code (files named with "util" in their path) in seven mature open-source projects (e.g., Linux kernel, Tomcat) using longitudinal analysis of their Git repositories. The study examines the correlation between util code usage, complexity, developer collaboration, and security vulnerabilities across 1773 monthly snapshots. Results indicate that util files are disproportionately associated with vulnerabilities and often exhibit limited developer collaboration, challenging the assumption that they promote code reuse and safety.
"Utility" code, intended to be broadly useful and reusable, is actually 2.75x more likely to be involved in a vulnerability than other code.
Filenames are a concise means of conveying information about source code to fellow developers. One such convention is util. Commonly understood to stand for"utility", filenames with the letters util are often an indication that the file contains code that may be broadly useful or reusable. Some projects use this convention heavily, for example, the Apache Tomcat server contains 925 files with util in the path name, which is 17.9% of all source code files in the tree. While the intent of the name may be to prevent duplicate code and reduce workload, what actually happens to util code over time? Do projects move away from util code as they mature? Are util files being used by fellow colleagues, or maintained and used by their author? The goal of our work is to help developers avoid creating unsafe and unused util files when developing their projects. We conducted a longitudinal mining study of the Git repositories of seven open source projects that have a long development history (Linux kernel, Django, FFmpeg, httpd, Struts, systemd, Tomcat). We analyzed how util usage, complexity, developer collaboration, and security are potentially correlated within these projects. Our longitudinal analysis was measured at 30-day intervals throughout the entire history of each project, resulting in 1773 snapshots over 147 project-years of development. We conducted rename tracking at every 30-day snapshot to examine util files over their entire lifetime in a codebase. For example, we found that a util file can be as much as 2.75 times more likely to be involved in a vulnerability than non-util files. While every project can adopt their own naming conventions, the ubiquity and longevity of util files shows a broader developer intent that is useful for understanding the socio-technical nature of software development.
