We study how security patches in highly configurable C/C++ systems map onto the space of compile-time variants. We formalize the Vulnerability Impact Condition (VIC) - a Boolean predicate over configuration options that denotes all variants that contained the original flaw - and introduce PatchLens, a purely static technique that recovers VICs by aligning AST-level patch hunks with source-level presence conditions and resolving file inclusion via lightweight build system analysis. Evaluating PatchLens on 1,192 Linux kernel, 289 FFmpeg, and 100 PHP patches, we compute precise, human-readable VICs without the need to compile any system variant. The resulting predicates are compact (avg. 1.84 variables for Linux, 3.23 for FFmpeg, 1.04 for PHP) and show that only a small fraction of vulnerabilities are system-wide, which carry higher CVSS scores; meanwhile, CVE texts almost never encode the required options (≈ 1

The main aspects considered in smart homes (SHs) include activity classification, routine prediction, energy consumption reduction, and actuator-state prediction. SHs require highly responsive behavior whenever state changes are detected. In this context, the key factors are both the response time and the quality of state prediction. However, many current approaches rely on deep learning models that demand substantial computational power and often require architectural changes whenever new device attributes are introduced. Moreover, the literature has predominantly focused on human-activity prediction rather than device-state prediction. In this work, we focus on actuator-state prediction and propose a flexible solution based on incremental learning, dynamic time windows, and data streaming, designed to accommodate frequent changes in user and device data structures independently of the underlying activity-recognition method. Using four datasets, one from CASAS, two generated by simulation, and one collected from a volunteer's SH, we evaluated the models in terms of Micro-F1 and per-instance inference time. The results show that, even in the most complex scenario, inference latencies for all algorithms remain in the millisecond range, making them practically negligible for real-time smart-home operation. Regarding predictive performance, adaptive random forest (ARF), k-nearest neighbors classifier (KNN), and extremely fast decision tree (EFDT) achieved the highest Micro-F1 scores across the different configurations, with ARF and EFDT offering an especially favorable balance between accuracy and responsiveness for deployment in real-world SH environments.

Computer Vision (CV) has become a key component of modern camera surveillance systems, enhancing public and private security. One persistent challenge in this domain is the reliable detection of handguns in low-quality images, in which weapons are often small, partially occluded, and carried discreetly to avoid attention. To address this, recent advances have focused on specialized models trained on specific weapon types and human poses. However, two crucial aspects remain underexplored. First, while state-of-the-art models have improved handgun detection rates, they also exhibit a noticeable increase in false positives, often mistaking unrelated objects for firearms. Second, although combining gun detection with pose estimation is a common approach, it may offer limited value in practice, as criminals tend to maintain natural, non-suspicious postures to avoid drawing attention. In this work, we analyze the effectiveness of such models in scenarios that reflect real-world urban settings: low-resolution surveillance footage, small concealed weapons, and non-suspicious human behavior. To address these limitations, we propose two key contributions: an enhanced approach that extends a gun-and-pose model with a different method for computing the intersection between predictions and ground truth; and a new set of images designed to better train models for detecting handguns in the context of non-suspicious human behavior. In addition to improving performance in our experiments, our findings also highlight the need for more robust and context-aware handgun detection systems in CV-based surveillance.

GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of the GHSA review processes, analyzing over 288,000 advisories spanning 2019-2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.

Architecture Decision Records (ADRs) are lightweight artifacts for documenting critical architectural decisions and supporting collaboration in software projects. Although ADRs have gained traction in open-source communities, adoption remains inconsistent, and their impact on repositories and developers is not well understood. This study presents an in-depth quantitative analysis of ADR practices in open-source software. Using a dataset of 921 GitHub repositories and 5800 ADRs from earlier ADR studies, we investigate (1) repository-centric patterns, relating ADR attributes such as length, frequency of updates, and lifecycle status to project quality and activity metrics, and (2) developer-centric factors, examining who contributes to ADRs, how core and peripheral developers differ, and how ADR engagement relates to their productivity and maintenance activities. Data extraction and analysis combine PyDriller for repository metadata and SonarQube for quality metrics. Our results show that ADR-related variables exhibit predominantly small correlations with code quality and productivity metrics, suggesting that ADR adoption is associated with, at most, modest observable effects at scale. At the same time, ADR adoption practices in open-source projects are inconsistent: about 63% of ADRs are opened directly with a status of "accepted" or equivalent, bypassing the deliberative context that ADRs are intended to capture. These findings highlight both the promise and the practical challenges of integrating ADRs into open-source software development.

Smart home systems have evolved from simple automation to AI-driven ecosystems. Nevertheless, user interaction often remains limited to rigid interfaces. This paper presents ECLIPS (Environmental Command Language Intelligent Processing System), an extension of a previously proposed Smart Home Orchestration Framework for a more intelligent and responsive environment. ECLIPS introduces a Two-Layer Modular Hierarchical Multi-Agent Architecture that integrates Large Language Model (LLM) agents as a semantic interpretation layer, while preserving established predictive models based on LSTM (Long Short-Term Memory) and MLP (Multi-Layer Perceptron) networks. The proposed approach enables natural language interaction, contextual information retrieval, and transparent explanation of system behavior without altering the underlying automation logic. Evaluated through a design science–oriented case study within an industrial smart home project, results demonstrate improved user understanding, flexibility, and control. Combining predictive machine learning with agentic LLM architectures enhances usability, transparency, and adaptability in smart home ecosystems.

The paradigm of Smart Environments (SE) has transitioned from simple remote automation to proactive, context-aware ecosystems driven by Artificial Intelligence. However, orchestrating heterogeneous AI subsystems, which range from high-frequency sensor streams to computationally intensive Large Language Models (LLMs), imposes significant challenges regarding latency, interoperability, and data privacy. To address these issues, we present ARGUS, a distributed, event-driven software architecture designed to orchestrate intelligent decision-making across the Edge-Cloud continuum. We validate the architecture through a reference implementation and performance evaluation, demonstrating that ARGUS effectively accommodates heavy computational workloads, such as those used in generative AI and recommendation systems, to create intelligent environments that dynamically adapt to user needs.

Software Product Lines (SPLs) improve time-to-market, enhance software quality, and reduce maintenance costs. Current SPL re-engineering practices are largely manual and require domain knowledge. Thus, adopting and, to a lesser extent, maintaining SPLs are expensive tasks, preventing many companies from enjoying their benefits. To address these challenges, we introduce Foundry , an approach utilizing software transplantation to reduce the manual effort of SPL adoption and maintenance. Foundry enables integrating features across different codebases, even codebases that are unaware that they are contributing features to a software product line. Each product produced by Foundry is pure code, without variability annotation, unlike feature flags, which eases variability management and reduces code bloat. We realise Foundry in prodScalpel , a tool that transplants multiple organs ( i.e. , a set of interesting features) from donor systems into an emergent product line for codebases written in C. Given tests and lightweight annotations identifying features and implantation points, prodScalpel automates feature extraction and integration. To evaluate its effectiveness, our evaluation compares feature transplantation using prodScalpel to the current state of practice: on our dataset, prodScalpel’s use speeds up feature migration by an average of 4.8 times when compared to current practice.

Smart homes are transforming domestic environments by integrating connected devices and sensors, enabling lighting, temperature, and security automation. While these systems enhance comfort and efficiency, they often rely on predefined settings or manual input due to the absence of adaptive recommendation systems. AI-driven recommendation systems personalize actions by learning from user behavior and environmental data, improving the smart home experience. However, they also introduce cybersecurity risks, particularly data poisoning attacks, where manipulated data disrupts system functionality. This paper exposes and examines vulnerabilities in smart home recommendation systems, categorizing data poisoning attacks and analyzing their impact. Through a literature review and attack vector analysis, we identify key weaknesses and propose mitigation strategies to enhance security. Our goal is to contribute to developing robust smart home technologies that protect user privacy, ensure reliability, and withstand adversarial threats.

Software Quality Assurance (SQA) Engineers are responsible for assessing a product during every phase of the software development process to ensure that the outcomes of each phase and the final product possess the desired qualities. In general, a great SQA engineer needs to have a different set of abilities from development engineers to effectively oversee the entire product development process from beginning to end. Recent empirical studies identified important attributes of software engineers and managers, but the quality assurance role is overlooked. As software quality aspects have become more of a priority in the life cycle of software development, employers seek professionals that best suit the company's objectives and new graduates desire to make a valuable contribution through their job as an SQA engineer, but what makes them great? We addressed this knowledge gap by conducting 25 semi-structured interviews and 363 survey respondents with software quality assurance engineers from different companies around the world. We use the data collected from these activities to derive a comprehensive set of attributes that are considered important. As a result of the interviews, twenty-five attributes were identified and grouped into five main categories: personal, social, technical, management, and decision-making attributes. Through a rating survey, we confirmed that the distinguishing characteristics of great SQA engineers are curiosity, the ability to communicate effectively, and critical thinking skills. This work will guide further studies with SQA practitioners, by considering contextual factors and providing some implications for research and practice.

Este artigo celebra a trajetória de Silvio Meira, engenheiro e cientista da computação, destacando seu papel fundamental como arquiteto do ecossistema de inovação digital brasileiro. Partindo de uma sólida formação acadêmica no ITA e no exterior, Meira consolidou o Centro de Informática da UFPE, combatendo a ”fuga de cérebros”regional. Sua visão pragmática resultou na criação de duas instituições cruciais: o C.E.S.A.R, uma ponte entre academia e mercado, e o Porto Digital, um parque tecnológico que revitalizou a economia do Recife. O texto aborda sua influência estratégica em grandes corporações e políticas públicas, consolidando-o como uma figura central na intersecção entre tecnologia, negócios e desenvolvimento socioeconômico no Brasil.

ContextSmart home devices have become increasingly popular in modern households, powered by the Internet of Things (IoT) advances. The data generated by smart devices can provide valuable insights into users' behavior and preferences. By analyzing the data, one can understand how people interact with their homes, thus creating a "smart home profile". To comprehend the complete IoT ecosystem dynamics of an intelligent environment, it is necessary to learn from each IoT device to predict its status in the future time. Nevertheless, dealing with real-world IoT data structure requires considerable preprocessing tasks and the employment of classifiers that can learn multiple IoT inputs from a single IoT message.ObjectiveAware of these challenges, this paper proposes a novel methodology to process multi-label IoT data and provide a comprehensive comparison of multi-label classifiers for forecasting the status of smart devices, considering their efficiency and accuracy.MethodWe propose a data transformation method to preprocess the IoT data to be used by multi-label classifiers. This method is based on real data structure.ResultsWe evaluate our proposal in two real-world scenarios and various multi-label classifiers. The promising findings indicate that efficient classifiers can generate many correct predictions for a comprehensive IoT ecosystem in a small fraction of a second.ConclusionsOur proposed data transformation can fit the context of prediction to smart homes and work with multi-label classifiers to understand user behavior.

Test smells indicate poor development practices in test code, reducing maintainability and reliability. While developers often struggle to prevent or refactor these issues, existing tools focus primarily on detection rather than automated refactoring. Large Language Models (LLMs) have shown strong potential in code understanding and transformation, but their ability to both identify and refactor test smells remains underexplored. We evaluated GPT-4-Turbo, LLaMA 3 70B, and Gemini-1.5 Pro on Python and Java test suites, using PyNose and TsDetect for initial smell detection, followed by LLM-driven refactoring. Gemini achieved the highest detection accuracy (74.35% Python, 80.32% Java), while LLaMA was lowest. All models could refactor smells, but effectiveness varied, sometimes introducing new smells. Gemini also improved test coverage, unlike GPT-4 and LLaMA, which often reduced it. These results highlight LLMs' potential for automated test smell refactoring, with Gemini as the strongest performer, though challenges remain across languages and smell types.

The adoption of Large Language Models (LLMs) is reshaping software development as developers integrate these LLMs into their applications. In such applications, prompts serve as the primary means of interacting with LLMs. Despite the widespread use of LLM-integrated applications, there is limited understanding of how developers manage and evolve prompts. This study presents the first empirical analysis of prompt evolution in LLM-integrated software development. We analyzed 1,262 prompt changes across 243 GitHub repositories to investigate the patterns and frequencies of prompt changes, their relationship with code changes, documentation practices, and their impact on system behavior. Our findings show that developers primarily evolve prompts through additions and modifications, with most changes occurring during feature development. We identified key challenges in prompt engineering: only 21.9% of prompt changes are documented in commit messages, changes can introduce logical inconsistencies, and misalignment often occurs between prompt changes and LLM responses. These insights emphasize the need for specialized testing frameworks, automated validation tools, and improved documentation practices to enhance the reliability of LLM-integrated applications.

This study describes a framework for integrating intelligent orchestration into smart homes. In addition, we used a design science approach to propose and showcase how the framework suggests scenes or rules tailored to smart home users of a Brazilian company.

Traditionally, energy efficiency research has focused on reducing energy consumption at the hardware level and, more recently, in the design and coding phases of the software development life cycle. However, software testing's impact on energy consumption did not receive attention from the research community. Specifically, how test code design quality and test smell (e.g., sub-optimal design and bad practices in test code) impact energy consumption has not been investigated yet. This study examined 12 Apache projects to analyze the association between test smell and its effects on energy consumption in software testing. We conducted a mixed-method empirical analysis from two dimensions; software (data mining in Apache projects) and developers' views (a survey of 62 software practitioners). Our findings show that: 1) test smell is associated with energy consumption in software testing. Specifically smelly part of a test case consumes 10.92\% more energy compared to the non-smelly part. 2) certain test smells are more energy-hungry than others, 3) refactored test cases tend to consume less energy than their smelly counterparts, and 4) most developers lack knowledge about test smells' impact on energy consumption. We conclude the paper with several observations that can direct future research and developments.

Research and development (R&D) projects involving universities and industry drive innovation by bringing scientific knowledge closer to practical problems. Nevertheless, the partnership comes with challenges, such as high developer turnover, team members with diverse backgrounds and experience levels, and part-time contributors. In this paper, we report experiences in a large R&D project in the smart home field, in which we proposed software development practices and tools with the goal of promoting short feedback cycles and dissemination of best practices. By surveying the developers of this project, we discovered that the practices and tools were generally well accepted and also determined specific areas that need improvement. The insights collected in this study can be used by other teams conducting R&D projects.

Computational notebooks, such as Jupyter, have been widely adopted by data scientists to write code for analyzing and visualizing data. Despite their growing adoption and popularity, few studies have been found to understand Jupyter development challenges from the practitioners’ point of view. This article presents a systematic study of bugs and challenges that Jupyter practitioners face through a large-scale empirical investigation. We mined 14,740 commits from 105 GitHub open source projects with Jupyter Notebook code. Next, we analyzed 30,416 StackOverflow posts, which gave us insights into bugs that practitioners face when developing Jupyter Notebook projects. Next, we conducted 19 interviews with data scientists to uncover more details about Jupyter bugs and to gain insight into Jupyter developers’ challenges. Finally, to validate the study results and proposed taxonomy, we conducted a survey with 91 data scientists. We highlight bug categories, their root causes, and the challenges that Jupyter practitioners face.