Despite ongoing efforts to integrate security concepts into computer science curricula, many graduates still lack practical software security skills. Active learning strategies-such as drill-and-practice-offer a promising approach to bridging this educational gap. To implement these strategies effectively, educators must design and deliver hands-on exercises focusing specifically on secure programming. However, creating effective secure programming exercises is difficult, requiring substantial time and in-depth expertise. This paper examines the potential of generative AI to aid in creating drill-and-practice exercises for introductory secure programming settings. Specifically, we prompt several large language models (LLMs) to assist in generating exercises targeting three common software vulnerability classes, with tasks aligned to the advanced beginner stage of the Dreyfus skills acquisition model. We systematically evaluate the generated exercises for correctness and instructional viability. Our results show that, for some vulnerabilities, LLMs can produce technically sound and useful exercises for advanced beginners. While many generated exercises were near classroom-ready, minor fine-tuning is often necessary to ensure quality and pedagogical alignment. These findings suggest that effective exercise generation in secure programming is best achieved through a symbiosis between generative AI and human educators.

In modern software systems, Web services are the primary means of provisioning remote resources. The service ecosystem exhibits significant duplication, with multiple services fulfilling, in essence, the same functional requirements. Such services often can be used interchangeably, so developers face the challenge of choosing the most suitable service for the task at hand. However, extant approaches for selecting services focus solely on the service’s performance characteristics (so-called QoS, whose properties include latency, reliability, availability, etc.). These approaches often neglect important utility characteristics (e.g., data accuracy, correctness, coverage, etc.). As a consequence, selected services may exhibit high performance, while delivering information that is either inaccurate or outdated. This article addresses this problem by introducing Quality of Information (QoI), a quality metric that measures data-related service performance. To be able to measure QoI accurately and effectively, we classify aspects of service QoI (e.g., data freshness) that can be measured automatically by comparing the service outputs and those (e.g., accuracy) that require manual effort for labeling the ground truth of a given test input. To accurately measure QoI without the costly manual effort, we formulate the input selection problem as selecting a small set of test inputs to most accurately approximate the QoI obtained by using a large input set. Inspired by input sample selection methods for testing machine learning (ML) algorithms, we have adapted these methods to evaluate their applicability on two datasets of service invocation results, having observed a noteworthy performance variance between ML testing and web service testing. Having identified insights and challenges in measuring QoI, this research highlights the need for further investigation.

Modern distributed systems replicate data across multiple execution sites to achieve high availability, low latency, and resilience against a single point of failure. These systems span heterogeneous platforms, ranging from native binaries to managed runtimes, thereby complicating the integration and extension of replicated data libraries (RDLs) across diverse execution environments. Contemporary RDLs typically presume a single dominant platform or expose limited interoperability through foreign function interfaces (FFIs), making cross-platform integration cumbersome. Moreover, extending an RDL with new capabilities often requires deep integration with a specific runtime or toolchain, hindering its reuse across diverse platforms. To address these challenges, we present BABELRDL, a software architecture that simplifies cross-platform interoperability and plug-in extensibility for replicated data management. BABELRDL establishes a common data format (CDF) that enables seamless interoperability among components running in compiled, interpreted, and managed execution environments. Its extensible plug-in model allows developers to introduce new functionality within a single language while preserving compatibility across others, reducing integration overhead and architectural fragmentation. We compare BABELRDL with FFI-based RDL integration, measuring performance and software quality characteristics. BABELRDL delivers up to 4.6 & times; lower latency and 3.2 & times; lower memory usage than FFI-based approaches, while improving throughput and balancing integration effort and long-term maintainability. Although requiring more upfront integration effort, BABELRDL yields simpler, more maintainable integration logic. As modern distributed systems increasingly depend on seamless interaction between diverse platforms, our work provides new insights into building maintainable, high-quality software architectures for cross-platform replicated data systems.

This artifact provides the implementation, deployment scripts, evaluation harness, and trace dataset for ScaleWave. It enables other researchers to (i) deploy ScaleWave on a multi-node Kubernetes/Knative cluster, (ii) deploy the face-recognition service and its equivalent implementations in the cluster, (iii) replay the provided workload trace against the Knative route endpoint, and (iv) collect run outputs (CSV) and generate plots using the included notebooks.

As demand grows, serverless computing systems must scale to meet increasing throughput requirements. Cloud computing easily achieves scalability by allocating abundant and elastic resources. In contrast, edge computing pre-deploys scarce and inelastic resources on site. However, edge applications often need to scale dramatically to handle bursty demand. Because they typically serve fewer users with highly variable workloads, our study shows that peak usage may require up to 8× more resources to be pre-deployed across edge nodes than in a centralized cloud. We observe that a typical serverless request can often be satisfied by different implementations, with dissimilar resource consumption profiles. When an edge application fails to scale up, the culprit is often a single bottleneck resource being fully consumed, with other resources readily available. Motivated by this observation, we introduce SCALEWAVE, a middleware for seamlessly scaling up with different implementations to fully utilize all available resources to achieve scalable serverless computing at the edge. Supporting multiple implementations, however, introduces new challenges for conventional auto-scaler designs. Reactive strategies tend to yield suboptimal performance, while proactive methods struggle with compatibility. SCALEWAVE overcomes these limitations by proactively distributing traffic across implementations, while leveraging existing autoscalers to manage instance scaling reactively for each one. Our evaluations using real workload traces on a heterogeneous cluster of edge devices demonstrate that our design allows edge applications to serve 2x more requests with minimal latency and achieve 50% more successful requests during workload bursts — showcasing substantial gains in scalability and resource efficiency.

Distributed nodes can access and modify replicated data using Conflict-free Replicated Data Types (CRDTs), which provide intuitive programming abstractions and enforce Strong Eventual Consistency (SEC) for conflict resolution. As a result of user errors, program bugs, or hardware malfunctions, a CRDT may be updated incorrectly, necessitating the undoing of the effects of executed operations. However, since many CRDT libraries lack built-in undo support, adding this capability requires modifying the library's source code, which is difficult to implement in a modular and reusable manner. Consequently, programmers often add this functionality ad hoc, resulting in code that is difficult to understand, maintain, and reuse. To address this problem, this paper presents CAMEL, a metaprogramming-based approach that automatically generates and actuates undo functionality for existing operation-based CRDT libraries using simple metadata configurations, without requiring manual source code modifications. The configurations specify which operations undo each other and the conditions that trigger the undo procedures. Based on this metadata, CAMEL generates a sequence of update operations that reverses the specified updates while preserving system consistency. We have implemented CAMEL in JavaScript and evaluated it against two state-of-the-art approaches. To demonstrate CAMEL's applicability, we apply it to three representative CRDTs of increasing complexity-Counter, Set, and Map-spanning scalar, collection, and associative data structures commonly deployed in practice. Our evaluation demonstrates that CAMEL reduces latency by approximately 7%-12% and memory consumption by approximately 6%-26%, on average, while software quality metrics shows that CAMEL enhances modularity, effectively streamlining the complexity of adding advanced features to distributed programming paradigms.1 Editor's note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Fuzzing has become a popular technique for discovering bugs and vulnerabilities. To increase the probability of finding bugs, developers should apply fuzzers that maximize program coverage. Program coverage typically measures the percentage of program lines or branches a fuzzer executes. However, these metrics fail to communicate the value of hitting a particular line, branch, or path. Many bugs manifest only within non-trivial control flows. To improve software quality, fuzzing non-trivial program paths should be more important than fuzzing trivial ones. This paper introduces rare-path coverage (RP-Coverage), a novel program coverage metric that conveys the value of discovering an unlikely control flow path. We have developed a new technique for estimating the probability of taking an execution path, which relies on probabilistic logic programming to declaratively express the logic for constructing and analyzing a probabilistic control flow graph. Our evaluation indicates RP-Coverage's promise as a metric for measuring fuzzing efficacy. Specifically, we observe that defects along rare paths-intuitively-substantially impact the effectiveness of fuzzers. However, we argue that existing fuzzing metrics fall short when conveying this significance. We also observe that the value of uncovering an unlikely path is better reflected by increases in RP-Coverage than existing metrics. Specifically, the average coverage increases are up to 49.5%, 11.1 %, and 15.4 % for RP-Coverage, line coverage, and branch coverage, respectively. This finding indicates that RP-Coverage is more elastic, or sensitive, to path probabilities and thus capable of more effectively quantifying a fuzzer's ability to discover unlikely program paths. As such, RP-Coverage demonstrates promise as a program coverage metric that enhances fuzzer fitness measures when supplementing standard criteria.

The increasingly poor state of software security poses significant threats to many of modern society's critical functions. Computing educators play a pivotal role in equipping future software engineers with the necessary skills to build secure systems. However, while traditional security courses often focus on conceptual knowledge, practical application is crucial for ensuring students can develop robust, secure software. Despite the importance of hands-on experience, students often lack suitable platforms for practicing secure programming. Inspired by drill-and-practice platforms that effectively train general programming skills, we have been working on a similar platform that focuses explicitly on teaching secure coding practices through active learning strategies. In this paper, we discuss the design of our prototype implementation: SecureCoder. Rooted in active learning principles, SecureCoder's design aims to promote student-centered education by encouraging students to actively apply theoretical secure programming concepts. Specifically, SecureCoder engages students with interactive attack-and-defend exercises, challenging them to exploit or patch software vulnerabilities in a sandboxed environment. Our ultimate objective is to bridge the gap between theoretical knowledge and practical application, fostering a deeper understanding and retention of secure coding principles. Through immediate and actionable feedback on validated exercises, SecureCoder is designed to reinforce learning and empower students to iteratively refine their solutions and build confidence in their skills. To study the potential of our design, we conducted a pilot study. The study results indicate that participants found SecureCoder to be relevant and engaging. Further, participant perceptions toward the attack-and-defend exercises suggest that SecureCoder's design has the potential to enhance secure programming education. Encouraged by SecureCoder's initial positive reception, we plan to open-source the project, inviting the broader education community to contribute to and benefit from shared security expertise. These collaborative efforts are essential for educating the next generation of security-aware software engineers. By integrating hands-on practice and active learning techniques, SecureCoder's design aims to address the urgent need for practical, skill-based security education, preparing students to meet the ever-evolving challenges of engineering secure solutions in the real world.

Exceptional behavior can be harmful to software quality and robustness. Like most modern programming languages, Java offers built-in mechanisms for expressing and handling exceptions. However, despite their languageintegrated design, exception handlers are easy to misuse. Researchers have identified exception-handling anti-patternsrecurring poor coding practices that threaten software quality. One of the most prevalent exception-handling anti-patterns-over-catching-occurs when a handler catches overly broad exception types, potentially obscuring the root cause of a failure. Integrated development environments (IDEs) play a critical role in helping developers identify and address software quality issues. Yet, existing tools can produce an overwhelming number of results, contributing to cognitive overload. To address this problem, we incorporate probabilistic reasoning into IDE-based exception-handling analysis. Exception Shipping & Handling (ESH), our prototype implementation, allows the IDE to present prioritized instances of the over-catch anti-patterns based on their likelihood of being problematic. We evaluate ESH through a user study focused on its usability for helping developers assess over-catching handlers. Our results show that participants found ESH intuitive and provide useful insights into how to integrate probabilistic reasoning into an IDE. Specifically, our study highlights the need for transparency and contextualized UI elements.

Modern replicated data systems often rely on libraries integrated with application code. These replicated data libraries exchange asynchronous messages, whose execution orderings are non-deterministic, allowing any message interleaving to occur during system execution. Testing the integration of application code with library code requires considering all possible interleavings, whose detection and simulation pose significant challenges for application developers. In this paper, we present ER-pi, a middleware system, designed to detect and replay possible interleavings in replicated data systems. ER-pi identifies potential interleavings for a given code segment and applies four novel pruning techniques to reduce the complexity of the problem space. Subsequently, it replays the remaining interleavings to perform the specified integration testing tasks. To assess the applicability and efficacy of ER-.., we integrated it with third-party replicated data libraries across various programming languages. Our experiments demonstrate ER-pi 's capability to replicate 12 known bugs and uncover 5 types of common misconceptions associated with replicated data libraries. Given that integration testing is essential for ensuring correctness and robustness, the design of ER-pi holds promise in extending these testing benefits to the realm of replicated data systems.

Modern distributed systems replicate data across multiple execution sites by means of special-purpose replicated data libraries (RDLs), which provide read-write data access and synchronization. Programming languages often need to be mixed across replica sites to meet business requirements and resource constraints. Because RDLs are typically written in a single language, integrating them in multilingual environments requires special-purpose code, whose characteristics are poorly understood. We aim to bridge this knowledge gap by reviewing two key strategies for integrating RDLs in multilingual environments: (1) foreign-function interface (FFI) and (2) common data format (CDF). Our preliminary results indicate performance and implementation tradeoffs: CDF offers latency and memory consumption advantages, while incurring an additional implementation burden. With modern distributed systems utilizing multiple languages, our findings can inform the design of RDLs for multilingual replicated data systems.

BACKGROUND: Modern distributed systems replicate data across multiple execution sites. Business requirements and resource constraints often necessitate mixing different languages across replica sites. To facilitate the management of replicated data, modern software engineering practices integrate special-purpose replicated data libraries (RDLs) that provide read-write access to the data and ensure its synchronization. Irrespective of the implementation languages, an RDL typically uses a single language or offers bindings to a designated one. Hence, integrating existing RDLs in multilingual environments requires special-purpose code, whose software quality and performance characteristics are poorly understood. AIMS: We aim to bridge this knowledge gap to understand the software quality and performance characteristics of RDL integration in multilingual environments. METHOD: We conduct an empirical study of two key strategies for integrating RDLs in the context of multilingual replicated data systems: foreign-function interface (FFI) and a common data format (CDF); we measure and compare their respective software metrics and performance to understand their suitability for the task at hand. RESULTS: Our results reveal that adopting CDF for cross-language interaction offers software quality, latency, memory consumption, and throughput advantages. We further validate our findings by (1) creating a CDF-based RDL for mixing compiled, interpreted, and managed languages; and (2) enhancing our RDL with plug-in extensibility that enables adding functionality in a single language while maintaining integration within a multilingual environment. CONCLUSIONS: With modern distributed systems utilizing multiple languages, our findings provide novel insights for designing RDLs in multilingual replicated data systems.

The exponential growth of genomic data presents a challenge to bioinformatics research. NCBI BLAST, a popular pairwise sequence alignment tool, does not scale with the hundreds of gigabytes (GB) of sequenced data. Therefore, mpiBLAST was widely adopted and scaled up to 65,536 processors. However, mpiBLAST is tightly coupled with an obsolete NCBI BLAST version, creating a challenge to upgrading mpiBLAST with the ever-changing NCBI BLAST code. Recent parallel BLAST implementations, like SparkBLAST, use parallelism wrappers separate from NCBI BLAST to overcome this issue. However, query partitioning, a parallel method that duplicates the genome database on each compute node, makes SparkBLAST scale poorly with databases larger than a single node's memory. Thus, no parallel BLAST utility simultaneously addresses performance, scalability, and software maintainability. To fill this gap, we introduce SparkLeBLAST, a parallel BLAST tool that uses the Spark framework and efficient data partitioning to combine mpiBLAST's performance and scalability with SparkBLAST's simplicity and maintainability. SparkLeBLAST democratizes scalable genomic analysis for domain scientists without extensive distributed computing experience. SparkLeBLAST runs up to 6.68× faster than SparkBLAST. SparkLeBLAST also accelerates taxonomic assignment of COVID-19 genomic diversity analysis by 20.9× as it speeds up the BLAST search component by 88.6× using 128 compute nodes.

Despite the widespread adoption of Web services in modern computing applications, there remains a lack of a systematic approach that can guide service developers in creating appealing services. This article addresses this gap by presenting findings from a comprehensive study of RapidAPI web services, the largest service marketplace, and their integration into GitHub-hosted applications. We collected data on over 16K RapidAPI services and 19K corresponding GitHub repositories invoking these services, evaluating each service based on metrics such as latency, reliability, pricing, followers, aggregate ratings community support, and provider support. Our analysis examines how these metrics influence service popularity and usage patterns on GitHub. We manually analyzed 800 GitHub repositories and identified developers’ service selection preferences and integration patterns, considering alternative services and their features. We then classified GitHub developers based on proficiency levels to understand how developers’ levels of proficiency impact their service selection and integration strategies. Moreover, we examined the metrics influence for matured set of repositories by excluding those intended solely for practice purposes. Our findings offer insights for service marketplaces to recommend integration-friendly services and for service developers to create offerings tailored to real-world application needs.

To harness the potential of edge resources, two-tier client-cloud applications require transformation into three-tier client-edge-cloud applications. Such transformations are hard for programmers to perform correctly by hand. Many cloud services maintain a runtime state that needs to be replicated at the edge. Once replicated, this state must then be synchronized efficiently and correctly. To facilitate the transition to edge computing, we present a framework that automatically transforms client-cloud apps to their client-edge-cloud versions. Our framework, EdgStr, automatically replicates cloud-based services at the edge. EdgStr synchronizes the replicated service state by relying on a third-party Conflict-Free Replicated Data Type (CRDT). It generates code that connects service state changes to CRDT update operations, thus ensuring that the state changes at each replica eventually converge to the same replicated state. As an evaluation, we applied EdgStr to transform representative distributed mobile apps for deployment in dissimilar network and device setups. EdgStr correctly replicates cloud services (targeting the important domain of Node.js), deploying the resulting replicas on an ad-hoc edge cluster, hosted by Raspberry PI devices. As long as eventual consistency is congruent with the functionality of a cloud service, EdgStr can automatically replicate this service and deploy the replicas at the edge, thus offering the performance benefits of edge-based execution, without the high costs of manual program transformation.

Despite their language-integrated design, Java exceptions can be difficult to use effectively. Although Java exceptions are syntactically straightforward, negligent practices often result in code logic that is not only inelegant but also unsafe. This paper explores the challenge of auditing Java software to enhance the effectiveness and safety of its exception logic. We revisit common anti-patterns associated with Java exception usage and argue that, for auditing, their detection requires a more nuanced approach than mere identification. Specifically, we investigate whether reporting such anti-patterns can be prioritized for subsequent examination. We prototype our approach as HANDEL, in which anti-patterns and their priority, or weight, are expressed declar-atively using probabilistic logic programming. Evaluation with representative open-source code bases suggests HANDEL'S promise in detecting, reporting, and ranking the anti-patterns, thus helping streamline Java software auditing to ensure the safety and quality of exception-handling logic.

To achieve low execution latency, time-sensitive applications, including AR/VR and autonomous driving, cache data at the edge of the network, close to end users. However, existing edge caches often fail to deliver low latency due to the inefficiency of DNS requests and the physical remoteness of their users. The solution described herein addresses these inefficiencies by presenting a millisecond-level, lightweight caching architecture that operates directly on widely deployed WiFi access points (APs). Specifically, our architecture interposes another level of caching closer to the client and is fine-tuned for APs's limited cache memory. Our solution (1) features a novel algorithm for managing cache at the AP level; (2) allows the cache query workflow to proceed at full speed; and (3) requires no changes to the application logic. Our evaluation demonstrates that our reference implementation can decrease application-level latency by as much as 76% compared to the existing solutions, without impacting AP core functions. Our caching architecture effectively improves application responsiveness by tapping into existing networking infrastructure, thus offering a powerful and cost-efficient system component for building emerging time-sensitive applications at the edge.

Despite the widespread adoption of Web services in modern computing applications, there remains a lack of a systematic approach that can guide service developers in creating appealing services. This paper addresses this gap by presenting findings from a comprehensive study of RapidAPI web services, the largest service marketplace, and their integration into GitHub-hosted applications. We collected data on over 16K RapidAPI services and 19K corresponding GitHub repositories invoking these services, evaluating each service based on metrics such as latency, reliability, pricing, community support, and provider support. Our analysis examines how these metrics influence service popularity and usage patterns on GitHub. We manually analyzed 800 GitHub repositories and identified developers' service selection preferences and integration patterns, considering alternative services and their features. Additionally, we classified GitHub developers based on proficiency levels to understand how developers' levels of proficiency impact their service selection and integration strategies. Our findings offer insights for service marketplaces to recommend integration-friendly services and for service developers to create offerings tailored to real-world application needs.

A QoS-optimal service balances reliability, execution cost, and latency to satisfy application requirements. In emerging distributed environments, with their unreliable and resource-scarce mobile/IoT devices, it is hard but essential to optimize the QoS of mobile services. Fortunately, these environments are characterized by ever-growing equivalent functionalities that satisfy the same requirements by different means. The combined execution of equivalent microservices has been used to improve QoS (e.g., majority voting for accuracy, speculative parallelism for latency, and failover for reliability). These executions are commonly described as workflow patterns, crude-grained recurring interactions across microservices within a service. However, as the number of equivalent microservices grows, applying a crude-grained pattern may cause severely unbalanced QoS, while nesting these patterns is convoluted to implement and expensive to maintain. In this article, we introduce a novel workflow meta-pattern for defining fine-grained workflow patterns that describe QoS-optimal combined executions of equivalent microservices. The meta-pattern employs a domain-specific algebraic expression to specify the invocation sequences of equivalent microservices, and a Boolean function to determine whether to terminate the execution. To evaluate the applicability of our meta-pattern, we build a Scala functional programming library, by which we further develop edge computing and cognitive service applications. Our experiments show that applying our meta-pattern to define such workflow patterns saves programmer effort, while the resulting patterns effectively improve the QoS of distributed applications.

Serverless computing enables service developers to focus on creating useful services, without being concerned about how these services would be deployed and provisioned. Many developers reuse existing open-source serverless functions to create their own functions. However, existing technologies for searching open-source software repositories have not taken into consideration the unique features of serverless functions. This paper presents a novel approach to searching for serverless functions, called Open-Source Serverless Search (OS3) that maximizes the utility of the returned serverless functions by (1) basing the search process on both descriptive keywords and library usages, thus increasing the search results' precision and completeness; (2) filtering and ranking the search results based on the software license, to accommodate the unique requirements of deploying serverless functions on dissimilar platforms, including cloud and edge computing. Implemented in 3K lines of Python, with a search space of 5,981 serverless repositories from four major serverless platforms, OS3 outperforms existing search approaches in terms of the suitability of the search results, based on our evaluation with realistic use cases.