Why secret detection tools are not enough: It's not just about false positives - An industrial case study.

Checked-in secrets in version-controlled software projects pose security risks to software and services. Secret detection tools can identify the presence of secrets in the code, commit changesets, and project version control history. As these tools can generate false positives, developers are provided with mechanisms to bypass the warnings generated from these tools. Providing this override mechanism can result in developers sometimes exposing secrets in software repositories. The goal of this article is to aid software security practitioners in understanding why' secrets are checked into repositories, despite being warned by tools, through an industrial case study of analysis of usage data of a secret detection tool and a survey of developers who bypassed the tool alert. In this case study, we analyzed the usage data of a checked-in secret detection tool used widely by a software company and we surveyed developers who bypassed the warnings generated by the tool. From the case study, we found that, despite developers classified 50% of the warning as false positive, developers also bypassed the warning due to time constraints, working with non-shipping projects, technical challenges of eliminating secrets completely from the version control history, technical debts, and perceptions that check-ins are low risk. We advocate practitioners and researchers to investigate the findings of our study further to improve secret detection tools and related development practices. We also advocate that organizations should insert secondary checks, as is done by the company we studied, to capture occasions where developers incorrectly bypass secret detection tools.

Implementing an integrated multi-technology platform for drug checking: Social, scientific, and technological considerations.

The illicit drug overdose crisis in North America continues to devastate communities with fentanyl detected in the majority of illicit drug overdose deaths. The COVID-19 pandemic has heightened concerns of even greater unpredictability in the drug supplies and unprecedented rates of overdoses. Portable drug-checking technologies are increasingly being integrated within overdose prevention strategies. These emerging responses are raising new questions about which technologies to pursue and what service models can respond to the current risks and contexts. In what has been referred to as the epicenter of the overdose crisis in Canada, a multi-technology platform for drug checking is being piloted in community settings using a suite of chemical analytical methods to provide real-time harm reduction. These include infrared absorption, Raman scattering, gas chromatography with mass spectrometry, and antibody-based test strips. In this Perspective, we illustrate some advantages and challenges of using multiple techniques for the analysis of the same sample, and provide an example of a data analysis and visualization platform that can unify the presentation of the results and enable deeper analysis of the results. We also highlight the implementation of a various service models that co-exist in a research setting, with particular emphasis on the way that drug checking technicians and harm reduction workers interact with service users. Finally, we provide a description of the challenges associated with data interpretation and the communication of results to a diverse audience.

Ontologies in biological data visualization.

In computer science, an ontology is essentially a graph-based knowledge representation in which each node corresponds to a concept and each edge specifies a relation between two concepts. Ontological development in biology can serve as a focus to discuss the challenges and possible research directions for ontologies in visualization. The principle challenges are the dynamic and evolving nature of ontologies, the ever-present issue of scale, the diversity and richness of the relationships in ontologies, and the need to better understand the relationship between ontologies and the data analysis tasks scientists wish to support. Research directions include visualizing ontologies; visualizing semantically or ontologically annotated texts, documents, and corpora; automated generation of visualizations using ontologies; and visualizing ontological context to support search. Although this discussion uses issues of ontologies in biological data visualization as a springboard, these topics are of general relevance to visualization.

How information visualization novices construct visualizations.

It remains challenging for information visualization novices to rapidly construct visualizations during exploratory data analysis. We conducted an exploratory laboratory study in which information visualization novices explored fictitious sales data by communicating visualization specifications to a human mediator, who rapidly constructed the visualizations using commercial visualization software. We found that three activities were central to the iterative visualization construction process: data attribute selection, visual template selection, and visual mapping specification. The major barriers faced by the participants were translating questions into data attributes, designing visual mappings, and interpreting the visualizations. Partial specification was common, and the participants used simple heuristics and preferred visualizations they were already familiar with, such as bar, line and pie charts. We derived abstract models from our observations that describe barriers in the data exploration process and uncovered how information visualization novices think about visualization specifications. Our findings support the need for tools that suggest potential visualizations and support iterative refinement, that provide explanations and help with learning, and that are tightly integrated into tool support for the overall visual analytics process.

Supporting the Collaborative Authoring of ICD-11 with WebProtégé.

The World Health Organization (WHO) is well under way with the new revision of the International Classification of Diseases (ICD-11). The current revision process is significantly different from past ones: the ICD-11 authoring is now open to a large international community of medical experts, who perform the authoring in a web-based collaborative platform. The classification is also embracing a more formal representation that is suitable for electronic health records. We present the ICD Collaborative Authoring Tool (iCAT), a customization of the WebProtégé editor that supports the community based authoring of ICD-11 on the Web and provides features such as discussion threads integrated in the authoring process, change tracking, content reviewing, and so on. The WHO editors evaluated the initial version of iCAT and found the tool intuitive and easy to learn. They also identified improvement potentials and new requirements for large-scale collaboration support. A demo version of the tool is available at: http://icatdemo.stanford.edu.

BioPortal: ontologies and integrated data resources at the click of a mouse.

Biomedical ontologies provide essential domain knowledge to drive data integration, information retrieval, data annotation, natural-language processing and decision support. BioPortal (http://bioportal.bioontology.org) is an open repository of biomedical ontologies that provides access via Web services and Web browsers to ontologies developed in OWL, RDF, OBO format and Protégé frames. BioPortal functionality includes the ability to browse, search and visualize ontologies. The Web interface also facilitates community-based participation in the evaluation and evolution of ontology content by providing features to add notes to ontology terms, mappings between terms and ontology reviews based on criteria such as usability, domain coverage, quality of content, and documentation and support. BioPortal also enables integrated search of biomedical data resources such as the Gene Expression Omnibus (GEO), ClinicalTrials.gov, and ArrayExpress, through the annotation and indexing of these resources with ontologies in BioPortal. Thus, BioPortal not only provides investigators, clinicians, and developers 'one-stop shopping' to programmatically access biomedical ontologies, but also provides support to integrate data from a variety of biomedical resources.

An interactive tool for visualizing design heterogeneity in clinical trials.

Clinical questions are often studied by randomized clinical trials (RCTs) of heterogeneous design. Systematic reviewers and trial designers need to compare the design and results across these trials. If trial information is available in computer processable form, computer-based visualization techniques can provide cognitive support for such comparisons. CTeXplorer offers systematic reviewers and trial designers a tool to better and more quickly understand design heterogeneity in RCTs. CTeXplorer supports dynamic queries on eligibility criteria, interventions, and outcomes in three linked views. We tested CTeXplorer for displaying 12 RCTs on prevention of mother-to-child transmission of HIV. Three target users found the representation and organization of information intuitive and easy to learn. They were able to use CTeXplorer to achieve a quick cognitive overview of a heterogeneous group of RCTs. This work shows the benefit of capturing trial information in computable form. Future work includes leveraging ontologies to enhance CTeXplorer visualizations.

National Center for Biomedical Ontology: advancing biomedicine through structured organization of scientific knowledge.

The National Center for Biomedical Ontology is a consortium that comprises leading informaticians, biologists, clinicians, and ontologists, funded by the National Institutes of Health (NIH) Roadmap, to develop innovative technology and methods that allow scientists to record, manage, and disseminate biomedical information and knowledge in machine-processable form. The goals of the Center are (1) to help unify the divergent and isolated efforts in ontology development by promoting high quality open-source, standards-based tools to create, manage, and use ontologies, (2) to create new software tools so that scientists can use ontologies to annotate and analyze biomedical data, (3) to provide a national resource for the ongoing evaluation, integration, and evolution of biomedical ontologies and associated tools and theories in the context of driving biomedical projects (DBPs), and (4) to disseminate the tools and resources of the Center and to identify, evaluate, and communicate best practices of ontology development to the biomedical community. Through the research activities within the Center, collaborations with the DBPs, and interactions with the biomedical community, our goal is to help scientists to work more effectively in the e-science paradigm, enhancing experiment design, experiment execution, data analysis, information synthesis, hypothesis generation and testing, and understand human disease.