全部放下还是着手处理？开发者如何应对 Log4JShell 漏洞
Drop it All or Pick it Up? How Developers Responded to the Log4JShell Vulnerability
AI总结：
通过分析 53 个受 Log4JShell 影响的 Maven 项目的 219 个 PR 和 354 个 issue，发现开发者虽在 5-6 天内快速响应，但并未放下其他工作，反而整体活动增加，且讨论中信息提供与寻求占主导，为漏洞修复最佳实践提供了新见解。
摘要：
尽管在当代软件开发中使用第三方库已变得十分普遍，但开发者往往难以更新其依赖项。已有研究承认，由于迁移工作量、优先级及其他问题，迁移过程会出现滞后。常见的假设是开发者应当放下所有其他活动，优先修复漏洞。我们的目标是理解开发者在面对代码中的高风险漏洞时的行为。我们探究了 Log4JShell 这一影响广泛、且可能是迄今为止严重性评级最高的漏洞案例之一，该漏洞受到了媒体的广泛关注。采用混合研究方法，我们分析了受 Log4JShell 漏洞影响的 53 个 Maven 项目中的 219 个 GitHub Pull Request（PR）和 354 个 issue。我们的研究证实，开发者表现出快速响应，用时为 5 到 6 天。然而，令人意外的是，开发者并没有放下一切，反而所有待处理 issue 和 PR 上的开发活动趋于增加。开发者讨论涉及提供信息（29.3%）和寻求信息（20.6%），而这在现有支持工具中是缺失的。利用这一可能独一无二的事件，相关见解开辟了一条新的研究路线，促使我们重新思考最佳实践以及开发者高效修复漏洞所需的条件。
英文摘要：
Although using third-party libraries has become prevalent in contemporary software development, developers often struggle to update their dependencies. Prior works acknowledge that due to the migration effort, priority and other issues cause lags in the migration process. The common assumption is that developers should drop all other activities and prioritize fixing the vulnerability. Our objective is to understand developer behavior when facing high-risk vulnerabilities in their code. We explore the prolific, and possibly one of the cases of the Log4JShell, a vulnerability that has the highest severity rating ever, which received widespread media attention. Using a mixed-method approach, we analyze 219 GitHub Pull Requests (PR) and 354 issues belonging to 53 Maven projects affected by the Log4JShell vulnerability. Our study confirms that developers show a quick response taking from 5 to 6 days. However, instead of dropping everything, surprisingly developer activities tend to increase for all pending issues and PRs. Developer discussions involved either giving information (29.3\%) and seeking information (20.6\%), which is missing in existing support tools. Leveraging this possibly-one of a kind event, insights opens up a new line of research, causing us to rethink best practices and what developers need in order to efficiently fix vulnerabilities.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
