Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: How Open Should Open Source Be?   Many open-source projects land security fixes in public repositories before
shipping these patches to users. This paper presents attacks on such projects -
taking Firefox as a case-study - that exploit patch metadata to efficiently
search for security patches prior to shipping. Using access-restricted bug
reports linked from patch descriptions, security patches can be immediately
identified for 260 out of 300 days of Firefox 3 development. In response to
Mozilla obfuscating descriptions, we show that machine learning can exploit
metadata such as patch author to search for security patches, extending the
total window of vulnerability by 5 months in an 8 month period when examining
up to two patches daily. Finally we present strong evidence that further
metadata obfuscation is unlikely to prevent information leaks, and we argue
that open-source projects instead ought to keep security patches secret until
they are ready to be released.

21
The categories of this paper are: adap-org
16
The categories of this paper are: stat
19
The categories of this paper are: eess
2
The categories of this paper are: math
32
The categories of this paper are: atom-ph
20
The categories of this paper are: acc-phys
24
The categories of this paper are: dg-ga
6
The categories of this paper are: astro-ph
22
The categories of this paper are: chao-dyn
14
The categories of this paper are: math-ph
29
The categories of this paper are: funct-an
33
The categories of this paper are: plasm-ph
11
The categories of this paper are: hep-lat
27
The categories of this paper are: comp-gas
12
The categories of this paper are: nucl-th
8
The categories of this paper are: hep-ex