Date: Sep 8, 2021

Study Name: Evaluating the Effectiveness of Dependency Transparency Tools in Assessing Exposure

Principal Investigator: Dr. Shane McIntosh (shane.mcintosh@uwaterloo.ca), School of Computer Science, University of Waterloo

Students and Co-Investigators: Mehran Meidani, MMath Student, School of Computer Science, University of Waterloo, Dr. Maxime Lamothe, Polytechnique Montréal

Purpose of the Research: In this study, we aim to determine whether a static analysis of build systems can improve the effectiveness and efficiency of software developers striving to assess the exposure of a source code change.

What you will be asked to do in the research: The study will take about 1 hour and requires an internet browser and a good internet connection. Prior to the start of the experiment, you are asked demographics questions about your background and programming experience. Then, you are asked to complete five tasks that require downloading some source codes provided in the description of the task and identify the impact of some changes in the source code under different compile-time configuration settings. We will follow up with a questionnaire, which collects tool usage questions about the CLI tools, IDEs, and/or other tools used to complete the tasks. Additionally, we are interested to know whether you find the provided tool useful and usable. We also ask you to comment on any problems that they may have encountered during the experiment. In some rare cases, we may contact you through the provided email address and ask you to conduct a follow-up interview through a Zoom call. Follow-up interviews will be semi-structured, and the questions will be inspired by your activities during the study.

Who may participate: You need to have programming experience to participate in this experiment as the goal of the study is to help programmers to assess the risk of their changes more efficiently and more accurately.

Risks and Discomforts: We do not foresee any risks or discomfort from your participation in the research.

Voluntary Participation: Your participation in the study is entirely voluntary, and you may choose to stop participating at any time. You can skip any question during the study. You can click on Cancel at any point during the experiment to withdraw from the study. In the event you withdraw from the study, all associated data collected will be immediately destroyed.

Confidentiality: You will be completing the study by a web application developed by the researchers. The server is located in a secure facility at the University of Waterloo. The researchers implemented technical, administrative, and physical safeguards to protect the information provided via the application from loss, misuse, and unauthorized access. We will not collect any identifiable information except an email address. You can create a specific email address for this study to maximize your anonymity. We may contact you in the future regarding this study through this email address. Your identity associated with all the information you supply will be held in confidence, and your email will not appear in any report or publication of the research. Your data will be safely stored in a locked facility stored on a secured UW server, and only research staff will have access to this information. Confidentiality will be provided to the fullest extent possible by law. The dataset without identifiers may be shared publicly. Your identity will be confidential. If you got the invitation email through your company mailing list, the company you work for will not be provided with any participant information and will not know who participated. Finally, Research data will be retained for a minimum of seven years, at which time it will be deleted.
When information is transmitted over the internet, privacy cannot be guaranteed. There is always a risk your responses may be intercepted by a third party (e.g., government agencies, hackers). University of Waterloo researchers will not collect or use internet protocol (IP) addresses or other information which could link your participation to your computer or electronic device without first informing you.

Study Sponsor This study is funded by Huawei Technologies Canada Co., Ltd and Ubisoft Toronto Inc. The study sponsors will not have access to the data and will not know who participated or not.

Questions About the Research?  If you have questions about the research in general or your role in the study, please feel free to contact  Dr. Shane McIntosh by email (shane.mcintosh@uwaterloo.ca). This study has been reviewed and received ethics clearance through a University of Waterloo Research Ethics Committee (ORE# 43727). If you have questions for the board, contact the Office of Research Ethics at 1-519-888-4567 ext. 36005 or reb@uwaterloo.ca.

Legal Rights and Signatures:

By checking this box, you consent to participate in Evaluating the Effectiveness of Dependency Transparency Tools in Assessing Exposure conducted by Dr. Shane McIntosh. You have understood the nature of this project and wish to participate. You are not waiving any of your legal rights by signing this form.