Poster: Computer Security Researchers' Experiences with Vulnerability Disclosures - Sri Ramulu, Harshini; Rotthaler, Anna Lena; Rossel, Jost; Gonzalez Rodriguez, Rachel; Wermke, Dominik; Fahl, Sascha; Kohno, Tadayoshi; Somorovsky, Juraj; Acar, Yasemin (Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security)
Vulnerability disclosures are necessary to improve the security of our digital ecosystem. However, they can also be challenging for researchers: it may be hard to find out who the affected parties even are, or how to contact them. Researchers may be ignored or face adversity when disclosing vulnerabilities. We investigate researchers' experiences with vulnerability disclosures, extract best practices, and make recommendations for researchers, institutions that employ them, industry, and regulators to enable effective vulnerability disclosures.
Keywords: software vulnerabilities; vulnerability disclosure; security research

Analyzing Security and Privacy Advice During the 2022 Russian Invasion of Ukraine on Twitter - Schmüser, Juliane; Ramulu, Harshini Sri; Wöhler, Noah; Stransky, Christian; Bensmann, Felix; Dimitrov, Dimitar; Schellhammer, Sebastian; Wermke, Dominik; Dietze, Stefan; Acar, Yasemin; Fahl, Sascha (Proceedings of the CHI Conference on Human Factors in Computing Systems, CHI 2024, Honolulu, HI, USA, May 11-16, 2024)

Decomposing and Measuring Trust in Open-Source Software Supply Chains - Boughton, Lina; Miller, Courtney; Acar, Yasemin; Wermke, Dominik; Kästner, Christian (Proceedings of the 2024 {ACM/IEEE} 44th International Conference on Software Engineering: New Ideas and Emerging Results, NIER@ICSE 2024, Lisbon, Portugal, April 14-20, 2024)

"Those things are written by lawyers, and programmers are reading that." Mapping the Communication Gap Between Software Developers and Privacy Experts - Horstmann, Stefan Albert; Domiks, Samuel; Gutfleisch, Marco; Tran, Mindy; Acar, Yasemin; Moonsamy, Veelasha; Naiakshina, Alena (Proc. Priv. Enhancing Technol.)

A Mixed-Methods Study on User Experiences and Challenges of Recovery Codes for an End-to-End Encrypted Service - Höltervennhoff, Sandra; Wöhler, Noah; Möhle, Arne; Oltrogge, Marten; Acar, Yasemin; Wiese, Oliver; Fahl, Sascha (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

The Challenges of Bringing Cryptography from Research Papers to Products: Results from an Interview Study with Experts - Fischer, Konstantin; Trummová, Ivana; Gajland, Phillip; Acar, Yasemin; Fahl, Sascha; Sasse, M. Angela (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

"These results must be false": A usability evaluation of constant-time analysis tools - Fourné, Marcel; Braga, Daniel De Almeida; Jancar, Jan; Sabt, Mohamed; Schwabe, Peter; Barthe, Gilles; Fouque, Pierre-Alain; Acar, Yasemin (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

"You have to read 50 different RFCs that contradict each other": An Interview Study on the Experiences of Implementing Cryptographic Standards - Huaman, Nicolas; Suray, Jacques; Klemmer, Jan H.; Fourné, Marcel; Amft, Sabrina; Trummová, Ivana; Acar, Yasemin; Fahl, Sascha (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

"But they have overlooked a few things in Afghanistan: " An Analysis of the Integration of Biometric Voter Verification in the 2019 Afghan Presidential Elections - Panahi, Kabir; Robertson, Shawn; Acar, Yasemin; Bardas, Alexandru G.; Kohno, Tadayoshi; Simko, Lucy (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

Security and Privacy Software Creators’ Perspectives on Unintended Consequences - Ramulu, Harshini Sri; Schmitt, Helen; Wermke, Dominik; Acar, Yasemin (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

S3C2 Summit 2023-11: Industry Secure Supply Chain Summit - Zahan, Nusrat; Acar, Yasemin; Cukier, Michel; Enck, William; Kästner, Christian; Kapravelos, Alexandros; Wermke, Dominik; Williams, Laurie A. (CoRR)

S3C2 Summit 2024-03: Industry Secure Supply Chain Summit - Tystahl, Greg; Acar, Yasemin; Cukier, Michel; Enck, William; Kästner, Christian; Kapravelos, Alexandros; Wermke, Dominik; Williams, Laurie A. (CoRR)

Exploring digital security and privacy in relative poverty in Germany through qualitative interviews - Kostan, Anastassija; Olschar, Sara; Simko, Lucy; Acar, Yasemin (33rd USENIX Security Symposium (USENIX Security 24))

Exploring digital security and privacy in relative poverty in Germany through qualitative interviews - Kostan, Anastassija; Olschar, Sara; Simko, Lucy; Acar, Yasemin (33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024)

A World Full of Privacy and Security (Mis)conceptions? Findings of a Representative Survey in 12 Countries - Herbert, Franziska; Becker, Steffen; Schaewitz, Leonie; Hielscher, Jonas; Kowalewski, Marvin; Sasse, M. Angela; Acar, Yasemin; Dürmuth, Markus (Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, CHI 2023, Hamburg, Germany, April 23-28, 2023)

"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain - Wermke, Dominik; Klemmer, Jan H.; Wöhler, Noah; Schmüser, Juliane; Sri Ramulu, Harshini; Acar, Yasemin; Fahl, Sascha (44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023)

Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories - Krause, Alexander; Klemmer, Jan H.; Huaman, Nicolas; Wermke, Dominik; Acar, Yasemin; Fahl, Sascha (32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023)

It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security - Fourné, Marcel; Wermke, Dominik; Enck, William; Fahl, Sascha; Acar, Yasemin (44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023)

"In Eighty Percent of the Cases, I Select the Password for Them": Security and Privacy Challenges, Advice, and Opportunities at Cybercafes in Kenya - Munyendo, Collins W.; Acar, Yasemin; Aviv, Adam J. (44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023)

"We are a startup to the core": A qualitative interview study on the security and privacy development practices in Turkish software startups - Keküllüoglu, Dilara; Acar, Yasemin (44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023)