{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:GEGGZPNFKZZDS3ZUP5DGPS5SIA","short_pith_number":"pith:GEGGZPNF","canonical_record":{"source":{"id":"1908.01489","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-05T06:52:33Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"32828f71392e1c660a6fef74d6ef09f3dce20cc75ef08da283545ffcf5cf618f","abstract_canon_sha256":"bb7f21c932c2af19623104418a72ee0f6977a72d09ae51abd36191be1863bbe1"},"schema_version":"1.0"},"canonical_sha256":"310c6cbda55672396f347f4667cbb2401d4f576a1023ccd2a6292e3855d53320","source":{"kind":"arxiv","id":"1908.01489","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.01489","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"arxiv_version","alias_value":"1908.01489v1","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.01489","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_12","alias_value":"GEGGZPNFKZZD","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_16","alias_value":"GEGGZPNFKZZDS3ZU","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_8","alias_value":"GEGGZPNF","created_at":"2026-07-04T23:51:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:GEGGZPNFKZZDS3ZUP5DGPS5SIA","target":"record","payload":{"canonical_record":{"source":{"id":"1908.01489","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-05T06:52:33Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"32828f71392e1c660a6fef74d6ef09f3dce20cc75ef08da283545ffcf5cf618f","abstract_canon_sha256":"bb7f21c932c2af19623104418a72ee0f6977a72d09ae51abd36191be1863bbe1"},"schema_version":"1.0"},"canonical_sha256":"310c6cbda55672396f347f4667cbb2401d4f576a1023ccd2a6292e3855d53320","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-04T23:51:30.977425Z","signature_b64":"w0pu/KlAbAvTJpiX4yPKg+dXTi7lrlvRC6WTiLSFNv9sxlLmt2/bKj2cQzmgeFVw0qV987tqHFAWkK1KjohXBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"310c6cbda55672396f347f4667cbb2401d4f576a1023ccd2a6292e3855d53320","last_reissued_at":"2026-07-04T23:51:30.977066Z","signature_status":"signed_v1","first_computed_at":"2026-07-04T23:51:30.977066Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1908.01489","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:51:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"mSgIj8y2tfFCpRTvs7VOvcqebPMRbaRWrFB39iQ9hRSpLFDZJtMnvAkbPYQl0oXvHL1GNzUKGaqBpOybkyf1Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T22:43:13.170564Z"},"content_sha256":"dff74bb4bbc116665e012995e62fd1b9e6866bc7c8fc0a5214d0b12a5da7f637","schema_version":"1.0","event_id":"sha256:dff74bb4bbc116665e012995e62fd1b9e6866bc7c8fc0a5214d0b12a5da7f637"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:GEGGZPNFKZZDS3ZUP5DGPS5SIA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"The Impact of Developer Experience in Using Java Cryptography","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Eric Bodden, Mohammad Ghafari, Mohammadreza Hazhirpasand, Oscar Nierstrasz, Stefan Kr\\\"uger","submitted_at":"2019-08-05T06:52:33Z","abstract_excerpt":"Previous research has shown that crypto APIs are hard for developers to understand and difficult for them to use. They consequently rely on unvalidated boilerplate code from online resources where security vulnerabilities are common.\n  We analyzed 2,324 open-source Java projects that rely on Java Cryptography Architecture (JCA) to understand how crypto APIs are used in practice, and what factors account for the performance of developers in using these APIs. We found that, in general, the experience of developers in using JCA does not correlate with their performance. In particular, none of the"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.01489","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1908.01489/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:51:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"N0uAUDCVaxMAD4yhQQblniV2/L1HGJETHSDodQ8HMUhPQqTQ8CY1l7E5y3ZxNrIXVaD40I8+vNyP/X3kYkXnDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T22:43:13.171096Z"},"content_sha256":"b78d092f56ec3f1e5ff53d614a4168fb126010252b062a349ff93362608ac7a7","schema_version":"1.0","event_id":"sha256:b78d092f56ec3f1e5ff53d614a4168fb126010252b062a349ff93362608ac7a7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/bundle.json","state_url":"https://pith.science/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T22:43:13Z","links":{"resolver":"https://pith.science/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA","bundle":"https://pith.science/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/bundle.json","state":"https://pith.science/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GEGGZPNFKZZDS3ZUP5DGPS5SIA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:GEGGZPNFKZZDS3ZUP5DGPS5SIA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bb7f21c932c2af19623104418a72ee0f6977a72d09ae51abd36191be1863bbe1","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-05T06:52:33Z","title_canon_sha256":"32828f71392e1c660a6fef74d6ef09f3dce20cc75ef08da283545ffcf5cf618f"},"schema_version":"1.0","source":{"id":"1908.01489","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.01489","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"arxiv_version","alias_value":"1908.01489v1","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.01489","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_12","alias_value":"GEGGZPNFKZZD","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_16","alias_value":"GEGGZPNFKZZDS3ZU","created_at":"2026-07-04T23:51:30Z"},{"alias_kind":"pith_short_8","alias_value":"GEGGZPNF","created_at":"2026-07-04T23:51:30Z"}],"graph_snapshots":[{"event_id":"sha256:b78d092f56ec3f1e5ff53d614a4168fb126010252b062a349ff93362608ac7a7","target":"graph","created_at":"2026-07-04T23:51:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1908.01489/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Previous research has shown that crypto APIs are hard for developers to understand and difficult for them to use. They consequently rely on unvalidated boilerplate code from online resources where security vulnerabilities are common.\n  We analyzed 2,324 open-source Java projects that rely on Java Cryptography Architecture (JCA) to understand how crypto APIs are used in practice, and what factors account for the performance of developers in using these APIs. We found that, in general, the experience of developers in using JCA does not correlate with their performance. In particular, none of the","authors_text":"Eric Bodden, Mohammad Ghafari, Mohammadreza Hazhirpasand, Oscar Nierstrasz, Stefan Kr\\\"uger","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-05T06:52:33Z","title":"The Impact of Developer Experience in Using Java Cryptography"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.01489","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:dff74bb4bbc116665e012995e62fd1b9e6866bc7c8fc0a5214d0b12a5da7f637","target":"record","created_at":"2026-07-04T23:51:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bb7f21c932c2af19623104418a72ee0f6977a72d09ae51abd36191be1863bbe1","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-05T06:52:33Z","title_canon_sha256":"32828f71392e1c660a6fef74d6ef09f3dce20cc75ef08da283545ffcf5cf618f"},"schema_version":"1.0","source":{"id":"1908.01489","kind":"arxiv","version":1}},"canonical_sha256":"310c6cbda55672396f347f4667cbb2401d4f576a1023ccd2a6292e3855d53320","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"310c6cbda55672396f347f4667cbb2401d4f576a1023ccd2a6292e3855d53320","first_computed_at":"2026-07-04T23:51:30.977066Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-04T23:51:30.977066Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"w0pu/KlAbAvTJpiX4yPKg+dXTi7lrlvRC6WTiLSFNv9sxlLmt2/bKj2cQzmgeFVw0qV987tqHFAWkK1KjohXBw==","signature_status":"signed_v1","signed_at":"2026-07-04T23:51:30.977425Z","signed_message":"canonical_sha256_bytes"},"source_id":"1908.01489","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:dff74bb4bbc116665e012995e62fd1b9e6866bc7c8fc0a5214d0b12a5da7f637","sha256:b78d092f56ec3f1e5ff53d614a4168fb126010252b062a349ff93362608ac7a7"],"state_sha256":"16e3b8c7855eb42bd372786f1344065fa26aa96ca852c944d83515aae96e6c8b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UNDTCFquM3racPWKLrtIOZfiaw0MasIu/crDAjf1VYBdu4hjDEicAJd8VcNhvQm6FP9bup3gB4C9OuAEucHFAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T22:43:13.176282Z","bundle_sha256":"35b4db658cc6f0fca0a88065cbed82c261dc472f3ff65de76ac93a87b1b48b0e"}}