Greg Wilson

@gvwilson@mastodon.social · Joined ⁨Oct⁩ ⁨2022⁩

I program, write, and teach. Co-founder of Software Carpentry and It Will Never Work in Theory; co-editor of The Architecture of Open Source Applications.

Personal site
third-bit.com/ verified
Teaching Tech Together
teachtogether.tech/
The Architecture of Open Source Applications
aosabook.org/
4Posts
0Following0Followers
Greg Wilson@gvwilson@mastodon.social

Geng et al 2026: "Mapping the Emerging Curriculum for AI-Assisted Software Engineering via Syllabus Analysis" arxiv.org/abs/2608.05898 interesting to see what people are trying… If anyone knows of a similar analysis for data science curricula, I'd be grateful for a pointer.

arxiv.org/abs/2608.05898
arXiv logoarXiv.orgMapping the Emerging Curriculum for AI-Assisted Software Engineering via Syllabus AnalysisAs Generative AI coding tools reshape professional software development, universities have begun designing courses to prepare students for AI-assisted development workflows. By analyzing the syllabi of these courses, we can gather empirical evidence about these courses, reveal how this emerging curricular area is being defined, and gain guidance for future curriculum design. We analyzed 23 publicly available syllabi and course materials of upper-division, credit-bearing courses that meet specific criteria, including explicitly addressing Generative AI in software engineering. Through iterative qualitative coding, we characterized courses' learning objectives, assessments, topics, and documented AI tools. Our analysis reveals commonalities and differences among these courses that allow researchers and educators to study and develop future courses.
Greg Wilson@gvwilson@mastodon.social

Please help if you can: I am working with some students who are studying programmers' beliefs about software engineering folklore. If you can spare a few minutes to answer the question in survey.bth.se/survey/2545, we would be very grateful. We would also be grateful if you could circulate the survey link to colleagues and friends - we would like to reach as diverse a demographic as possible. Thanks in advance.

survey.bth.se/survey/2545
survey.bth.seClaims Validity of SE Folklore - Practitioner Survey
Greg Wilson@gvwilson@mastodon.social

Dietrich et al 2026: "No Snake Oil: Verifying Python Package Builds" arxiv.org/abs/2607.21888 "Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPI wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively."

arXiv logoarXiv.orgNo Snake Oil: Verifying Python Package BuildsPython has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equ
Greg Wilson@gvwilson@mastodon.social

Zięba-Kozarzewski 2026: "No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild" arxiv.org/abs/2607.22140 "52.9% of SBOMs declare no edges at all, 8.8% declare a dependency block yet leave the majority of components isolated, and 38.3% form well-connected graphs."

arXiv logoarXiv.orgNo Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the WildSoftware Bills of Materials (SBOMs) are consumed not only as component inventories but as dependency graphs: vulnerability triage, reachability filtering, and impact analysis all traverse the edges an SBOM declares. We present the first large-scale characterization of the declared dependency graph across 78,612 real-world SBOM files from the Wild SBOMs dataset (77,092 parseable). We find that the population splits into three regimes: 52.9% of SBOMs declare no edges at all (failing the NTIA minimum-elements requirement of dependency relationships), 8.8% declare a dependency block yet leave the majority of components isolated (degenerate regime; among such SBOMs with at least 50 components the median orphan share is 93%, and our 11 Syft-generated container-image SBOMs fall in this regime at 95-98% orphans), and 38.3% form well-connected graphs. Edge emission is determined by the generator, not the described software (0%-100% no-edge rates across tools), and the specification-level mechan