This empirical paper examines the time delays that occur between the publication of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD) and the Common Vulnerability Scoring System (CVSS) information attached to published CVEs. According to the empirical results based on regularized regression analysis of over eighty thousand archived vulnerabilities, (i) the CVSS content does not statistically influence the time delays, which, however, (ii) are strongly affected by a decreasing annual trend. In addition to these results, the paper contributes to the empirical research tradition of software vulnerabilities by a couple of insights on misuses of statistical methodology.Comment: http://www.sciencedirect.com/science/article/pii/S221083271730299

The General Data Protection Regulation (GDPR) in the European Union is the most famous recently enacted privacy regulation. Despite of the regulation's legal, political, and technological ramifications, relatively little research has been carried out for better understanding the GDPR's practical implications for requirements engineering and software architectures. Building on a grounded theory approach with close ties to the Finnish software industry, this paper contributes to the sealing of this gap in previous research. Three questions are asked and answered in the context of software development organizations. First, the paper elaborates nine practical constraints under which many small and medium-sized enterprises (SMEs) often operate when implementing solutions that address the new regulatory demands. Second, the paper elicits nine regulatory requirements from the GDPR for software architectures. Third, the paper presents an implementation for a software architecture that complies both with the requirements elicited and the constraints elaborated.

Self-quantification of health parameters is becoming more popular; thus, the validity of the devices requires assessments. The aim of this study was to evaluate the validity of Fitbit One step counts (Fitbit Inc., San Francisco, CA, USA) against Actigraph wActisleep-BT step counts (ActiGraph, LLC, Pensacola, FL, USA) for measuring habitual physical activity among children. The study was implemented as a cross-sectional experimental design in which participants carried two waist-worn activity monitors for five consecutive days. The participants were chosen with a purposive sampling from three fourth grade classes (9–10 year olds) in two comprehensive schools. Altogether, there were 34 participants in the study. From these, eight participants were excluded from the analysis due to erroneous data. Primary outcome measures for step counts were Fitbit One and Actigraph wActisleep-BT. The supporting outcome measures were based on activity diaries and initial information sheets. Classical Bland–Altman plots were used for reporting the results. The average per-participant daily difference between the step counts from the two devices was 1937. The range was [116, 5052]. Fitbit One gave higher step counts for all but the least active participant. According to a Bland–Altman plot, the hourly step counts had a relative large mean bias across participants (161 step counts). The differences were partially explained by activity intensity: higher intensity denoted higher differences, and light intensity denoted lower differences. Fitbit One step counts are comparable to Actigraph step counts in a sample of 9–10-year-old children engaged in habitual physical activity in sedentary and light physical activity intensities. However, in moderate-to-vigorous physical activity, Fitbit One gives higher step counts when compared to Actigraph.

Product safety has been a concern in Europe ever since the early 1960s. Despite the long and relatively stable historical lineage of product safety regulations, new technologies, changes in the world economy, and other major transformations have in recent years again brought product safety to the forefront of policy debates. As reforms are also underway, there is a motivation to review the complex safety policy framework in the European Union (EU). Thus, building on deliberative policy analysis and an interpretative literature review, this paper reviews the safety policy for nonfood consumer products in the EU. The review covers the historical background and the main laws, administration and enforcement, standardization and harmonization, laws enacted for specific products, notifications delivered by national safety authorities, recalls of dangerous products, and the liability of these. Based on the review and analysis of these themes and the associated literature, some current policy challenges are further discussed.