An Empirical Study of the TianoCore Community

• URL: http://arxiv.org/abs/2608.23280v1
• Date: Mon, 24 Aug 2026 14:04:38 GMT
• Title: An Empirical Study of the TianoCore Community
• Abstract summary: We conduct a survey and a limited interview study with participants representing independent firmware vendors, original equipment manufacturers, security experts, firmware developers, and academic researchers.<n>We highlight important gaps in the current state of firmware development within the TianoCore ecosystem and identify key areas in which improved security practices, greater adoption of memory-safe technologies, and increased automation of manual processes could strengthen the maintenance and security of the UEFI firmware.
• Score: 13.280896247955212
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We investigate the software security and maintenance practices adopted by stakeholders in the TianoCore community and identify opportunities to improve firmware development workflows. We conduct a survey and a limited interview study with participants representing independent firmware vendors, original equipment manufacturers, security experts, firmware developers, and academic researchers. This open-source development community maintains a reference implementation for the core of the UEFI firmware. We highlight important gaps in the current state of firmware development within the TianoCore ecosystem and identify key areas in which improved security practices, greater adoption of memory-safe technologies, and increased automation of manual processes could strengthen the maintenance and security of the UEFI firmware.

Related papers

• Automotive HSMs - Architectural Challenges and Security Implications [0.0]
  Hardware Security Modules (HSMs) have become a key building block in automotive system-on-chips.<n>This paper presents an architectural analysis of automotive HSMs and examines their role in establishing secure boot and hardware roots of trust.
  arXiv  Detail & Related papers  (2026-08-25T23:12:41Z)
• How Do You Choose Your AI Component? An Interview Study of Secure AI Integration in Practice [3.3043425525629293]
  We conduct semistructured interviews with 22 software developers, architects, and AI practitioners about how they integrate AI components into their software.<n>Our analysis finds that practitioners' model selection is predominantly driven by functional criteria, including performance, accuracy, cost, and specific features.<n>We observe a consistent lack of security concern throughout the AI component integration process, with established software supply chain lessons overlooked or ignored.
  arXiv  Detail & Related papers  (2026-07-18T06:30:12Z)
• Security Vulnerabilities in Software Supply Chain for Autonomous Vehicles [5.600944414742589]
  We analyze security vulnerabilities in open-source software components in autonomous vehicles.<n>The goal is to inform researchers, practitioners, and policymakers about the existing security flaws in the commonplace open-source software ecosystem in the AV domain.
  arXiv  Detail & Related papers  (2025-09-21T03:22:05Z)
• Qualcomm Trusted Application Emulation for Fuzzing Testing [0.3277163122167433]
  This research centers on trusted applications (TAs) within the Qualcomm TEE.<n>Through reverse engineering techniques, we develop a partial emulation environment that accurately emulates their behavior.<n>We integrate fuzzing testing techniques into the emulator to systematically uncover potential vulnerabilities within Qualcomm TAs.
  arXiv  Detail & Related papers  (2025-07-11T06:10:15Z)
• Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things [61.43014629640404]
  Zero-Trust Foundation Models (ZTFMs) embed zero-trust security principles into the lifecycle of foundation models (FMs) for Internet of Things (IoT) systems.<n>ZTFMs can enable secure, privacy-preserving AI across distributed, heterogeneous, and potentially adversarial IoT environments.
  arXiv  Detail & Related papers  (2025-05-26T06:44:31Z)
• AISafetyLab: A Comprehensive Framework for AI Safety Evaluation and Improvement [73.0700818105842]
  We introduce AISafetyLab, a unified framework and toolkit that integrates representative attack, defense, and evaluation methodologies for AI safety.<n> AISafetyLab features an intuitive interface that enables developers to seamlessly apply various techniques.<n>We conduct empirical studies on Vicuna, analyzing different attack and defense strategies to provide valuable insights into their comparative effectiveness.
  arXiv  Detail & Related papers  (2025-02-24T02:11:52Z)
• Uncovering EDK2 Firmware Flaws: Insights from Code Audit Tools [1.2713814898630649]
  General code audit tools for firmware analysis proven effective in identifying critical areas for enhancement in firmware security. UEFI Development Kit II (EDK2) plays a crucial role in shaping firmware architecture. scarcity of open-source tools specifically designed for firmware analysis emphasizes the need for adaptable, innovative solutions.
  arXiv  Detail & Related papers  (2024-09-22T12:29:28Z)
• Securing the Open RAN Infrastructure: Exploring Vulnerabilities in Kubernetes Deployments [60.51751612363882]
  We investigate the security implications of and software-based Open Radio Access Network (RAN) systems. We highlight the presence of potential vulnerabilities and misconfigurations in the infrastructure supporting the Near Real-Time RAN Controller (RIC) cluster.
  arXiv  Detail & Related papers  (2024-05-03T07:18:45Z)
• Best Practices for Facing the Security Challenges of Internet of Things Devices Focusing on Software Development Life Cycle [0.0]
  Security for IoT devices is now a top priority due to the growing number of threats. The objective of the study is to raise awareness of potential threats, emphasizing the secure software development lifecycle. The study will also serve as a point of reference for future developments.
  arXiv  Detail & Related papers  (2024-02-12T17:43:02Z)
• Survey on Foundation Models for Prognostics and Health Management in Industrial Cyber-Physical Systems [1.1034992901877594]
  Large-scale foundation models (LFMs) like BERT and GPT signifies a significant advancement in AI technology. ChatGPT stands as a remarkable accomplishment within this research paradigm, harboring potential for General Artificial Intelligence. Considering the ongoing enhancement in data acquisition technology and data processing capability, LFMs are anticipated to assume a crucial role in the PHM domain of ICPS.
  arXiv  Detail & Related papers  (2023-12-11T09:58:46Z)
• Embedded Software Development with Digital Twins: Specific Requirements for Small and Medium-Sized Enterprises [55.57032418885258]
  Digital twins have the potential for cost-effective software development and maintenance strategies. We interviewed SMEs about their current development processes. First results show that real-time requirements prevent, to date, a Software-in-the-Loop development approach.
  arXiv  Detail & Related papers  (2023-09-17T08:56:36Z)
• Empowered and Embedded: Ethics and Agile Processes [60.63670249088117]
  We argue that ethical considerations need to be embedded into the (agile) software development process. We put emphasis on the possibility to implement ethical deliberations in already existing and well established agile software development processes.
  arXiv  Detail & Related papers  (2021-07-15T11:14:03Z)
• Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
  Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance. We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
  arXiv  Detail & Related papers  (2020-10-19T13:09:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.