Chapter 8 — Defense and publication plan
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The defense"]
N2["8.2 Hard questions"]
N3["8.3 Honest answers"]
N4["8.4 Publications"]
N5["8.5 Incidental findings"]
N6["8.6 After the defense"]
N7["Practitioner briefing"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The defense"]
N2["8.2 Hard questions"]
N3["8.3 Honest answers"]
N4["8.4 Publications"]
N5["8.5 Incidental findings"]
N6["8.6 After the defense"]
N7["Practitioner briefing"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 The defense]
|
v
[8.2 Hard questions]
|
v
[8.3 Honest answers]
|
v
[8.4 Publications]
|
v
[8.5 Incidental findings]
|
v
[8.6 After the defense]
|
v
[Practitioner briefing]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) prepare a doctoral defense on supply-chain evidence; (2) answer hard questions honestly; (3) plan publications and practitioner outputs; (4) plan responsible disclosure of any incidental findings.
8.1 The defense
Forty minutes: question, gap, methods, results, limits, contributions. Yusuf rehearses with three colleagues playing sceptical examiners. The rehearsal colleagues prepare questions from the critiques the paper received, so the hardest objections are practised first. Yusuf gives the limits their own slide early, rather than at the end where time may run short. He also prepares the conversion of the 12-day effect into a share of the foundation's median exposure, since practical importance is a likely question. Rehearsals with his supervisor keep the talk within forty minutes, leaving the rest of the defence for questions.
8.2 Hard questions
"Does your result hold outside larch?" "Does a shorter manifest exposure matter if users never upgrade?" "Could bots themselves be a supply-chain risk?" For the last, he cites Ladisa et al. (2023), whose taxonomy includes compromise of tools in the dependency path, and notes that his study did not measure that risk. For the first question, he answers that the matched comparison and interviews come from one registry and a second synthetic ecosystem, so generalisation is a hypothesis. For the second, he explains that the thesis measures producer-side exposure, a scope fixed after Reviewer 2's critique.
8.3 Honest answers
"I don't know, but here is how I would find out" is better than overclaiming. Yusuf uses this answer when asked about users who never upgrade: his data stop at the manifest, and a study of deployment telemetry would be needed. Saying so plainly protects the claims he can support. For the question about bots as a supply-chain risk, his answer cites the taxonomy and says plainly that his data cannot size that risk; he names the study design that could, such as tracing incidents in which update tools themselves were compromised.
8.4 Publications
Paper 1: matched comparison. Paper 2: interview study. Practitioner report for the Larchwood Foundation. Each is mapped to thesis chapters. Each output reports the same headline with both comparisons, so no version overstates the effect. The interview paper uses only coded counts and anonymised quotations, as the ethics approval requires. The practitioner report leads with the guidance on failing bot pull requests and links to the archive for anyone who wants the evidence. Paper 1 draws on the main-study and critique chapters, and Paper 2 on the interview chapter, so no finding is published twice.
8.5 Incidental findings
During data collection Yusuf noticed six synthetic projects still pinned to a vulnerable quillog version. Under the study's disclosure plan, the foundation's security team contacts the maintainers privately; the thesis reports only aggregate counts. Reporting only aggregates keeps the thesis from becoming a list of vulnerable projects. The foundation, not Yusuf, decides how to contact maintainers, which follows the plan approved before data collection. The thesis records when the foundation was informed, so examiners can see the plan was followed.
8.6 After the defense
Archive deposited, data access statement final, post-doctoral plan drafted. The deposited archive is the corrected version with the regenerated manifest. The data access statement explains that interview transcripts are withheld and how other researchers can obtain the synthetic replicas. The post-doctoral plan starts from the open questions he stated in the defence: user-side exposure and the risk posed by update bots themselves. The archive's persistent identifier is cited in every output, so readers of the papers and the practitioner report all reach the same deposited version.
Practitioner briefing
After the defense, Yusuf gives a one-hour briefing to Larchwood maintainers: what exposure is, what the study found, and three practical steps (enable an update bot, invest in tests for upgrades, assign an owner to failing bot pull requests). Questions from maintainers suggest follow-up research on test coverage.
Reflection
Yusuf notes that early pre-registration and the pilot saved months of rework later.
Worked example
An examiner asks whether the 12-day within-project effect is practically important. Yusuf compares it with the foundation's median exposure of 30 days: a 40% reduction, valuable when combined with test investment. The examiners pass the thesis with minor corrections.
Synthetic case. The defense is synthetic.
Errors and limits
One ecosystem and three packages are a modest base; future work should replicate.
Exercises
- EX045 — Defense outline. List the defense sections. Rubric: 3 = question, gap, methods, results, limits, contributions; 2 = four; 1 = two; 0 = none.
- EX046 — Bot risk answer. How did Yusuf answer the bot-risk question? Rubric: 3 = Ladisa taxonomy includes tool compromise; not measured; 2 = partial; 1 = vague; 0 = none.
- EX047 — Honest stance. What is better than overclaiming? Rubric: 3 = "don't know; here's how I'd find out"; 2 = partial; 1 = vague; 0 = none.
- EX048 — Publications. Name the planned outputs. Rubric: 3 = two papers + practitioner report; 2 = partial; 1 = vague; 0 = none.
- EX049 — Disclosure. How were the six projects handled? Rubric: 3 = foundation security team contacted privately; aggregate in thesis; 2 = partial; 1 = vague; 0 = none.
- EX050 — Practical size. Why is 12 days important? Rubric: 3 = ~40% of 30-day median; 2 = partial; 1 = vague; 0 = none.
Synthesis
Defend with evidence and honesty, publish for researchers and practitioners, and disclose responsibly.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →