Closed jyasskin closed 1 month ago
Hi @jyasskin, thank you for your comment.
So in general I feel the same way as you, that important topics like Threat Modeling is an important topic to be "chartered" and I have and we have made several thoughts with respect to CG or IG. I'll write them down for you here the reasoning we've done, I'd appreciate your opinion. Then if you prefer let's also talk about it in call or as it's more convenient for you (maybe we'll even meet at TPAC in f2f :))
I hope I explained myself, let me know what you think about the reasoning :)
quoting @jaromil from https://github.com/w3c/charter-drafts/issues/550#issuecomment-2228183719
Dears, it took me some time to better understand the context and method in place. I am sure there are specific Threat Model (TM) competences in security as well methodology that are best overlooked by the SING, which is ultimately about security. However what we propose as TM also includes issues on privacy, harm, fair governance, civil rights, and even more contexts; I believe that a highly interdisciplinary group is needed for TM and I can imagine most of its work would be in facilitating a cross disciplinary discourse to fit methodologies from well-established groups as PING and SING and distill clear problem definitions.
addressed here, we can follow up the discussion in the PR https://github.com/w3c/strategy/issues/449#issuecomment-2241282461
@simoneonofri noticed that we don't have a home at the W3C for general web threat modeling. He tried to address this by creating https://www.w3.org/community/tmcg/, but my personal sense is that this area is mature enough to fit into a chartered group. The horizontal review group for security will be enforcing a particular threat model, so it makes sense to give them the responsibility to write it down.