Developer survey on MDN

[dontcallmedom]

Since we want to improve practices around security for Web developers, I think getting some data about how they perceive the problem space would be informative.

One possibility for that would be to request a slot to run a short survey on MDN via the WebDX Community Group (disclaimer: I co-chair that group) - see the couple of surveys we ran last fall.

A possible focus would be on what developers tend to find most challenging when it comes to keeping their app secure; here is a strawman proposal of what the survey could ask, where each option option would offer a rating from "very challenging" to "very easy".

To keep your Web app and its users same from security vulnerabilities, rate how easy or challenging are the following aspects:

• understanding the security model of Web browsers (e.g. same-origin policy, CORS, permissions policy)
• keeping up to date the frameworks and libraries your app depends on
• integrating safely third-party services (e.g. login, payment)
• configuring the server to match the required security properties (e.g. SSL, HTTP headers)
• detecting security vulnerabilities introduced in your development workflow (e.g. cross-site scripting)

(we could also survey developers on their awareness of some of the technologies or concepts we think are relevant)

[torgo]

As discussed on our call, I suggest we add a bullet point on "threats":

• understanding security threats and how they might apply to my your web application

…and also add a free text entry field to the poll asking "What are your security-related challenges?"

[dontcallmedom]

filed https://github.com/web-platform-dx/developer-research/issues/19 for review by the WebDX CG

[dontcallmedom]

if all goes as planned, the survey should run on MDN week of May 15

[tidoust]

Survey ran as planned. Raw results along with an interpretation are available in the GitHub repository of the WebDX Community Group. The survey was also advertised in relation with the workshop on the W3C blog, see Securing the Web forward: Addressing developer concerns in web security.

Survey results will be briefly presented during the workshop to set the context.