Re: Securing the security reviews in W3C - how to proceed ?

On 2016/07/21 23:49, Anne van Kesteren wrote:
> On Thu, Jul 21, 2016 at 4:34 PM, GALINDO Virginie
> <Virginie.Galindo@gemalto.com> wrote:
>> Thanks for jumping in that thread if you believe you can help with improving security reviews in W3C !
>
> I think increasing the overall security competence and understanding
> of the same-origin policy, through self-review and learning, is much
> more important than delegating the task to a pool of "experts". The
> idea of having "accessibility", "internationalization", and now
> "security" pillars has proven not to scale and has done more harm than
> good. It's good to have communities where you can go for help, but
> making them responsible doesn't really work.

Based on my experience with internationalization, I think both trying to 
take responsibility for all aspects of your spec AND being able to ask 
expert groups for help is important.

The reasons for the later are at least two-fold:

1) Most people are good at quite a lot of things, but not at everything.
    Even if they force themselves to think and work hard in some areas,
    it may be very difficult. As an example, at least some areas of
    security require a very distrusting mindset. To some extent, that can
    be learned, but it may require a lot of time. To others, it may come
    more natural.

2) Most if not all of the areas we are talking about have some easy
    things that by now we hope every average spec writer and developer
    should get. For internationalization, that might be something like
    "use Unicode". But each of these areas also comes with a long tail,
    where it may be difficult to keep reasonably current even for the
    experts.

Regards,   Martin.

Received on Friday, 22 July 2016 09:48:12 UTC