20:25:09 <dg> I'm giving it a brief read; I obviously don't know all the details but any structured system is better.
20:25:18 <str4d> The modified DREAD model makes better sense to me than the original.
20:26:06 <dg> I have a lot of respect for OWASP too. :P
20:26:10 <str4d> "If we look at the five components, we see that none of these are highly correlated – one of them does not imply the other. This means we have independent factors, which is one of the strongest criteria for a solid model. Thus our task is to figure out how to properly weight the inputs. In WSC, we told you to rate them from 1-10, add them up, and divide by 5. If we apply some obvious tests, we find that a damage of 1, and all other factors 10 (a well known nuisance
20:26:10 <str4d> "If we look at the five components, we see that none of these are highly correlated - one of them does not imply the other. This means we have independent factors, which is one of the strongest criteria for a solid model. Thus our task is to figure out how to properly weight the inputs. In WSC, we told you to rate them from 1-10, add them up, and divide by 5. If we apply some obvious tests, we find that a damage of 1, and all other factors 10 (a well known nuisance
20:26:10 <str4d> , e.g., pop-ups) gets weighted the same as a discoverability of 1 and everything else 10 (hard to sort out, but causes the heat death of the universe). This is an obvious malfunction."
20:27:10 <str4d> dg: so do I. They have many other potentially-useful models and docs there.
