There are important standardization bodies that actually create very good and widely used standards in engineering and development.This is prominent in other engineering domains, but less common in computer science.We may speculate about the reasons, but it may be that computer science is relatively young, and therefore, techniques and methods evolve frequently, and standards may hinder this form of innovation.A second reason may be that in computer science, large companies are developing the de facto standards that are not necessarily becoming formal standards.But in computer science, standards also ensure compatibility, interoperability, reliability, security, reusability, and potentially many other good properties across services, applications, systems, and technologies.And we all know some key categories and examples of relevant standards, such as programming language standards (e.g.,

Abstract Threat Modeling is an essential step in secure software system development. It is a (so far) manual, attacker-centric approach for identifying architecture-level security flaws during the planning phase of software systems. In recent years, academia has presented ideas to automate threat detection that do not focus on a particular class of security flaws but offer means of pattern-based security flaw descriptions. However, comparing presented ideas (tools) for automated threat detection contains the potential for unwilling bias or restricted information content. In this work, we investigate the process of comparing automatic security flaw detection tools, clarify common pitfalls during this process, and propose a fair, reproducible, and informative comparison approach to be used as a community standard. We additionally discuss the necessary steps for the community to effectively implement this approach and support improved comparisons and evaluations in the future. We use a previously published case study to determine problems with current comparison techniques and classify different levels of comparison to be used for future reference as our main contribution. As a consequence, we propose using a model-based approach for specifying security flaws and apply an existing natural language-based catalogue to this model-based approach. Furthermore, we introduce an inspection process model (for providing a standard to specify findings of a threat detection process) to streamline the evaluation and comparisons of automatic security flaw detection tools. We provide an exemplary evaluation of this detection guideline and inspection process model along the lines of both automatic approaches from the original case study. All artefacts of the work are publicly available to support the research community and to create a common baseline for future tool comparisons.

Abstract The need to produce software quicker and in greater quantities continues to grow, while the market for professional programmers struggles to meet the rising demand. Low-code development platforms (LCDPs) have been proposed as a solution that enables individuals without formal training to develop applications. However, current LCDPs typically rely on proprietary, fixed code generation processes, which limit flexibility, hinder interoperability, and risk vendor lock-in. To address these limitations, this paper introduces Dandelion+, a cloud-based low-code platform designed to create domain-specific LCDPs and applications within them. Our approach is highly model-driven, from defining the scaffolds of low-code platforms (e.g., models, meta-models, users, and roles) to creating applications. In particular, applications are powered by PlatFlow, a platform-aware graphical workflow language. Comprising both model operations and low-code-focused nodes, PlatFlow offers flexible control over the code generation process that drives LCDPs. We conduct two case studies to evaluate our approach. First, we confront Dandelion+ with other low-code platforms to design interactive applications and produce artifacts. Second, we report on the benefits of Dandelion+ in the industrial context of UGROUND, a Spanish software firm that uses low code in its projects.