Category:OWASP Open Review Project owasp.fortify.com FAQ - Revision history

Dancornell at 02:47, 18 September 2008

2008-09-18T02:47:17Z

Dancornell: /* How do you calculate the number of lines of code? */

2008-09-17T13:28:52Z

‎How do you calculate the number of lines of code?

Dancornell: /* How does this project handle disclosure responsibly? */

2008-09-17T13:28:24Z

‎How does this project handle disclosure responsibly?

Dancornell: /* What can I do to help the Open Review efforts? */

2008-09-17T13:27:09Z

‎What can I do to help the Open Review efforts?

Dancornell: /* What can I do to help the Open Review efforts? */

2008-09-17T13:26:27Z

‎What can I do to help the Open Review efforts?

Dancornell: /* Do we need to notify you when we release a new version? */

2008-09-17T13:25:26Z

‎Do we need to notify you when we release a new version?

Dancornell: /* Will you review the code again when we've resolved the problems? */

2008-09-17T13:24:37Z

‎Will you review the code again when we've resolved the problems?

Dancornell: /* How long does the review process take to get open source code scanned? */

2008-09-17T13:23:15Z

‎How long does the review process take to get open source code scanned?

Dancornell: /* Are there any submission criteria? */

2008-09-17T13:21:55Z

‎Are there any submission criteria?

Dancornell: /* What kinds of projects are accepted? */

2008-09-17T13:21:08Z

‎What kinds of projects are accepted?

← Older revision		Revision as of 02:47, 18 September 2008
Line 78:		Line 78:

	During scans we compare defects found in the last previous scan, with all the issues uncovered in the current scan. If an issue found in the last scan is no longer present, we consider the defect to be "fixed".		During scans we compare defects found in the last previous scan, with all the issues uncovered in the current scan. If an issue found in the last scan is no longer present, we consider the defect to be "fixed".
		+
		+	== System Availability ==
		+
		+	=== What are the scheduled downtime periods? ===
		+
		+	System downtime has been planned for the hours between 9PM-12AM PT every Sunday. Other than that we will try to keep the system available.

@@ Line 73: / Line 73: @@
 === How do you calculate the number of lines of code? ===
-Fortify only counts lines of code containing actual operations. This translates into a more accurate count of actual statements within the code base.
+Fortify SCA only counts lines of code containing actual operations. This translates into a more accurate count of actual statements within the code base.
 === How do you determine if a defect is "fixed"? ===
 During scans we compare defects found in the last previous scan, with all the issues uncovered in the current scan. If an issue found in the last scan is no longer present, we consider the defect to be "fixed".

@@ Line 59: / Line 59: @@
 Disclosing security issues in a manner that is both useful to software developer and software user can be a difficult task. Ultimately, it is about how to get the defect resolved with the smallest impact to the user. In the case of this project, all of the source code is publicly available. In theory, malicious individuals currently can examine the code themselves to attempt to find defects. Such a use can not be prevented, however; it would be irresponsible for this project to make an attacker's job easier.<br>
-The Fortify Open Review project has adopted a fairly basic "responsible disclosure" policy. For the open review, we accomplish responsible disclosure by:
+[http://owasp.fortify.com/ owasp.fortify.com] has adopted a fairly basic "responsible disclosure" policy. For the open review, we accomplish responsible disclosure by:
-*  Only publishing aggregate defect information to anonymous users.
+* Only publishing aggregate defect information to anonymous users.
 * Letting project owners have input on who can review their code.
 * Alerting project owners of critical security defects that have been uncovered.

@@ Line 51: / Line 51: @@
 #'''Help Audit Projects'''<br>Do you have Java or PHP programming experience? Have you studied and understood the defects we find? Volunteer to help review the analysis results discovered during the automated phase of the open review process!
 #'''Submit Bug Fixes'''<br>Finding and alerting open source projects about security concerns is all well and good, but fixing  issues for the projects goes one step further! Take a look at the reviewed and confirmed defects, fix the issue, and then submit a patch to the affected project!
-#'''Submit Projects'''<br>Know of an excellent project that's not on the list? Are you involved in a project that you'd like to have analyzed? Submit it to us! Try as we may, the Java Open Review team can't be aware of all the open source projects out there. Help by keeping us aware of what's out there.
+#'''Submit Projects'''<br>Know of an excellent project that's not on the list? Are you involved in a project that you'd like to have analyzed? Submit it to us! Try as we may, the OWASP Open Review team can't be aware of all the open source projects out there. Help by keeping us aware of what's out there.
 == Concerns ==

@@ Line 49: / Line 49: @@
 === What can I do to help the Open Review efforts? ===
-#Help Audit Projects<br>Do you have Java or PHP programming experience? Have you studied and understood the defects we find? Volunteer to help review the analysis results discovered during the automated phase of the open review process!
+#'''Help Audit Projects'''<br>Do you have Java or PHP programming experience? Have you studied and understood the defects we find? Volunteer to help review the analysis results discovered during the automated phase of the open review process!
-#Submit Bug Fixes<br>Finding and alerting open source projects about security concerns is all well and good, but fixing  issues for the projects goes one step further! Take a look at the reviewed and confirmed defects, fix the issue, and then submit a patch to the affected project!
+#'''Submit Bug Fixes'''<br>Finding and alerting open source projects about security concerns is all well and good, but fixing  issues for the projects goes one step further! Take a look at the reviewed and confirmed defects, fix the issue, and then submit a patch to the affected project!
-#Submit Projects<br>Know of an excellent project that's not on the list? Are you involved in a project that you'd like to have analyzed? Submit it to us! Try as we may, the Java Open Review team can't be aware of all the open source projects out there. Help by keeping us aware of what's out there.
+#'''Submit Projects'''<br>Know of an excellent project that's not on the list? Are you involved in a project that you'd like to have analyzed? Submit it to us! Try as we may, the Java Open Review team can't be aware of all the open source projects out there. Help by keeping us aware of what's out there.
 == Concerns ==

@@ Line 43: / Line 43: @@
 === Do we need to notify you when we release a new version? ===
-As long as your SCM information does not change, we should pick up the newest release version as part of the weekly analysis. If the SCM or build information does change, please ask your OWASP co-ordinator to make the necessary changes.
+For Java and PHP projects, as long as your SCM information does not change, we should pick up the newest release version as part of the weekly analysis. If the SCM or build information does change, please email the [mailto:open-review-project@lists.owasp.org OWASP Open Review mailing list] to make the necessary changes.
 == Contributing ==

@@ Line 39: / Line 39: @@
 === Will you review the code again when we've resolved the problems? ===
-Yes, we will automatically download the code from your source repository on a weekly basis and re-run the analysis.
+Yes.  We will automatically download code for Java and PHP projects from your source repository on a weekly basis and re-run the analysis.  Projects developed in other languages will need to be manually re-scanned so there may be a delay.
 === Do we need to notify you when we release a new version? ===

@@ Line 31: / Line 31: @@
 === How long does the review process take to get open source code scanned? ===
-Barring technical difficulties, the initial code will get scanned within hours of submission, depending on the number of projects queued.
+For Java and PHP projects, barring technical difficulties, the initial code will get scanned within hours of submission, depending on the number of projects queued.  The time frame for getting projects developed in other languages may take longer as they must be manually scanned and uploaded.
 === Do we receive a detailed list of problems so we can solve them? ===

@@ Line 25: / Line 25: @@
 * Project owner email address
-Please contact your OWASP co-ordinator to have your project listed.
+Please contact the [mailto:open-review-project@lists.owasp.org OWASP Open Review mailing list] to have your project listed.
 == After Submission ==

@@ Line 11: / Line 11: @@
 === What kinds of projects are accepted? ===
-We will accept any compilable open source  project for review. Essentially, if the project meets the [http://www.opensource.org/docs/osd Open Source Initiative definition], it's kosher. Currently, we support Java and PHP projects, though support for more languages is in the works.
+We will accept any compilable open source  project for review. Essentially, if the project meets the [http://www.opensource.org/docs/osd Open Source Initiative definition], it's kosher. Currently, we support Java and PHP projects, though support for more languages is in the works.  If you have an open source project written in ASP Classic, .NET, C/C++ or ColdFusion email the [mailto:open-review-project@lists.owasp.org Open Review Project mailing list] to see about getting a scan run on the project source code and getting that scan uploaded to the [http://owasp.fortify.com/ owasp.fortify.com] site.
 === Are there any submission criteria? ===