TimMorgan at 21:14, 7 November 2012

2012-11-07T21:14:44Z

TimMorgan: Created page with "== FLOSSHack for Software Maintainers == If your software project been selected for a FLOSSHack event, then '''congratulations'''! This means that we're interested in br..."

2012-06-16T16:41:29Z

Created page with "== FLOSSHack for Software Maintainers == If your software project been selected for a FLOSSHack event, then '''congratulations'''! This means that we're interested in br..."

New page

== FLOSSHack for Software Maintainers ==

If your software project been selected for a [[FLOSSHack]] event, then '''congratulations'''! This means that we're interested in breaking your code, in a good way.

FLOSSHack events are designed to accomplish two primary goals:
* Help those who want to learn more about security auditing of software
* Improve the security posture of a worthy software project (like yours) at low or no cost

For the event to be the most successful, we encourage close collaboration with software maintainers. While we could operate completely autonomously (relying solely on software and documentation that software maintainers have already published), we think an ''ideal'' FLOSSHack event would go something like this:

# FLOSSHack "target" software selected
# Software maintainers contacted and provide FLOSSHack organizers with:
## Their opinion on the best version of software to test against (latest release version vs. source code repository version, etc)
## Instructions on the typical deployment/installation configuration (or better yet, provide organizers with a pre-installed virtual machine!)
## An overview of the applications authorization model: what roles exist and ''who'' should be allowed to do ''what''
## Any information on what attack scenarios are most likely against the software
# FLOSSHack organizers schedule the workshop event, publish details
# About one week before the workshop date, participants begin auditing the software based on details provided by maintainers
# On the day of the workshop:
## Participants gather face-to-face and remotely for an intensive hack session
## Friendly competition on who can find the "most" or "best" bugs is encouraged
## Software maintainers are encouraged to send a representative or join remotely. This can be very helpful for participants as questions about the software's intended use cases arise.
## At the end of the hack session, awards may be given to the most successful participants, based on number or types of vulnerabilities found. (Software maintainers are welcome to provide small prizes to be given away as awards. Small incentives can go a long way!)
# FLOSSHack organizers gather up all of the vulnerabilities and other security-related flaws found by participants and are provided to the software maintainer through a [http://en.wikipedia.org/wiki/Responsible_disclosure responsible disclosure] process:
## In most cases, CVE identifiers will be assigned to the vulnerabilities found
## After the flaws have been corrected in the source code, software maintainers release patches and/or new versions of the software to help secure their userbase. At that time, the original FLOSSHack participants who found the flaws ''should be credited with the finding, unless they choose to remain anonymous''. A simple credit is all that is necessary, such as "Thanks to Jane Participant for bringing CVE-XXXX-XXXX to our attention."
## After all flaws have been corrected, a listing of the flaws found will be posted to the FLOSSHack event page

@@ Line 13: / Line 13: @@
 ## Their opinion on the best version of software to test against (latest release version vs. source code repository version, etc)
 ## Instructions on the typical deployment/installation configuration (or better yet, provide organizers with a pre-installed virtual machine!)
-## An overview of the applications authorization model: what roles exist and ''who'' should be allowed to do ''what''
+## An overview of the application's authorization model: what roles exist and ''who'' should be allowed to do ''what''
 ## Any information on what attack scenarios are most likely against the software
 # FLOSSHack organizers schedule the workshop event, publish details

FLOSSHack for Software Maintainers - Revision history

TimMorgan at 21:14, 7 November 2012

TimMorgan: Created page with "== FLOSSHack for Software Maintainers == If your software project been selected for a FLOSSHack event, then '''congratulations'''! This means that we're interested in br..."