OWASP Spring Of Code 2007 Applications - Revision history

Dinis.cruz: Protected "OWASP Spring Of Code 2007 Applications": Submission period is over [edit=sysop:move=sysop]

2007-04-10T06:49:17Z

Protected "OWASP Spring Of Code 2007 Applications": Submission period is over [edit=sysop:move=sysop]

Dinis.cruz at 06:48, 10 April 2007

2007-04-10T06:48:51Z

Dinis.cruz: /* Any other reasons why you and your project should be selected */

2007-04-10T06:47:06Z

‎Any other reasons why you and your project should be selected

Arshan: /* Challenge */

2007-04-02T12:44:35Z

‎Challenge

Caseydk: /* Caseydk (Keith Casey, CaseySoftware.com) - Security throughout the SDLC */

2007-03-31T02:42:29Z

‎Caseydk (Keith Casey, CaseySoftware.com) - Security throughout the SDLC

Caseydk: /* Caseydk (Keith Casey, CaseySoftware.com) - Security throughout the SDLC */

2007-03-31T02:40:50Z

‎Caseydk (Keith Casey, CaseySoftware.com) - Security throughout the SDLC

Caseydk: /* Caseydk - Security in the SDLC */

2007-03-31T02:39:34Z

‎Caseydk - Security in the SDLC

Caseydk at 02:30, 31 March 2007

2007-03-31T02:30:56Z

EdFinkler: Added proposal for "A comprehensive input retrieval/filtering system for PHP"

2007-03-30T22:15:40Z

Added proposal for "A comprehensive input retrieval/filtering system for PHP"

Rezos: Przemyslaw 'rezos' Skowron - Refresh Attacks list

2007-03-30T21:07:13Z

Przemyslaw 'rezos' Skowron - Refresh Attacks list

← Older revision		Revision as of 06:48, 10 April 2007
Line 1:		Line 1:
		+
		+	[10th April 2006] : UPDATE: the submission period is now closed and this page is locked for editing. The OWASP board will now evaluate the proposals and publish the results as soon as possible
		+
		+
	This page contains project Applications to the [[OWASP_Spring_Of_Code_2007]]		This page contains project Applications to the [[OWASP_Spring_Of_Code_2007]]

← Older revision		Revision as of 06:47, 10 April 2007
Line 958:		Line 958:

	I believe that my involvement in the local Washington, DC development community - NoVaLUG, DCLUG, DCPHP, NoVaJUG, NoVaRUG - puts me in a special position to gather this information. Yes, dome of it can be found online in various documents, but there are volumes of information in the hands of the developers and system administrators. This information will not be classified, sensitive, etc, but may be considered embarrassing and therefore would will never see the light of day. In addition, I am active with a number of groups and have connections to various security researchers who may be able to help seed and potentially promote the effort.		I believe that my involvement in the local Washington, DC development community - NoVaLUG, DCLUG, DCPHP, NoVaJUG, NoVaRUG - puts me in a special position to gather this information. Yes, dome of it can be found online in various documents, but there are volumes of information in the hands of the developers and system administrators. This information will not be classified, sensitive, etc, but may be considered embarrassing and therefore would will never see the light of day. In addition, I am active with a number of groups and have connections to various security researchers who may be able to help seed and potentially promote the effort.
		+
		+	== Paulo Coimbra: Organize the 'OWASP branding project' and make a 1st pass at the current abuses of the OWASP brand ==
		+
		+	I propose to give a contribution to the OWASP Branding Project, by working on the following issues:
		+	# Accordingly to the established rules now in place for the utilization of the OWASP Brand, I intend:
		+	## To identify the users of the Brand and their pattern of utilization;
		+	## To identify cases where misusing occurs: which rules are mostly broken and what processes are used to break them;
		+	## To create a typified profile of inadequate utilization of the OWASP Brand;
		+	# Based on the previous survey, I intend:
		+	## To contribute for the enhancement and stabilization of a political and economical concept for the Brand and for what it represents in terms of market positioning;
		+	## Having as a base the Brand’s enhanced concept, to establish a set of rules whereby the circumstances of use of the Brand are objectively controlled and measured.

@@ Line 662: / Line 662: @@
 === Challenge ===
-Many sites today would enjoy the ability to allow users to provide their own HTML in order to customize their page layout and general user experience. Because of the concerns regarding XSS, it is generally thought of as 'too dangerous' to allow them to input any HTML at all. Sites like MySpace who have been brave enough to provide this functionality have no standardized, proven solution to validate user HTML. In many cases, it's easier to disallow everything that looks HTML or to output encode all their input. Sites like MySpace that have been brave enough to try to attempt this have been the targets of complex attacks. Many sites today don't offer this type of functionality because of concerns for XSS and dangerous HTML.
+Many sites today would enjoy the ability to allow users to provide their own HTML in order to customize their page layout and general user experience. Because of the concerns regarding XSS, it is generally thought of as 'too dangerous' to allow them to input any HTML at all. Sites like MySpace who have been brave enough to provide this functionality have no standardized, proven solution to validate user HTML. In many cases, it's easier to disallow everything that looks HTML or to output encode all user input. Not coincidentally, those sites have been the targets of complex attacks. Many sites today don't offer this type of functionality because of concerns for XSS and dangerous HTML.
 === Objectives ===

← Older revision		Revision as of 02:42, 31 March 2007
Line 919:		Line 919:
	* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.		* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.

−	== Caseydk ~~(Keith Casey, CaseySoftware.com)~~ - Security throughout the SDLC ==	+	== Caseydk - Security throughout the SDLC ==

@@ Line 922: / Line 922: @@
-* Educational and professional background:
+=== Educational and professional background ===
 I have a BS in Electrical Engineer which although I rarely use it, I have been told that I "write code like an engineer".  I value simplicity and functionality and work to refactor regularly to make my code reflect these principles.  I am a core contributor to dotProject - LAMP-based Project Management System - and prior to starting my own company worked at the Department of Justice with the SDLC on a daily basis.  During my time there, I provided Independent Verification and Validation, Risk Management, and Technical Review for various projects related to internal systems and homeland security.  Most of these projects were inter-Departmental and required the coordination and involvement of numerous stakeholders from numerous organizations.
-* Participation and leadership in open communities
+=== Participation and leadership in open communities ===
 In terms of Open Source, I have been a core contributor to dotProject since 2004 and have recently joined the Zend Framework project.  Within the dotProject community, I have been a big proponent of ease of use while simultaneously working to close various issues related to security, permissions, and general suitability of the system.  While this is simple when you have complete control over your environment, the vast majority of our community is using shared hosting and therefore we have to secure the system multiple ways simultaneously to cover every possibility.  My specific contributions were the implementation of additional permissions types - previously View and Edit were often confused - and the implementation of .htaccess to lock down all sub-directories, many extraneous files, and still allow for a variety of access methods.  While I don't consider it perfect, I believe we have made huge strides in the past year or two.
-* The opportunity, challenges, issues or need your proposal addresses
+=== The opportunity, challenges, issues or need your proposal addresses ===
 Currently, security across the SDLC is often viewed as an item to checkoff.  While this may have worked in the past where access to a system required physical presence, it is short-sighted and dangerous in our currently connected world.  The concept of "the seven touchpoints" is a step forward and offer a model of active security processes and procedures, but once again, these are often treated as items to checkoff the list.  I propose a research effort to develop and support a compelling call to action so that organizations see that they must implement the practices and procedures out of their own best interest.  Recent examples such as the Department of Veterans' Affairs, TJ Maxx, and many others show that organizations with bad practices put us all at risk.
-* Objectives or ways in which you will meet the goal(s)
+=== Objectives or ways in which you will meet the goal(s) ===
 I see this effort working out into two major pieces.  While there is a fundamental need to understand the security perspective, there's the secondary aspect of getting in the mind of an Evil Guy(tm).  First, there is the research and documentation phase.  I propose to gather a series of real-world security policies, operations, and practices.  While this in itself may not be interesting to most, I further propose to supplement this information with real-world examples of these practices in action with a focus on the local Federal Agencies and their supporting organizations.  I believe this perspective is something that should provide for interesting discussion and comparison.  Out of these various policies and actions, I hope to combine this to identify how "real practices" compare with "best practices" and discuss areas where these differences do and do not make sense.  This portion of the project will be entirely done by me.
@@ Line 940: / Line 940: @@
 The second and more interesting part of this project is an Abuse Case Repository (ACR).  Many system architects and developers have a single view of their system:  How it's supposed to be used.  By having a repository of Abuse Cases, I hope to provide a one-stop-shop for nefarious thoughts and practices to get minds rolling and ideas flowing.  Hopefully by seeding this with a number of real-world examples and small explanatory code snippets, this will encourage other people to make contributions and suggestions... not only on new and interesting security problems, but also potential solutions.  Yes, this sort of repository has the ability to be used for evil purposes.  In order to reasonably protect contributors, code snippets would have to be scrubbed to remove system-identifying variables and information.  This effort would be started by me but would include anyone with information and ideas to share.
-* Specific deliverables and a rough project schedule so we can track progress
+=== Specific deliverables and a rough project schedule so we can track progress===
 Milestones:
@@ Line 953: / Line 953: @@
 *  Ongoing - Convincing people to participate in the ACR effort.
-* Long-term vision for the project
+=== Long-term vision for the project===
 I believe the most valuable aspect to come out of this project will be ACR and I see it outliving this effort as time goes on and more individuals become aware of the risks and challenges they face.  Since it will not solve their problems and simply identify potential holes, I believe it can only grow as new attack vectors, technologies, and problems arise.  Developing a normalized notation for these risks will be key in the effort.
-* Any other reasons why you and your project should be selected
+=== Any other reasons why you and your project should be selected===
 I believe that my involvement in the local Washington, DC development community - NoVaLUG, DCLUG, DCPHP, NoVaJUG, NoVaRUG - puts me in a special position to gather this information.  Yes, dome of it can be found online in various documents, but there are volumes of information in the hands of the developers and system administrators.  This information will not be classified, sensitive, etc, but may be considered embarrassing and therefore would will never see the light of day.  In addition, I am active with a number of groups and have connections to various security researchers who may be able to help seed and potentially promote the effort.

← Older revision	Revision as of 06:49, 10 April 2007
(No difference)

← Older revision		Revision as of 02:39, 31 March 2007
Line 919:		Line 919:
	* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.		* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.

−	== Caseydk - Security in the SDLC ==	+	== Caseydk (Keith Casey, CaseySoftware.com) - Security throughout the SDLC ==
		+
		+
		+	* Educational and professional background:
		+
		+	I have a BS in Electrical Engineer which although I rarely use it, I have been told that I "write code like an engineer". I value simplicity and functionality and work to refactor regularly to make my code reflect these principles. I am a core contributor to dotProject - LAMP-based Project Management System - and prior to starting my own company worked at the Department of Justice with the SDLC on a daily basis. During my time there, I provided Independent Verification and Validation, Risk Management, and Technical Review for various projects related to internal systems and homeland security. Most of these projects were inter-Departmental and required the coordination and involvement of numerous stakeholders from numerous organizations.
		+
		+	* Participation and leadership in open communities
		+
		+	In terms of Open Source, I have been a core contributor to dotProject since 2004 and have recently joined the Zend Framework project. Within the dotProject community, I have been a big proponent of ease of use while simultaneously working to close various issues related to security, permissions, and general suitability of the system. While this is simple when you have complete control over your environment, the vast majority of our community is using shared hosting and therefore we have to secure the system multiple ways simultaneously to cover every possibility. My specific contributions were the implementation of additional permissions types - previously View and Edit were often confused - and the implementation of .htaccess to lock down all sub-directories, many extraneous files, and still allow for a variety of access methods. While I don't consider it perfect, I believe we have made huge strides in the past year or two.
		+
		+	* The opportunity, challenges, issues or need your proposal addresses
		+
		+	Currently, security across the SDLC is often viewed as an item to checkoff. While this may have worked in the past where access to a system required physical presence, it is short-sighted and dangerous in our currently connected world. The concept of "the seven touchpoints" is a step forward and offer a model of active security processes and procedures, but once again, these are often treated as items to checkoff the list. I propose a research effort to develop and support a compelling call to action so that organizations see that they must implement the practices and procedures out of their own best interest. Recent examples such as the Department of Veterans' Affairs, TJ Maxx, and many others show that organizations with bad practices put us all at risk.
		+
		+	* Objectives or ways in which you will meet the goal(s)
		+
		+	I see this effort working out into two major pieces. While there is a fundamental need to understand the security perspective, there's the secondary aspect of getting in the mind of an Evil Guy(tm). First, there is the research and documentation phase. I propose to gather a series of real-world security policies, operations, and practices. While this in itself may not be interesting to most, I further propose to supplement this information with real-world examples of these practices in action with a focus on the local Federal Agencies and their supporting organizations. I believe this perspective is something that should provide for interesting discussion and comparison. Out of these various policies and actions, I hope to combine this to identify how "real practices" compare with "best practices" and discuss areas where these differences do and do not make sense. This portion of the project will be entirely done by me.
		+
		+	The second and more interesting part of this project is an Abuse Case Repository (ACR). Many system architects and developers have a single view of their system: How it's supposed to be used. By having a repository of Abuse Cases, I hope to provide a one-stop-shop for nefarious thoughts and practices to get minds rolling and ideas flowing. Hopefully by seeding this with a number of real-world examples and small explanatory code snippets, this will encourage other people to make contributions and suggestions... not only on new and interesting security problems, but also potential solutions. Yes, this sort of repository has the ability to be used for evil purposes. In order to reasonably protect contributors, code snippets would have to be scrubbed to remove system-identifying variables and information. This effort would be started by me but would include anyone with information and ideas to share.
		+
		+	* Specific deliverables and a rough project schedule so we can track progress
		+
		+	Milestones:
		+	* April 9th - Notification / Kickoff
		+	* April 23rd - Draft Outline of Document
		+	* April 28th - Abuse Case Repository (ACR) Design/Draft/RFC
		+	* April 30th - Gathering information on practices, policies, etc
		+	* June 1st - ACR Launch
		+	* June 4th - Evaulate real-world information gathered, determine value, usefulness, and targets for completion
		+	* June 15th - Draft of final report, status report on ACR
		+	* July 9th - Project "complete"
		+	* Ongoing - Convincing people to participate in the ACR effort.
		+
		+	* Long-term vision for the project
		+
		+	I believe the most valuable aspect to come out of this project will be ACR and I see it outliving this effort as time goes on and more individuals become aware of the risks and challenges they face. Since it will not solve their problems and simply identify potential holes, I believe it can only grow as new attack vectors, technologies, and problems arise. Developing a normalized notation for these risks will be key in the effort.
		+
		+	* Any other reasons why you and your project should be selected
		+
		+	I believe that my involvement in the local Washington, DC development community - NoVaLUG, DCLUG, DCPHP, NoVaJUG, NoVaRUG - puts me in a special position to gather this information. Yes, dome of it can be found online in various documents, but there are volumes of information in the hands of the developers and system administrators. This information will not be classified, sensitive, etc, but may be considered embarrassing and therefore would will never see the light of day. In addition, I am active with a number of groups and have connections to various security researchers who may be able to help seed and potentially promote the effort.

← Older revision		Revision as of 02:30, 31 March 2007
Line 918:		Line 918:
	* Ongoing: Advocacy. PR via interviews and news items about releases; writing articles demonstrating the system for various sources; presentations via the web and at major PHP conferences.		* Ongoing: Advocacy. PR via interviews and news items about releases; writing articles demonstrating the system for various sources; presentations via the web and at major PHP conferences.
	* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.		* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.
		+
		+	== Caseydk - Security in the SDLC ==

← Older revision		Revision as of 22:15, 30 March 2007
Line 801:		Line 801:
	Why I? Because I have experience, skills, goodwill and free time.		Why I? Because I have experience, skills, goodwill and free time.
	Why this project? Because this is strong base for education for any programmer, administrator and many others professionals. Knowledge attacks vectors... this is helpful for more secure not only (e-)world.		Why this project? Because this is strong base for education for any programmer, administrator and many others professionals. Knowledge attacks vectors... this is helpful for more secure not only (e-)world.
		+
		+
		+
		+	== EdFinkler - A comprehensive input retrieval/filtering system for PHP ==
		+
		+	=== About Me ===
		+	I received a Bachelor's Degree in English from Indiana University in 1997. I've been a web developer since 1996, and a PHP developer since 1999. I worked for four years as Supervisor of Web Development at Golden Dome Media, and have spent my last six years as Web and Security Archive Administrator for CERIAS, the Center for Education and Research in Information Assurance and Security ([http://www.cerias.purdue.edu http://www.cerias.purdue.edu]), at Purdue University.
		+
		+	I am a member of the PHP Security Consortium ([http://phpsec.org http://phpsec.org]), and creator/project lead on PHPSecInfo, a PHP environment security auditing tool ([http://phpsecinfo.com http://phpsecinfo.com]). I regularly speak on web application security issues, and am an advocate of secure programming practices via CERIAS and as a member of the PHP and larger web development community.
		+
		+
		+	=== The state of PHP application development ===
		+
		+	The state of application development in PHP is worrisome. Reviewing the NIST NVD data from 2006 reveals that '''over 40% of all vulnerabilities reported were PHP application vulnerabilities''' -- not vulnerabilities in the language itself, but errors in proper coding practice. I believe that to address the widespread problem of insecure PHP application development, new development paradigms are required. The typical approach of easy, direct interaction with input is inherently problematic, even for a programmer with strong security practices. The developer should be forced to consider his or her expectations for the data, and apply appropriate filtering/validation to ensure that those expectations are correct. For the cases where raw input is required, the developer should be forced to '''demonstrate clear intent''', much moreso than simply using the assignment operator. This will, I believe, make it '''easier to develop secure applications in PHP''', and '''harder to develop insecure ones'''.
		+
		+
		+	=== Creating a new paradigm ===
		+
		+	We have a strong foundation for a new paradigm in Zend_Filter_Input ([http://funkatron.com/wp/wp-content/ZFI_docs.pdf http://funkatron.com/wp/wp-content/ZFI_docs.pdf]), a component of the Zend Framework developed by PHP security expert Chris Shiflett ([http://shiflett.org http://shiflett.org]). Disappointingly, the component was dropped from the framework, a move I and many others strongly disagreed with. After some discussions with Chris and others, I feel that the best approach would be to resurrect Zend_Filter_Input, making it framework-independent and addressing existing limitations.
		+
		+
		+	=== The details and examples ===
		+
		+	Essentially, this system would act as a sort of "firewall" API between user input and the rest of the application. By default, the constructor would take an array, assign it to an internal property, and set the passed array to NULL. By setting up filter objects from the standard user input superglobals, developers would be forced to access all data via the filter system's API. A developer must demonstrate clear intent in order to get unfiltered data.
		+
		+
		+	====Usage examples====
		+
		+	Note that in these examples, I've used the name "InputFilter" for the filter system. This will likely change when I can come up with something snazzier.
		+	<pre>
		+	// Typical ZFI-style usage
		+	$f_post = new InputFilter($_POST);
		+
		+
		+	// $_POST['searchtext'] == "<strong>hello</strong>";
		+	$comment = $f_post->noTags('comment');
		+	// $comment === "hello";
		+	$comment_raw = $f_post->getRaw('comment');
		+	//$comment_raw === "<strong>hello</strong>";
		+
		+
		+	// makePostFilter would be a helper method that retrieves the $_POST array,
		+	// wraps the data in an InputFilter, and nullifies the $_POST array
		+	$f_post = InputFilter::makePostFilter();
		+
		+
		+	// get email
		+	if ( $email = $f_post->isEmail('email') ) {
		+	echo "Valid email address";
		+	} else {
		+	echo "Not a valid email address";
		+	}
		+
		+	// automatically strip all html tags and bbcode tags from POST input.
		+	// This kind of input restriction would also be configurable via
		+	// external conf files
		+	$restrictions = array('noHTML','stripBBCode');
		+	$f_post = InputFilter::makePostFilter($restrictions);
		+	</pre>
		+
		+
		+	====Bootstrap file example====
		+
		+	<pre>
		+	<?php
		+	// standard bootstrap file
		+	require '/path/to/inputfilterclass.php';
		+
		+	$if = new InputFilter();
		+	$if->loadConfig('/path/to/configfile/inputfilter.conf');
		+	$if->buildStandardFilters(); // builds from $_GET, $_POST, $_COOKIE, $_SERVER
		+
		+	// the make*Filter methods use a singleton pattern to retrieve prebuilt filter objects
		+	$f_post = $if->makePostFilter();
		+	$f_get = $if->makeGetFilter();
		+	$f_cookie = $if->makeCookieFilter();
		+	$f_server = $if->makeServerFilter();
		+
		+	// $_POST, $_GET, $_COOKIE and $_SERVER are now all NULL
		+	// Only way to access this data is via the $f_* objects
		+
		+	?>
		+	</pre>
		+
		+
		+	==== Key improvements over Zend_Filter_Input ====
		+
		+	* Provide retrieval and filtering support for multidimensional arrays
		+	* Provide solutions for scoping issues (avoid the need for "global" keywords everywhere)
		+	* A variety of helper methods to reduce code verbosity
		+	* Block deprecated HTTP_*_VARS and other ways to grab input data without filtering
		+	* Auto-restrictions on input defined programatically or via configuration files
		+	* Compatible with PHP4 and PHP5
		+	* Self contained; not reliant on external libraries
		+	* Able to work with a wide variety of frameworks and app architectures; easily "pluggable" into any given web app
		+
		+
		+	===Responsibilities===
		+
		+	I expect to be responsible for all development and documentation. I will rely on the expertise of various members of the PHP security community for input and criticism, and hope to receive advocacy support from them as well. The development process will be open, and I intend to release code throughout to gather feedback.
		+
		+
		+	===Development milestones===
		+	''Dates assume an April 9th start''
		+
		+	* April 16th: Untethering the Zend_Filter_Input code from the Zend Framework
		+	* April 23rd: Rewriting PHP5-specific portions to work in PHP4
		+	* May 1st: Development of approach to address scoping issues (a big plus of the $_* superglobals is that they are always available in all scopes automatically)
		+	* May 3rd: Initial release of code (continues throughout at appropriate points)
		+	* May 10th: Addition of a variety of "helper" methods to make filtered input object creation and interaction easier
		+	* May 20th: Addition of automatic input "restriction" filters
		+	* July 1st: Addition of input filtering system configuration via external config files
		+	* July 1st: Full API doc generated from phpDoc-style documentation
		+	* July 9th: Detailed usage documentation, including examples of bootstrapping and methods of integration with various frameworks. Example source code included.
		+	* July 9th: PEAR channel for packaged distribution
		+	* Ongoing: Advocacy. PR via interviews and news items about releases; writing articles demonstrating the system for various sources; presentations via the web and at major PHP conferences.
		+	* Ongoing: Work with major PHP app devs and framework devs to integrate the system -- or encourage the development of similar approaches -- within their projects.

← Older revision		Revision as of 21:07, 30 March 2007
Line 762:		Line 762:

	We expect that with a worldwide contribution, the Attack and Vulnerability reference guides can become the most complete and updated security reference available. Also, we expect to create cross-reference among OWASP documents, using the same concepts, definitions, and categories in order to inter-link all the documents.		We expect that with a worldwide contribution, the Attack and Vulnerability reference guides can become the most complete and updated security reference available. Also, we expect to create cross-reference among OWASP documents, using the same concepts, definitions, and categories in order to inter-link all the documents.
		+
		+	== Przemyslaw 'rezos' Skowron - Refresh [[:Category:Attack\|Attacks]] list ==
		+
		+	===* My educational and professional background===
		+
		+	I'm 24 year old system administrator/it security specialist with 6 years experience.
		+	Also I'm speaker at many different meetings about IT Security (e.g. at OWASP Poland Local Chapter in April 2007) and student Computer Science (last year).
		+
		+	===* Application security experience===
		+
		+	I have 5 years experience in security audits. Mainly applications for linux/win32 platform, but since 2 years I'm _interested_ web security. I know many attacks vectors, what and how I can do it with security bug and how correct (e.g. changes in code, configuration or something else).
		+	In 2004 year I wrote my first article about bugs in code. Currently I preparing presentation at FIRST! OWASP Poland Local Chapter Meeting about "secure programming in practice".
		+
		+	===* Participation and leadership in open communities===
		+
		+	I'm member of ISACA Poland and (I hope so!) OWASP Poland Local Chapter.
		+
		+	===* Objectives or ways in which you will meet the goal(s)===
		+
		+	1) flesh out any item complete from [[:Category:Attack\|Attacks]] list
		+	2) complete any item which is not complete or is blank
		+	3) refresh [[:Category:Attack\|Attacks]] list, everyday is new for new vectors attacks
		+
		+	===* Specific activities and who will carry out these activities===
		+
		+	Security education for newbie, medium-advanced and advanced people. Currently mainly via presentation on ISACA Poland meetings. My protector in this education is Shadow (sorry, I don't know in this moment if I mind operate his (first/last)name).
		+
		+	===* Specific deliverables and a rough project schedule so we can track progress===
		+
		+	My goals list (3 points) is good for make progress bar. First and second goals this is base what I want do it. Third goal is a little research working, but this is what I WANT do it in my life :)
		+
		+	===* Long-term vision for the project===
		+
		+	If [[:Category:Attack\|Attacks]] list is complete (9th July) in cycle on one year this work must be refresh. Very important is update [[:Category:Attack\|Attacks]] list every time when you hired about new vector attacks. Why? Because when description about this news vector attacks is not complete, in the next year you don't must making 3 goals, just 2 (first and second). Perfectly when any new item at [[:Category:Attack\|Attacks]] list is develop at moment emerge or even though max. 3 months for someone wrote it.
		+
		+	===* Any other reasons why you and your project should be selected===
		+
		+	Why I? Because I have experience, skills, goodwill and free time.
		+	Why this project? Because this is strong base for education for any programmer, administrator and many others professionals. Knowledge attacks vectors... this is helpful for more secure not only (e-)world.