Podcast News - Revision history

Jmanico: /* OWASP Podcast Roundtable */

2010-08-26T16:59:08Z

‎OWASP Podcast Roundtable

Jmanico: /* OWASP Podcast Roundtable */

2010-08-26T16:53:44Z

‎OWASP Podcast Roundtable

Jmanico at 00:56, 19 May 2010

2010-05-19T00:56:46Z

Jmanico at 23:08, 18 May 2010

2010-05-18T23:08:41Z

Jmanico at 23:08, 18 May 2010

2010-05-18T23:08:16Z

Jmanico at 19:36, 18 May 2010

2010-05-18T19:36:59Z

Jmanico at 03:30, 6 April 2010

2010-04-06T03:30:55Z

Jmanico: Replaced content with ''''OWASP Podcast News''' OWASP NEWS 2010
== OWASP Podcast Roundtable == '''Next Recording : April 20, 2010 9m Eastern''''

2010-03-17T02:58:23Z

Replaced content with ''''OWASP Podcast News''' OWASP NEWS 2010<br> == OWASP Podcast Roundtable == '''Next Recording : April 20, 2010 9m Eastern''''

Jmanico at 11:31, 10 February 2010

2010-02-10T11:31:40Z

Jmanico at 09:18, 9 February 2010

2010-02-09T09:18:10Z

@@ Line 7: / Line 7: @@
 '''Next Recording&nbsp;: Week of August 30, 2010. Day and Time TBD'''
-# ?
+Suggested Topics:
 # ?
 # ?
 # ?
 # ?

@@ Line 5: / Line 5: @@
 == OWASP Podcast Roundtable  ==
-'''Next Recording&nbsp;: May 18, 2010 9pm Eastern'''
+'''Next Recording&nbsp;: Week of August 30, 2010. Day and Time TBD'''
-# OWASP is focusing on outreach for 2010, but what is the best way to reach out? How should appsec professionals reach software developers?
+# ?
-# Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/
+# ?
-# The word trust is often used in IT security. How would you say application security applies to the trust relationship between customers and vendors, or endusers and developers if you will?
+# ?
-# Joshua Corman, David Rice, and Jeff Williams released the Rugged Software Manifesto in February. Does it stick to software developers or is it just an appsec utopia? Do developers really care if their software is rugged or not?
+# ?
-# What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to code with security knowledge in mind?
+# ?

@@ Line 11: / Line 11: @@
 # The word trust is often used in IT security. How would you say application security applies to the trust relationship between customers and vendors, or endusers and developers if you will?
 # Joshua Corman, David Rice, and Jeff Williams released the Rugged Software Manifesto in February. Does it stick to software developers or is it just an appsec utopia? Do developers really care if their software is rugged or not?
-# What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to both with security knowledge?
+# What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to code with security knowledge in mind?

@@ Line 7: / Line 7: @@
 '''Next Recording&nbsp;: May 18, 2010 9pm Eastern'''
-) OWASP is focusing on outreach for 2010, but what is the best way to reach out? How should appsec professionals reach software developers?
+# OWASP is focusing on outreach for 2010, but what is the best way to reach out? How should appsec professionals reach software developers?
-) Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/
+# Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/
-) The word trust is often used in IT security. How would you say application security applies to the trust relationship between customers and vendors, or endusers and developers if you will?
+# The word trust is often used in IT security. How would you say application security applies to the trust relationship between customers and vendors, or endusers and developers if you will?
-) Joshua Corman, David Rice, and Jeff Williams released the Rugged Software Manifesto in February. Does it stick to software developers or is it just an appsec utopia? Do developers really care if their software is rugged or not?
+# Joshua Corman, David Rice, and Jeff Williams released the Rugged Software Manifesto in February. Does it stick to software developers or is it just an appsec utopia? Do developers really care if their software is rugged or not?
-) What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to both with security knowledge?
+# What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to both with security knowledge?

← Older revision		Revision as of 23:08, 18 May 2010
Line 7:		Line 7:
	'''Next Recording : May 18, 2010 9pm Eastern'''		'''Next Recording : May 18, 2010 9pm Eastern'''

−	1) Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/	+	1) OWASP is focusing on outreach for 2010, but what is the best way to reach out? How should appsec professionals reach software developers?
		+	2) Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/
		+	3) The word trust is often used in IT security. How would you say application security applies to the trust relationship between customers and vendors, or endusers and developers if you will?
		+	4) Joshua Corman, David Rice, and Jeff Williams released the Rugged Software Manifesto in February. Does it stick to software developers or is it just an appsec utopia? Do developers really care if their software is rugged or not?
		+	5) What do you think, do we need to educate developers about security - or just make their frameworks more secure so developers do not need to both with security knowledge?

← Older revision		Revision as of 19:36, 18 May 2010
Line 5:		Line 5:
	== OWASP Podcast Roundtable ==		== OWASP Podcast Roundtable ==

−	'''Next Recording : ~~April 20~~, 2010 9pm Eastern'''	+	'''Next Recording : May 18, 2010 9pm Eastern'''
		+
		+	1) Panopticlick project at the EFF. You are uniquely identifiable by your browser characteristics, even if you use an anonymous proxy. Some interesting data https://panopticlick.eff.org/

← Older revision		Revision as of 03:30, 6 April 2010
Line 5:		Line 5:
	== OWASP Podcast Roundtable ==		== OWASP Podcast Roundtable ==

−	'''Next Recording : April 20, 2010 9m Eastern'''	+	'''Next Recording : April 20, 2010 9pm Eastern'''

← Older revision		Revision as of 02:58, 17 March 2010
Line 5:		Line 5:
	== OWASP Podcast Roundtable ==		== OWASP Podcast Roundtable ==

−	'''Next Recording : ~~February 16~~, 2010'''	+	'''Next Recording : April 20, 2010 9m Eastern'''
−
−	~~==== Listener Question : public file uploads ====~~
−
−	Paul Wescott Asks: "I’d really like to see something about how to securely allow public file uploads to web sites. What are the risks, how can they be avoided. Discussion around using whitelists, file size limits, file type checking (extension, mime, magic number checking), handling Office 2007 (archive files), rendering uploaded files as pdfs, virus checking, poison null injection, renaming uploaded files, directory file permissions, etc…"
−
−	~~==== US Cybersecurity Bill ====~~
−
−	~~[http://www.theregister.co.uk/2010/02/04/house_cybersecurity_bill/ http://www.theregister.co.uk/2010/02/04/house_cybersecurity_bill/]~~
−
−	~~The US House of Representatives has overwhelmingly passed a bill that would direct almost $400m toward research designed to shore up the nation's cybersecurity defenses.~~
−
−	~~The Cybersecurity Enhancement Act would authorize $108.7m over five years to establish a cybersecurity scholarship program. In return, students would serve in federal government posts upon graduation.~~
−
−	~~==== A few Billion Lines of Code Later ====~~
−
−	~~[http://cacm.acm.org/magazines/2010/2/69354-a-few-billion-lines-of-code-later/fulltext http://cacm.acm.org/magazines/2010/2/69354-a-few-billion-lines-of-code-later/fulltext]~~
−
−	While we've focused on some of the less-pleasant experiences in the commercialization of bug-finding products, two positive experiences trump them all. First, selling a static tool has become dramatically easier in recent years. There has been a seismic shift in terms of the average programmer "getting it." When you say you have a static bug-finding tool, the response is no longer "Huh?" or "Lint? Yuck." This shift seems due to static bug finders being in wider use, giving rise to nice networking effects. The person you talk to likely knows someone using such a tool, has a competitor that uses it, or has been in a company that used it.
−
−	Moreover, while seemingly vacuous tautologies have had a negative effect on technical development, a nice balancing empirical tautology holds that bug finding is worthwhile for anyone with an effective tool. If you can find code, and the checked system is big enough, and you can compile (enough of) it, then you will always find serious errors. This appears to be a law. We encourage readers to exploit it.
−
−	~~==== Microsoft's 1999 "Secure Windows Initiative" ====~~
−
−	~~Proof that Microsoft's 1999 "Secure Windows Initiative" and 2002 "Trustworthy Computing" have provided immutably secure software:~~
−
−	~~===== New IE zero-day : IE Flaw Allows File Access =====~~
−	~~(February 3 & 4, 2010)~~
−
−	Microsoft has issued a security advisory warning of a vulnerability in Internet Explorer (IE) that affects users running Windows XP or who have disabled IE Protected Mode. The vulnerability essentially turns vulnerable computers into "public file server[s];" attackers can exploit the flaw to access files with known filenames and locations if they trick users into visiting specially-crafted websites. The vulnerability is the result of incorrectly rendering local files in the browser. It affects IE 5.01 and IE 6 on Windows 2000; IE 6 on Windows 2000 SP 4; and IE 6, 7 & 8 on Windows XP and Windows Server 2003.
−	~~http://www.microsoft.com/technet/security/advisory/980088.mspx~~
−	~~http://www.theregister.co.uk/2010/02/04/ms_browser_bug/~~
−	~~http://www.computerworld.com/s/article/9151838/IE_flaw_gives_hackers_access_to_user_files_Microsoft_says?taxonomyId=17~~
−
−	~~===== Google to Drop IE 6 Support =====~~
−
−	~~(February 3, 2010)~~
−	Google has announced that as of March 1, 2010, its applications will no longer support Internet Explorer 6 (IE 6). Although Google did not say so directly, the decision may have been influenced by recently disclosed attacks against Google and other US companies that exploited a vulnerability in IE 6. The attacks prompted public warnings in Germany, France and Australia against using IE 6.
−	~~http://www.msnbc.msn.com/id/35219388/ns/technology_and_science-security/~~

← Older revision		Revision as of 11:31, 10 February 2010
Line 6:		Line 6:

	'''Next Recording : February 16, 2010'''		'''Next Recording : February 16, 2010'''
		+
		+	==== Listener Question : public file uploads ====
		+
		+	Paul Wescott Asks: "I’d really like to see something about how to securely allow public file uploads to web sites. What are the risks, how can they be avoided. Discussion around using whitelists, file size limits, file type checking (extension, mime, magic number checking), handling Office 2007 (archive files), rendering uploaded files as pdfs, virus checking, poison null injection, renaming uploaded files, directory file permissions, etc…"

	==== US Cybersecurity Bill ====		==== US Cybersecurity Bill ====

@@ Line 14: / Line 14: @@
 The Cybersecurity Enhancement Act would authorize $108.7m over five years to establish a cybersecurity scholarship program. In return, students would serve in federal government posts upon graduation.
 ==== Microsoft's 1999 "Secure Windows Initiative" ====
 Proof that Microsoft's 1999 "Secure Windows Initiative" and 2002 "Trustworthy Computing" have provided immutably secure software:
 ===== New IE zero-day : IE Flaw Allows File Access =====

Podcast News - Revision history

Jmanico: /* OWASP Podcast Roundtable */

Jmanico: /* OWASP Podcast Roundtable */

Jmanico at 00:56, 19 May 2010

Jmanico at 23:08, 18 May 2010

Jmanico at 23:08, 18 May 2010

Jmanico at 19:36, 18 May 2010

Jmanico at 03:30, 6 April 2010

Jmanico: Replaced content with ''''OWASP Podcast News''' OWASP NEWS 2010 == OWASP Podcast Roundtable == '''Next Recording : April 20, 2010 9m Eastern''''

Jmanico at 11:31, 10 February 2010

Jmanico at 09:18, 9 February 2010

Jmanico: Replaced content with ''''OWASP Podcast News''' OWASP NEWS 2010
== OWASP Podcast Roundtable == '''Next Recording : April 20, 2010 9m Eastern''''