What do you want OWASP to be - Revision history

Fmavituna at 11:32, 13 November 2007

2007-11-13T11:32:42Z

Thesp0nge: /* PROJECTS */

2007-11-09T15:48:36Z

‎PROJECTS

Antti: /* Helsinki, Finland */

2007-11-09T15:22:29Z

‎Helsinki, Finland

Antti: /* Helsinki, Finland */

2007-11-09T15:21:19Z

‎Helsinki, Finland

Antti: /* Helsinki, Finland */

2007-11-09T15:20:03Z

‎Helsinki, Finland

Brennan at 13:59, 9 November 2007

2007-11-09T13:59:18Z

Sdeleersnyder: /* PROJECTS */

2007-11-07T19:31:06Z

‎PROJECTS

Sdeleersnyder: /* CHAPTERS */

2007-11-07T19:29:24Z

‎CHAPTERS

Stephendv: /* PROJECTS */

2007-11-07T18:03:45Z

‎PROJECTS

Stephendv: /* PROJECTS */

2007-11-07T11:27:16Z

‎PROJECTS

← Older revision		Revision as of 11:32, 13 November 2007
Line 84:		Line 84:

	* OWASP should be more on the hands of developers than security people. Also more alignment with other domains of security would be beneficial for getting the message through in companies.		* OWASP should be more on the hands of developers than security people. Also more alignment with other domains of security would be beneficial for getting the message through in companies.
		+
		+
		+
		+	====Turkey====
		+
		+	* Certification is not required. It requires lots of resources and it’s way too commercial.
		+	* Apache Foundation is a good example but also we believe OWASP should not turn into a software development based organization.
		+	*–
		+	* Only “members” should pay money, not project leaders and chapter leaders. Requesting money from chapter leaders or project leader is unacceptable. Since they already spent lots of their time for OWASP.
		+	* Current state of OWASP is quite all right. Making it more formal potentially not going to work and even in this state lots of chapters and chapter leaders are not active enough. Getting more formal is not going to help it either.
		+	* There are some recommendations:
		+	** Generally we want changes, it’s good.
		+	** Active chapters should be supported more and we should start to eliminate inactive chapters.
		+

	===PROJECTS===		===PROJECTS===

← Older revision		Revision as of 15:48, 9 November 2007
Line 109:		Line 109:
	* Charge for vendor attendance at conferences		* Charge for vendor attendance at conferences
	* I like the current idea of membership which provides the benefit for commercial license of OWASP projects. I think that's a good idea to continue pushing, especially as the OWASP project keep growing.		* I like the current idea of membership which provides the benefit for commercial license of OWASP projects. I think that's a good idea to continue pushing, especially as the OWASP project keep growing.
		+
		+	====Orizon====
		+	I think that as long as Owasp growns up it must follow other Opensource community approach. I mean that having a set of projects and creating like Apache, Debian, OpenBSD does is the right path.
		+
		+	In my opinion, Owasp doesn't have to become a certification authority instead it could offer security reviews on demand.
		+	A fee could be applied to commercial projects and the collected fees could be used in events such as Spoc, Aoc and conferences, meanwhile these services would be free of charge for opensource projects.
		+
		+	I think vendors have to pay for being sponsored in Owasp site and Owasp conferences and project and chapter leaders have to be paying owasp member.
		+
		+	Of course, just my 2 cents

@@ Line 61: / Line 61: @@
 Nov-9 Compiled Answers from mailing list members
-A certifying and CBK type pseudo-company like (ISC)2?
+''A certifying and CBK type pseudo-company like (ISC)2?''
 * No but maybe it should be wise to seek some co-operation with certifying organizations
-An open source project organized along the lines of Debian, Apache, or a similar group that owns a set of projects?
+''An open source project organized along the lines of Debian, Apache, or a similar group that owns a set of projects?''
 * Open source projects should be part of OWASP but other activities are needed.
-Does OWASP want to certify apps, testers, both or none? (I've seen all POV advocated)
+''Does OWASP want to certify apps, testers, both or none? (I've seen all POV advocated)''
 * Rather not
-Who will be required to pay what kind of dues, if any?
+''Who will be required to pay what kind of dues, if any?''
 * Current system is working.
-How formal of an organization will OWASP become?
+''How formal of an organization will OWASP become?''
-Some increase in formality is perhaps needed to increase visibility. Independence and openess should be retained.
+* Some increase in formality is perhaps needed to increase visibility. Independence and openess should be retained.
-Other?
+''Other?''
 * OWASP should be more on the hands of developers than security people. Also more alignment with other domains of security would be beneficial for getting the message through in companies.

← Older revision		Revision as of 15:21, 9 November 2007
Line 60:		Line 60:

	Nov-9 Compiled Answers from mailing list members		Nov-9 Compiled Answers from mailing list members
		+
	A certifying and CBK type pseudo-company like (ISC)2?		A certifying and CBK type pseudo-company like (ISC)2?

@@ Line 58: / Line 58: @@
 ====Helsinki, Finland====
 Nov-1 - Waiting for comments from mailing list members
 ===PROJECTS===

@@ Line 30: / Line 30: @@
 ====NY/NJ Metro====
-/31 - Under membership and local chapter leaders review pending comment
+* A certifying and CBK type pseudo-company like (ISC)2? - That is one area to explore or partner with existing SANS as a example.
 ====Belgium====

@@ Line 50: / Line 50: @@
 ===PROJECTS===
-'''Education (Seba)'''
+====Education====
 * I do not think OWASP is the right place to perform certifications. It makes us ‘lawmaker’ and judge at the same time. What OWASP could/should do is propose a certification scheme / criteria input for other parties. This is even a project: http://www.owasp.org/index.php/SpoC_007_-_The_OWASP_Web_Security_Certification_Framework ?
 * Organization wise, I like the [http://www.apache.org/foundation/how-it-works.html http://www.apache.org/foundation/how-it-works.html]. The organization should not be the goal: it is there to support achieving the goals. My vote for Apache like organization: +1
@@ Line 57: / Line 58: @@
 * Some projects and chapters will ‘die’: how do we detect this and make this visible? It should be clear for OWASP users/visitors what the project / chapter status is.Define a few measurable criteria that taken together provide a good insight in the project/chapter status.
-'''Java Project'''
+====Java Project====
 * The Top 10 has been widely misused and misquoted as a Web Application Security Standard.  This obviously indicates that a standard is what the industry is looking for.  Re-working the sec. dev. guide and the top 10 project to produce a set of web app standards would be an excellent start.  But, I don't think it is OWASP's role to verify compliance with, or to certify applications/products with these standards - as that would open a huge can of worms and require considerable changes to how OWASP is funded and staffed.
 * The same approach as above could be applied to other aspects of app security, such as secure development.  I.e. create the standards formally and provide resources around their implementation, but don't actually certify applications.

← Older revision		Revision as of 11:27, 7 November 2007
Line 46:		Line 46:
	* Over-regulation kills creativity and scares volunteers away. We should keep it very easy for people to start new projects or new chapters. When the projects/chapters grow, the contributing people and project leader(s) can regulate themselves if it is necessary to guarantee continuity. By providing some practical how-to’s and working examples instead of rules, OWASP provides the framework for successful projects/chapters.		* Over-regulation kills creativity and scares volunteers away. We should keep it very easy for people to start new projects or new chapters. When the projects/chapters grow, the contributing people and project leader(s) can regulate themselves if it is necessary to guarantee continuity. By providing some practical how-to’s and working examples instead of rules, OWASP provides the framework for successful projects/chapters.
	* Some projects and chapters will ‘die’: how do we detect this and make this visible? It should be clear for OWASP users/visitors what the project / chapter status is.Define a few measurable criteria that taken together provide a good insight in the project/chapter status.		* Some projects and chapters will ‘die’: how do we detect this and make this visible? It should be clear for OWASP users/visitors what the project / chapter status is.Define a few measurable criteria that taken together provide a good insight in the project/chapter status.
		+
		+	'''Java Project'''
		+	* No response from list members, the following is from Stephen de Vries (project lead)
		+	* The Top 10 has been widely misused and misquoted as a Web Application Security Standard. This obviously indicates that a standard is what the industry is looking for. Re-working the sec. dev. guide and the top 10 project to produce a set of web app standards would be an excellent start. But, I don't think it is OWASP's role to verify compliance with, or to certify applications/products with these standards - as that would open a huge can of worms and require considerable changes to how OWASP is funded and staffed.
		+	* The same approach as above could be applied to other aspects of app security, such as secure development. I.e. create the standards formally and provide resources around their implementation, but don't actually certify anything.