This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Template:Application Security News"
From OWASP
| Line 1: | Line 1: | ||
<!-- please add stories to the main Application Security News page --> | <!-- please add stories to the main Application Security News page --> | ||
| + | |||
| + | ; '''Dec 10 - [http://news.com.com/Security+Bites+Podcast+MySpace,+Apple+in+patch+snafu/2324-12640_3-6142120.html MySpace and Apple mess]''' | ||
| + | : MySpace and Apple show how NOT to handle security incidents (see also [http://blog.washingtonpost.com/securityfix/2006/12/how_not_to_distribute_security_1.html How Not to Distribute Security Patches]) | ||
| + | ; '''Nov 28 - [[OWASP JBroFuzz|JBroFuzz 0.3 Released]]''' | ||
| + | : This version adds a more stable core, length updating for fuzzed POST requests and allows you to specify your own fuzz vectors in a separate file. | ||
; '''Dec 2 - [http://blogs.oracle.com/security/2006/11/27#a39 Oracle blames security researchers]''' | ; '''Dec 2 - [http://blogs.oracle.com/security/2006/11/27#a39 Oracle blames security researchers]''' | ||
Revision as of 16:22, 11 December 2006
- Dec 10 - MySpace and Apple mess
- MySpace and Apple show how NOT to handle security incidents (see also How Not to Distribute Security Patches)
- Nov 28 - JBroFuzz 0.3 Released
- This version adds a more stable core, length updating for fuzzed POST requests and allows you to specify your own fuzz vectors in a separate file.
- Dec 2 - Oracle blames security researchers
- "We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the Oracle Software Security Assurance program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?
- Nov 30 - What? Ajax is secure now?
- Nice article making the point that Ajax is not necessarily insecure. Read it carefully folks - it isn't easy to build a secure Ajax application, just possible. And remember that although the article doesn't mention it, Ajax apps use new parsers and interpreters that haven't been very well tested for security.
- Nov 30 - Democracy Schlemocracy
- A paper from NIST argues that touchscreen voting machines are "more vulnerable to undetected programming errors or malicious code" and that "potentially, a single programmer could 'rig' a major election."
- Nov 28 - Litchfield slams Oracle lack of SDL
- David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is gloating a little.
- Nov 28 - Foreign software - threat or xenophobia?
- Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.
