This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Projects/Reports/2013-20-12"

From OWASP
Jump to: navigation, search
(Created page with "=PROJECT METRICS= <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">link=</div> ==Metrics== *'''[https://docs.googl...")
 
 
(8 intermediate revisions by the same user not shown)
Line 7: Line 7:
 
*'''[https://docs.google.com/spreadsheet/ccc?key=0AllOCxlYdf1AdHBGbDhXQko4akJoVnMtMUpvZnJucVE&usp=sharing Project Numbers]'''
 
*'''[https://docs.google.com/spreadsheet/ccc?key=0AllOCxlYdf1AdHBGbDhXQko4akJoVnMtMUpvZnJucVE&usp=sharing Project Numbers]'''
  
*Active Projects: 153
+
*Active Projects: 155
 
*Inactive Projects: 102
 
*Inactive Projects: 102
*Incubator Projects: 120
+
*Incubator Projects: 122
 
*Lab Projects:18
 
*Lab Projects:18
 
*Flagship Projects: 15
 
*Flagship Projects: 15
  
==[https://docs.google.com/spreadsheet/ccc?key=0Amvv_7Gz8Z7TdHZfWGhHZ0Z4UFFwZU42djBXcVVLSlE&usp=sharing New Project Applications]==
+
==New OWASP Projects==
*ISO/IEC 27034 Application Security Controls
+
*[https://www.owasp.org/index.php/OWASP_ISO_IEC_27034_Application_Security_Controls_Project ISO/IEC 27034 Application Security Controls]
*NINJA PingU
+
*[https://www.owasp.org/index.php/OWASP_NINJA_PingU_Project NINJA PingU]
  
 
==Projects Under Review==
 
==Projects Under Review==
Line 30: Line 30:
  
  
*'''Projects: 2014 Goals'''
+
*'''Projects and Women in AppSec at AppSec APAC 2014'''
**I am currently working on putting together a 2014 Project Goals document.
+
**I worked on trying to get more OWASP Projects represented at the AppSec APAC conference taking place in Tokyo, Japan in 2014.
**This will be the roadmap of goals and operational projects that I will focus on for 2014.  
+
**Our projects have been under represented in the region, and this is why I felt this was an important initiative to take on this week.
**I plan to send this out to the Leaders for feedback when it is complete.  
+
**I spoke to Rio and Laura about it, and I drafted up an announcement to try and get more project leaders to apply to the CFP.  
**Below are my high level goals for the year.  
+
**I hope the selection team chooses at least 3 project talks for the event.
**Goal 1: Continue developing the Operational Projects Platform into a more self sufficient platform.
+
**Additionally, I spoke to the planning team about having Women in AppSec at the conference.  
**Goal 2: Bring more Project Leaders together: Summits, AppSecs.
+
**I put together some additional information for them, and sent it over to the team.  
**Goal 3: Solidify the Projects Review Process: Pragmatic method of doing project reviews.
+
**I hope they agree to have the program run at the conference.
**Goal 4: Design a more sustainable revenue stream for Projects.
 
**I plan on having this document completed by the end of December.  
 
  
*'''Post Project Summit Report'''
+
*'''Apple Developer Program'''
**I continue to gather information for the Post Project Summit Report.
+
**I spent some time researching how to best make this happen for our leaders.  
**I am using the 2011 Project Summit report as a rough outline to follow for the 2013 report.
+
**I contacted Apple, and I am glad to say that they were very helpful.
**This will be completed and shared to the community by the end of the month.  
+
**Making this available is going to cost the foundation $99 a year.
 +
**Thankfully, I have gotten our project budget approved, and I was able to purchase this membership for us.
 +
**I had to apply for a D-U-N-S number for the organization, and I am waiting for approval on that.
 +
**After I get this information, I can start adding people to the developer program so we can start offering our applications on the Apple Appstore.  
  
*'''2014 Project Summit'''
+
*'''Documentation Development'''
**I continue to work on seeking out sponsorship opportunities for the 2014 Project Summit.
+
**I continue to work on finishing my reports/documents for the year.  
**More to come after the holidays.  
+
**Below is a list of the documents I am putting together.
 +
**Post 2013 Summit Report
 +
**Q4 DHS Guidebook Report
 +
**2014 Project Leader Handbook
 +
**2014 Projects Plan
 +
**2014 Projects Fundraising Plan
 +
**Project Page content update
  
*'''Project Guidelines and Policies'''
+
*'''[https://www.owasp.org/index.php/Projects/Internships/Grants_and_Fundraising_Intern/Kait_Disney_Leugers Grants and Fundraising Intern: 1st Proposal]'''
**We received approval for the project guideline and policy documents from the Board of Directors this week.
+
**Over the past two weeks, Kait has been working on putting together a mock up grant proposal, budget, and project plan.
**The links below will take you to each document.  
+
**It is the first time Kait has ever put something like this together.
**I will begin implementing these at the start of 2014.  
+
**I asked her to put together a mock up proposal and project plan for a book development project using our Security Principles Project for the content.
**[https://www.owasp.org/index.php/Grant_Spending_Policy Grant Spending Policy]
+
**The learning curve was high, but I am glad to report that she has successfully completed the proposal.
**[https://www.owasp.org/index.php/Project_Spending_Policy Project Spending Policy]
+
**She is now finishing off the mock project plan.
**[https://www.owasp.org/index.php/Project_Sponsorship_Operational_Guidelines Project Sponsorship Operational Guidelines]
+
**We completed this exercise as training for next year when Kait will help us put together a real grant proposal for the Blackstone Foundation.  
 +
 
 +
*'''ESAPI Hackathon'''
 +
**For the past two weeks, Chris, Kevin, and I have been working on the logistics of the ESAPI Hackathon.
 +
**The aim of the Hackathon is to encourage contributions to the ESAPI Project in several key areas.
 +
**There will be 1st, 2nd, 3rd, and 4th place prizes awarded to the best 4 contributions.  
 +
**The Hackathon starts today, December 20th 2013 and ends January 20th 2014.
 +
**For more information, visit the [https://www.owasp.org/index.php/Projects/ESAPI_Hackathon Guidelines page] or e-mail Chris, Kevin, or me directly.
  
 
*'''Daily Project based queries and requests'''
 
*'''Daily Project based queries and requests'''
Line 143: Line 157:
 
=PROJECT ANNOUNCEMENTS=
 
=PROJECT ANNOUNCEMENTS=
  
==Message from OWASP Podcast Project Leader, Mark Miller==
+
==Message from OWASP ESAPI Project Leaders, Kevin Wall & Chris Schmidt==
 +
 
 +
'''ESAPI Hackathon / Bug Bash Contest'''
 +
 
 +
Our very own OWASP ESAPI Project Leaders, Chris Schmidt and Kevin Wall, are hosting the OWASP ESAPI Hackathon starting on Friday, December 20th 2013 and ending on Monday, January 20th 2014. The aim of the ESAPI Hackathon is to encourage contributors to Implement modular security controls, fix existing bugs, provide reference implementations, and improve user documentation.
 +
 
 +
Each participant will be evaluated by four judges, and prizes will be awarded to those who provide the most valuable contribution to the project. Here are the list of prizes:
 +
 
 +
*First place: Apple iPad Mini and an ESAPI T-shirt
 +
 
 +
*Second place: $30.00 (USD) Amazon Gift Card and an ESAPI T-shirt
 +
 
 +
*Third place: $20.00 (USD) Amazon Gift Card and an ESAPI T-shirt
 +
 
 +
*Fourth place: An ESAPI T-shirt
 +
 
 +
We encourage all those who can participate to contribute to the OWASP ESAPI Project. Please view the [https://www.owasp.org/index.php/Projects/ESAPI_Hackathon contributing guidelines] wiki page for more detailed information on participant expectations. If you still require more assistance, please contact either, Kevin Wall ([email protected]) or Chris Schmidt ([email protected]).
 +
 
 +
[https://docs.google.com/a/owasp.org/file/d/0B3Yc2oc1Z9n5bzNXU2xMLVBCbE0/edit Download a pdf version of the guidelines here.]
  
We have three new interviews posted on the OWASP Podcast site. See below:
+
==Message from OWASP ZAP Project Leader, Simon Bennetts==
  
* <b>[http://trustedsoftwarealliance.com/2013/12/10/appsec-usa-2013-michael-coates-on-the-appsensor-project/ AppSec USA 2013 – Michael Coates on the AppSensor Project]</b>
+
I'm delighted to tell you that ZAP came top of the Toolswatch Best Security Tool of 2013:
* <b>[http://trustedsoftwarealliance.com/2013/12/02/the-owasp-application-security-ciso-guide-with-marco-morana-and-tobias-gondrom/ The OWASP Application Security CISO Guide with Marco Morana and Tobias Gondrom]</b>
+
http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/
* <b>[http://trustedsoftwarealliance.com/2013/11/27/the-purpose-of-owasp-an-interview-with-co-founder-dennis-groves/ The Purpose of OWASP, an Interview with Co-Founder Dennis Groves]</b>
 
  
==Message from Project Leader, Jonathan Marcil: OWASP Media Project==
+
Also congrats to OWASP Xenotix and OWASP O-Saft who also made the top 10
  
Hi leaders,
+
Thank you to everyone who voted for ZAP and other OWASP projects!
  
I'm glad to announce that we are now close to 10,000 views on YouTube!
+
==Message from OWASP Media Project Leader, Jonathan Marcil==
  
We have 43 online talks for 32 hours of content from AppSecUSA 2013. Thank you to all who contributed content during the conference.  
+
TLDR; 11k views and 450 subscribers!
 +
 
 +
As you all know, we did a lot of work at last AppSecUSA in order to get 43 videos online for 32 hours for the talks, and also 6 videos from the Project Summit for 2.5 hours of content. All of that was online live for the summit and 24h after for the first talks, then the rest was published in one week the week just after the conference.
 +
 
 +
I managed to get the Project Summit recording by myself, but for the talks, it wouldn't have been possible without the support from AppSecUSA who used their resources to help us with that. To make it clear, we had a professional firm that recorded and uploaded the videos into YouTube. The only work I did on my side was to organize them into a playlist and publish them periodically.
 +
 
 +
 
 +
'''AppSecUSA 2013 playlist'''
  
Playlist, all the recorded talks are available on this page:
 
 
https://www.youtube.com/playlist?list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU
 
https://www.youtube.com/playlist?list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU
Short URL: http://sl.owasp.org/usa13_videos
 
  
YouTube, people will be able to see AppSecUSA featured contents on:
 
https://www.youtube.com/owaspglobal
 
  
Link directly to the whole playlist beginning with the first talk:
+
'''OWASP Projects Summit 2013 playlist'''
https://www.youtube.com/watch?v=pYFtLA2yTR8&list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU&index=1
+
 
 +
https://www.youtube.com/playlist?list=PLpr-xdpM8wG80aEXBZV9lk5nkEf3q-jaz
 +
 
 +
 
 +
On the fail part, we missed some of the important talks, such as the keynote because it was at the very beginning and also Jeremiah's talk that was a hit, but we achieved 77% publishing within one week. One thing that actually wasn't real good in the short run was that the title didn't contains "OWASP" nor "AppSecUSA". That will probably hurt us in the long run and I might decide to change titles if we don't come out first in search results (as for now we don't https://www.youtube.com/results?search_query=appsecusa).
 +
 
 +
We actually plan to do the same thing for AppSecUSA 2014 and I'll be in touch with the team in order to prepare in advance. They want to have live streaming and be as fast.
 +
 
 +
One thing that is sure, is that we need more people in OWASP Media project. The good news is, unlike most other OWASP projects, you don't need to be an application security specialist to be really useful, you just need to be motivated to share knowledge with the world. I think that
 +
 
 +
Now for some stats, covering from Nov 17 2013 to Dec 19 2013.
 +
 
 +
We are at 11,289 views and 79,874 of estimated watched minutes.
 +
 
 +
Let me remind you that before that, we where at 245 views for 1,312 minutes, mainly from the OWASP Global Meetings live hangouts.
 +
 
 +
We are at 438 subscribers and we gained 442 of them with AppSecUSA efforts. We lost 4 hence the numbers.
 +
 
 +
The average view duration is 7:04 minutes, so 16% of the total times of videos. Since we have mostly one hour long videos, this is normal and in fact is probably a great number.
 +
 
 +
 
 +
'''Notable popular videos are:'''
 +
 
 +
 
 +
'''OWASP Zed Attack Proxy - Simon Bennetts'''
 +
 
 +
2,126 views 17,712 minutes watched 8:19 avg
 +
 
 +
http://youtu.be/pYFtLA2yTR8
 +
 
 +
 
 +
'''Top Ten Proactive Controls - Jim Manico'''
 +
 
 +
845 views 8,293 minutes watched 9:48 avg
 +
 
 +
http://youtu.be/Cg5dN8Pyn_c
 +
 
 +
 
 +
'''What You Didn't Know About XML External Entities Attacks - Timothy Morgan'''
  
 +
790 views 5,857 minutes wathced 7:24 avg
  
If you want to help, go watch and "Like" the ones you prefer, share them
+
http://youtu.be/eHSNT8vWLfc
and subscribe to the channel.
 
  
==Message from OWASP Ops Team==
 
  
The last 2013 OWASP Global Connector is out now. You can find it on the OWASP Blog: http://owasp.blogspot.com/2013/12/owasp-global-connector.html
+
From what I saw, Simon's used his network to publish his videos and I helped him by putting it as the trailer for the channel for a while. Same with Jim but with less engagement from his network (less comments). Timothy's was published from an external news website and got some views trough that.
  
==Message from Project Leader, Larry Conklin: OWASP Code Review Guide==
 
  
Eoin and I had the great pleasure to present the Code Review Guide 2.0 project at APPSECUSA2013.  I want to thank everyone involved in the project and to give you my personal thank you. It was very much an honor to talk about our success and hard work. We are not done but I feel we surprised a lot of people with how much work a few dedicated volunteers have done.
+
'''Finally, the following countries were the top viewership:'''
 +
*United States 37%
 +
*Canada 12%
 +
*India 4.5%
 +
*United Kingdom 4.0%
  
Please don't loose sight of the end but we are getting closer. Below is our wiki pages loaded into a word doc. Yes, it is rough, but we made sure everyone knew it was an early release document. Also my ppt is included attached.
 
  
Larry Conklin, CISSP
+
I must point out that we were watched in 114 countries. That's amazing and shows the power of OWASP worldwide. With that big first step done, we will continue with our roadmap https://www.owasp.org/index.php/OWASP_Media_Project#tab=Roadmap and the next thing on the table is to present a Webinar on how to use Google Hangout and try to setup the next webinars within our YouTube channel. I also want to shake things with the Chapters by incite them to use Hangout and YouTube in order to get more into the Global Chapter Meetings Project. This has great potential but is not really used right now for helping smaller chapters to get contents. And and last, but not least, we are officially on the www.owasp.org homepage and we can control what is shown trough that small playlist: https://www.youtube.com/playlist?list=PLpr-xdpM8wG9g8l21uzfgyx4xAJ9aY7e7
  
*[https://www.owasp.org/images/f/fa/Code_Review_Guide_Pre-AlphaV2_%281%29.pdf Code Review Guide: ALPHA]
+
Thanks to all who contributed and helped with OWASP Media Project,
  
*[https://www.owasp.org/images/f/f7/APPSEC2013-CRV2.pdf Code Review Guide AppSec USA 2013 Presentation]
+
See you next year!
  
  
Line 197: Line 270:
 
'''View [https://soundcloud.com/owasp-podcast All Available Broadcasts] or choose one of our new single episodes below:'''
 
'''View [https://soundcloud.com/owasp-podcast All Available Broadcasts] or choose one of our new single episodes below:'''
  
* <b>[http://trustedsoftwarealliance.com/2013/12/10/appsec-usa-2013-michael-coates-on-the-appsensor-project/ AppSec USA 2013 – Michael Coates on the AppSensor Project]</b>
+
* <b>[http://trustedsoftwarealliance.com/2013/12/19/appsec-usa-2013-abbas-naderi-and-the-owasp-php-security-project/ AppSec USA 2013 – Abbas Naderi and the OWASP PHP Security Project]</b>
* <b>[http://trustedsoftwarealliance.com/2013/12/02/the-owasp-application-security-ciso-guide-with-marco-morana-and-tobias-gondrom/ The OWASP Application Security CISO Guide with Marco Morana and Tobias Gondrom]</b>
+
* <b>[http://trustedsoftwarealliance.com/2013/12/13/appsec-usa-2013-zed-attack-proxy-project-with-simon-bennetts-interview/ AppSec USA 2013: Zed Attack Proxy Project with Simon Bennetts]</b>
* <b>[http://trustedsoftwarealliance.com/2013/11/27/the-purpose-of-owasp-an-interview-with-co-founder-dennis-groves/ The Purpose of OWASP, an Interview with Co-Founder Dennis Groves]</b>
 
  
  
 
'''Upcoming interviews'''
 
'''Upcoming interviews'''
 
* Kevin Wall (ESAPI)
 
* Kevin Wall (ESAPI)
* Abbas Naderi (RBAC Project, PHP Security Project)
 
 
* Jim Manico (OWASP Podcast Series)
 
* Jim Manico (OWASP Podcast Series)
 
* Larry Conklin (Code Review Project)
 
* Larry Conklin (Code Review Project)
 
* Andrew van der Stock (Pro-Active Controls)
 
* Andrew van der Stock (Pro-Active Controls)
* Simon Bennetts
 
 
* Andrew van der Stock
 
* Andrew van der Stock
 
* Larry Conklin
 
* Larry Conklin

Latest revision as of 21:00, 20 December 2013

OWASP Project Header.jpg

Metrics

  • Active Projects: 155
  • Inactive Projects: 102
  • Incubator Projects: 122
  • Lab Projects:18
  • Flagship Projects: 15

New OWASP Projects

Projects Under Review


  • Projects and Women in AppSec at AppSec APAC 2014
    • I worked on trying to get more OWASP Projects represented at the AppSec APAC conference taking place in Tokyo, Japan in 2014.
    • Our projects have been under represented in the region, and this is why I felt this was an important initiative to take on this week.
    • I spoke to Rio and Laura about it, and I drafted up an announcement to try and get more project leaders to apply to the CFP.
    • I hope the selection team chooses at least 3 project talks for the event.
    • Additionally, I spoke to the planning team about having Women in AppSec at the conference.
    • I put together some additional information for them, and sent it over to the team.
    • I hope they agree to have the program run at the conference.
  • Apple Developer Program
    • I spent some time researching how to best make this happen for our leaders.
    • I contacted Apple, and I am glad to say that they were very helpful.
    • Making this available is going to cost the foundation $99 a year.
    • Thankfully, I have gotten our project budget approved, and I was able to purchase this membership for us.
    • I had to apply for a D-U-N-S number for the organization, and I am waiting for approval on that.
    • After I get this information, I can start adding people to the developer program so we can start offering our applications on the Apple Appstore.
  • Documentation Development
    • I continue to work on finishing my reports/documents for the year.
    • Below is a list of the documents I am putting together.
    • Post 2013 Summit Report
    • Q4 DHS Guidebook Report
    • 2014 Project Leader Handbook
    • 2014 Projects Plan
    • 2014 Projects Fundraising Plan
    • Project Page content update
  • Grants and Fundraising Intern: 1st Proposal
    • Over the past two weeks, Kait has been working on putting together a mock up grant proposal, budget, and project plan.
    • It is the first time Kait has ever put something like this together.
    • I asked her to put together a mock up proposal and project plan for a book development project using our Security Principles Project for the content.
    • The learning curve was high, but I am glad to report that she has successfully completed the proposal.
    • She is now finishing off the mock project plan.
    • We completed this exercise as training for next year when Kait will help us put together a real grant proposal for the Blackstone Foundation.
  • ESAPI Hackathon
    • For the past two weeks, Chris, Kevin, and I have been working on the logistics of the ESAPI Hackathon.
    • The aim of the Hackathon is to encourage contributions to the ESAPI Project in several key areas.
    • There will be 1st, 2nd, 3rd, and 4th place prizes awarded to the best 4 contributions.
    • The Hackathon starts today, December 20th 2013 and ends January 20th 2014.
    • For more information, visit the Guidelines page or e-mail Chris, Kevin, or me directly.
  • Daily Project based queries and requests
    • This has not changed much since I began the post: questions are very similar in nature.
    • Global AppSec questions.
    • Funding queries.
    • Travel availability.
    • Project based administrative help.
    • Project status information.
    • Several project donation questions.
    • Marketing questions.
    • Grant funding questions.
    • OWASP social media updates.
    • What's happening with projects, questions.

General Awards

  • OWASP OWTF Project: Brucon 5x5 Award
  1. Amount: €5,000.00 (Approx. $6,670.00)
  2. Status: Awarded. Congratulations, Abraham Aranguren and all involved in the project, for your award.

Proposals Awarded

  1. Amount: $25,000 USD
  2. Status: Awarded. The first payment has been allocated to our project budgets. The second invoice has now been sent to Georgia Tech and payment has been received.
  3. OWASP Development Guide Plan
  4. OWASP Testing Guide Plan
  5. OWASP Code Review Guide Plan
  • Google Grants Proposal
  1. Amount: $120,000 USD in Adwords Funds
  2. Status: Awarded.
  3. Note: There is no link to show the proposal for this grant. There was a form that was submitted to Google, and we did not receive a record of this form.
  • Google Summer of Code
  1. Amount: $5,500
  2. Status: Awarded
  • Projects breakdown:
    • 4 ZAP Projects: $2,000
    • 4 OWTF Projects: $2,000
    • 1 PHP Security Project: $500
    • 1 Hackademics Project: $500
    • 1 Modsecurity Project: $500
    • Note: Big thank you to Fabio Cerullo for coordinating and managing this award.
  1. Amount: $15,000 USD
  2. Status: Awarded.
  • Total Funds Awarded: $172,170 USD for 2013.

Proposals Denied

  • European Commission Grant Proposal
  1. Amount: €250,000
  2. Status: Denied.
  1. Amount: $112,000 USD
  2. Status: Denied
  1. Amount: $25,000 USD
  2. Status: Denied
  1. Amount: $30,000 USD
  2. Status: Denied
  1. Amount: $55,800 USD
  2. Status: Denied

Current Project Funds

Message from OWASP ESAPI Project Leaders, Kevin Wall & Chris Schmidt

ESAPI Hackathon / Bug Bash Contest

Our very own OWASP ESAPI Project Leaders, Chris Schmidt and Kevin Wall, are hosting the OWASP ESAPI Hackathon starting on Friday, December 20th 2013 and ending on Monday, January 20th 2014. The aim of the ESAPI Hackathon is to encourage contributors to Implement modular security controls, fix existing bugs, provide reference implementations, and improve user documentation.

Each participant will be evaluated by four judges, and prizes will be awarded to those who provide the most valuable contribution to the project. Here are the list of prizes:

  • First place: Apple iPad Mini and an ESAPI T-shirt
  • Second place: $30.00 (USD) Amazon Gift Card and an ESAPI T-shirt
  • Third place: $20.00 (USD) Amazon Gift Card and an ESAPI T-shirt
  • Fourth place: An ESAPI T-shirt

We encourage all those who can participate to contribute to the OWASP ESAPI Project. Please view the contributing guidelines wiki page for more detailed information on participant expectations. If you still require more assistance, please contact either, Kevin Wall ([email protected]) or Chris Schmidt ([email protected]).

Download a pdf version of the guidelines here.

Message from OWASP ZAP Project Leader, Simon Bennetts

I'm delighted to tell you that ZAP came top of the Toolswatch Best Security Tool of 2013: http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/

Also congrats to OWASP Xenotix and OWASP O-Saft who also made the top 10

Thank you to everyone who voted for ZAP and other OWASP projects!

Message from OWASP Media Project Leader, Jonathan Marcil

TLDR; 11k views and 450 subscribers!

As you all know, we did a lot of work at last AppSecUSA in order to get 43 videos online for 32 hours for the talks, and also 6 videos from the Project Summit for 2.5 hours of content. All of that was online live for the summit and 24h after for the first talks, then the rest was published in one week the week just after the conference.

I managed to get the Project Summit recording by myself, but for the talks, it wouldn't have been possible without the support from AppSecUSA who used their resources to help us with that. To make it clear, we had a professional firm that recorded and uploaded the videos into YouTube. The only work I did on my side was to organize them into a playlist and publish them periodically.


AppSecUSA 2013 playlist

https://www.youtube.com/playlist?list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU


OWASP Projects Summit 2013 playlist

https://www.youtube.com/playlist?list=PLpr-xdpM8wG80aEXBZV9lk5nkEf3q-jaz


On the fail part, we missed some of the important talks, such as the keynote because it was at the very beginning and also Jeremiah's talk that was a hit, but we achieved 77% publishing within one week. One thing that actually wasn't real good in the short run was that the title didn't contains "OWASP" nor "AppSecUSA". That will probably hurt us in the long run and I might decide to change titles if we don't come out first in search results (as for now we don't https://www.youtube.com/results?search_query=appsecusa).

We actually plan to do the same thing for AppSecUSA 2014 and I'll be in touch with the team in order to prepare in advance. They want to have live streaming and be as fast.

One thing that is sure, is that we need more people in OWASP Media project. The good news is, unlike most other OWASP projects, you don't need to be an application security specialist to be really useful, you just need to be motivated to share knowledge with the world. I think that

Now for some stats, covering from Nov 17 2013 to Dec 19 2013.

We are at 11,289 views and 79,874 of estimated watched minutes.

Let me remind you that before that, we where at 245 views for 1,312 minutes, mainly from the OWASP Global Meetings live hangouts.

We are at 438 subscribers and we gained 442 of them with AppSecUSA efforts. We lost 4 hence the numbers.

The average view duration is 7:04 minutes, so 16% of the total times of videos. Since we have mostly one hour long videos, this is normal and in fact is probably a great number.


Notable popular videos are:


OWASP Zed Attack Proxy - Simon Bennetts

2,126 views 17,712 minutes watched 8:19 avg

http://youtu.be/pYFtLA2yTR8


Top Ten Proactive Controls - Jim Manico

845 views 8,293 minutes watched 9:48 avg

http://youtu.be/Cg5dN8Pyn_c


What You Didn't Know About XML External Entities Attacks - Timothy Morgan

790 views 5,857 minutes wathced 7:24 avg

http://youtu.be/eHSNT8vWLfc


From what I saw, Simon's used his network to publish his videos and I helped him by putting it as the trailer for the channel for a while. Same with Jim but with less engagement from his network (less comments). Timothy's was published from an external news website and got some views trough that.


Finally, the following countries were the top viewership:

  • United States 37%
  • Canada 12%
  • India 4.5%
  • United Kingdom 4.0%


I must point out that we were watched in 114 countries. That's amazing and shows the power of OWASP worldwide. With that big first step done, we will continue with our roadmap https://www.owasp.org/index.php/OWASP_Media_Project#tab=Roadmap and the next thing on the table is to present a Webinar on how to use Google Hangout and try to setup the next webinars within our YouTube channel. I also want to shake things with the Chapters by incite them to use Hangout and YouTube in order to get more into the Global Chapter Meetings Project. This has great potential but is not really used right now for helping smaller chapters to get contents. And and last, but not least, we are officially on the www.owasp.org homepage and we can control what is shown trough that small playlist: https://www.youtube.com/playlist?list=PLpr-xdpM8wG9g8l21uzfgyx4xAJ9aY7e7

Thanks to all who contributed and helped with OWASP Media Project,

See you next year!


"OWASP 24/7" with Mark Miller is a series of recorded broadcasts, highlighting OWASP projects and people from around the world. With over 43,000 members in 100 countries, the OWASP 24/7 channel is available on demand, at anytime, anywhere on the planet. You are welcome to embed the broadcasts on your page, download them for your personal listening or keep up to date by subscribing to the iTunes channel. Please view the Podcast Project page for a list of current interviews.


View All Available Broadcasts or choose one of our new single episodes below:


Upcoming interviews

  • Kevin Wall (ESAPI)
  • Jim Manico (OWASP Podcast Series)
  • Larry Conklin (Code Review Project)
  • Andrew van der Stock (Pro-Active Controls)
  • Andrew van der Stock
  • Larry Conklin
  • Chetan Karande - Node.jsGoat
  • Mark Arnold - OWASP Boston Chapter Lead
  • Mike McCabe, Ben Johnson
  • Rafael Gil
  • Seba Deleersnyder
  • Josh Corman
  • Ryan Berg