This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:OWASP Project Assessment"
From OWASP
(→Assessment Scale for OWASP DOCUMENTATION Projects) |
(→Assessment Scale for OWASP TOOLS Projects) |
||
Line 19: | Line 19: | ||
* Include online documention built into tool (based on required user documentation) | * Include online documention built into tool (based on required user documentation) | ||
* Include build scripts that facilitate building the application from source (Goal: One-click build) | * Include build scripts that facilitate building the application from source (Goal: One-click build) | ||
+ | * Publicly accessible bug tracking system established, ideally at the same place as the source code repository (e.g., at Google code, or Sourceforge) | ||
* Java projects should be run through [http://opensource.fortifysoftware.com/welcome.html Fortify Software's open source review] (if appropriate) and [http://findbugs.sourceforge.net/ FindBugs]. | * Java projects should be run through [http://opensource.fortifysoftware.com/welcome.html Fortify Software's open source review] (if appropriate) and [http://findbugs.sourceforge.net/ FindBugs]. | ||
**WebGoat would not be appropriate for example since it would light up like a Christmas tree :-) | **WebGoat would not be appropriate for example since it would light up like a Christmas tree :-) | ||
Line 24: | Line 25: | ||
* When approved to be Release Quality: Update the link to it on: the [[:Category:OWASP_Project | OWASP Project]] page and update its project quality tag on its project page to be Release Quality. | * When approved to be Release Quality: Update the link to it on: the [[:Category:OWASP_Project | OWASP Project]] page and update its project quality tag on its project page to be Release Quality. | ||
'''Recommendations:''' | '''Recommendations:''' | ||
− | |||
* Conference style Powerpoint presentation that describes the use and status of the tool. (This could be used by others to discuss the tool at OWASP Chapter meetings, serve as easy to review offline documentation, etc.) | * Conference style Powerpoint presentation that describes the use and status of the tool. (This could be used by others to discuss the tool at OWASP Chapter meetings, serve as easy to review offline documentation, etc.) | ||
* UAT pass on functionality of the tool | * UAT pass on functionality of the tool | ||
Line 39: | Line 39: | ||
* Have an easy to use installer (Goal: Fully automated installer) (or stand alone executable version) | * Have an easy to use installer (Goal: Fully automated installer) (or stand alone executable version) | ||
* Include user documentation in Project's OWASP Wiki page(s) | * Include user documentation in Project's OWASP Wiki page(s) | ||
− | * Add a common About Box or help menu | + | * Add a common About Box or help menu in the tool itself |
**(which lists name of tool, author, e-mail address of author, current version number and/or release date) | **(which lists name of tool, author, e-mail address of author, current version number and/or release date) | ||
* Include documentation on how to build it from code, starting with getting it directly from the code repository. (Ideally, this would include easy to use build scripts, which is required for Release Quality) | * Include documentation on how to build it from code, starting with getting it directly from the code repository. (Ideally, this would include easy to use build scripts, which is required for Release Quality) | ||
+ | * This documentation must stored be in the same repository as the code. | ||
* When approved to be Beta Quality: Update the link to it on: the [[:Category:OWASP_Project | OWASP Project]] page and update its project quality tag on its project page to be Beta. | * When approved to be Beta Quality: Update the link to it on: the [[:Category:OWASP_Project | OWASP Project]] page and update its project quality tag on its project page to be Beta. | ||
| | | | ||
Line 53: | Line 54: | ||
| | | | ||
* Agree to [[OWASP Licenses|OWASP's open source license]] | * Agree to [[OWASP Licenses|OWASP's open source license]] | ||
− | |||
− | |||
− | |||
* The “main” page for any OWASP tool must be on the OWASP website. This page must: | * The “main” page for any OWASP tool must be on the OWASP website. This page must: | ||
− | ** describe the tool, the project leader, contact info, and include all relevant links, | + | ** describe the tool, the project leader, contact info, and include all relevant links, including a download link for the code and the executable version, |
** include the Alpha Quality Tool project tag. (Which we still need to define), | ** include the Alpha Quality Tool project tag. (Which we still need to define), | ||
** be placed at [[:Category:OWASP_Project | OWASP Project]] page. | ** be placed at [[:Category:OWASP_Project | OWASP Project]] page. | ||
− | * Have its code in Googlecode, or Sourceforge. | + | * Have its code and any documentation in Googlecode, or Sourceforge. |
* [https://lists.owasp.org/mailman/listinfo Mailing list for project created]. | * [https://lists.owasp.org/mailman/listinfo Mailing list for project created]. | ||
* Solves a core application security need. | * Solves a core application security need. |
Revision as of 13:58, 10 March 2008
(Work in progress)
The following defines the quality levels for OWASP TOOLS and DOCUMENTATION (Projects). Rating projects against these criteria aid in recognizing excellent contributions and identifying projects in need of further work.
Assessment Scale for OWASP TOOLS Projects
Class | Criteria | Review Process | Example |
---|---|---|---|
Release Quality OWASP Tools | All Beta Quality Requirements plus:
Recommendations:
|
|
OWASP WebGoat Project |
Beta Quality OWASP Tools | All Alpha Quality Requirements plus:
|
|
OWASP AntiSamy Project |
Alpha Quality OWASP Tools |
|
|
OWASP CSRFTester Project |
Assessment Scale for OWASP DOCUMENTATION Projects
Class | Criteria | Review Process | Example |
---|---|---|---|
Release Quality OWASP Documentation | WORK IN PROGRESS - WORK IN PROGRESS |
|
OWASP AppSec FAQ Project |
Beta Quality OWASP Documentation | WORK IN PROGRESS - WORK IN PROGRESS |
|
OWASP CLASP Project |
Alpha Quality OWASP Documentation |
|
|
OWASP AJAX Security Project |
FAQ
- 1. What is the purpose of the project ratings?
- The rating system allows OWASP to monitor the quality of Projects in our subject areas, and to prioritize work on these projects. It is also utilized to prepare for static releases of Wikipedia content.
- 2. How do I add a project (tool or documentation) to the OWASP Projects?
- To propose a new project, please send an email to OWASP.
- 3. How does the assessment scale work?
- Each category has a set of requirements/criteria to be met. Beta Quality implies that all of its requirements, as well as the Alpha Quality requirement have been met. Release Quality implies that all of the requirements, including Alpha and Beta, have been met.
- 4. Who can assess projects?
- The OWASP Project Manager can assign you a reviewer.
- 5. Why didn't the reviewer leave any comments?
- Unfortunately, due to the volume of projects that need to be assessed, we are unable to leave detailed comments in most cases. If you have particular questions, you might ask the person who assessed the project; they will be happy to provide you with their rationale.
- 6. What if I don't agree with a rating?
- You can list it in the section for assessment requests below, and someone will take a look at it. Alternatively, you can ask any member of the project to rate the project again.
- 7. Aren't the ratings subjective?
- Yes, they are somewhat subjective, but it's the best system we've been able to devise. If you have a better idea, please don't hesitate to let us know!
- 8. What if I have a question not listed here?
- If your question concerns the project assessment process specifically, please contact OWASP or its Project Manager directly.
Requests for assessment
If you have made significant changes to a project and would like an outside opinion on a new rating for it, please feel free to list it below or e-mail OWASP Project Manager.
- Here
- Or here
- Add new requests above this line
Pages in category "OWASP Project Assessment"
The following 14 pages are in this category, out of 14 total.