This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Project Assessment"

From OWASP
Jump to: navigation, search
(→‎Assessment Scale for OWASP TOOLS Projects)
(→‎FAQ)
Line 10: Line 10:
  
 
; 1. What is the purpose of the project ratings? : The rating system allows OWASP to monitor the quality of Projects in our subject areas, and to prioritize work on these projects.  It is also utilized to prepare for static releases of Wikipedia content.   
 
; 1. What is the purpose of the project ratings? : The rating system allows OWASP to monitor the quality of Projects in our subject areas, and to prioritize work on these projects.  It is also utilized to prepare for static releases of Wikipedia content.   
−
; 2. How do I add an project (tool or documentation) to the OWASP Projects? : To propose a new project, please send an email to [mailto:[email protected]?subject=New_OWASP_Project_idea OWASP].
+
; 2. How do I add a project (tool or documentation) to the OWASP Projects? : To propose a new project, please send an email to [mailto:[email protected]?subject=New_OWASP_Project_idea OWASP].
−
; 3. How does the assessment scale works? : Each category should have a certain amount of requirements/criteria to accomplish. The second category (Beta Quality) implies that all of its requirements, as well as the ones defined for the category below (Alpha Quality), have been accomplished. The last category (Quality Release) implies that all of its requirements, as well as the ones defined for the categories below (Alpha and Beta), have been accomplished.  
+
; 3. How does the assessment scale work? : Each category has a set of requirements/criteria to be met. Beta Quality implies that all of its requirements, as well as the Alpha Quality requirement have been met. Release Quality implies that all of the requirements, including Alpha and Beta, have been met.  
−
; 4. Who can assess projects? : WORK IN PROGRESS
+
; 4. Who can assess projects? : [mailto:[email protected] Paulo Coimbra] can assign you a reviewer.
−
; 5. Why didn't the reviewer leave any comments? : Unfortunately, due to the volume of projects that need to be assessed, we are unable to leave detailed comments in most cases.  If you have particular questions, you might ask the person who assessed the project; they will be happy to provide you with their reasoning.
+
; 5. Why didn't the reviewer leave any comments? : Unfortunately, due to the volume of projects that need to be assessed, we are unable to leave detailed comments in most cases.  If you have particular questions, you might ask the person who assessed the project; they will be happy to provide you with their rationale.
 
; 6. What if I don't agree with a rating? : You can list it in the [[:Category:OWASP Project Assessment#Requests for assessment|section for assessment requests]] below, and someone will take a look at it.  Alternately, you can ask any member of the project to rate the project again.   
 
; 6. What if I don't agree with a rating? : You can list it in the [[:Category:OWASP Project Assessment#Requests for assessment|section for assessment requests]] below, and someone will take a look at it.  Alternately, you can ask any member of the project to rate the project again.   
 
; 7. Aren't the ratings subjective? : Yes, they are somewhat subjective, but it's the best system we've been able to devise.  If you have a better idea, please don't hesitate to let us know!
 
; 7. Aren't the ratings subjective? : Yes, they are somewhat subjective, but it's the best system we've been able to devise.  If you have a better idea, please don't hesitate to let us know!
−
; 8. What if I have a question not listed here? : If your question concerns the project assessment process specifically, please contact the [mailto:[email protected] OWASP] or its [mailto:[email protected] Project Manager] directly.
+
; 8. What if I have a question not listed here? : If your question concerns the project assessment process specifically, please contact [mailto:[email protected] OWASP] or its [mailto:[email protected] Project Manager] directly.
  
 
== Assessment Scale for OWASP TOOLS Projects==
 
== Assessment Scale for OWASP TOOLS Projects==

Revision as of 19:37, 21 February 2008

(Work in progress)

From OWASP Project


This assessment area focuses on assessing the quality of OWASP TOOLS and DOCUMENTATION (Projects). The resulting ratings are used within the project to aid in recognizing excellent contributions and identifying topics in need of further work.


FAQ

1. What is the purpose of the project ratings? 
The rating system allows OWASP to monitor the quality of Projects in our subject areas, and to prioritize work on these projects. It is also utilized to prepare for static releases of Wikipedia content.
2. How do I add a project (tool or documentation) to the OWASP Projects? 
To propose a new project, please send an email to OWASP.
3. How does the assessment scale work? 
Each category has a set of requirements/criteria to be met. Beta Quality implies that all of its requirements, as well as the Alpha Quality requirement have been met. Release Quality implies that all of the requirements, including Alpha and Beta, have been met.
4. Who can assess projects? 
Paulo Coimbra can assign you a reviewer.
5. Why didn't the reviewer leave any comments? 
Unfortunately, due to the volume of projects that need to be assessed, we are unable to leave detailed comments in most cases. If you have particular questions, you might ask the person who assessed the project; they will be happy to provide you with their rationale.
6. What if I don't agree with a rating? 
You can list it in the section for assessment requests below, and someone will take a look at it. Alternately, you can ask any member of the project to rate the project again.
7. Aren't the ratings subjective? 
Yes, they are somewhat subjective, but it's the best system we've been able to devise. If you have a better idea, please don't hesitate to let us know!
8. What if I have a question not listed here? 
If your question concerns the project assessment process specifically, please contact OWASP or its Project Manager directly.

Assessment Scale for OWASP TOOLS Projects

Class Criteria Example
Release Quality OWASP Tools
  • Be reasonably easy to use
  • Include online documention built into tool (based on required user documentation)
  • Include build scripts that facilitate building the application from source (Goal: One-click build)
  • Java projects should be run through Fortify Software's open source review (if appropriate) and FindBugs.
    • WebGoat would not be appropriate for example since it would light up like a Christmas tree :-)
  • C/C++ apps (if we have any) should consider being run through Coverity's open source review. Coverity also accepts submissions for open source Java applications.
  • Meets all Alpha and Beta Quality standards

Recommendations:

  • Publicly accessible bug tracking system (e.g., at Sourceforge)
  • Conference style Powerpoint presentation that describes the use and status of the tool. (This could be used by others to discuss the tool at OWASP Chapter meetings, serve as easy to review offline documentation, etc.)
  • UAT pass on functionality of the tool
  • Developer documents any limitations
 OWASP WebGoat Project
Beta Quality OWASP Tools
  • Have an easy to use installer (Goal: Fully automated installer) (or stand alone executable version)
  • Include user documentation in Project's OWASP Wiki page(s)
  • Add a common About Box or help menu
    • (which lists name of tool, author, e-mail address of author, current version number and/or release date)
  • Include documentation on how to build it from code, starting with getting it directly from the code repository. (Ideally, this would include easy to use build scripts, which is required for Release Quality)
  • Meets all Alpha Quality standards
 OWASP AntiSamy Project
Alpha Quality OWASP Tools
  • Agree to OWASP's open source license
  • Create a project page at OWASP that describes:
    • the tool, the project leader,contact info, and includes a download link for the code and the executable version.
  • Have its code in Googlecode, or Sourceforge
  • Mailing list for project created
  • Solves a core application security need
 OWASP CSRFTester Project

Assessment Scale for OWASP DOCUMENTATION Projects

Class Criteria Example
Release Quality OWASP Documentation WORK IN PROGRESS - WORK IN PROGRESS OWASP AppSec FAQ Project
Beta Quality OWASP Documentation WORK IN PROGRESS - WORK IN PROGRESS OWASP CLASP Project
Alpha Quality OWASP Documentation
  • Agree to OWASP's open source license
  • Create a project page at OWASP that describes:
    • WORK IN PROGRESS
  • Mailing list for project created
OWASP AJAX Security Project

Requests for assessment

If you have made significant changes to an project and would like an outside opinion on a new rating for it, please feel free to list it below.

  1. Here
  2. Or here
  3. Add new requests above this line
Retrieved from "https://wiki.owasp.org/index.php?title=Category:OWASP_Project_Assessment&oldid=25733"