This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Template:Application Security News
From OWASP
- Dec 2 - Oracle blames security researchers
- "We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the Oracle Software Security Assurance program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?
- Nov 30 - What? Ajax is secure now?
- Nice article making the point that Ajax is not necessarily insecure. Read it carefully folks - it isn't easy to build a secure Ajax application, just possible. And remember that although the article doesn't mention it, Ajax apps use new parsers and interpreters that haven't been very well tested for security.
- Nov 30 - Democracy Schlemocracy
- A paper from NIST argues that touchscreen voting machines are "more vulnerable to undetected programming errors or malicious code" and that "potentially, a single programmer could 'rig' a major election."
- Nov 28 - Litchfield slams Oracle lack of SDL
- David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is gloating a little.
- Nov 28 - Foreign software - threat or xenophobia?
- Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.
