OWASP Needs to Evolve

https://github.com/owasp-change/owasp-change.github.io

by bretpiatt • 3 years ago

201 45 3 years ago

weinzierl• 3 years ago

Today, many projects operate independently, in some cases managing their own sponsorships, finance, websites, domains, communication platforms, and developer tools."

This is quite noticeably when you look at the difference between Dependency-Track and DefectDojo. Both are OWASP projects, but one seems to be modern up-to-date software the other looks like straight from the early 2000s.

throwboatyface• 3 years ago

In my experience if the authors get their wish then both will look 20-years-old.

robertlagrant• 3 years ago

ThreatDragon[0] is also looking nice.

[0] https://www.threatdragon.com

secondcoming• 3 years ago

OWASP

The Open Worldwide Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software.

airza• 3 years ago

Last time i heard from owasp was when they wanted me to do unpaid review for papers being accepted to a paid conference..

quelltext• 3 years ago

So, like any other instance of this (in academia).

tptacek6• 3 years ago

I was going to say: that describes Usenix, too.

wccrawford• 3 years ago

I understand the visceral reaction there, but OWASP is a nonprofit foundation, and conferences cost money to host. They were attempting to make the conference as cheap as possible by getting volunteers instead of paying people for whatever work they could, I'm sure.

If this was a for-profit company, I'd completely agree with you, but it's not.

eastbound• 3 years ago

In other words, they’re asking for funding and a clear plan per project. OWASP does the Maven dependency scanner, which relies on the NIST db.

As a small software vendor, buying other security scanning solutions is very expensive, and they still aren’t as accurate as a pentester investigating our code.

Would it be a good idea if OWASP had a paid service where companies would pay for the verification of OSS libraries (hi NPM!)? and that would innocent you in front of EU’s diligence requirements?

KrugerDunnings2• 3 years ago

Look at this thiefdom of tools, ZAP is the only cool thing on this list, all the other things are bean counting apps.

unixhero• 3 years ago

Bean counters get funding to improve cyber security and hire the techies. Respect the Excel jockies mate.

KrugerDunnings2• 3 years ago

Only if they use Excel instead of these tools buddy

chrismorgan2• 3 years ago

I have a very poor opinion of OWASP content, because the couple of areas I’ve paid any attention to have never been any better than mediocre, clearly written by amateurs long ago and largely unmaintained ever since, with known errors and heavily misleading statements hanging around for over a decade on no or unsound justification, among many other problems obvious to any that actually know the field. (See https://hn.algolia.com/?query=chrismorgan%20owasp&type=comme... for a few comments with somewhat more detail, but things have historically been just so bad and so obviously bad that I haven’t bothered enumerating more than the issue that has annoyed me the most.)

(Sigh. I see that as part of fixing a lot of the obvious unsuitability of https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc... some time in the past two years—and it is much better now, though there are still a few dodgy things about it in both content and presentation—they reintroduced the erroneous advice to entity-encode /, which was only finally removed two years ago. Feel free to try to get that fixed, anyone; for my part, I have no interest in trying to work with OWASP.)

colbyx• 3 years ago

Agreed, that matches my experience too, it's the clueless leading the clueless. I actively steer people away from OWASP regarding training and reference materials.

programmarchy• 3 years ago

What’s the best alternative?

DyslexicAtheist2• 3 years ago

where are you steering them to?

zenexer2• 3 years ago

They didn’t reintroduce the error; it was never completely fixed. I created an issue for it. https://github.com/OWASP/CheatSheetSeries/issues/1089

zenexer2• 3 years ago

Fixed: https://github.com/OWASP/CheatSheetSeries/issues/1089#issuec...

breadchris• 3 years ago

wow, I have not seen much of the errors that you have come across! That is good to know about.

In regards to freely available information about security, are there other resources you can recommend? Something that I find myself constantly being asked is “how should I protect my code” from engineers. I really fail to find much better freely accessible content in one place than the content available on OWASP.

Not that this would help the quality of the content, but maybe ML can help here? I know a lot of very skilled security people who post on various places around the Internet and an ML search engine to help you find relevant security material might be helpful?

At the company I work for, we are building an ML chat bot that would allow you to ask questions about security vulnerabilities and get linked to the relevant material to help you make your own determination about relevancy.

couchand• 3 years ago

This is exactly the subject matter that using a chat bot is incredibly dangerous for. The difference between "looks good but fundamentally broken" and "logically sound" in security arguments is very small. The consumer of the content is likely to have little to no developed taste on the matter (or they would seek out more specific resources).

If you have some authoritative curation of the resources it may have promise, but the question becomes, why not have the product of the curation be directly consumable, rather than feed it through an opaque layer?

Inventing problems here, people. It was a nice society while it lasted.

tptacek6• 3 years ago

I agree with you, and further would say that this has been the case with OWASP for at least a decade.

My take about OWASP on HN has generally been: they're effective at producing communication tools that raise the salience of application security, especially within large companies. And that's about it.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

taeric• 3 years ago

I think that is how I view them. In particular, I am always surprised when people don't know of them, but I also don't advocate for them too heavily.

Do you have any similar group that you do recommend?

Mountain_Skies• 3 years ago

Reading between the lines, sounds like they want control handed over to large corporations with everything controlled by a CoC, enforced by representatives of those corporations, directly or covertly.

ath0• 3 years ago

Counterpoint from Josh Sokol, former OWASP board member: https://www.linkedin.com/feed/update/urn:li:activity:7031305...

The OWASP nonprofit isn’t like the well-funded Linux Foundation; it runs on a shoestring budget made worse by the loss of conference revenue during the pandemic. OWASP charters events, local meetups, training content and OSS projects - the authors of this memo focus only on the OSS project needs. The OWASP board sees itself as community first and foremost; projects should seek their own sponsorships.

electroly• 3 years ago

If OWASP wants to focus on chapters and events, why do they have projects under their umbrella at all? We had a similar problem in the .NET ecosystem with the .NET Foundation. It turned out they don't really do that much for the projects they oversee after all, so what's the point? Why be part of an organization that isn't providing the support you need?

Perhaps, indeed, they should not be. Given this response, it sounds to me like the projects should leave. What they need is simply different than what OWASP wants or is financially able to provide. The projects have outgrown the organization, and the organization doesn't see itself as being primarily about the projects. Sounds, to me, like it's time to make a clean break that unburdens OWASP and frees the projects.

throwaway2847• 3 years ago

The projects should leave. I don't think they are a critical component of OWASP compared to the educational material provided through their documentation and conferences.

Ekaros• 3 years ago

So where do they expect to get the 3-8 million in extra funding just for their projects? From the current whole budget of OWASP of 2 million...

DyslexicAtheist2• 3 years ago

any security standards today and legislations such as radio equipment directive (RED) for IoT piggy-backs on the work done by OWASP. maybe it's time for these standards bodies, ETSI, ISO, UL, IoXT, ... to give back and help with some of the funding.

tptacek6• 3 years ago

They're explicitly asking for corporate membership on the OWASP board, to attract more sponsorship dollars.

Sytten• 3 years ago

One of the reason we started to work on my own startup was to provide a credible alternative to Burpsuite as Zap was not evolving in that direction. If we had funding in the amount this letter wants per year it would easy to build it open source and free, but where do they think this money will come from? This is not like the Linux foundation which produces something businesses can use to produce massive amount of money on top. This is competing with commercial products in the space and potentially reducing their revenue.

sdiq• 3 years ago

owasp-change.github.io

ethereal-haze• 3 years ago

You'd think with all those name, they could come up with a better standard or something

markl42• 3 years ago

I’m not familiar with the work that OWASP does, other than the cheat sheet series.

The cheat sheet series is amazing - a great resource to defer to when you don’t know or want to think about how to do <x>, you just want to look up and implement the industry standard.

It’s a great reference, and I use it lot. <3 to the folks working on that :)

chrismorgan2• 3 years ago

The main cheat sheet I’ve looked closely at is the XSS one, and it’s never been better than mediocre, with (for over a decade, despite it being known about; only recently has it been redone to be tolerable, though still not excellent) awful framing, grossly misleading structure (seriously, almost every citations I’ve seen of it has misapplied it because of this), irrelevant and excessive content in some areas and critical missing content in other areas.

Therefore my recommendation is: use it for general awareness, perhaps, but do not trust it. Because there probably isn’t anyone really working on it—you’re probably actually looking at something that was written well over 10 years ago by an amateur, and has received almost no maintenance since then.

CaliforniaKarl• 3 years ago

Can you recommend a good substitute for the Cheatsheets?

OWASP Needs to Evolve

Related Stories