Cleaning Data with Google Refine

@austinogilvie posted this nice Cleaning Data with Google Refine entry where it shows the Google Refine (soon to be called OpenRefine) project in action.

Google Refine in their own words is: "...a power tool for working with messy data, cleaning it up, transforming it from one format into another, extending it with web services, and linking it to databases like Freebase...."

Nice visualisation and animation of graph data (from NYTimes)

NYTimes 512 Paths to the White House is a very nice way to present complex data (I wonder if we could use something similar for TeamMentor, OWASP or O2 Platform's content)

Here is the default view:

Improving VisualStudio productivity by compiling and executing code from the IDE

The Real-time Programming C# WinForms Controls in VisualStudio's IDE (i.e. without using F5) blog entry shows how to use the VisualStudio C# REPL - O2 Platform extension to update/fix an existing WinForms control without going through the painful (and slow) process of VisualStudio GUI programming.

What you will see in that example is that I will dynamically compile and execute a WinForms Control, without using VisualStudio's Debug/Run capabilities to see the new changes in action. I was able to compile the modified Source Code file, and using reflection, was able to create a new instance of an WinForm's Control (without leaving the VisualStudio's IDE).

And the best part is that we can code our tests in an REPL environment (think Roslyn), which allows the support for complex (and unit-test like) scenarios.

I can't underestimate how powerful, fast and efficient it is to be able to have this type of REPL environment while coding.

This is what I would like to see on the next version of VisualStudio.

Real-time Programming C# WinForms Controls in VisualStudio's IDE (i.e. without using F5)

Here is an example of using the VisualStudio C# REPL - O2 Platform extension to update/fix an existing  WinForms control without going though the painful (and slow) process of VisualStudio GUI programming, which usually goes something like this:

• Coding + Compiling + F5 + Wait for App to Load + Going to Control + Testing it + Stopping 
• Coding + Compiling + F5 + Wait for App to Load + Going to Control + Testing it + Stopping 
• Coding + Compiling  + ....

We start with the O2 Platform Solution loaded in VisualStudio 2010, with the projects from the O2.FluentSharp and O2.Platform.Projects repositories, and the VisualStudio C# REPL - O2 Platform extension installed (note the extra REPL menu)

From the REPL menu, chose the C# REPL - 'Hello World' menu option:

Which looks like this (it's a good idea to right-click on the code editor to open the context menu, and to select the show Log Viewer option:

Here is a small text change to show the C# REPL environment in action

Now here is the powerful part, this script:

Will create a new popup window with the ascx_Simple_Script_Editor WinForms Control (that was just dynamically compiled from the original source code (note: the ascx_Simple_Script_Editor Control is the one used to create the C# REPL environment))

What is happening is that the ascx_Simple_Script_editor.cs file (whose source code is shown in the background) was dynamically compiled and executed .... without leaving the VisualStudio's IDE.


Just to double-check that we are doing this in real time, lets make a small code change in the  ascx_Simple_Script_editor.cs source code (using VisualStudio's code editor).

The code shown below will create two MessageBox(es). The first was created using the normal .Net MessageBox call syntax,  and the 2nd uses O2's FluentSharp API (which should be easier to read)

Here is the 1st MessageBox:

Here is the 2nd MessageBox:

The ascx_Simple_Script_Editor WinForms Control will appear after the MessageBox(es):

Now that we've proven that we are able to change, compile and execute a C# WinForm's control in a REPL environment, let's do something more interesting.

Moving a ToolStrip Control

One of the O2 Platform user's feature requests that I have received for this control (the one that we are editing), is to move the ToolStrip Control  (the one with the New, Open and Save As buttons) from the bottom of the Control,  to the top (which is where usually ToolStrips are located).

Going back to the VisualStudio document with the ascx_Simple_Script_editor.cs source code, here is the addToolStrip method that 'inserts below' the commandsToExecute Control an ToolStrip Control (the rest of the addToolStrip method adds the TootlStrip items (3x Buttons, 1x Label and 1x TextBox)

To change the location of the ToolStrip Control, we will use the FluentSharp insert_Above Extension Method  (vs the originally used insert_Below Extension Method)  :

Once the change is saved, we can immediately see these changes in action, by using the REPL environment created via the gist script shown above..

Here is the updated version of the ascx_Simple_Script_editor Control with the ToolStrip Control at the top.

Note that I didn't use VisualStudio's Debug/Run capabilities to see the new changes in action. I was able to compile the modifed Source Code file, and using reflection, was able to  create a new instance of that WinForm's Control (with everything done inside VisualStudio's IDE).

Adding a new Button

As a final example, lets add a Run button to the ToolStrip Control.

Here is the updated source code (note the new add_Button line)

Once saved , complied and executed (not by VisualStudio), we can see that there is a Run button on the ToolStrip.

Here is the button being used to execute a test REPL script:

VisualStudio power is still all there

Another benefit of this technique/workflow is that we still have access to the powerful VisualStudio Intellisense and Error detection:

Compiling and executing the Solution

The final step is to compile the Solution file (with the changes made)

And run the O2 Platform executable (now using VisualStudio's F5).

Note how the O2 Platform's native C# REPL editor now has the changes made to the ToolStrip Control (it is above the code-editor and has an extra Run button)

This technique will change the way you code (once you got your head around it)

I can't underestimate how powerful, fast and efficient it is to be able to have this type of  REPL environment while coding (and how painful is the VisualStudio workflow in comparison).

In fact, this REPL environment is a curse, since once you tried it, there is no way back! :)

This is why I say that I develop O2 in O2 :)

TM - Library Manager (with REPL) v1.2.4.exe

Here is a (still quite raw) Library Manager for TeamMentor with REPL support (packaged as an O2 Platform stand-alone exe).

You can download this version from: TM - Library Manager (with REPL) v1.2.4.exe

Using HawkEye to find control to Script (Findings Viewer example)

Here is an O2 Script/API that helps to find the control to script (via the script_Me extension method)

Let's say that you have a script that opens a Findings Viewer:

Which looks like this:

By adding a reference to the API_HackEye.cs you can call the openControlFinder (via the new REPL menu added)

This will open up a popup window with the HawkEye

Drag the eye (i.e. the target icon) on top of a control to see its properties, and click on the 'Open ScriptMe for this control' link:

This will open a script editor, with the selected object passed as a parameter:

Note that this will only work for WinForm controls that exist in the current .NET process.


Source Code:

The best technical history of Windows technologies and APIs

This (long) article is simply spectacular: Turning to the past to power Windows' future: An in-depth look at WinRT

It provides a deep technical analysis of the history of Microsoft's released OSes and APIs, taking into account their technologies and (internal to MS) political ramifications.

Peter Bright also takes a stab at creating a better diagram of Windows 8 Metro vs Desktop apps, which I agree makes more sense:

This diagram adds a couple clues to the questions I asked Windows Store/Metro Apps - A 'client-server' sandbox built using Javascript? and raises a couple more (for Metro Apps):

• So is the CLR running under the same process of Metro apps?
• And if so, which CLR? the 4.5?
• And if C# code is running under that CLR, is that full-trust or partial trust?
• In that CLR, is the Verifier enabled?
• And if that C# code (or any other .Net code) is running under full-trust, surely then the only 'limitations' of that code are the ones imposed by the user account and its UAC/privilege-level (since it will be possible to jump into 'unmanaged code')
• On the topic of UAC, are UAC security boundaries in Windows 8? Since in the past they were not
• Can we write IL code (i.e. non VS created IL) on Metro Apps?
• If can write IL (which I expect to be able to), then how is type safety enforced? (see C# Type Confusion - tricking the compiler to view a String as a StringBuilder (or a TextBox as a Label) for how in a normal .NET full-trust app, most type safety is enforced by the compiler, not the CLR) 

Why I stopped using Gaug.es (and the problem of being a feature)

As you can see by Gaug.es is Amazing - Just added RealTime website tracking to TeamMentor I was pretty excited about Gaug.es, and since I'm now looking for Website Monitoring Services, a good question is 'Are you still using Gaug.es and can it be used for WebSite monitoring?'

The short answer for the 'Are you still using Gauges' part is that Google Analysis killed it

The short answer for the 'can it be used for WebSite monitoring' part is: NO

Gaug.es had one feature that was really powerful: the real-time visualisation of web traffic (which was really good and I even got for a while a paid subscription)

But once I was able to get the same data from Google Analytics, the value of Gaug.es plummeted.

Since I had such a good experience with Gaug.es (via their customer service and presentation), I did made a bit of an effort to get more value from it, but:

• the data analysis that they provided on their GUI was very limited, 
• there was no power-user analysis and 
• their API support (and language support) was quite limited.

One area that Gaug.es could had entered was the data/website monitoring and analysis (which is what I need now).

For example, they have enough data to identify problems with a particular website. But that would change their current model and I understand why they want to keep providing a simple (and easy to use) service.

The problem is that when you are a feature not a product (as Steve said to Dropbox) you have to make sure you are better than the equivalent features in the products out there (Dropbox will need to keep innovating if they want to stay relevant)

In a way Gaug.es failed to innovate. They were able to get a head start on Google Analytics and should had continued adding features. I think they are owned by github, so maybe the key Gaug.es devs are the ones making GitHub.com even better.

And if I have to choose between a better GitHub vs a better Gaug.es, GitHub will win every time :)

Securing Frames with Html 5 and examples of Html 5 vulns (and fixes)

On the topic of Html 5 , here is a nice How to Safeguard your Site with HTML5 Sandbox article which comes with a https://github.com/writeline/HTML5-Sandbox-Demo sample.

Also really good is the Defense in Depth: HTML5 Sandbox page from Microsoft's IE team which shows a couple vulnerabilities (and how they can be mitigated):

One question I have on these Html 5 protections is: What about ClickJacking?

Html 5 Sandbox site

Here is a cool site that can be used to try Html 5 (and its security features): http://htmlsandbox.com

Here is the default UI:

Michael Feather's 10 Papers Every Programmer Should Read (At Least Twice)

Michael Feathers posted 10 Papers Every Programmer Should Read (At Least Twice) which looks like a great list for a rainy day.

Here are the 10 (and I'm embaraced to say that I have not read most of them):

• On the criteria to be used in decomposing systems into modules – David Parnas
• A Note On Distributed Computing – Jim Waldo, Geoff Wyant, Ann Wollrath, Sam Kendall
• The Next 700 Programming Languages – P. J. Landin
• Can Programming Be Liberated from the von Neumann Style? – John Backus
• Reflections on Trusting Trust – Ken Thompson
• Lisp: Good News, Bad News, How to Win Big – Richard Gabriel
• An experimental evaluation of the assumption of independence in multiversion programming – John Knight and Nancy Leveson
• Arguments and Results – James Noble
• A Laboratory For Teaching Object-Oriented Thinking – Kent Beck, Ward Cunningham
• Programming as an Experience: the inspiration for Self – David Ungar, Randall B. Smith

If you don't have time to read them, or want to chose the first one to tackle, go to Michael's 10 Papers Every Programmer Should Read (At Least Twice)  post and read is brief description of each of these papers.

Website monitoring services?

I'm looking for a website monitoring service (for a couple TeamMentor live sites) that provides the following:

• Uptime (site is up/down)
• Performance stats (page loads)
• Broken pages/links
• GUI still looks the same (this is a visual check, not a code one)
• Transaction checks (for example 'login sequence' and 'article viewing')
• Content changes (ideally with detection of injected malicious code)
• Web/SaaS based solution
• API to trigger and consume results
• Solution based on Unit tests (where the checks are scripted and easily modified/customized) - but I don't think such service exists today :)

Any recommendations or personal accounts/horror-stories?

A quick google search found:

http://www.uptrends.com/

and http://www.alertra.com

Using SAST technology on Android to detect SSL implementations issues

Arvind called my attention to this pdf Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security which (looks like) is a great read and it includes this really interesting paragraph:

8. COUNTERMEASURES
8.1 OS SolutionsMalloDroid 

Installation Protection. (page 59)

MalloDroid could be integrated into app installers, such as Kirin [9], to perform static code analysis at install time. This analysis performed directly on a phone could warn of potentially unsafe applications. Users would then have to decide whether they wish to install the app irrespective of the warning.

I ABSOLUTELY agree with this!!!!!

There is a point where the complexity level of what is being implemented is so high and there are so many moving parts to take into account (or to do them consistently in deployment) that we need a way to codify what is (or should) happen.

Interesting SSL challenge between Dev/QA and production

So as we have another small issue with SSL in of TeamMentor's live server (see Problem loading content via SSL in docs.teammentor.net) I'm trying to figure out a way to make SSL deployment more robust.

At the moment there is already a setting in TM to force SSL redirects for all requests. But one issue that exists, is that normally during Dev and QA we don't test on SSL sites, which means that this setting tends to be disabled. Yes this something that we should be changing, but I really like the current light 'dev environment setup' that TM currently has, and adding SSL to it will increase its complexity.

This is actually one of those cases where the 'individual' solution(s) are easy and understood. The problem is in getting them to work in a streamlined and 'check-list-driven' mode. And that is one of the big challenges of Security. Every change as side-effects and ensuring that all moving parts happen at the same time and in the right order is a big challenge.

So when we (the security-side) say 'you should run all your site in SSL', we should understand that there is a lot more to it than just flip a switch in a webserver. See Etsy's Scaling User Security post for some of the challenges that they had when moving to SSL (and I also agree with their decision that the control of SSL should rely on the application and not on the infrastructure).

Another big problem that exists is getting accurate feedback on what is going on. Our UnitTest coverage in TM is not as good as it should, and we still don't have a live website monitoring with 'is it still ok' service (which is something we need to look into next)

I'm thinking about ways to address this in code:

• Detect if the current server supports SSL (and don't allow SSL redirects if that is not working)
• Allow the enable and disable of SSL via a special 'admin only' REST command (which will be a challenge to do if the whole site is currently redirecting to SSL)
• Create a special 'Current Stats' REST command that provides information about the current server
• Find if there is a way to access IIS logs from TM so that we can use TM to detect that something is going wrong with IIS (for example the 404 errors in the current problem are IIS one, and they never reach the .NET Http pipeline
• Create a set of SAST rules specific for each release so that these 'check-list' items can be checked in a programatically fashion (and part of the deployment workflow)

Windows Store/Metro Apps - A 'client-server' sandbox built using Javascript?

I read the MSDN article Web to Windows 8: Security by Tim Kulp (@seccode), and one topic that caught my attention was the idea that in Windows Store Apps there are two 'Contexts' that javascript can run under (see. Features and restrictions by context (Windows Store apps using JavaScript and HTML)) 

Tim in the Web to Windows 8: Security article keeps referring to the idea that in a normal client-server application (like when a website consumes data from a website/server) most client-side security is for 'usability purposes' and the real security work (for example Constrain, Reject and Sanitize input or authorise data accesses) happens at the server.

Now is correct when the 'assets (and capabilities) to protect' are at the server and the client shouldn't have full access to them.

I.e. the security needs to happen at the location where there are security implications and abuse scenarios. A simple example is authorisation: we don't want the user to be able to click on 'admin' features, but the enforcement of that security measure (i.e. 'users don't have access to admin functions') must not happen on the client but on the server.

So as I read that article and got my head around the new 'Local vs Web context' I was thinking "Hold on, this has nothing to do with javascript code vs server code". What matters is 'where' the client and server code are located. And it looks to me as what is happening is that in Windows Store Apps the client is the 'Web Content' code and the server is the 'Local context' code

Looking at this code execution from the point of view of trust and capabilities boundaries, we have the same concepts and architecture as in the normal 'Browser-WebServer' model.

In the example shown in the article, there is code that running at a higher privilege mode (the Local Context code) which as access to important assets (like the local data storage) and there is code that runs at a lower privilege mode (the Web Context code) which is going to do dangerous thinks like 'fetching javascript from other sources'.

There is even an 'official' communication channel between the Web and Local contexts that uses the postMessage Html5 feature (see example in 'Communicating Between Contexts' section) 

This is a typical client-server architecture where security needs to be applied at the location where the assets can be accessed (in this case the Local Context code) and 'untrusted code' is sandboxed (i.e. isolated).

Is this Microsoft inventing another Sandbox technology? (Btw I still think that CAS (Code Access Security) is by far the best Sandbox model out there , which is a shame since CAS has been killed but  since there is a big different between mostly dead and all dead a 'miracle man' might bring it back one day :)  )

Back to Windows Store Apps, the most important question on any Sandboxing technology, is who is enforcing the sandbox? 

Practically speaking, a Sandbox is just a way to prevent 'unprivileged code' from executing 'privileged actions' or accessing 'privileged data':

• In kernel drivers: there is no sandbox
• In Windows apps: The Windows Process is the sandbox, enforced by the Kernel
• In .Net and IIS apps: The Windows Process is the sandbox, enforced by the Kernel
• In .Net apps and IIS running in partial trust: The .Net's AppDomain is the sandbox, enforced by the CLR
• In Client-Server apps: the client is the sandbox, enforced by the server's attack surface
• In Mobile apps: the app 'execution environment/process' is the sandbox, enforced by the OS (and a security policy)
• In Windows 8 Store Apps: the Web Context is the sandbox, but who enforces it?

Its the last one that I am not sure of:

• Who is actually enforcing this Sandbox? the browser? the Javascript engine, a javascript APIs? the windows process?
• What are the communication possibilities between the Web and Local contexts?
• Is there an CAS-Like security demands architecture that declares and enforces Code Access Security on specific functions (or assets)?
• Aren't they both (Web and Local contexts) javascript/html code that is running on the same browser session? (and OS process)?
• Isn't there a gazillion of objects (think Html elements and Javascript variables/objects) that are shared between them?
• How does this play with the powerful javascript capabilties to 'bend reality' and change just about everything (for example prototypes)?
• What are the rules-of-engagement for the Javascript this object?
• What about all those Html 5 security issues? (see these two cheat-sheets)
• Are there any SAST (static code analysis) tools that can scan these Windows Store Apps and identify security issues?
• Is this a javascript sandbox for javascript code? That is a hard one to pull off (and if so, surely Microsoft must have changed the way its Javascript's engine works)

Btw, let me know if there a site or page with these answers? (see the Windows 8 Sandboxing post for some good references I found)  

OK, so if I'm getting this right, in Windows Store Apps: 

• We have a browser (IE 10) running under an 'locked down' user identity (with for example file restrictions enforced by the OS)
• That browser loads a website which has Javascript code running under two different contexts
• 'Somebody' is enforcing/sandboxing a number of security restrictions on the 'Web Context' javascript code
• There are a number of 'Javascript accessible' assets that need to be protected from that sandboxed Javascript code (which that can come from hostile/compromised sources)

Humm... this sounds very dangerous (from a security point of view). 

I bet part of Microsoft's strategy to keep Metro Apps secure, is to do a lot of security analysis on the app's submission for publishing (note: after trying very hard on this post to use the 'Windows Store Apps' (or whatever the latest name is) I agree with Hal in just keep calling it Metro , and am going to use the Metro Apps name from now on).

Appendix: 

Error in plain sight: What is wrong with these two pictures (which passed MSDN publishing QA)

Image from the MSDN article:

Original image (used as inspiration for the one above)

Util - Cir Viewer (with C# DLL converter) v1.0

Here is an oldie one by still really effective.

I just rebuilt the O2's CirViewer (CIR = Common Intermediate Representation (from the OunceLabs days)) as an easy to consume stand-alone tool which you can get from: Util - Cir Viewer (with C# DLL converter) v1.0.exe

MSDN Magazine article: "Web to Windows 8: Security"

Here is an interesting article to read (which I haven't (yet)):

Web to Windows 8: Security

It is in the Nov 2012 issue of MSDN magazine, in the Javascript Security section, and it covers topics like:

• Input Validation 
• Sensitive Data Storage 
• Local vs. Web Contexts 
• Communicating Between Contexts

Scripting MDbg and DbgHostLib

If you are into script .Net debugging sessions (see WinDbg, Cdb, Sun-Of-Strike and Util - Start SoSNet (O2 Version).exe  and Scripting SoS (Sun-of-Strike) .Net managed extension using O2 ) you will also find interesting the Scripting MDbg.pdf and  Scripting DbgHostLib.pdf documents (both embedded below)

WinDbg, Cdb, Sun-Of-Strike and Util - Start SoSNet (O2 Version).exe

If you are want to manipulate or analyze a .Net in real time, one of the best options is to use the .Net debugging API, and the best way to do that is to use the cdb.exe utility (downloadable from here) with the SoS (Sun-Of-Strike) managed debugger extension

A while back I found the SoSNet project (which was a gui on top of Sos) from https://bitbucket.org/grozeille/sosnet which I then forked into https://github.com/o2platform/O2_Fork_SoS_Net/ in order to allow it to compile under Roslyn (and add a couple other changes/fixes)

If you want to give this tool a test drive here is an stand-alone exe: Util - Start SoSNet (O2 Version) v1.0.exe (created from the Util - Start SoSNet (O2 Version).h2 script), which you can see in action at the end of this post.

Scripting SoS (Sun-of-Strike) .Net managed extension using O2

If you want to script the Sun-of-Strike (SoS) managed .Net debugging extension (see WinDbg, Cdb, Sun-Of-Strike and Util - Start SoSNet (O2 Version).exe post) you should read the Scripting SoS.net pdf (embedded bellow) since it provides a detailed explanation (with tons of scripts) of how I used the O2 Platform to script (in realtime) SoS and to create the Util - Start SoSNet (O2 Version) v1.0.exe tool (see also the SunOfStripeAPI.cs and SosNet scripts folder)

(tips of Firebug and) Using TM code sample as source material for posts

Arvind just posted Javascript application testing - Firebug which talks about using Firebug to do some client-side manipulation on a browser.

What I like about that post is that he is using TeamMentor as the background of his example.

That is great, since one of the reasons why I fell is so important to have TeamMentor's source code publicly available is to allow its code to be used in application security threads (like for example the one I tried to start with Is there a spreadsheet/template for Mapping WebServices Authorization Rules? ) 

The complexity will still exists (even if you don't want to look at it)

One of the common complains I get when presenting a large set of ideas (or prototypes) is the "woooahhh that's complex" or "that's too complex" or "that's too much"

To usually my reply is "... well we are dealing with a complex topic..."

It's always interesting how it is easier to ignore complexity, than it is to try to understand it.

It's easier to ignore reality, than to see what really exists (or what is possible).

And the 'reality' will still be there, but if we ignore it, usually what happens is : Nothing! 

Unless we are very lucky, it is very hard to solve a problem when we don't know what the problem is.

For me, the interesting questions are :

• "Is this 'complex thing' that I'm presenting an accurate representation of reality?"
• "If so, is it simpler than the previous version (or the current status quo)"

If the answer is NO, then its time to understand where the 'understanding gaps' exist, to modify the model/solution and to see if it still works.

If the answer is YES, then I'm happy that I'm on the right direction.

Now usually at this stage, the 'complexity level' is still too high, and maybe the target 'user base' is very small. But I believe that Simple solutions are a result of an continuous refactoring of complexity, until the 'right' solution 'just happens'. 

So until we reach the "...now that's simple..." destination, its time to go back to the engine room and  create the next generation of the working prototype (which hopefully will be simpler/less-complex and closer to the final solution).

Btw, one of my favourite moments, was when I was presenting (to a wider audience) an early prototype of O2's ability to visualise multiple SAST traces into one 'consolidated trace' and 

 ... the first guy said (pointing at the screen) "THAT! is crazy!, this is far to complex and hard to use"

and

 ... the 2nd guy said (pointing at the screen) "THAT! is simplicity!, because I spend hours and hours to process the same traces, and don't even get to this level of understanding" 

I wish that OWASP in 2014 ....

In 2014, it would be amazing if OWASP  has:

Open question to Etsy security team: How can OWASP help?

Since I don't have a direct contact at Etsy's security team (apart from security-reports@etsy.com), here is the question I would like to ask them (which hopefully will reach the right person).

------------------------------------------------------------------------------------------------

Dear Etsy security team, 

How can OWASP help?

Etsy.com - A case study on how to do security right?

First a quick disclaimer that as far as I can think of, I don't know anybody at Etsy.com or had any conversations with them in the past.

Following from Nick's presentation on Amazing presentation on integrating security into the SDL ,  my look into Etsy's Code as Craft blog and my experiment with Graphite (see Measure Anything, Measure Everything, AppSensor and Simple Graphite Hosting).

I have to say that I have been more and more impressed with Etsy's pragmatic and focused approach to application security.

For example check these out:

• Scaling User Security (where they described their experience in: 'Rolling out Full Site SSL' and  'Two factor authentication'
• Announcing the Etsy Security Bug Bounty Program 
• Couple more posts tagged as 'security': http://codeascraft.etsy.com/category/security/
• Etsy has been one of the best companies I've reported holes to. (reddit thread)
• Effective approaches to web application security (haven't read it but looks like another really 'must see' presentation' 

This is 'real-world' stuff and its what happens when there is a good awareness on the importance and need for doing security.

As you can see,  here is a team (from management to engineering) that 'gets' application security, and these are the guys that should be driving a number of OWASP's initiatives, since they represent the 'real-world'. Please correct me if I'm wrong, but a google and owasp search (for 'OWASP Etsy') didn't show a lot of joint activity (the best ones where Nick's participation in the AppSec USA and this job post mentioning the OWASP Top 10). It would be great to see Etsy's guys pushing projects like: AppSensor, ESAPI, Zap, Testing+Developer+Code-Review guides, O2, Exams/Certification, etc...

We (OWASP) need to find ways go get these guys more involved and put them on the driving seat.

In fact, for the next OWASP Summit, we have to make sure these guys are there, working collaboratively with the best minds in Application Security :)