The Open Web Interface for .NET (OWIN) and Katana

Definitely need to take a look at this: http://www.asp.net/aspnet/overview/owin-and-katana/an-overview-of-project-katana (anybody used it?)

Here is its hello world example:

A quick skim of that article showed that they were inspired by Rack and Node.Js , which can't be a bad thing :)

To Read: A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications

This looks like a promising way to deal with CSRF:

A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications (PDF)

To read: Reddit’s thread on ‘We are the Mozilla Security Community, Ask Us Anything!’

This looks like a great Q&A from Mozilla’s (quite impressively big) security team:

http://www.reddit.com/r/netsec/comments/1b3vcx/we_are_the_mozilla_security_community_ask_us/

Feedback needed on 'Static Analysis Tool Evaluation Criteria'

Sherif Koussa is looking for feedback on the Static Analysis Tool Evaluation Criteria document he is working on.

This is a really important document/criteria which would help SAST users to know which is the best tool for their needs.

It looks good and I will try to read it in the next week or so.

There is a mailing list which you should join if interested in this topic.

Daniel Pradilla on 'Stop punishing your users and learn some design'

Daniel Pradilla has a great post on Stop punishing your users and learn some design which is also been discussed on reddit

Is O2 like Humane Assessment?

Dennis Groves pointed me to http://www.humane-assessment.com/ saying “This looks a lot like the O2 Platform” and I have to say that at first glance, yes, yes it does:

Netflix “Resilience Engineering” FOSS Library and Security

Really powerful stuff (and to-read material):

• Netflix Open Sources “Resilience Engineering” Code Library  - news article
• Reddit thread about the article linked above
• Fault Tolerance in a High Volume, Distributed System and Making the Netflix API More Resilient - detailed NetFlix blog posts
• Performance and Fault Tolerance for the Netflix API - August 2012 - speaker deck presentation
• Netflix / Hystrix - GitHub repo

Michael Feather's 10 Papers Every Programmer Should Read (At Least Twice)

Michael Feathers posted 10 Papers Every Programmer Should Read (At Least Twice) which looks like a great list for a rainy day.

Here are the 10 (and I'm embaraced to say that I have not read most of them):

• On the criteria to be used in decomposing systems into modules – David Parnas
• A Note On Distributed Computing – Jim Waldo, Geoff Wyant, Ann Wollrath, Sam Kendall
• The Next 700 Programming Languages – P. J. Landin
• Can Programming Be Liberated from the von Neumann Style? – John Backus
• Reflections on Trusting Trust – Ken Thompson
• Lisp: Good News, Bad News, How to Win Big – Richard Gabriel
• An experimental evaluation of the assumption of independence in multiversion programming – John Knight and Nancy Leveson
• Arguments and Results – James Noble
• A Laboratory For Teaching Object-Oriented Thinking – Kent Beck, Ward Cunningham
• Programming as an Experience: the inspiration for Self – David Ungar, Randall B. Smith

If you don't have time to read them, or want to chose the first one to tackle, go to Michael's 10 Papers Every Programmer Should Read (At Least Twice)  post and read is brief description of each of these papers.

To read: ENISA on 'National Cyber Security Strategies'

On May 08, 2012 ENISA published an National Cyber Security Strategies paper which the current status of cyber security strategies.

 

Here is their desciption:
"..The paper includes a short analysis of the current status of cyber security strategies within the European Union and elsewhere. It also identifies common themes and differences, and concludes with a series of observations and recommendations. The paper is based on the preliminary findings and analysis from an ENISA project that is working to develop a Good Practice Guide on how to develop, implement and maintain a national cyber security strategy. The Good Practice Guide is intended to be a useful tool and practical advice for those responsible and involved in cyber security strategies...."

Here is the PDF, any comments?

Btw, I had a quick look and found no reference to OWASP, shouldn't we be involved here? Or does Cyber-Security has nothing to do with Application Security?