O2 REPL scripting video with Audio (consuming YouTube data)

This video shows the power of O2's REPL environment, for example to quickly create several GUIs to visualize the data received from YouTube.

As you noticed, this video contains Audio (99% of the O2 videos created so far are silent). In this case I'm providing a running commentary of the creation of the list you can see in the 39 O2 Platform videos with 12k YouTube views post

So here is a question to you: does the audio helps to understand what is going on better?

39 O2 Platform videos with 12k YouTube views

After uploading the O2 Installer video, I took at look at the O2 related videos stats and was amazed to see that there were 20 subscribers with about 12,000 views of O2 related videos :)

Looking at the list of those videos, there are some really good gems in there, so for reference here they are:

• O2 Script to Download List of YouTube Videos - Apr 12
• O2 Platform v4.0 Installer and quick tour of its scripting tools - Apr 12
• O2 Demo - Auto patching of Asp.NET response.Write - Nov 11
• A developer's rant about security professional - Oct 11
• Writing an O2 'IE Automation' Script for JPetStore Account Creation - Jul 11
• Using O2 to view ESAPI's call-flow graphs - Jul 11
• JpetStore - View Spring MVC Controllers and CommandClasses - Jul 11
• JpetStore - Start Server and Make sure everything is working - Jul 11
• JpetStore - BlackBox Exploits - Jul 11
• Fixing a bug in an O2 Script - Jul 11
• Writing an O2 Script to login into Veracode - Jul 11
• O2 Platform - MediaWiki Page Editor - Viewing, Editing and Creating content - Oct 10
• O2 Platform - WebScarab - Custom O2.avi - Oct 10
• O2 Platform - Gui Automation PoC - Using Notepad.avi - Oct 10
• O2 Platform - Findings Viewer - IBM AppScan Source 7 0 - Oct 10
• O2 Platform - Tool - Using OpenPgp to Encrypt or Decrypt.h2 - Oct 10
• O2 Platform - UnitTest - Twitter_XSS_Vuln_in_ManageDomains - Oct 10
• O2 Platform - Tool - Create Twitter Accounts - Oct 10
• Tool - Find Physical Location via MAC Address (using Google's APIs).h2 - Oct 10
• O2 Platform - View IBM AppScan 7.9 scan files - Aug 10
• O2 Video - Demo Script - HacmeBank Full PoC - Jul 10
• WebGoat - First Example of O2's WebGoat API  - Jun 10
• O2 Platform - Amazon S3 Browser - Jun 10
• O2 Platform - DotNet - Convert VBNet into CSharp - Jun 10
• O2 Platform - DotNet - Convert CSharp into VBNet - Jun 10
• O2 Platform - XSS PoC builder - Jun 10
• O2 Platform - Javascript Stats Viewer - Jun 10
• O2 Platform - Javascript AST Viewer - Jun 10
• HacmeBank - wizard to start server - Jun 10
• HacmeBank - exploit's execution gui - Jun 10
• O2 Platform - Installing V1.0 Beta (22-June-2010) - Jun 10
• O2 Platform - Blogger API (post new blog entry) - May 10
• Using WatiN to create a GMail account - May 10
• O2 Script - API for BTOpenZone (Ask for credentials) - May 10
• O2 Script - API for BTOpenZone - May 10
• Using the O2 .NET Ast Engine - May 10
• Using O2 to Write a tweet - May 10
• Updating O2 XRules Database - May 10
• O2 Tool OzasmtQuery - Editing data - Feb 09
• O2 Tool OzasmtQuery - Viewing Data - Feb 09

If you want to see how I created this list, take a look at the first video or at O2 Script to get YouTube videos list

Video of O2 Platform v4 Installer and quick demo of its scripting tools

Here is a video of how to install the latest (v4) version of the OWASP O2 Platform and a quick demo of some of O2 scripting tools I bet most of you have never seen that O2's Graph scripting environment :) .

If you want to install O2 now, download or clone it from : https://github.com/o2platform/O2_Install 

Here are a couple more details: Installer for O2 Platform v4.0 (first release) 

Video of TeamMentor.net in action

Using with Camtasia today I created a video of how to use the main TeamMentor GUI.

I was quite happy with the annotations added (TextBoxes and Balloons) :)

What do you think, do those annotations help?

On using Hashes as passwords (from client to server)

Following from the How to enforce password complexity on a Hash? post, here are some more thoughts on the use of a hash as password.

The key issue is that without SSL, there is no way we can really protect the user against somebody who is listening in (remember that the session ID is as good as a password).

In terms of the hash being the password (as it is with TeamMentor), if the hash is discovered, then it is as good as a password (although not usable via the GUI).

I quite like fact that the server never knows the password (it only knows the hash, which is the password salted with the username). Also note that on the server-side the hashes are stored by default in an XML file, since in a normal install there is no server-side-secure-storage capabilities.

The only attack I can see we might be able to mitigate is the reuse of stolen hashes. I.e. we could hash the current hash with the current sessionID on login, which would make it a 'only valid during this session token' which in a way is probably as secure as we can get. Note that if the attacker is able to grab the hash via traffic sniffing, then he can also grab the session ID (which for that session is as good as a hash). 

If we go down this route (hash+sesssionId), there is still going to be one moment when the username+password hash will need to be sent to the server (the one with no sessionId salt). That moment is when an account is created (the server needs to have a 'clean hash' to compare with the hash+sessionID hash :) )

At the moment, TeamMentor's most secure login solution is the Windows/AD integration which TeamMentor fully supports since 3.1.

Another option, is adding OAuth support (it would be great to be able to use Twitter, Google or Facebook as an identity provider)

Note: On the topic of the multiple type of hashes, see this answer in the OWASP Security 101 list by Michael Coates

GMail new design sucks. Google please learn from Apple not Microsoft

So it looks like GMail finally pulled the plug on using the 'old' Gmail design and is now forcing the 'new' design into its users.

The reason I don't like the new design is because I like the 'old' one ,and don't want to learn the new UI concepts dreamed up by Google designers.

Everytime I tried to use the new design I didn't like it. It didn't feel confortable and the things that I wanted to do where not dramatically simpler (or even intuitive). I'm sure that if I spent time with it I might start using it better (or be able to racionalize better why it sucks), but I have other things to do with my life.

This is the mistake that Microsoft makes over and over. Why do I have to learn how to do the stuff I already knew how to do? And if you are going to change it, at least it make a massive difference (for the better), but in a lot of case the number of steps are similar, only the path changes.

And this is where Apple (in most cases) gets it right. They are experts in making incremental changes that just feel 'right'

More and more I feel that it is important to have evolutionary changes (whose timeline can be moved back and forward), which btw,  is a sign of good engineering practices.

And it looks like I'm not the only one that fells like this:

• http://heresthethingblog.com/2011/11/02/gmail-reader-mail/
• http://groups.google.com/a/googleproductforums.com/forum/#!topic/gmail/MY0kVJ9ACak
• http://heresthethingblog.com/2012/04/19/gmail-heres-chance-google/ 

From the last link it looks like the only short term solution is to use the even older html-only version :(

Any ideas on how to get the GMail back to its previous state?

In fact, why doesn't Google provide a Git like history so we can revert back to the versions we like :)

30/Apr Update: Here are a couple solutions http://techably.com/make-gmail-older-look-permanent/4215/ (the bookmark one looks specially interesting)

Testing TeamMentor 2.0 security using O2

Here are a couple documents I created almost one year ago when I started looking at TeamMentor.

These are a great example of the type of testing and security analysis I can do with O2 and what I would call a 'first pass at an Authorization Security mapping'

• v2.0 -TeamMentor WebServices Unit Tests.pdf
• v2.0 - Security Testing of TeamMentor WebServices - Part 1.pdf 
• v2.0 -Security Testing of TeamMentor WebServices - Part 2.pdf

Finally here is a very cool PoC that I did that allowed me to deploy (via new EC2 Image and remote O2 communications) a complete new server install of TeamMentor in a couple minutes (note that this was before I discovered Git)

• v2.0 -Tool for Deploying the TeamMentor to the Clould.pdf

OWASP Project Reboot 2012 - Here is a better model

In the last ROI on OWASP investment on Projects (ie paying leaders) post I mentioned that we need a better model to empower OWASP leaders with available funds (which seem to be at the moment about 100,000 USD)

My proposal / idea is to create a OWASP Project Sponsorship model based on these following simple rules:

• OWASP makes available a budget for OWASP Projects (for example 100k)
  
• OWASP leaders are free to use that money in anyway they want, with only the following restrictions:
  
• They can't pay another OWASP leaders or a company that an OWASP leader is directly connected to
• For amounts less than $500 they add its description to the respective OWASP WIKI page 24h before they commit to make the expense
• For amounts less than $5000 they add its description to the respective OWASP WIKI 7 days  before they commit to make the expense
• Each expense item is mapped to an individual OWASP leader and multiple OWASP Leaders can work together.
• Payments will be made by Alison on Invoice submission (by paypal or direct bank transfer)
  
• After the budget is spent (or in 6 months time), OWASP will review the outcomes and see if these rules need to be changed

And that's it!

This will allow the OWASP leaders (of any type) to just get on with it and find the best ways to take OWASP projects to the next level.

After you read this idea, take a look at the current Project Reboot Proposal at the OWASP Wiki.

From my point of view, there are a number of problems with that proposal:

• It allows the payment of OWASP leaders (see Why OWASP can't pay OWASP Leaders for a list of reasons why this is a bad idea)
  
• It doesn't learn from the past and all the hard work that went into the OWASP Season Of Code (SoC) concept - This proposal is basically OWASP SoC 2012, so at least least reuse what has been done before: https://www.owasp.org/index.php/Category:OWASP_Season_of_Code
  
• It puts the barrier of entry as an OWASP Membership (which is a 50USD registration) - I would put this barrier of entry at OWASP Leader level, since those are individuals that have earned OWASP's trust and have delivered (note that the issue of  'does an OWASP leader deserve to be OWASP leader' is a separate thread)
  
• There are a lot of pieces missing - If we are going down this path (which again is OWASP SoC 2012), then we will need to be as transparent and efficient as the last OWASP SoC. To get a better picture of what will need to be done, spend some time with the amazing pages that Paulo Coimbra (and the GPC) created on https://www.owasp.org/index.php/Category:OWASP_Season_of_Code (for example a lesson learned from past SoC is that all proposals must be submitted via the OWASP wiki)
  
• There is no Project Manager - Investing in OWASP projects in this way is a full time job. The first step should be to hire a project manager to work on this (one of the beauties of the model I propose above is that is much lighter to implement (since there is a high degree of self control)

Finally, don't get me wrong! Investing on OWASP's projects is one of most important things that OWASP needs to do, and if the Project Reboot Proposal is approved, we will be better than we were before.

The reasons for this post, is that I just think there is a better and simpler way of doing it :)

ROI on OWASP investment on Projects (ie paying leaders)

I was thinking about the crazy idea of paying OWASP leaders (still supported by a number of OWASP leaders) and I started wondering what was the ROI (Return of Investment) for OWASP and its community when OWASP did pay OWASP leaders (existing and new ones) to work.

For reference here are the projects sponsored in the past:

OWASP Autumn Of Code 2006  - 34,000$ USD invested on :

• WebScarab NG  ,  
• Live CD , 
• CAL9000 ,  
• SiteGenerator and ORG , 
• Pantera ,  
• Web Goat , 
• Testing Guide , 
• OWASP .NET Tools ,. 
• OWASP Website and Branding 

OWASP Spring Of Code 2007 - 117,500$ USD invested on:

• The OWASP Web Security Certification Framework ,
• SqlMap ,
• OWASP Site Generator , 
• Attacks Reference Guide ,
• The Scholastic Application Security Assessment Project,
• Inspekt: Input filtering and validation library for PHP ,
• Code review Project ,
• OWASP Certification Project ,
• OWASP Education Project ,
• OWASP The Anti-Samy Project ,
• Security throughout the SDLC ,
• OWASP WebGoat Solutions Guide ,
• OWASP WeBekci Project ,
• Python Tainted Mode ,
• WebScarab NG Security Test Automation ,
• Refresh Attacks list ,
• Best Practices & Countermeasures ,
• OWASP brand ,
• Web Application Security put into practice ,
• OWASP JBroFuzz Project ,
• Owasp Orizon Project ,
• Enigform: Firefox Addon for OpenPGP signing of HTTP requests ,
• OWASP LiveCD Education Project ,
• OWASP Java Project ,
• OWASP LiveCD Project ,
• Interim @ Aspect Offices ,
• Help with SpoC project management ,
• OWASP Corporate Application Security Rating Guide

OWASP Summer of Code 2008  $104,000 USD invested on

• 100% Completion
• OWASP Testing Guide v3 
• OWASP Ruby on Rails Security Guide v2 
• OWASP Live CD 2008 Project
• OWASP Code review guide, V1.1 
• OWASP AntiSamy .NET 
• OWASP .NET Project Leader
• OWASP Source Code Review OWASP Projects 
• OWASP AppSensor - Detect and Respond to Attacks from Within the Application
• OWASP Backend Security Project 
• OWASP Securing WebGoat using ModSecurity 
• OWASP Teachable Static Analysis Workbench Dmitry Kozlov 
• OWASP Access Control Rules Tester 
• OWASP Skavenger Matthias Rohr
• OWASP Online code signing and integrity verification service for open source community (OpenSign Server) 
• OWASP Code Crawler
• OWASP OpenPGP Extensions for HTTP - Enigform and mod_openpgp
• OWASP Application Security Verification Standard
• OWASP Classic ASP Security Project 
• OWASP UI Component Verification Project (a.k.a. OWASP JSP Testing Tool) 
• OWASP SQL Injector Benchmarking Project (SQLiBENCH)
• OWASP Spanish Project 
• OWASP Internationalization Guidelines Project 
• GTK+ GUI for w3af project
• OWASP Book Cover & Sleeve Design
• OWASP Individual & Corporate Member Packs, Conference Attendee Packs Brief 
• Above 50% Completion
• OWASP Orizon Project 
• OWASP Application Security Desk Reference (ASDR)
• OWASP Application Security Tool Benchmarking Environment and Site Generator refresh
• OWASP Education Project
• OWASP Python Static Analysis 
• Below 50%  Completion
• OWASP WeBekci Project Bunyamin Demir
• OWASP Positive Security Project 

As you can see there were a LOT of projects that OWASP sponsored

From a pure ROI point of view, we need to ask: "How many of these projects are successful (or even active) today?" and "How much impact did these this investment actually had?"


If we look purely from a project deliverables point of view, although there were a number of solid deliveries I think one will struggle to come up with a positive balance (specially since some of the best things done to these projects happened after this sponsorship).

But if we look at this from the point of view of:

• Bringing new energy to OWASP (namely OWASP leaders)
• Improve the research on WebAppSecurity
• Improving the connections and relationships between these OWASP Leaders
• Empowering these OWASP Leaders to be involved in other areas (and projects) at OWASP (note how a lot of the most active OWASP leaders today were involved)
• Creation of new Chapters (directly connected to a sponsored OWASP leader) , with some of these chapters also eventually organizing OWASP Conferences

I would say that the balance is massively positive!

So the question is: "if we want to achieve similar results today, should we pay OWASP leaders again or do something different?"

My view is that we need a new model, one that is based on the concept that 'OWASP cannot pay for OWASP leaders' and focused on empowering those leaders.

For more on this topic see:

• Why OWASP can't pay OWASP Leaders
• Project Management at OWASP
• Why large OWASP projects start to stale (and who should pay for the work) 
• OWASP: Proposed change for SoC: Use budget to pay for project related expenses  (from 2009)

Alternatives to IE WebBrowser Control in .NET

UPDATE (Jun/13): see When the best way to automate Chrome is to use ... Chrome (with examples on Google search, direct AngularJS scope manipulation and ChromeDriver javascript access) for a way to use the the actual chrome window inside a .NET process

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for a much better and powerful way to consume Chrome (and IE and Firefox) in another process

---

UPDATE (Jun/12): After this post was written I was able to use CefSharp to consume Chrome natively in C#:

• Running Chrome inside O2
• Video: Installing and running CefSharp (C# Chrome with WPF Browser)
• Video: Running Chrome Natively in O2 and VisualStudio  

---

I did some research on some alternatives to IE's WebBrowser control and here are some interesting options:

• CefSharp ...Net binding for the Chromium Embedded Framework...
• Berkelium ...provides off-screen browser rendering via Google's open source Chromium web browser... 
• berkelium-sharp ...Managed wrapper for the Berkelium embedded browser library.. 
• open-webkit-sharp ...GTLite Navigator An open-source WebKit web browser...
• Chromium ...open-source projects behind the Google Chrome browser and Google Chrome OS...
• Awesomium - ...Web Browser Framework ... (Commercial and Indie License) 
• Mono WebBrowser

Here are some StackOverflow threads:

• Use chrome as browser in C#? 
• Replacing .NET WebBrowser control with a better browser, like Chrome? 
• Is there an embeddable Webkit component for Windows / C# development?

I really would like to start consuming Chrome and Firefox's engines in O2 :)

Moral behaviour in animals. The privacy of Rewards

This Ted presentation is really interesting, specially the part (close to the end) when the same task is rewarded differently.

This made me think that a job's pay/salary/reward is a privacy issue (whose disclosure has negative effects for a team's overall performance).

Configuring .NET to use IE9 inside O2

If you are using O2's REPL environment to write IE scripts, you really should change your environment to use the latest version of IE inside the C# .NET Control (or else you will be using IE 6 or 7 which is just about unusable in today's web world)

This is the O2 Script that does that: Set .NET WebBrowser Control to use latest version of IE

Once that is executed, you should get IE 9 inside O2:

Code Mirror and TeamMentor's Html Code Editor

Code Mirror (online code editor) is great, I used it on TeamMentor (TM) to create an web editor for server side content (one of the gems hidden inside it :)  ).

Code Mirror was really easy to integrate and you can see it in action below or at: jsbin.com , sourcelair.com or wescheme.org

Yes, I can edit HTML directly from the browser :)

This is a great 'admin' feature and has helped me to solve a lot of problems in real-time on remote deployments. It also has a number of security features/requirements, which I want to cover on later posts.

Btw, I would like to package this module as a separate project, since this HTML/Ashx code editor is already packaged as a stand alone unit inside TM (if anybody wants to do it ping me directly, this would be a great mini-project to do)

At TM, the code is the WebEditor folder and the real action happens inside the WebEditorService.ashx file.

Here it is in action:

Arithmetic, Population and Energy, by Albert A Bartlett

Albert A Bartlett provides a really powerful explanation of the power of the Exponential function.

In fact, on his "Arithmetic, Population and Energy" presentation (see video below) he states: "The greatest shortcoming of the Human Race is our Inability to Understand The Exponential Function" 

I actually think that exponential growth (until it reaches saturation) is one of the more effective, pragmatic, democratic and healthy types of growth.

The examples provided are amazing, and really makes us think about how to measure success and what are the real signs of adoption.

I will really look differently at 2% or 5% growth from now on :)

The presentation is an an eight part video, and here is the first one:

And here are all 8 of them

Light Table - Amazing PoC of IDE

Couple days ago Chris Grangers posted Light Table - a new IDE concept (inspired by Bret Victor - Inventing on Principle presentation) , and its Light Table's numbers follow-up post shows how well his ideas where received by the developer community.

In a way a number of these concepts are already present in the latest version of O2 and its REPL C# environment (note to self: start blogging about O2's scripting environment)

These two videos are well worth the time to see them

Chris Grangers - Light Table
 

Bret Victor - Inventing on Principle

Google BBS - What Google would have looked like in the 80s

Ahh this takes me down the memory lane...

http://www.masswerk.at/googleBBS/ is a javascript demo of "Google BBS - What Google would have looked like in the 80s"

I spent a lot of time on BBS , I even hosted one for a while :)

Adding Gaug.es to Blogger, XSS by design?

I just added Gaug.es monitoring to this blog (hosted by Blogger). That can easily be done by:

• going to the Blogger Layout page (via the admin panel)
• at the bottom click on 'Add a Gadget'
• chose the HTML/Javascript gadget from the 'Basics' list
• add the Guag.es tracking code, that look something like this:

For this to work, Blogger is in essence allowing me to inject Javascript into this blogging site, which is basically persistent XSS :)

In fact , the code sample above (GIST from GitHub) is also an XSS injection, so one can also put script execution on normal posts:


So what are the security implications of this?

• The javascriopt code will be executed under the http://diniscruz.blogspot.com/ domain, so (in principle) any script on it should not be able to affect any other *.blogspot.com domain
• The injection of code via the blog Layout means that any blog admins can take over this blog (so that is OKish)
• But what about Javascript on the blog post? Doesn't that mean that any author of this blog can take over the blog (by putting a payload on a page and waiting for an admin to see it?)
• What about visitors to this blog? Is there a way to 'attack' them? 
• For example: will it be possible to auto-post a comment (or vote) for them? It looks like comments are made from http://www.blogger.com/comment.g?... so that could prevent it

Question: Is there a write-up somewhere on the interweb about the security implications, threads and countermeasures of allowing user Script injection in a user-driven site like blogger?

This question is very relevant to me at the moment, since the 3.1 beta version of TeamMentor allows raw HTML (and Scripts) to be used on TM Articles (this is a feature requested). And I need to figure out the best way to handle it

Gaug.es is Amazing - Just added RealTime website tracking to TeamMentor

If you haven't tried Gaug.es you are missing on a great service. They are now owned by GitHub and it is easy to see why they were bought. Not only you get real-time data, their AirTraffic Live view is just amazing (it's basically world map with a little dot showing a request)

I just added gaug.es support to TeamMentor and I'm really happy with the results. All of TeamMentor's content is dynamic, so it actually making it work required some customizations.

You can see it in action in the TM Documentation site (build using TeamMentor):

• http://docs.teammentor.net - main page which loads dynamically the documentation 
• http://docs.teammentor.net/html_pages/Gui/TeamMentor.html - base TeamMentor GUI, which also loads the TM Articles dynamically in the preview window
• http://docs.teammentor.net/xsl/TeamMentor_Technology - This is the wiki-inspired version of TeamMentort, which I'm using to document how TeamMentor works. A server-side XML+XSL = HTML page which also loads the content dynamically.
• http://docs.teammentor.net/xml/Eval and   http://docs.teammentor.net/xml/Customer - Client-side XML+XSL = HTML where the article's content is edited directly via XML (checkout the source code of this page)

As you can see in all cases, I needed to be able to feed gaug.es normalized traffic so that the data collected is a good reflection of what actually happened (what pages where opened, etc...).

To do this, I modified the default https://secure.gaug.es/track.js they provide and  added a couple extra features ( I also host this file from the TM server which is a good security practice)

You can see the final version in this GitHub file Gauges_Tracking_Code.js with the key changes shown  in the source code snippet included below. Once this is set, I can feed data to gaug.es by just calling my_Gauge.track("Action", "Page"):

Checkmarx database export, VistaDB in O2, Opening up Checkmark's rules, and more....

I just posted on the O2 Blog and TM Documentation the scripts I wrote during the PoC of integrating TeamMentor with Checkmarx:

• VistaDB API and GUI (as used by Checkmarx SAST engine) - O2 Blog
• Exporting Checkmarx SAST Database into XML files - O2 Blog
• Case Study – Creating a CWE Library from CheckMarx data - TM Documentation

Earlier today I had a call with Checkmarx to follow up the idea I talked with Maty (Checkmarx CTO) about the release of Checkmarx 'C# based rules' under an Open Source/CC license on GitHub.

I have to say that the Checkmarx camp seems really motivated to do this, and if they do it, it could be a big game changer (I offer to put those rules in GitHub since I already have the Query.xml file :), so lets see what happens next ).

Btw, if you are a Checkmarx customer (or are evaluating it - which if you are looking at SAST you should), drop them a line saying that it is a good idea :)

Video on TeamMentor Install/Execution

As you can see it is pretty easy to install/execute TeamMentor from a local server (Cassini) or IIS :)

If you want to repeat the steps from the video, the GitHub repository you need to fork is: https://github.com/TeamMentor/TeamMentor-Documentation

Leaking TeamMentor's Pricing model

Last week I was with Ed Adams (Security Innovation CEO) while he was in the UK to meet some TeamMentor customers, and I commented how it really sucks when a tool vendor doesn't give you a strait answer when you ask them the simple question: '...so... how much does your tool costs?' 

And they usually reply '...well, that depends on this, ... and on that,  ... and on how many users, .. blah ... blah... blah...  and if it is yellow, .. and on how much support is needed , blah.. blah... blah .. and if it needs to sign in tune ... blah... blah...blah...and if it actually needs to work ... blah ... blah...blah...'  (and after 5 minutes you still have no idea how much it costs)

I'm sure you have heard those lines before :)

It basically means that they trying to figure out before they give you a price: a) how big you are, and b)  how much money you have to spend

This is just wrong!

Customers need to be treated with respect, and pricing must be clear, consistent and easy to understand.

So as Ed was agreeing with me, I gently noted that we didn't put our current pricing model for TeamMentor (TM) on the Security Innovation (SI) website :)

And please note, the SI team is really good ! The politics level is very low, and they are a pleasure to work with. But when everybody is doing it (not disclosing prices) it is hard to be the first one.

So let me see if I can help :)

And the end of our conversation, I said "... you know Ed ...  I really want to leak TeamMentor pricing model  ... and once it is out there ... it is out there ...."  :)

And (actually not to my surprise, since Ed is really relax in these things), Ed just said "...ok, do it.."

So, here it is: (get ready for an anti-climax moment)    

TeamMentor pricing model is:

• 40k USD  - Unlimited (per business unit) TM Server Installs + SI Library (with 4000 Articles) +  dedicated GitHub Fork (which we will maintain) , 
• 10k USD  - 1x  TM  Server Licence + SI Library + dedicated GitHub Fork
• 0k USD    - 1x  TM  Server License + OWASP Library + shared GitHub download (this is our 'evaluation' version and comes with a 'not for commercial use' license)

There are a couple TeamMentor related Services that we will be providing ( 'Policy document to TeamMentor Library' conversion, 'TeamMentor in the Cloud', TeamMentor customizations, etc...), and there is also a reseller agreement, with a 20% to 40% commission.

In a way, one of the value propositions of TeamMentor, is that it is more expensive to pay somebody to write 'specialized application security' content, than it is to buy TeamMentor's Library.

And that' it :)

Disclamer: I did forward this email internally at SI (as a sign of respect and to made sure that I didn't get any details massively wrong), and apart for the strike-through 'a 20% to' (just above) there were no further changes. One comment that Adam (VP of sales) made  was "... well I do wish that they contact me directly if they want to talk about pricing..", so to make Adam happy, here are his contact details: ahoffman@securityinnovation.com  +1 (978)337-1810

Autonomy, Mastery and Purpose

These are the 3 factors that lead to better performance & personal satisfaction, according to this is great presentation from Daniel Pink  (the animation on top of it is pure genius) :

Drive: The surprising truth about what motivates us:

This presentation provides a lot of clues of why OWASP leaders/contributors work so hard and in fact why they love OWASP.

Basically OWASP gives them these 3 things: Autonomy, Mastery and Purpose :)

Here is the original presentation from Daniel Pink (which is 40m long):

UK's Government Digital Service Design Principles

This is simply amazing: https://www.gov.uk/designprinciples

These guys from UK's Gov, just released a set of
10 Design Principles which are absolutely spot on:

• Start with needs*
• Do less
• Design with data
• Do the hard work to make it simple
• Iterate. Then iterate again.
• Build for inclusion
• Understand context
• Build digital services, not websites
• Be consistent, not uniform
• Make things open: it makes things better

This is a roadmap for a lot of things, in fact, the more I look at it, the more I feel that this is the kind of focus that OWASP should have.

And so should the O2 Platform and TeamMentor

My favorite is #4 : Do the hard work to make it Simple... Making something look simple is easy; making something simple to use is much harder — especially when the underlying systems are complex ..."

Why OWASP can't pay OWASP Leaders

Since I was the one that created and executed (initially alone and then with Paulo) the only Seasons of Code that OWASP did (AoC 2006 , SoC 2007 , SoC 2008) I know first hand what can be done, what works, what doesn't work and its side effects. In fact it was that experience that made me have such strong views on this topic.

There is a subtle but very key distinction that we need to have in this thread. And that is the issue of 'OWASP paying OWASP leaders'

Hiring interns or other professionals to work on specific projects/tasks is fine (specially if they are doing what our OWASP leaders and contributors don't want to do). The main problem happens when OWASP leaders can be part of the pool that can be paid by OWASP (again nothing wrong with them being paid by a 3rd party to work on an OWASP Project (like what already happens today)).

So why it is very wrong to pay OWASP leaders to work on OWASP projects?

Project Management at OWASP

What OWASP needs ASAP is Project Management (the type Paulo was doing).

In fact, we don't need 1, we need 4 or 5 project managers....

But I will settle for one in the short term,

There is a HUGE amount of work that needs to be done by the OWASP Operational machine, and THAT is where we (OWASP) needs to be putting our resources (i.e. creating the 'OWASP Platform') .

At the moment we (OWASP) can't even accept and guide projects that want to become OWASP projects!!! And let's not forget the 'huge' (i.e. none) support we give our current projects leaders (Hey !..I'm one of those OWASP Leaders that feels quite abandoned at a conner of the OWASP Project's landscape...)