Privacy is one of those subjective topics that is hard to talk about, because everybody seems to have a different definition of it (which depends on culture, personal experience, current/past jobs and state-of-mind.
Recently I found a Seth Godin post (while reading Whatcha Gonna Do with That Duck? in the toilet) which really provided a great explanation of privacy.
The post happens to also be online (People don't truly care about privacy) and here is the key part:
Saturday, 8 June 2013
Friday, 7 June 2013
Why the need to enable the use of OWASP chapter funds
I just send the text below to the OWASP Leaders list, which was part of this thread
My answer was to Tim's comment and I started a new thread with it
-------------
Tim's solution (see below) is great and we should apply it now (using data from the last year). The only thing I would change is to remove the C (soft cap) and P (hard cap). This would have a net positive result for all chapters (and not move the money to the 'OWASP mothership' which is a very sensitive topic).
My answer was to Tim's comment and I started a new thread with it
-------------
Tim's solution (see below) is great and we should apply it now (using data from the last year). The only thing I would change is to remove the C (soft cap) and P (hard cap). This would have a net positive result for all chapters (and not move the money to the 'OWASP mothership' which is a very sensitive topic).
For the ones really interested in this thread/topic, you should read the amazing Seth Godin's post Non-profits have a charter to be innovators which really explains why OWASP (as an organisation) as the DUTY and moral responsibility to spend its available funds, to experiment, to get things done, etc....)
OWASP is Hiring a FT Event Manager (35k USD)
Sarah Baso just posted the email below to the OWASP-leaders list which is a great move for OWASP.
-
OWASP Leaders -
We are looking for a motivated professional to take on management of OWASP Events.
Applications are being accepted until June 21, 2013 with interviews immediately following with a final decision made by July 5, 2013.
How to apply: Email a cover letter and resume with your name and the position you are applying for in the subject line to owasp.foundation@owasp.org.
Please help us spread the word about the position by posting to your chapter/project lists, adding to applicable job boards, or forwarding to any individuals that you think would be interested.
Help out with WebGoat .NET development
If you are looking for a great project to learn about ASP.NET, C# and Web Application Security, WebGoat .NET is a great place to start.
Please grab the code (here or here), read the current issues and join the mailing list
See my WebGoat.NET in Action (and how I set-it up) post if you need help setting it up.
And please fell free to invite others to join the party :)
Please grab the code (here or here), read the current issues and join the mailing list
See my WebGoat.NET in Action (and how I set-it up) post if you need help setting it up.
And please fell free to invite others to join the party :)
13 Great Quotes from Steve Jobs
I like the fact that I can relate to most and am actively involved in executing them.
For example ... the idea that when we start working on something it tend to be very complex, and it is only by working on it 'over and over again' that it becomes simple, easy to use and useful (for a wide audience) ... is exactly how I approach the development of the O2 Platform and TeamMentor
For example ... the idea that when we start working on something it tend to be very complex, and it is only by working on it 'over and over again' that it becomes simple, easy to use and useful (for a wide audience) ... is exactly how I approach the development of the O2 Platform and TeamMentor
Controlling Selenium and Chrome WebDriver from a C# REPL GUI (while fixing UnitTest)
When I was Running TeamMentor WebAutomation UnitTests locally (using Selenium and ChromeDriver), there were a number of TeamMentor's UnitTests that failed, and could not be fixed with simple changes or re-execution
This post shows how I used the O2 Platform's FluentSharp REPL script_Me capabilities to debug the problem and find a solution.
This post shows how I used the O2 Platform's FluentSharp REPL script_Me capabilities to debug the problem and find a solution.
Running TeamMentor WebAutomation UnitTests locally (using Selenium and ChromeDriver)
If you want to run the TeamMentor's WebAutomation UnitTests (for example to see how we use Selenium and the multiple WebDrivers, like ChromeDriver), there are couple gotchas that you will need to take into account.
This post shows how I went from a git clone to a full execution of all unit tests.
This post shows how I went from a git clone to a full execution of all unit tests.
Wednesday, 5 June 2013
Adding Markdown support to TeamMentor's Article 'view and edit workflow'
After Adding MarkdownDeep Web Editor and Editing/Viewing an TeamMentor Article, the next step was to add Markdown support to the main TeamMentor's Article rendering and editing workflow.
Since all the heavy lifting was already done, adding these capabilities was relatively easy to do with the code that can be see on the 2ead06cf1098872849f8e1d68fb3215e2668f502 commit:
Since all the heavy lifting was already done, adding these capabilities was relatively easy to do with the code that can be see on the 2ead06cf1098872849f8e1d68fb3215e2668f502 commit:
Adding MarkdownDeep browser-based Markdown 'Edit and Preview' capabilities to TeamMentor (and editing an TM Article)
After Adding MarkDown support to TeamMentor using MarkDownDeep, where I got MarkdownDeep to work on the backend (ie server-side markdown transformation), the next step was to add client-side viewing and editing (i.e browser-side markdown transformation).
Although there is a MarkdownDeep NuGet package with the client-side coed, I wanted to put the files in a specific location, so I manually added the html, JS and CSs files into the TM’s Javascript folder:
Although there is a MarkdownDeep NuGet package with the client-side coed, I wanted to put the files in a specific location, so I manually added the html, JS and CSs files into the TM’s Javascript folder:
Adding MarkDown support to TeamMentor using MarkDownDeep
After adding ASP.NET MVC 4.0 in TeamMentor (with simple Controller, View and master Layout) I was ready to add Markdown support to TeamMentor.
I chose MarkdownDeep after reviewing the multiple Markdown C# and JavaScript APIs currently available (for more details see the references section at the end of this post)
My first step was to go NuGet and choose the MarkDownDeep - .NET Only Edition package:
I chose MarkdownDeep after reviewing the multiple Markdown C# and JavaScript APIs currently available (for more details see the references section at the end of this post)
My first step was to go NuGet and choose the MarkDownDeep - .NET Only Edition package:
Using ASP.NET MVC 4.0 in TeamMentor (with simple Controller, View and master Layout)
On TeamMentor's 3.3. release we added support for C# RazorEngine and System.Web.Razor.
For 3.4 release, there is requirement to add Markdown support (see next post). Since the API that I want to use (MarkdownDeep) works really well with ASP.NET MVC 4.0, here is how I added ASP.NET MVC 4.0 support to TeamMentor.
The process was quite smooth, and I was able to quickly get it up and running.
It all started with NuGet where I added this package
For 3.4 release, there is requirement to add Markdown support (see next post). Since the API that I want to use (MarkdownDeep) works really well with ASP.NET MVC 4.0, here is how I added ASP.NET MVC 4.0 support to TeamMentor.
The process was quite smooth, and I was able to quickly get it up and running.
It all started with NuGet where I added this package
Tuesday, 4 June 2013
WebGoat.NET in Action (and how I set-it up)
For the OWASP EU Tour London event I showed the WebGoat.NET vulnerable web app (which is a .NET variation of the highly successful Java-based OWASP WebGoat project).
Here are (draft) notes on my efforts to get WebGoat.Net up and running (which might help help others since there is very little documentation about this great new OWASP Project)
After cloning from https://github.com/jerryhoff/WebGoat.NET and using the code from the https://github.com/jerryhoff/WebGoat.NET/tree/new-lessons branch (note that there is now the https://github.com/OWASP/WebGoat.NET repo, which is a better home for this code), I was able to get WebGoat.Net running (see below the probs I had to solve), and here is what the first page looks like:
Here are (draft) notes on my efforts to get WebGoat.Net up and running (which might help help others since there is very little documentation about this great new OWASP Project)
After cloning from https://github.com/jerryhoff/WebGoat.NET and using the code from the https://github.com/jerryhoff/WebGoat.NET/tree/new-lessons branch (note that there is now the https://github.com/OWASP/WebGoat.NET repo, which is a better home for this code), I was able to get WebGoat.Net running (see below the probs I had to solve), and here is what the first page looks like:
View ESAPI 11 Encodings methods in real-time via an ASP.NET Web Page
In the Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net) I posted the screenshots below, which are such a big step forward that I'm creating this separate blog post to expand the idea a little bit :)
One of the things that I always wanted to do with ESAPI , was to have programmatic access to the multiple ESAPI encodings methods, since I believe they are a great example of the type of encodings capabilities that are needed in order to safely consume data provided by (potentially malicious) users.
ESAPI provides a number of sepecific methods to encode a string (each focused on a particular use case)
One of the things that I always wanted to do with ESAPI , was to have programmatic access to the multiple ESAPI encodings methods, since I believe they are a great example of the type of encodings capabilities that are needed in order to safely consume data provided by (potentially malicious) users.
ESAPI provides a number of sepecific methods to encode a string (each focused on a particular use case)
- encodeForHTML
- encodeForHTMLAttribute
- encodeForCSS
- encodeForJavascript
- encodeForVBScript
- encodeForLDAP
- encodeForDN
- encodeForXPath
- encodeForXML
- encodeForXmlAttribute
- encodeForURL
Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net)
Yesterday at the OWASP EU Tour London Chapter event meeting I presented the next step of my research on using ESAPI and AppSensor inside a .NET application like TeamMentor (using Jni4Net to allow the JVM to work side by side with the CLR).
The source code of the demo I presented is posted to the github.com:DinisCruz/TeamMentor_3_3_AppSensor repo, and this post shows a number of screenshots of what is in there.
I used TeamMentor’s TBot C# and AngularJS pages to create the prototypes (since it is very easy and fast to code in that enviroment)
The source code of the demo I presented is posted to the github.com:DinisCruz/TeamMentor_3_3_AppSensor repo, and this post shows a number of screenshots of what is in there.
I used TeamMentor’s TBot C# and AngularJS pages to create the prototypes (since it is very easy and fast to code in that enviroment)
Saturday, 25 May 2013
Creating o2platform.com website using GitHub Pages (with screenshots of all design options)
In order to set-up a site for the http://o2platform.com domain, I just used GitHub Pages to create and publish a brand new site.
This is what it looks like:
This is what it looks like:
What do you think?
Please see below the other design options and let me know if I made a mistake. Also if you want help in editing this site, ping me with your GitHub account, and I'll give you push access (or fork the o2platform.github.com repo and send me pull requests)
Using FluentSharp API’s to refactor C# TreeView sample
While reading reddit’s r/csharp I saw the Can anyone help me answer a quick question about treeview? thread which asked this question:
Creating a GitHub Fork in order to commit changes to PartyCraft
After posting Minecraft In-Game C# REPL I was curious on how it worked, so I quickly created a local clone of the https://github.com/SirCmpwn/PartyCraft repo and opened up the main Solution file in VisualStudio 2010.
PartiCraft has a couple Submodules, so the VisualStudio load process had a couple missing projects.
The problem is that after updating the two required submodules, the project references/paths where still wrong.
The fixes where easy (path changes and re-adding the references) which when done allowed the C# based Minecraft server to fire up ok.
But this meant that my local clone was out of sync with GitHub, and since I din't have push privileges into the main PartyCraft repo, I needed to push my changes into my own fork.
PartiCraft has a couple Submodules, so the VisualStudio load process had a couple missing projects.
The problem is that after updating the two required submodules, the project references/paths where still wrong.
The fixes where easy (path changes and re-adding the references) which when done allowed the C# based Minecraft server to fire up ok.
But this meant that my local clone was out of sync with GitHub, and since I din't have push privileges into the main PartyCraft repo, I needed to push my changes into my own fork.
Friday, 24 May 2013
Embedding O2 Platform Mailing list in this blog
While looking at the Google Groups options for the new O2 Platform mailing list I found an 'Embedding your Group' which I decided to try on this blog.
And the result is quite in interesting.
You can see it in action here (or by clicking on the O2 Platform Mailing List link above) and it looks like this:
And the result is quite in interesting.
You can see it in action here (or by clicking on the O2 Platform Mailing List link above) and it looks like this:
Minecraft In-Game C# REPL
This is really cool, just saw on this reddit thread the video below which shows a REPL inside minecraft
This is part of C# Minecraft written in C#:
This is part of C# Minecraft written in C#:
- https://github.com/SirCmpwn/PartyCraft
- http://sircmpwn.github.io/PartyCraft/ and https://github.com/SirCmpwn/PartyCraft
- Another powerful video: writing a Minecraft Classic server from scratch in 6 hours.
Should we use Bayesian or Neural Networks for SAST? yes, but not yet (we are not ready for it)
The super sharp OWASP Leader Johanna Curiel, while trying to get her head around the O2 Platform, asked me earlier today :
-
in your research, have you try static code analysis using any form of artificial intelligence such as Bayesian or neural networks ?
let know, while I was studying, I was researching this stuff. I just would like to hear from you if you had any experience with this
The short answer is NO, I have not really looked at Bayesien or Neural Networks for SAST (Static Analysis)
The longer answer is We Dont need it (yet), since there are many bigger limitations of the current SAST technology and tools, which we need to solve first before we look into that type of advanced analysis and techniques.
Thursday, 23 May 2013
Sarah Baso as OWASP Executive director, how it broke the model, structure and culture of OWASP employees
(note: I don't have a lot of time to write the detailed analysis that I wanted to do, but as time is passing by, I wanted to go on the record with my thoughts of that happened. So think of this post as a brain dump of my views on this important topic for OWASP)
In April 8th the OWASP board announced that OWASP Creates Executive Director Position.
My view at the time (and still is) was that OWASP Executive Director Role (Not yet), specially because:
In April 8th the OWASP board announced that OWASP Creates Executive Director Position.
My view at the time (and still is) was that OWASP Executive Director Role (Not yet), specially because:
-
What we need are another Kate, Sarah, Kelly or Samantha, they still work FAR too much for OWASP and my worry is that they will implode one day. Not sure that they need a boss to tell them what to do, if anything I would delegate to them the powers currently 'assigned' to the Executive Director.
Why should a company open source one of their products? and what is the business case?
If you where asked by a friend to help him make the business case to open source a product created by his company, how would you answer?
The scenario is a company that has a couple products and fells that it is not able to spend significant time and resources in one of them.
My answer was to 'just do it and push the support + maintenance efforts to the community'
Here are some links to good articles on Open Source business models:
The scenario is a company that has a couple products and fells that it is not able to spend significant time and resources in one of them.
My answer was to 'just do it and push the support + maintenance efforts to the community'
Here are some links to good articles on Open Source business models:
Trying Google Groups as the OWASP O2 Platform mailing list
This is something that some OWASP project leaders have talked/tested in the past, so to try it I moved the current mailman-based O2 list to the new Google Groups (which look much better than a couple years ago)
How TeamMentor creates SHA256+PBKDF2 password hashes and stores them in XML files
In the 3.3. version of TeamMentor there was a significant change in how the user's password hash is submitted and stored.
In version 3.2. we used a SHA256 hash of “username+password” (created either on the client (browser) or server) which was stored in the user’s xml file (which is a serialization of the in memory user-object).
Although we never stored the user’s password on disk (in fact in most cases we never even sent it to the server), due to advances in processing power and Credentials Brute Force Attacks, in 2013 that is not a secure way to store password anymore.
After some threads (see TM stores passwords insecurely issue), it was agreed that a solution based on PBKDF2 should be used.
In version 3.2. we used a SHA256 hash of “username+password” (created either on the client (browser) or server) which was stored in the user’s xml file (which is a serialization of the in memory user-object).
Although we never stored the user’s password on disk (in fact in most cases we never even sent it to the server), due to advances in processing power and Credentials Brute Force Attacks, in 2013 that is not a secure way to store password anymore.
After some threads (see TM stores passwords insecurely issue), it was agreed that a solution based on PBKDF2 should be used.
Wednesday, 22 May 2013
Upgrading the 'TeamMentor View Library Links Status’ tool to 3.3
One of the tools I developed during the 3.2 release was a window's tool that allowed the analysis and mapping of broken links in an TeamMentor library.
This tool is similar to the one I showed in this video and is on the https://github.com/TeamMentor/UnitTests repository:
This tool is similar to the one I showed in this video and is on the https://github.com/TeamMentor/UnitTests repository:
Subscribe to:
Posts (Atom)