OWASP Development Guide – what do you want in, and what do you want out?

Comments

4 responses to “OWASP Development Guide – what do you want in, and what do you want out?”

1. 

   May 9, 2012

   Andrey Botalov

   There are a lot of empty sections in the guide. I think that it’s better not to have section at all, then to have it empty/in draft or incomplete status. Clicking on those empty sections takes a lot of time. I think that if section is empty but is self-explanatory (OWASP-0602 Verify that all output encoding/escaping controls are implemented on the server side.), then it will be better to put it’s name into higher level list and to cut off list item that doesn’t contain information inside
2. 

   May 9, 2012

   vanderaj

   The empty sections are to be written 🙂 It’s early days as yet. However, my commitment is to high quality. I want the Guide to be THE reference architects, tech leads and developers have nearby
3. 

   May 9, 2012

   Ron S

   Working on the programming side I would like to see a “summary” document with code examples for each of the techniques that can be handed to programmers. I find the current documentation too high level for the average programmer to interpret. I just want to be able to say, when you are writing code, or doing quality check walk-throughs use the following coding techniques instead of the “bad” examples.
   We can edit the docs to eliminate or de-emphasize techniques that don’t apply to our specific situations.

   The more different languages you can provide the examples in, the better chance we have of finding one that we can “transliterate” into what-ever unique langauge we are using.
4. 

   May 9, 2012

   vanderaj

   I am going to be eliminating bad examples and code, just to make the guide shorter. I intend to use GoF design pattern templates and UML at the abstract, and code examples in the concrete. Do your devs know about the abstract architectural stuff? I do need to get a feel for the average dev, because I really want the Guide to be more widely used.

   I want to use positive patterns in their place, with concrete examples in at least PHP, and hopefully other languages.

   The summary version of the OWASP Developer Guide is / will become the existing Application Security Verification Standard. If you need a checklist, that’s exactly what it is. There’s an update in the works right now, so feel free to help those guys produce exactly what you need, because we are going to be tracking the ASVS document.