[Owasp-leaders] Good bye OWASP leaders - time to leave the hornet

johanna curiel curiel johanna.curiel at owasp.org
Mon Nov 30 19:41:32 UTC 2015


Josh

A stepped down of the Project Review task force on 2nd September 2015
http://lists.owasp.org/pipermail/owasp-board/2015-September/016044.html

>>The Board will still need to provide action on the abuse of the OWASP
brand as there is no committee in place currently to handle these concerns

I handled these concerns very clearly when I sent to you and the entire
community the project review done. I even reacted to Jeff Williams on the
DarkReading website.

BTW that was my last review done with Abbas.We both concluded the same
things and all of these reviews are publicly available on the Project Task
Force email list.

The problems with all the bureaucracy and guidelines and Committees is,
that it is very unclear *who* should take action when brand abuses occur.
That was never responsibility of the PROJECT REVIEW team. Just to made
reviews and advice.

I requested the board to take action , a statement that's what I
recommended, to make clear that OWASP does not endorse the opinions of the
vendor(Contrast) with regard the claims done using OWASP Benchmark.


   - My issue here is that Contrast has misused OWASP Benchmark using false
   claims.
   - Dave Wichers is in a position of Conflict of Interest


And these false claims are also demeaning against SAST/DAST tools as if
IAST is more superior. The arguments are false, nothing can be concluded
for this project as it is in Beta stage, as also experts such as Kevin Wall
has made it clear.

BTW Contrast just changed slightly his website by taking down the demeaning
false statements against DAST/SAST:
https://docs.google.com/document/d/1G3u34fxhgnbbYY8VsBmceLUjQPKax0Go1HwlphLK7lw/edit?usp=sharing


   - "Contrast Dominates SAST & DAST in Speed and Accuracy "
   - "SAST & DAST Leave Businesses Vulnerable"
   - "As *clearly demonstrated by the OWASP Benchmark*, this approach is
   not only many times more accurate, but is faster and easier to deploy as
   well."


All this is FALSE FALSE FALSE. Contrast needs to take down all these
statements by using Benchmark as if is true.

Do you need more brand guidelines to take action?

Regards

Johanna

https://docs.google.com/document/d/1G3u34fxhgnbbYY8VsBmceLUjQPKax0Go1HwlphLK7lw/edit?usp=sharing

On Mon, Nov 30, 2015 at 2:46 PM, Josh Sokol <josh.sokol at owasp.org> wrote:

> I am sad to see you go, Johanna.  Your efforts with respect to OWASP
> projects has been an inspiration to many, including myself.  Thank you for
> all your hard work and dedication.
>
> Before you go (assuming you haven't abandoned yet), I would like to make a
> suggestion here.  You are currently leading the Project Task Force, which
> is empowered to act under the OWASP Committees 2.0 framework (
> https://owasp.org/index.php/Committees_2.0).  And as I look to the
> Guidelines for OWASP Projects (
> https://owasp.org/index.php/Guidelines_for_OWASP_Projects) I note that
> these guidelines are maintained under the scope of that committee.
>
> This page is maintained by the OWASP Project Task Force to help assist
>> Project Leaders with information about successfully running an OWASP
>> Project. It will be updated from time to time, and changes will be
>> discussed and announced on the OWASP-Leaders list.
>>
>
> The Committees 2.0 framework had the goal of empowering our community to
> effectively delegate power away from the Board and to themselves within a
> pre-defined scope.  The only question in my mind, at this point, is whether
> this committee still has the 5 people necessary in order to hold a vote.
> If so, I would like to make a few recommendations to the committee:
>
>    1.  Amend this guideline to include verbiage stating that a project
>    leader must not have a bias that would prevent them from being objective
>    with respect to their project.  If such a bias were to occur, the project
>    leader would be removed and a new leader would need to be found in order
>    for the project to continue as an OWASP project.
>    2. Amend the guidelines around project levels (Incubator, Lab,
>    Flagship) stating that a mandatory requirement for Lab and Flagship
>    projects is that they have a diverse enough set of contributors to support
>    objective efforts.
>    3. Perform a blanket review of projects against these new criteria and
>    adjust accordingly for all projects failing to meet these new requirements.
>
> I believe that these actions are wholly within the stated scope of the
> committee and is not in violation of our Bylaws Code of Ethics, Mission,
> etc, and therefore, appropriate for the committee to make.  Committee
> decisions are considered official once a record has been published to the
> community.
>
> The Board will still need to provide action on the abuse of the OWASP
> brand as there is no committee in place currently to handle these concerns,
> but the power to act on the project level is there should you choose to use
> it.  Just a thought since the Board is trying to manage to policy and you
> have the ability to change that.
>
> ~josh
>
> On Sun, Nov 29, 2015 at 4:24 PM, johanna curiel curiel <
> johanna.curiel at owasp.org> wrote:
>
>> Hi Leaders
>>
>> I have decided that I  stop participating at OWASP as community member ,
>> especially being involved in any new activities regarding direct volunteer
>> efforts. If I ever considered running to the board I have definitely desist.
>>
>> Someone would like to know my perspective about my point of view can take
>> the time to read this article:
>>
>>
>> https://docs.google.com/document/d/1iNeG2lOBTAo8qsMiNZDARLKm4X727OME50CamzY3vn8/edit?usp=sharing
>>
>> I will keep supporting certain projects as I have direct contact with
>> these project leaders, but I think OWASP is in a process of decay as an
>> organisation.
>>
>> I stop Curacao Chapter , I guess there will be no caribbean region at
>>  OWASP as none of these countries are active. This one is stopping right
>> now. Research initiative too.
>>
>> I'll keep my OWASP mail and I'll be an official member as many are 'on
>> paper'. So yes, you want to contact me and I can help you directly, always
>> welcome.
>>
>> Good luck all to you.
>>
>> Regards
>>
>> Johanna
>>
>> _______________________________________________
>> OWASP-Leaders mailing list
>> OWASP-Leaders at lists.owasp.org
>> https://lists.owasp.org/mailman/listinfo/owasp-leaders
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/owasp-leaders/attachments/20151130/5a4b6ea5/attachment.html>


More information about the OWASP-Leaders mailing list