OWASP Top 10 updates - owasp

Has the OWASP top 10 project not been updated since 2010?
Having had a look at the following site on OWASP I can see that this may be the case: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
My company is making a big deal out of OWASP compliance, so I just want to be sure that I'm up to date?

Update -- OWASP Top Ten 2017 was released. You can always find the latest version here. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
OWASP Top Ten 2013 was released today! You can download here http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013%20-%20RC1.pdf

AFAIK - there is a 2013 update in progress.
Contact Dave Wichers for more info, or better yet, volunteer on the topten mail list. :)

Yes, the 2010 version of the OWASP Top Ten is the latest version. Before that, the last version was in 2007. If more people volunteered, it would get updated more often, but most of us who work on OWASP projects also hold down full-time day jobs, so progress can be frustratingly slow at times.

Related

Has this framework been abandoned or what?

Latest activity on this framework was on July 21, 2014. There hasn't been any news or updates about this framework. The community isn't active at all. Have the developers stopped and abandoned this framework or is there something else going on? I really like how clean and modern looking this framework is. But if it's abandoned I don't see why would I use this.
He emailed me:
I think it would be better to evaluate activity by github commits:
https://github.com/vitmalina/w2ui/commits/master. Currently, I am
working on releasing 1.5 version, which should be out soon.
There is an email listed at the bottom of this support page:
http://w2ui.com/web/support
Suggest you send an email and ask.

What is the state of Bazaar version control?

I am looking to start a project with distributed source control and am evaluating the different options. Looking at Bazaar, I stumbled over several articles (e.g. this) that development has slowed down significantly.
What is the status of the project bazaar? Are bugs getting fixed?
I will try to answer first with facts.
1/ According to the Active (published) Bazaar branches of Bazaar, we can see that there is 8 active development branches (changed since beginning of 2013)
2/ According to Bazaar 2.6b3 milestone, 3 bugs out of 12 are fixed for the next 2.6b3 release. This version started 6 month ago (August 2012).
3/ According to Bazaar v2.5 series, v2.5 series had a beta/minor release every month.
4/ According to Bazaar v2.6 series, v2.6 series has a beta/minor release every 4 months (well, there are not so many releases to give trends here).
5/ Bazaar is still used on prestigious/ambitious/large projects : Ubuntu, Debian,  MySql , Launchpad ... projects that are active in the Bazaar community.
So the first observation is that releases are less frequent, clearly.
One may think it's bad trends, but one can consider that the application is now mature enough and that new road map (with new features) needs to be forecast.
To finish, here is an extract of a IRC chat I had with bzr team. This may point out the issue with intermediate release.
trident_job: Hi there. I've seen that latest bzr version is v2.6.2
and is 1 year ago (nearly).
trident_job: next version v2.6.3 still
have 3 bugs to fix ... do you think the project is stall ?
mmm: we lack anyone who's job it is to do the release these days
mmm: you're right that there's stuff on trunk that could have done with being
released a good while ago
trident_job: mmm: yeah, that's not good
advertisement for an open source project to have 1 year release cycle
mmm: well poked... so, probably an rt unfortunately
UPDATE 2013.09.20 : Bazaar retrospective from a dev.
Read especially the last two chapters :
Bazaar on the slow track
Conclusion

TFS help - Backlog,burncharts, velocity, and raising questions in TFS

Can I have guidence for TFS 2010 for the following areas:
What is the correct use of tfs and the properties that are exposed for each backlog item and task for recording of effort so that we report on progress using the burndown charts and can assess velocity.
It is not obvious to us what is the appropriate workflow for raising questions about functionality against tasks / user stories so that the person who needs to answer them can easily find those tasks / stories that have outstanding questions. And for when the question is answered how the person(s) who need to know the answer are alerted that the answer is there. Maybe tfs is not the right place to do this and we should be manually doing this?
Unless you customized something, the report features you are asking about will light up in the reports if you use the field in the Task work item named Remaining Work - update it regularly - daily if possible.
The database most of the default reports use (Tfs_Analysis) gets updated every 2 hours by default. Some of the reports only show a daily roll-up so depending on what you are looking for you might not see changes until the day after.
As for your 2nd question about how to communicate about missing information in user stories, etc.. you should read the Process Guidance for the template that was used to create your Team Project. I'm guessing you are using the MSF Agile 5.0 template, so do a search for that and "Process Guidance." The Process Guidance is basically the instructions for how to use the TFS work items and reports, etc... It can be found online (on MSDN) or by right-clicking on your team project in Team Explorer and choosing Process Guidance from the context menu. I'm answering this from my phone but can include a link to it later if you find this helpful.

Is there any place to host your code online?

There are many free online services which provides you with large spaces to store your personal materials, mails, etc. But is there any place that can let us host our code - which keeps the change history?
Google Code or SourceForge may not be a ideal place because it requires creating a project which is specific and useful to others, while what I want is a place to hold any kind of code which I think is useful but may not be for anybody else.
It's all about Github. 300 MB repository for free. Nice interface, easy to use. Plus we all know GIT > SVN :)
You can get free GIT and SVN hosting at unfuddle.com
BitBucket allow for public and private Mercurial repositories.
Github has Gists that might work for you. Also, Snipplr.
http://codeplex.com is where MS provides open source source control via Team Foundation Server.
projectlocker is also a good alternative for free Subversion, Git hosting..
You can also get free, private SVN hosting at http://beanstalkapp.com/. Their 100MB package is free.
Google Code link.
How about http://cvsdude.com/ which paid or http://xp-dev.com/ which is free.
come on guys don't you see that he is interest only in hosting online some fragments
of code like some functions etc not full projects and also not public but private.
Of course it is possible with each and every solution you all said in your posts
but it is not exactly what he was looking for .
You all replied like spammers and is that's funny
So why don't you just use http://gist.github.com/
as someone already mentioned
You can host private projects on DevjaVu is you want to use Subversion.
http://www.svnhostingcomparison.com/
CVSDude does free 2M subversion repository, you can also use CVS if you pay.
I've used http://planetsourcecode.com/ to store all sorts of bits of code. Users even upload entire applications.
There are even online code editors available (well, a kind of, that project is still in the development phase).
Linky: https://bespin.mozilla.com/
I've used CodeSpaces for over a year now and never had a problem. I'm a new user so I apparently can't post links...
There are plenty of answers already submitted which are suited to hosting full-fledged applications so I won't bother adding to the list but if you're looking at hosting smaller things (code snippets, simpler projects) with revision history you could consider using a wiki?
I know this was posted 4 years ago, but you could always just sign up on Pastebin and have private source code there.
Pastebin has been around since 2002 and is currently "the #1 paste tool". It supports a number of syntaxes (including C++, C, Ruby, and Java. Full list on site.)
Edit;
Their PRO plan is only $2.95 USD for one month or $1.99 USD/mo if you purchase for a full year. You can find out more on the limits of free vs Pro here.
Edit 2;
If nothing else, sign up for Dropbox, SkyDrive, or Mediafire and upload your files there.
Team Services has free, private, unlimited, Git repos for version control. You also get integrated bug and work item tracking, enterprise Agile tools for DevOps, like backlogs and Kanban boards, automated build, test, and release plus other team capabilities to build and ship apps.
You can connect with Xcode, Eclipse, IntelliJ, Android Studio, Visual Studio, or any dev tool you like.
Team Services is free for the first 5 users with Basic access, plus unlimited stakeholders working on the backlog, and Visual Studio subscribers. Here's how to get started with Team Services.

TFS: Email diffs

Eric suggests that you read your team's diffs every morning. Can I get TFS to automate this in some way? Ideally I'd like an email with all of the differences in, but I'd settle for a link to each of the commits.
As someone who works for Eric and who has the behaviour of checking the diffs each morning let me explain what I do. I'd like to think that I was one of the people he was thinking about when he wrote the post, but I know for a fact that he didn't know I did the diff checking each morning :-)
In Eclipse I use the Team, Synchronize... functionality to compare my local workspace with the latest on the server. As I do a get latest frequently, this tells me what has happened since I last did this (i.e. what changed while I wasn't looking).
In Visual Studio, I can do a similar thing by right clicking on the root folder of the area that interests me and selecting Compare... and then doing a compare of the Workspace version with the latest version.
Alternatively, you can just do a "History..." on the folder that is of interest and a brief scan down the history view will show you what has been happening and you can go look at what is interesting. It also encourages you to leave good check-in comments, and to encourage your developers to do the same :-)
I used to have email alerts configured for each check-in (Team, Project Alerts...), but I just ended up ignoring them most of the time. I even have a robotic rabbit configured to talk to me when someone does a check-in or runs a build - but this is only useful during the day, not checking what has happened the previous day while I was asleep (I live in a different time-zone to the rest of my colleagues so they do a lot of work while I sleep and vice-versa, making the practise of diff-checking even more useful)
In theory it would be possible to write a program that did generate you a diff each day between the latest version and your workspace version, however I've never bothered myself. This is partly because as I find the most value of the practise comes in exploring the changes that were made each day rather than just reading about them. I also admit that I wasn't aware that anyone else in the world was doing this daily diff routine - I figured I was alone in my code voyerisum, but obviously not!
UPDATE Feb 12, 2009: The following blog post just came to my attention.
http://blogs.msdn.com/abhinaba/archive/2008/07/07/auto-generating-code-review-email-for-tfs.aspx
It talks about (and provides source for) a tool called CRMail that will generate an email from a shelveset that will contain links back to Team System Web Access to show the diffs for each change in the changeset. It would be possible to modify this source to get it to show you diffs between changesets if you wanted to. Then you would just need to hook it up to run either as a nightly scheduled task or on every check-in by subscribing to the check-in event from TFS.
Have you explored setting up a report on the project portal that would show diffs based on date? I haven't done this (and I'm at home now so I can't investigate it), but I know that there is a lot of information you can get out of the portal. Whether you can get code diffs, I don't know.
The other alternative would be automating something with tfsadmin or the power tools. Again, not at work so I can't look at it, though the power tools seem like they may make it possible to do what you want from the docs.
A quick solution would be to configure project alerts to send you one email per changeset.
Filter these into a separate folder in your email client, and review them at your leisure.