update for phpsec.owasp.org?

[enygma]

Given the new state of this project, I'd suggest that the related website, phpsec.owasp.org, be updated to point out the project is deprecated and that any information there is for reference only. It should also mention that the software is no longer available except in archive.

[imifos]

I just wanted to post that as well. I think this web site should simply be removed. There is no reason to keep old stuff online (other than having names in the google index or "because we can").

[mebjas]

I think having a banner that, project is deprecated would be better. It might drive developers to work on a newer version.

[enygma]

@mebjas I don't really see a reason to keep the site around honestly. It's mostly a reference for the tool and doesn't really offer anything by itself.

[enygma]

@abiusx If it points to something deprecated, what's the rationale for leaving it? All it does is provide confusion for users that may want to use the tool and find out that they can't but only by going to the project.

Even the "Download Now!" link only gives them an archive with just the README in it...

[enygma]

But...it did vanish (effectively). Even the repository is empty now.

While I get that other projects leave sites up even though the project is deprecated, this project has been wiped out almost completely.

[imifos]

Jezz...

You want a reason to remove this page?

Articles like this - http://www.devstrend.com/8-best-php-security-libraries/ (date: November 25,2015) - pointing to this page and prising it as one of the best PHP security frameworks "of da world11".

If you still want to take responsability for the potential damage caused by this framework being used and the resulting security problems, that is your choice of course. You can fork this page on a domain that you host and you will have your name attributed to it for all eternity, no problem, but it should definitively not be published under the name of a foundation that promotes security.

And the "the OWASP folks forced their influence upon this" are just responsible people not having the same opinion than you have.

[abiusx]

Closed.

[paragonie-scott]

I don't think we should listen to @abiusx here as if he's an OWASP officer, let's instead let the OWASP folks force their influence upon this again for the good of developers the whole world over.

[mebjas]

Yeah there is a website pointing to phpsec as one of the best php security library. If someone lands on phpsec.owasp.org, it wont be difficult for them to realize, this project isn't being maintained if there is a big banner.

If you ask what's the point of keeping it up, I think the problems the library was trying to solve still exist, and we should try to solve existing glitches and make the libraries secure rather than hiding it. Its an open source project after all.

Shouldn't we just change the front page with information about its current status and TODOs we need to solve before bringing this project up again!

[owaspjocur]

Hi Scott,
If you want to make a former request to take the phpsec.owasp.org website
down
then take contact with
jim.manico@owasp.org
claudia.aviles-casanovas@owasp.org

One of the problems at owasp is that there are no volunteers neither
technical staff to administrate projects properly not even the little
resources around them such as the Github or the domain owasp name

Please bear with us, phpsec was an effort and an experiment, if you
consider it failed and all regarding this project should disappear from the
internet, we understand but please understand also there was an effort with
all the good intentions to create a security library and the author of this
effort, Abbas, did tried.
At least he tried and we should respect that.

if there are articles like
http://www.devstrend.com/8-best-php-security-libraries/ mentioning this is
secure
maybe , just as an advice, would be wise you contact the author of this
website and explain why you consider this is not valid. This is outside
owasp domain, what is decided to be published or not.

Regards

Johanna

On Wed, Dec 2, 2015 at 4:19 PM, Scott notifications@github.com wrote:

I don't think we should listen to @abiusx https://github.com/abiusx
here as if he's an OWASP officer, let's instead let the OWASP folks force
their influence upon this again for the good of developers the whole world
over.

—
Reply to this email directly or view it on GitHub
#120 (comment).

[imifos]

@mebjas
I'm totally with you on that. If the library gets some love, of course it should stay up and running. Speaking of the problems the library wants solve, it sounded just like an awesome idea for a blog post or an article in the PHP section of the OWASP wiki :) ... oh yes... the PHP section on the OWASP wiki would need some work too, if you are fancy :) (Of course, anybody of you is invited to tune the info there.)

[ircmaxell]

I think there's an important thing to consider here. Yes, this is open source. And yes, anyone can "fix" it because of that, and nobody has a right to say no because it's open source.

However, it's also being advertised with the OWASP name, with a very "official" sounding domain/project name. The implication is that it's a supported library. And if that's the case, then it needs to be accurate and promote good security.

The simple fact here is that the vast majority of people disagree as to the value the library provides. That doesn't mean it's bad. That doesn't mean the people who wrote it are bad. It just means that it shouldn't be published under an official name or domain until it's to the point where people in the industry agree that it's not promoting bad practices.

And I completely get that things are being done by volunteers. But that doesn't mean that there is no responsibility. In fact, I'd argue that there's a greater responsibility precisely because it's run by volunteers.

[paragonie-scott]

To be completely honest, instead of reinventing the wheel, I'd rather see a PHP Security project that evaluates and recommends the existing packages in the ecosystem, regardless of vendor/supplier, that are believed (by a panel of volunteer experts perhaps?) to be secure, not only against the OWASP Top Ten, but against more pernicious threats.

That would be a constructive direction to take this.

[paragonie-scott]

As a follow-up to my previous comment, here's a rough draft for a hypothetical system to track negative findings (i.e. no vulnerabilities):

(in PostgreSQL, which is how I usually express data structures in my notes)

CREATE TABLE suppliers (
    supplierid BIGSERIAL PRIMARY KEY,
    name TEXT
);
CREATE TABLE projects (
    projectid BIGSERIAL PRIMARY KEY,
    supplier BIGINTEGER,
    name TEXT
);
CREATE TABLE project_versions (
    versionid BIGSERIAL PRIMARY KEY,
    project BIGINTEGER,
    version TEXT,
    created TIMESTAMP DEFAULT NOW()
);
CREATE TABLE reviewers (
    reviewerid BIGSERIAL PRIMARY KEY,
    auditor TEXT,
    bio JSONB
);
CREATE TABLE evaluations (
    reviewid BIGSERIAL PRIMARY KEY,
    project BIGINTEGER,
    version BIGINTEGER,
    reviewbody TEXT,
    sev_lo INTEGER,
    sev_med INTEGER,
    sev_hi INTEGER,
    created TIMESTAMP DEFAULT NOW(),
    modified TIMESTAMP,
    passed BOOLEAN DEFAULT FALSE
);

Volunteers can join and offer to evaluate the code for a particular version of a library or widget. The incentive here isn't just to discover/report/get-credit-for vulnerabilities, but also to attest for "I looked and didn't find any problems".

This would be useful in multiple ways:

1. We can ensure that the "many eyes" approach is being followed, at least within the PHP Security project.
2. We can expose new people to code auditing practices, train them to find and fix vulnerabilities in PHP projects, and grow the talent pool for appsec-savvy PHP developers.

I think this would be a win-win.

(Yes, I'm being optimistic that less than 2^31 sev:hi vulnerabilities will be found in any particular review of any given version of any given PHP project. I hope this isn't wrong.)

[jmanico]

That was me. Several bugs were filed against the project and the project leader chose to hide them all. At that point I revoked access to all OWASP repositories.

Jim Manico
@manicode

On Dec 2, 2015, at 11:12 AM, AbiusX notifications@github.com wrote:

The repository holds the history of the code. Only the current version is empty.
I did not choose to delete the files. Some OWASP folks forced their influence upon this.

On Dec 2, 2015, at 2:06 PM, Chris Cornutt notifications@github.com wrote:

But...it did vanish (effectively). Event the repository is empty now.

While I get that other projects leave sites up even though the project is deprecated, this project has been wiped out almost completely.

—
Reply to this email directly or view it on GitHub #120 (comment).

—
Reply to this email directly or view it on GitHub.