Subject: Re: [HASMAT] moving forward

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 01 Sep 2010 16:40:41 -0600

On 8/24/10 7:17 PM, Barry Leiba wrote:
> As I've said to Jeff back in Pays-Bas, I'm less concerned about the
> name than about the charter.  The problem description at the BoF said
> that a main issue is that this stuff has been previously dealt with in
> a haphazard manner.  We then looked at three haphazard drafts, which
> the charter proposes to standardize.  This doesn't address the core
> problem.
> 
> What does address the core problem is the part about studying the
> problem space.  From one of the proposed charters:
> 
>> In addition, this working group will consider the overall topic of HTTP
>> application security and compose a "problem statement and requirements"
>> document that can be used to guide further work.
> 
> I'd like to see much more emphasis placed on this part, and have the
> scope of this hashed out a bit more.  I think the focus of the WG
> should be on this, with the three existing drafts as something we do
> along the way... rather than the other way 'round, as it is now.

That is indeed the larger and more important goal, so I agree that its
well worth spending more of our time up front on a clear and
comprehensive problem statement that can drive our future work.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: [email-masked]
Date: Thu, 2 Sep 2010 17:00:48 -0400 (EDT)

>>> -----Original Message-----
>>> From: [email-masked] [mailto:[email-masked]] On 
>>> Behalf Of Peter Saint-Andre
>>> Sent: Thursday, September 02, 2010 12:17 PM
>>> To: Kai Engert
>>> Cc: [email-masked]
>>> Subject: Re: [HASMAT] moving forward
>>>
>> > I wanted to propose "WebAppSec", but there's already 
>>> http://www.webappsec.org/
>> 
>> That's a good group to reach out to. :) Is anyone here involved with 
>> those folks? Are there other such groups to be aware of?
>
> One of the Officers/Founders sits practically next to me.  I can definitely check with the WASC folks if they 
> are concerned about the name.  

Hello Hasmat,
 
I am one of the cofounders of 'The Web Application Security Consortium' (http://www.webappsec.org/) and was recently
informed about this thread. Since this is a discussion about the name of your project it probably makes sense to pick 
something less generic; something that makes your unique cause stand out (for your benefit). As to what that name should be
I'm not going to step on anyone's toes as an outsider but I wanted to provide you with some common names/references
within the appsec space that you should be aware of. 

- OWASP (owasp.org): Open 'Web Application Security Project'
- WASC (webappsec.org): The Web Application Security Consortium
- Appsec: Used by SANS for a conference (http://www.sans.org/appsec-2010/) as well as owasp (http://appsecdc.org/)
- webappsec list: Securityfocus.com runs a mailing list called webappsec (http://www.securityfocus.com/archive/107/description)
- The Web Security Mailing List: run by WASC (http://www.webappsec.org/lists/websecurity/) also known as websecurity. 
  We were going to name it webappsec but didn't want to cause additional confusion :)

Feel free to ping me if you're debating related names and I can assist with letting you know if something
similar exists (I am well connected).

Regards,
- Robert Auger
WASC Co Founder/Moderator of The Web Security Mailing List
http://projects.webappsec.org/
http://www.cgisecurity.com/
http://www.qasec.com/