OWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly
summary
Project history and concrete outcomes matter: ESAPI starts as interfaces plus a bundled reference implementation, that bundling creates brittle coupling and dependency bloat, causing constant security churn and a long release gap while migration from Google Code/Subversion/Ant to Git/Maven is debugged. Backward compatibility of old encrypter interfaces leads to CVE-2013-5679 (MAC bypass), initial singletons are not thread safe, a crypto review offer costs $30,000, and the roadmap moves to ESAPI 3 with a small core and separate implementation jars.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:55Objectives
- 2:13The Process Perspective
- 6:53How Do You Security Test the Library
- 7:27People Perspective
- 14:59Singletons
- 16:25Enterprise Security Exception
- 17:24Backward Compatibility Is the Curse of Software Design
- 19:13Ant to Maven
related talks
47mOWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly
09mESAPI Crypto Changes
31mOWASP API Security Project
45mSecurity Architecture, An Adventure?
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
01h 29mAPI Vulnerabilities and What to Do About Them
45mLeveraging OWASP in Open Source Projects
26mThe Future of API Security