Standard Classification: Rough Consensus - An OWASP Story
summary
Claims that software security labels will fix market failure by making security visible and that prototypes plus dozens of studies and meetings with NIST and lawmakers support this approach. Mentions concrete work: OWASP testing guide and WebGoat as successful projects, a recent NIST event after a cyber exec order, and practical experiments in labeling and tooling. Offers rough metrics and history — about 20 years of effort and visible prototypes that are influencing policy.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:37I love software
- 1:22We seem unable to do anything
- 1:58The Abstech problem
- 3:48Weve already benefited
- 4:25Were not there yet
- 5:09Its mission not accomplished
- 6:20Market for lemons
- 9:26Visibility levels
- 11:22Trust
- 12:06Security and Sunshine
- 14:31Markets
- 15:01Software Security Labels
- 15:55Research on Labels
- 17:52DevSecops
- 20:20OOAs
- 21:36Top 10 Lists
- 22:18Why OSS is Special
- 23:52Public Health
- 24:38OS
- 25:38Governing Philosophy
- 26:20Summary
related talks
44mNavigating Open Source and Open Standards for Better Cybersecurity
44mOWASP: The Next 25 years
34mCan Open Source be Secure by Design?
40mBuilding Developer Confidence in Software Security with the DevRel Community
05mApplication Security is a Community Effort
40mSecurity: Why It _has_to Be Open Source
45mLeveraging OWASP in Open Source Projects
35mNever Walk Alone: Inspirations From a Growing OWASP Project