tag:blogger.com,1999:blog-7061568054540301299.post7486866364556986346..comments2019-07-22T14:10:16.627+01:00Comments on Dinis Cruz Blog: Fortify hands-on demo/session at forthcoming OWASP Northern Virginia ChapterUnknownnoreply@blogger.comBlogger2125tag:blogger.com,1999:blog-7061568054540301299.post-40060500969632155922009-09-21T08:40:32.765+01:002009-09-21T08:40:32.765+01:00Even with no &gt;blunt&lt; &quot;snake oil &amp; m...Even with no &gt;blunt&lt; &quot;snake oil &amp; marketing&quot; content, vendors still get the chance to sell their product this way. You are basically giving vendors a &quot;booth&quot; to show their product.<br /><br />I think this is a bit shady...המועצה לצרחנותhttps://www.blogger.com/profile/08124894109886680310noreply@blogger.comtag:blogger.com,1999:blog-7061568054540301299.post-76595213796809982582009-09-17T23:50:26.615+01:002009-09-17T23:50:26.615+01:00(also sent to the owasp-leaders list) Just conso...(also sent to the owasp-leaders list) <br /><br />Just consolidating some of the comments I seen on this list or received privately. <br /><br />Here are a couple more items/ideas for the &#39;rules-of-engagement&#39;<br /><br />A) On the vendor behavior:<br /><br /> 1) No calls to action<br /> 2) No talk about price or licensing<br /> 3) Allow competitors to join the talk and give counterpoints (like the full week it takes to get Fortify to run against a large codebase - even longer for Ounce)<br /> 4) Preferably having someone OTHER than the vendor do the talk may help.<br /><br />B) I wouldn&#39;t count on every chapter leader to organize such a thing. Maybe it should be coordinated with the OWASP board? Alternatively, maybe a chapter leader should get 5 leaders to say he will do right to proceed?<br /><br />C) Publish the detailed content in advance, or at least communicate it to the chapter leader. I actually require every speaker who work for a vendor to submit the slides before the meeting to inspect them for over commercialization.<br /><br />D) Require specific speakers. It&#39;s the speaker who makes the presentation. Just having a &quot;company&quot; present, sending an available sales engineer has a huge potential of being a bummer. If you get an engineer from dev, or at least a product manager who can shed some light on future directions you are better off.<br /><br />E) Ensure &#39;sender email&#39; usage is consistent: &quot;...My little comment is that I am wondering why Eric Dalci used his Yahoo email address yesterday to announce the event on the Secure Code<br />Mailing List (SC-L) while previously he has used his Cigital email address on the Virginia chapter mail list (e.g. https://lists.owasp.org/pipermail/owasp-wash_dc_va/2009-September/000236.html). Perhaps splitting hairs but some might perceive it to be sneaky....&quot;<br /><br /><br />I (Dinis) am pretty sure i&#39;ve read a variation somewhere of the next three ideas, but it is getting too late, so here they are they way I remember them :)<br /><br />F) all non-vendor participants need to disclose their relationship(s) with the vendor(s). For example I received the comment today &quot;...Cigital owns most of Fortify...&quot; , is this true? I don&#39;t know! (John might should be able to clarify this), but the key point is that the audience should know this information. <br /><br />Once this information is disclosed, the audience can independently make up on their minds on how &#39;independent&#39; the &#39;independent security consultant&#39; really is :) .... (yes ... on this last independent paragraph I did made an effort to independently use as many as possible variations of the word &#39;independent&#39; :) ) <br /> <br />G) Don&#39;t have a vendor employee participating on the presentations at ALL!!. Ideally the presenters (&amp; people helping) should be as removed as possible from the vendor. I think security consultancy companies like Cigital are a good compromise (as long as they behave :) (I trust John Steven on this one)), but it would be great if the people driving this would be the ACTUAL users of these products (who tend to have a much more pragmatic view of the value provided by them AND how to work around the limitations of those projects)<br /><br />H) do a &#39;multi-vendor&#39; event where the multiple products are shown in action with the same target apps (from easy to hard) and test environments (btw, this is what I (Dinis) tried to do with the London WAF bake-off a couple years ago) . Note that although this option is the most interesting of them all, it is the most complicated to execute from a logistically point of view (and the one that needs to resources from OWASP to organize it properly)<br /><br />Keep the comments coming, since I think we are almost there :)<br /><br />Dinisdiniscruzhttps://www.blogger.com/profile/12323524926773519367noreply@blogger.com