[websec] OWASP AppSec Research EU CFP/CFT

2012-03-28 Thread OWASP AppSec EU
Colleagues,

In 2012, OWASP is holding its Global AppSec Research (EU) Conference
in Athens, Greece! The OWASP AppSec Research conference is a premier
gathering for Information Security leaders and researchers. It brings
together the application security community to share cutting-edge
ideas, initiatives and technology advancements.


The OWASP AppSec Research 2012 Call for Papers (CFP) is open. Visit the
following URL to submit your proposal for the July 12-13, 2012 talks
in Athens, Greece:

http://www.easychair.org/conferences/?conf=appseceu2012

The final closing date for submissions is Sunday, April 15, 2012. We
look forward to receiving submissions for technical presentations,
demos or research papers on the following topics:

* Security aspects of new/emerging web technologies/paradigms (mashups, web
2.0, offline support, etc)
* Security in web services, XML, REST, and service oriented architectures
* Security in cloud-based services
* Security of development frameworks (Struts, Spring, ASP.Net MVC etc)
* New security features in platforms or languages
* Next-generation browser security
* Security for the mobile web
* Secure application development (methods, processes etc) and secure coding
practices
* Business risks of Application Security
* Starting and Managing Secure Development Lifecycle Programs.
* Privacy Concerns regarding applications and Data Storage
* Threat modeling of applications
* Vulnerability analysis and application security testing (code review,
pentest, static analysis etc)
* Countermeasures for application vulnerabilities
* Metrics for application security
* Application security awareness and education
* Securing e-government applications and services
* Government Initiatives & Case Studies
* OWASP Tools and Projects


OWASP AppSec Research 2012 is also currently soliciting training
providers for the conference. Visit the following URL to submit your
training proposal for the July 10-11, 2012 training days in Athens,
Greece:

http://www.appsecresearch.org/cft

The following conditions apply for people or organizations that want
to provide training at the conference:

Training provider should provide class syllabus / training materials.
Proceeds will be split 60/40 (OWASP/Trainer) for the training class.
OWASP will provide the Venue, Marketing with Conference materials,
Registration and basic AV.

Trainers will cover travel and accommodations for the instructor(s)
and all course materials for students

OWASP will reserve up to 2 training slots at no cost and the trainer
may reserve up to one slot at no cost

Price per attendee: 2-Day Class €990 / 1-Day Class €495.

Trainers can brand training materials to increase their exposure
Classes are to be focused around Application Security but are in no
way limited to web application security.

We will look favourably on laboration-based/hands-on training.


We will make the first round of selections, based on the Training
proposals we have received by March 30, 2012. We have extended the
final closing date for submissions to Sunday, April 15, 2012.

Submit proposals to train...@appsecresearch.org using the CFT template
(
http://www.appsecresearch.org/wp-content/uploads/2012/02/OWASP_CFT_AppSecEU2012.doc
).
All trainers will be required to submit a Training Instructor
Agreement (
http://www.appsecresearch.org/wp-content/uploads/2012/02/OWASP_AppSecEU2012_Training_Instructor_Agreement.doc
)
in order to have their classed scheduled.

Additional information can be found at http://www.appsecresearch.org.

Please forward to all interested practitioners and colleagues.
___
websec mailing list
websec@ietf.org
https://www.ietf.org/mailman/listinfo/websec


Re: [websec] STS ABNF, was: new rev: draft-ietf-websec-strict-transport-sec-04

2012-03-28 Thread Julian Reschke

Here's the promised concrete change proposal:

Section 6.1., paragraph 3:
OLD:

 Strict-Transport-Security = "Strict-Transport-Security" ":"
 *( ";" [ directive ] )

NEW:

 Strict-Transport-Security = "Strict-Transport-Security" ":"
 [ directive ] *( ";" [ directive ] )


(fixes the leading ";" problem)

Section 6.1., paragraph 12:
OLD:

   Additional directives extending the semantic functionality of the STS
   header field may be defined in other specifications (which "update"
   this specification), using the STS directive extension point.

NEW:

   Additional directives extending the semantic functionality of the STS
   header field can be defined in other specifications (which "update"
   this specification).

(the extension directive extension point was removed earlier on when the 
ABNF was simplified)


Section 6.1.1., paragraph 2:
OLD:

   The syntax of the max-age directive is defined as:

NEW:

   The syntax of the max-age directive's value (after potential quoted-
   string when applicable) is defined as:


Section 6.1.1., paragraph 3:
OLD:

max-age   = "max-age" "=" delta-seconds

NEW:

max-age-value = delta-seconds

(We just define the parameter value ABNF)

Section 6.2., paragraph 0:
OLD:

   The syntax of the includeSubDomains directive is defined as:

 includeSubDomains = "includeSubDomains"

 6.2.  Examples

NEW:

(text removed, as the directive is value-less)


 6.2.  Examples


Section 6.2., paragraph 2:
OLD:

  Strict-Transport-Security: max-age=31536000

NEW:

  Strict-Transport-Security: max-age="31536000"

(changed one example to use q-s)

Best regards, Julian
___
websec mailing list
websec@ietf.org
https://www.ietf.org/mailman/listinfo/websec


Re: [websec] IETF-83 WebSec Session minutes?

2012-03-28 Thread Alexey Melnikov

On 28/03/2012 10:27, =JeffH wrote:

Hi,

would whomever was taking (hopefully detailed) minutes of the IETF-83 
WebSec Session minutes please post them to the list? if they're still 
"raw", that's fine, just denote them as such.


Jeff, I am editing Richard Barnes' jabber notes. This might take a few 
days (don't have time today).


___
websec mailing list
websec@ietf.org
https://www.ietf.org/mailman/listinfo/websec


[websec] IETF-83 WebSec Session minutes?

2012-03-28 Thread =JeffH

Hi,

would whomever was taking (hopefully detailed) minutes of the IETF-83 WebSec 
Session minutes please post them to the list? if they're still "raw", that's 
fine, just denote them as such.


thanks,

=JeffH
___
websec mailing list
websec@ietf.org
https://www.ietf.org/mailman/listinfo/websec