Re: [Owasp-input-api-developers] Status?

[Alex R. <al...@se...>]

Gabriel Lawrence wrote:
> What we really need to do next is come to a consesnsus on the project
> goals and pull that together in to a document. It feels a little to me
> that we haven't really reached a consensus yet, rather that different
> viewpoints have been put forth. Correct me if I am wrong.

I think we can summarize what we've agreed on thus far as:

	1.) we dissagree on a lot of stuff
	2.) we must canonicalize data before filtering
	3.) we're supposed to filter stuff...and stuff...
	4.) that I can't spell.

and what we dissagree on as:

	1.) how far the project should go in protecting developers
	2.) whether or not our target developers know a compiler from a hole in 
the ground
	3.) whether or not type checking is sane, considering we're not all 
programming in nice, tidy, languages like Java
	4.) how "signatures" should be stored
	5.) whether or not we should use "signatures" at all
	6.) how many licks it takes to get to the center of a tootsie-pop
	7.) how much work should be required on the part of developers to 
create/invoke a given filter.

> How can we move forward to make sure that there is common ground and common
> agreement on what this project will be doing?

I submit that we need to set out a list of points that we need to agree 
on. Once those points are decided, they should more or less dictate the 
overall design, and we can then start to iterate on a reference 
implementation.

-- 
Alex Russell
al...@Se...
al...@ne...