RE: [Owasp-input-api-developers] Vision Document

[Alex R. <al...@se...>]

On Mon, 12 Aug 2002, John Percival wrote:

> Hi guys,
> 
> I just had a read through, and that doc looks clear and informative. The
> only thing that I would question, without wanting to open a can of worms, is
> the choice not to develop for DCOM/.NET technology. I am not in a position
> to create such filters, but is it our position to judge what language our
> 'customers' will be using?

No, and perhaps doing a VBScript/D-flat verion is worth considering. 
That said, developers using MS tech are starting from an inherently
disadvantaged position WRT to security (IIS, MSSQL, etc..), and probably 
have bigger problems.

I think we can safely say that we won't refuse a contributed MS-tech
version of the filters once we have them working in a reference
language, but I for one won't be spending much (any?) time on that port
as I simply don't have any MS software to develop against. Perhaps when
Mono goes gold...

Additionally, providing filters for MS languages, while undeniably 
necessaray, almost condones their use for security-critical applications,
and I think that if we ever do ship such a port, we should point out to
developers the insecure posture that relying upon a vendor like MS
inherently creates.

Should we grease the squeaky wheel? I don't have a strong opinion one way 
or the other, save that for the time being I'm "out" when it comes to 
developing such a port.
 
-- 
Alex Russell
al...@Se...
al...@ne...