8000 Monthly Chat Agenda August 2022 (2022-08-01 and 2022-08-15) · Issue #2690 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Monthly Chat Agenda August 2022 (2022-08-01 and 2022-08-15) #2690

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dune73 opened this issue Jul 19, 2022 · 3 comments
Closed

Monthly Chat Agenda August 2022 (2022-08-01 and 2022-08-15) #2690

dune73 opened this issue Jul 19, 2022 · 3 comments
Labels
🔖 Meeting Agenda

Comments

@dune73
Copy link
Member
dune73 commented Jul 19, 2022 •
edited
Loading

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2022-08-01, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2022-08-15. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Archived previous meetings and their decision are here.

What happend in the meantime since the chat last month

Outside development

  • Blog post explaining the delay
  • The CRS project entered an agreement with a PR company to help us with project marketing. The goal is the promote the project and participating as developer (we are not doing marketing to bring CRS to users, we do marketing to bring developers to our project!). This is paid for by our sponsors.
  • The CRS project has started to pay Christian Folini / @dune73 a small monthly sum for project coordination and various administration work. This is paid for by our sponsors.
  • There is a virtual hackathon running from Aug 1 to Aug 5 where CRS developers will write PRs to fix the remaining open bug bounty reports. This is happening in the private dev slack channel.
  • The 2022 CRS developer retreat will happen from Saturday Oct 29 to Saturday November 5, 2022. We'll stay in the Villa Cagnola near Varese, Italy. That's 20-30 min from Milano airport.

PRs that have been merged since the last meeting

We merged 10 PRs since the last monthly project chat.

Open PRs

Open PRs marked DRAFT or work in progress or needs action

Sub projects

  • Demo / Sandbox site: There is a new sandbox mode that triggers a blockade / 403 if the anomaly score is above the treshold. This can be configured via a HTTP header.

  • Documentation: no change

  • Technical Blog Posts:

    • @RedXanadu is slowly 🐢 🐌 working on a blog post idea: "A quantitative approach to false positives": Testing our regular expressions against large bodies of examples of natural language and seeing how different PLs compare for FPs (inspired by a Bug Bounty submission).

  • Status page: no change

  • Coraza: no news

  • GSoC: 2 midterm evaluations submitted: CVE: pass / ML: pass but with addition "I have some reservations about passing the contributor".

Other items

Open Issues - Separate Issues Meeting (Monday, 2022-08-15)

  • First item on agenda: Status of the bug bounty findings
  • The turning to open PRs, namely bug bounty
  • Looking through bug bounty findings and how to attack the remaining open ones
  • Sandbox with different results than a local CRS installation

This month's issues

There are FIXME open issues at the beginning of the issue chat.

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

  • Issue slot 1: #FIXME
  • Issue slot 2: #FIXME
  • Issue slot 3: #FIXME
  • Issue slot 4: #FIXME
  • Issue slot 5: #FIXME
  • Issue slot 6: #FIXME
  • Issue slot 7: #FIXME
  • Issue slot 8: #FIXME
  • Issue slot 9: #FIXME
  • Issue slot 10: #FIXME

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp.org/slack/invite .

Everybody is welcome to join our community chat.
@franbuehler
Copy link
Contributor
franbuehler commented Aug 1, 2022 •
edited by theseion
Loading

Meeting decisions

Other Items

  • Sandbox: Should blocking with 403 be the new default behavior?
    -> Unless @fzipi and maybe @theMiddleBlue bring some cutting arguments in favor of 200 we'll change to 403 by default during the week.
  • Restricted file types: We removed .axd from the restricted extensions list, but there's talk of adding it back. Should we leave it off the list? (feat(extensions): added some archive extensions as restricted #2562)
    -> If we removed .axd in 7 Dec 2020 and no one has noticed or complained… maybe we keep it simple and take it out for good. Assuming there are no objections or good reasons to add it back in. And if somebody has hard feelings we're open for a PR that adds a commented out variant with .axd to crs-setup.conf.
  • feat(protocol): Accept, Accept-Charset and Content-Encoding protocol enforcement rules #2591 is at an impasse. Need to make a tough decision about the direction we are taking here. We have 2 options to deal with:
    • Max has created an admittedly hard and probably relatively slow regular expression. A manual regex.
    • Karel has created a PoC script that writes an optimized regular expression. But the script is not ready for prime time. Integrating it into the regex-assembly would take some really hard work. And we're a bit worn down on that front.
      -> We agree on starting with Max' (fixed) regexp for now, and revisit the issue when the script by Karel is going places.

Open PRs

@dune73 dune73 assigned fzipi and unassigned fzipi Aug 1, 2022
@dune73 dune73 mentioned this issue Sep 4, 2022
Closed
@azurit
Copy link
Member
azurit commented Sep 21, 2022

Can i close this?

@dune73
Copy link
Member Author
dune73 commented Sep 22, 2022

Absolutely. Thank you for cleaning up.

@azurit azurit closed this as completed Sep 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
🔖 Meeting Agenda
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@dune73 @azurit @fzipi @franbuehler
0