<story><title>OWASP Needs to Evolve</title><url>https://github.com/owasp-change/owasp-change.github.io</url></story><parent_chain></parent_chain><comment><author>ath0</author><text>Counterpoint from Josh Sokol, former OWASP board member: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.linkedin.com&amp;#x2F;feed&amp;#x2F;update&amp;#x2F;urn:li:activity:7031305273990389760&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.linkedin.com&amp;#x2F;feed&amp;#x2F;update&amp;#x2F;urn:li:activity:7031305...&lt;/a&gt;&lt;p&gt;The OWASP nonprofit isn’t like the well-funded Linux Foundation; it runs on a shoestring budget made worse by the loss of conference revenue during the pandemic. OWASP charters events, local meetups, training content and OSS projects - the authors of this memo focus only on the OSS project needs. The OWASP board sees itself as community first and foremost; projects should seek their own sponsorships.</text></comment>
<story><title>OWASP Needs to Evolve</title><url>https://github.com/owasp-change/owasp-change.github.io</url></story><parent_chain></parent_chain><comment><author>chrismorgan</author><text>I have a very poor opinion of OWASP &lt;i&gt;content&lt;/i&gt;, because the couple of areas I’ve paid any attention to have never been any better than mediocre, clearly written by amateurs long ago and largely unmaintained ever since, with &lt;i&gt;known&lt;/i&gt; errors and heavily misleading statements hanging around for over a decade on no or unsound justification, among many other problems obvious to any that actually know the field. (See &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hn.algolia.com&amp;#x2F;?query=chrismorgan%20owasp&amp;amp;type=comment&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;hn.algolia.com&amp;#x2F;?query=chrismorgan%20owasp&amp;amp;type=comme...&lt;/a&gt; for a few comments with somewhat more detail, but things have historically been just &lt;i&gt;so&lt;/i&gt; bad and so &lt;i&gt;obviously&lt;/i&gt; bad that I haven’t bothered enumerating more than the issue that has annoyed me the most.)&lt;p&gt;(Sigh. I see that as part of fixing a lot of the obvious unsuitability of &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cheatsheetseries.owasp.org&amp;#x2F;cheatsheets&amp;#x2F;Cross_Site_Scripting_Prevention_Cheat_Sheet.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cheatsheetseries.owasp.org&amp;#x2F;cheatsheets&amp;#x2F;Cross_Site_Sc...&lt;/a&gt; some time in the past two years—and it &lt;i&gt;is&lt;/i&gt; much better now, though there are still a few dodgy things about it in both content and presentation—they &lt;i&gt;reintroduced&lt;/i&gt; the erroneous advice to entity-encode &amp;#x2F;, which was only &lt;i&gt;finally&lt;/i&gt; removed two years ago. Feel free to try to get that fixed, anyone; for my part, I have no interest in trying to work with OWASP.)</text></comment>