Tuesday, May 5, 2020

April 2019 Connector

OWASP
Connector
April 2019

COMMUNICATIONS


Letter from the Vice Chairman:

Dear OWASP Community,

Over the past number of months the Board of Directors has been working on the feedback received from the community. This feedback aligned with our key strategic goals for the year. One of our key goals was to further strengthen the "P" in OWASP. To this end we have been working with the Open Security Summit to put more of a focus on improving project development and growth and hope to enable projects through events such as this.

Another goal is to strengthen our student outreach. One idea I had was to work with colleges all over the world to support our projects development as part of their internships. I wonder if there would be anyone in the community to assist in this effort by creating a Committee under the revised Committee 2.0 model - https://www.owasp.org/index.php/Governance/OWASP_Committees. To simplify things I have added a quick start guide at the beginning of the document.

Diversity is something that we hold dear to our hearts. There are a number of people in our community that have driven this initiative to enable OWASP to be a more diverse community, without naming any names, we would like to thank them and encourage more of those in and outside of the OWASP community to get involved and help OWASP grow.

Last but not least, planning for our global conferences is well under way with OWASP Global AppSec Tel Aviv coming up at the end of May – one small ask is that everyone share information on this conference in your communities,https://telaviv.appsecglobal.org.

Thanks for all your hard work.

Owen Pendlebury
OWASP Vice Chairman
 

OWASP FOUNDATION UPDATE FROM INTERIM EXECUTIVE DIRECTOR:

For these first few months I have been focused on business operations retooling. As you know, Mailman was recently retired. There is now an online static archive of historical messages. Our goal before Q3 is to have most of our tools on managed, trusted hosted services.

We have increased our use of JIRA to manage inbound requests and last month the team closed 98.6% of service tickets within their prescribed SLA. In January it was 20.4%. This is a very big accomplishment and demonstrates our progress on this work effort. There have also been a number of back office changes that most members won't notice, but we're focused on stronger business continuity for the long term.

In addition to all our upcoming events, the staff along with some members of the community are actively prototyping how we will completely update the website this summer. This effort will not be simply cosmetic, it will be a foundational change in how we manage and publish content that we believe will better connect with our community - and more importantly help us grow. Expect more updates on this in the coming months.

Be safe out there,

Mike McCamon
OWASP, Interim Executive Director
Have you Registered yet? 
Sponsorship for Global AppSec Tel Aviv is still available.  
Global AppSec DC September 9-13, 2019
submit to the Call for Papers and Call for Training

EVENTS 

You may also be interested in one of our other affiliated events:

REGIONAL AND LOCAL EVENTS

Event Date Location
Latam Tour 2019 Starting April 4, 2019 Latin America
OWASP Portland Training Day September 25, 2019 Portland, OR
LASCON X October 24-25,2019 Austin, TX
OWASP AppSec Day 2019 Oct 30 - Nov 1, 2019 Melbourne, Australia

PARTNER AND PROMOTIONAL EVENTS
Event Date Location
Cyber Security and Cloud Expo Global April 25-26, 2019 London
IoT Tech Expo Global April 25-26, 2019 London
Internet of Things World May 13-16, 2019 Santa Clara Conventional Center, CA
Hack in Paris 2019 June 16-20, 2019 Paris
Cyber Security and Cloud Expo Europe June 19-20, 2019 Amsterdam
IoT Tech Expo Europe June 19-20, 2019 Amsterdam
it-sa-IT Security Expo and Congress October 8-10, 2019 Germany

PROJECTS

The Project Showcase at Global AppSec Tel Aviv has received a great deal of interest.  Anyone attending will be in for a steady stream of information on OWASP Projects.  The following projects are proposed for the showcase (the actual schedule has not been developed so the order is not indicative of time slots):

Project Presenter(s)
Glue Tool Omer Levi Hevroni
Internet of Things Aaron Guzman
Embedded AppSec Aaron Guzman
Software Assurance Maturity Model (SAMM) John DiLeo
API Security Erez Yalon, Inon Shkedy
Mod Security Core Rule Set Christian Folini, Tin Zaw
Automated Threats Tin Zaw
Application Security Curriculum Project John DiLeo
Defect Dojo Aaron Weaver
Web Honeypot Project Adrian Winckles
Damned Vulnerable Serverless Application Tal Melamed

The scheduled for project reviews at Global AppSec Tel Aviv are the following:
 
Project Review Level Leaders
Snakes and Ladders Lab Colin Watson, Katy Anton
Amass Lab Jeff Foley
Attack Surface Detector Lab Ken Prole
SecureTea Tool Lab Ade Yoseman Putra, Bambang Rahmadi KP, Rejah Rehim.AA
Serverless-Goat Lab Ory Segal
Cheat Sheet Series Flagship Dominique Righetto, Jim Manico
Mobile Security Testing Guide Flagship Sven Schleier, Jeroen Willemsen


If you are attending Global AppSec Tel Aviv 2019 and can participate in the project reviews (to be held on Monday and Tuesday prior to the conference, schedule pending), then please send an email to project-reviews@owasp.org

COMMUNITY

New OWASP Chapters
Amaravathi, India
Belo Horizonte, Brazil
Bhopal, India
Cusco, Peru
Dindigul, India
Kharkiv, Ukraine 
Meerut, India
Rio de Janeiro, Brazil
San Jacinto College, Texas
San Pedro Sula, Honduras
Seoul, Korea
West Delhi, Delhi

MEMBERSHIP

 
We welcome the following Contributor Corporate Members

Premier Corporate Members

Contributor Corporate Members
Join us
Donate
Our mailing address is:
OWASP Foundation 
1200-C Agora Drive, # 232
Bel Air, MD 21014  
Contact Us
Unsubscribe






This email was sent to *|EMAIL|*
why did I get this?    unsubscribe from this list    update subscription preferences
*|LIST:ADDRESSLINE|*

Saturday, May 2, 2020

Storium Theory: Don't Count Yourself Out

Today, I'd like to spend a bit of time on something that I've seen here and there on Storium - cases where a person perhaps goes a bit too Weak with a Weakness play...and takes themselves out of a scene.

It feels right - it feels better than right, doesn't it? Isn't it a great expression of a Weakness to not just suffer a setback, not just suffer some kind of injury, but actually get knocked out or otherwise removed from play for a bit?

Well...it is, and it isn't.

Let's start off with the good: This is, undoubtedly, an example of a player being very willing to show his character suffering for his Weakness. That's great, and that's an attitude that I hope people learn on Storium.

But actually taking yourself out...getting knocked out, getting poisoned to the extent that you can't move, draining yourself so much of energy that you're too exhausted to go on...there are times these things are appropriate, but they need to be used with restraint.

Otherwise, they can mess with the flow of a story.

I've seen it happen: A battle happens, one part of a longer sequence of events all taking place in a short period of time. One player plays a Weakness card and portrays themselves as exhausted, or poisoned, or just plain knocked out cold. Then the battle ends.

Now a few things can happen:
  • Somehow, the player character recovers very quickly, and keeps on going, so the story can keep moving. That's unsatisfying, as it feels like a major moment is just brushed over and somewhat ignored.
  • The narrator puts in a point where the group can rest for a while to make it seem more realistic that the player character takes time to recover from his state...but now the story loses momentum.
  • The story goes on, and the player character is put someplace safe to recover in the meantime, which means:
    • The player misses out on part of the story, or...
    • The narrator has to come up with things that happen around wherever the player character was left that they can work with in their current state.
I'm not particularly fond of any of these options. If you address a Weakness play that severe, you're going to find your story either feeling like it doesn't address the weakness properly, losing its momentum, or going on temporarily without a player (which can be harmful both to that player's experience with the story, and to the game as a whole, given how Storium tends to work).

 Now...you can make this work. You can. A good narrator who is used to letting the players have heavy story control, especially, can make this work out great. Maybe the group has to stop to allow the player character to recover, but in the process, the problem they're trying to address worsens. Or maybe that's the next challenge: Can they find things to help the player quickly enough that the next challenges don't worsen in the meantime?

But the thing is, even though you can make this work...it just oftentimes ends up more trouble than it is worth to put in this strong of a Weakness play. You can get some great, great character moments and a strong feeling of struggle and danger and fading hope from injury or tiredness that still leaves the character able to go on to new fights.

Sometimes, that can be even stronger. If a character is knocked out, the group might stop to deal with that and then go on once he's recovered. If that happens, the knockout doesn't add as much tension to the story. If a character is injured or tired but still goes on, though, we see that in everything they do for the next few scenes - they're in a bad way, one arm too hurt to hold up their shield, or dragging themselves forward in the battle. It's powerful.

Stopping the story's progress can add some tension if managed properly, but continuing despite your wounds always adds tension.

I'm not saying that you should absolutely avoid major consequences as part of Weakness plays, mind! There are times when it is appropriate, entirely appropriate. Particularly late in the story, particularly when the narrator has told you this is the final battle, you might pull out these powerful Weakness plays. Because there - there - it won't make the story pause or lose momentum. It'll emphasize just how bad things are currently, just how much of a struggle it is for the characters...but there's nothing ahead that the players need to address.

Keep yourselves within the bounds of the challenge, but that is when you should be safer using some of these powerful Weakness concepts.

Before that? Before that, earlier in the story, don't go that far! Go lighter with what goes wrong...but use what goes wrong more. Pick up some kind of injury and carry it with you for the next few scenes, showing your character struggling with it. Show the tiredness that you're feeling, even as you struggle to move on.

Or almost encounter one of those points...and leave things open. Let someone else save you from them. Those can be amazing moments in a tale too.

Weakness plays don't have to be about solid, absolute consequences for your character. They can be about the threat of those consequences. They can be about what might happen if the battle isn't turned around. If you knock your character out, he's knocked out. That's certain. It's done. But if you put in the possibility, you're giving someone else the chance to write. And that's what Storium is all about - working with each other to write interesting or fun stories.

So I suggest pulling back from the solid a bit - work with possibilities. Get hurt and need help. Or, need help to avoid getting hurt. Get tired and struggle. Need someone's shoulder to lean on. Need someone to fight by your side. But unless the story really, truly demands it, don't get taken out entirely. That cuts off possibilities - like bluntly leaving in the middle of a conversation.

And if you're going to take yourself out at all, try not to do it while you still have card plays left for the scene! Hopefully narrators are taking my advice to not use up all their points, but still, it's useful if players keep open the option to play all their cards if needed.

Now, one more note here: I've already said that late in the story you might be fine pulling out heavier, solid consequences as part of a Weakness play if that's your thing. There are points earlier in the story where you might do that too. The narrator might even set them up specifically. If he does...go with it, obviously! If the Weak outcome is "you're all knocked out," well, that's what the outcome is, so do the normal thing with a Weak outcome if you get it and write your spin on that outcome! You get knocked out.

The narrator, obviously, will have planned for that possibility since he put it in the outcomes, right?

Similarly, you might find a situation where it feels like the consequences should be higher - where the outcomes suggest this battle or event is more dangerous than normal, or where you're already portraying your character in a bad way and it just feels like they should have something more solid happen to them on your next Weakness play. And that's fine...I just suggest that you consider talking to the narrator first. Remember, you're writing collaboratively: Check, when you're thinking about having something this major happen to your character, and work with the narrator to figure out how it can happen but still keep the story moving (and not exclude you as a player).

This isn't a solid "don't ever do this." I want to be clear on that. What it is is a caution: Be careful of how and when you do this. When a hero is solidly defeated in battle or exhausts herself in the service of a cause, that can be a great story moment. It's just important to make sure that it's the right time - and that it doesn't derail the story's momentum or leave it short of players in the process.

Meet Commodore's VIC(-20), The Friendly Computer




When Commodore made the PET-2001, they made a computer that found some success in the market, especially in Europe.  The PET turned into a series, but it was an all-in-one PC that came with a monochrome monitor and was rather an expensive product.  Commodore wanted to expand to more of a mass-market, and they designed the Commodore VIC-20, the first personal computer to sell for less than $300.  The VIC was very successful when it was released in 1981, becoming the first computer to sell over one million systems.  Its low price and feature set (color graphics, 4-channel sound) helped it to outsell its competitors.  But it days in the limelight were short-lived due to the arrival of its successor, the Commodore 64.  Having acquired a VIC-20, let's take a look at some of the practical issues with using it.


Read more »