I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause of those vulnerabilities is a lack of security education from the developers. I've been thinking about what could be done about those problems. My idea would be to start an "open source web application" penetration testing community. The community would be composed of like-minded security professionals/enthusiasts.
The community :
- select a specific version of an open source web application and dedicate a 1 to 4 weeks time frame to it (depending on the size of the application).
- test the application for security problems. Penetration testing + source code review. (maybe following the various OWASP guides)
- issue a list of vulnerabilities to the open source organization
- help write/review the patches
- provide design recommendation and educational materials to the open source organization
- compile all materials created and publish it for educational purpose
The members of the community can submit their vulnerabilities within the established time frame. The vulnerabilities submissions are only visible to trusted/participating members and remain hidden until X(?) weeks before the publication. I know some people have mixed feelings about vulnerabilities disclosure but I think the benefits far outweigh the disadvantages (and I don't want to start a debate about that here).
Now the questions :
- How many weeks should the vulnerabilities stay hidden?
- Should we ask permission to the open source organization? (Is there any law/license against open source pentesting?)
- Should we invite a member of the open source organization to supervise the process from the inside? (view the vulnerabilities submissions/take part of the discussion)
- Do you think such community would be relevant to the open source?