Agenda for 11/6/2017

[csanders-git]

Agenda for the CRS project / community chat on Nov 6

• Promotion of 3 heavy contributors to developers (@fgsch, @fzipi and @spartantri) Docs will be updated to reflect their promotion, congrats and thank you!!!
• CRS Summit at AppSecEU in June in Tel Aviv (?) dune73 will setup a project and let us know the status as we move along. fzipi spoke at OWASP Dev Summit about WAF test data. A new license is available (https://cdla.io/)
• Testing (FTW is working when using with https://github.com/CRS-support/ftw/pull/14) PR is awaiting merge but seems to be working well. dune73 plans to write a blog.
• Idea to update release poster (with logo in the center) We had some great press about the poster. Need to check balance, Dune73 will finance privately. Shooting for by AppSecEU
• Idea to start to sell the release poster via a printing service like Redbubble
• Info: CRS nominated for the German Open Source Business award (http://osbar.it)
• Plans for new blog posts Franbuehler writing up about SQL disassembly dune73 writing about FTW csanders-git writing about Apache vulnerability breakdown.
• [PR #881] : Java Attacks Will be assigned to csanders-git
• [PR #884] : SQL injection probing rule split 942370 emphazer is working on a PR for this so it's in line with franbuelers comments.
• [PR #896] : Command substitution backquoted version support Splitting into two and fixing conflict when available.
• [PR #899] : Dokuwiki and Nextcloud exclusion packages (work in progress) Will be done when submitter has time.
• [PR #905] : Duplicated header bypass fix and chunk support csanders-git and fzipi are going to take the helm on getting this one through.
• [PR #922] : New developers (see above) Merged, need to add other testers also. remove spratantri from 905 as contributor
• Many PRs / test updates by @azhao155 (which are awesome). Bring up a question about what to do with Apache versus Nginx behaviors when the underlying engine 'fixes' and issue. Going to add support for multiple return status. This should take care of all the test updates.
• [Issue #924] (on request of @fgsch who might skip the chat)
• Release 3.1 planning Possible after JS fixes are done.
• Stickers and maybe shirts (for appsec eu) Redbubble

Squared's update.

• New ModSec t-shirt -> The small batch for AppSec ended at the event and I'm trying to get a new batch printed for the next event. Hopefully will have ready by end of month
• ModSec 3.0 talk on B-sides Toronto next week: http://www.bsidesto.ca/abstracts.html#6
• BlackHat Europe Arsenal demo for libModSecurity in December: https://www.blackhat.com/eu-17/arsenal/schedule/#modsecurity-300-9079
• We are working very hard on v3 and we hope to have a second release some time this year but not sure yet when.
• We've been incredibly busy with all things ModSec related lately, hence why we are not able to work much on CRS. Let us know if you know anyone to join our team to help us :)
• No plans for 2.9.3 yet. Definitely not for this year.
• Still not time to look into those language encoding issues. Hopefully we will able to once v3 is released.

[dune73]

I think it is best to enter update right into @csanders-git's description. Non-developers ideally comment and we can then add it for you into the agenda.

[fgsch]

I'd like to add #924 to the agenda.

Also, I'm currently in Japan so it might be too early for me to attend :(

[dune73]

done

[dune73]

Did that monthly chat.

The minutes of the talk are https://coreruleset.org/20171107/crs-project-news-november/