OWASP Needs to Evolve
I have a very poor opinion of OWASP <i>content</i>, because the couple of areas I’ve paid any attention to have never been any better than mediocre, clearly written by amateurs long ago and largely unmaintained ever since, with <i>known</i> errors and heavily misleading statements hanging around for over a decade on no or unsound justification, among many other problems obvious to any that actually know the field. (See <a href="https://hn.algolia.com/?query=chrismorgan%20owasp&type=comment" rel="nofollow">https://hn.algolia.com/?query=chrismorgan%20owasp&type=comme...</a> for a few comments with somewhat more detail, but things have historically been just <i>so</i> bad and so <i>obviously</i> bad that I haven’t bothered enumerating more than the issue that has annoyed me the most.)<p>(Sigh. I see that as part of fixing a lot of the obvious unsuitability of <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" rel="nofollow">https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...</a> some time in the past two years—and it <i>is</i> much better now, though there are still a few dodgy things about it in both content and presentation—they <i>reintroduced</i> the erroneous advice to entity-encode /, which was only <i>finally</i> removed two years ago. Feel free to try to get that fixed, anyone; for my part, I have no interest in trying to work with OWASP.)