OWASP & the security community

Source: https://influences.sgit.ai/register/owasp/index.html↗ · markdown twin of the entry page.

An influence on Dinis Cruz — one of 25 entries in his register.

• tier traced — corpus evidence exists today
• kind community + era
• status full — the seven-block register format
• briefing none

Not a person and not a work: two decades inside an open community, and the Summit model in particular. The seed list's own phrasing was the cyber security community — an era, treated as an influence in its own right.

Block 1 — The anchor

OWASP, and participation in it from the early 2000s onward

• anchor: https://owasp.org/ ↗

The anchor for a community or an era is the first documented contact with it, not a work. The Summits are the specific institution this entry is about.

Linked, never rehosted.

Block 2 — In his own words

The claim worth defending here is narrower than open communities are good. It is about the Summit format specifically: sessions that must produce an artefact, working groups that outlive the room, and outputs published whether or not they are finished. That is an unusual thing to have been formed by, and it shows up in the estate as a set of habits rather than as a topic — publishing unresolved questions as first-class pages, versioning documents rather than replacing them, and treating a working document as a deliverable.

The second strand is what a global, volunteer, chapter-based organisation teaches about distributed work — a lesson learned twenty years before it became a general one, and which nests naturally with diverse and distributed teams↗.

This entry deliberately does not cover open-source governance or funding models. Those belong to the open-source sibling↗, which carries the full history pack.

Block 3 — The principle

Knowledge compounds fastest in the open, among people who owe each other nothing — and the format of the gathering decides whether it compounds at all.

Block 4 — The trace table

No trace table yet. The habits this entry claims — publish unresolved, version rather than replace, treat a working document as a deliverable — are visible across the estate and across this whole site network, and the mining run recorded the volume rather than the instances. Building the rows means naming specific practices and where they are written down, and the entry publishes the claim without them rather than inventing paths to point at. Tracked as R2 ↗.

Block 6 — The checklist

• Did the session produce an artefact, or did it produce agreement that will be gone by Friday?
• Is the unresolved part published, or is it waiting until it is presentable?
• Could someone who was not in the room pick this up from what was written down?
• Is this being kept private because it is sensitive, or because it is unfinished?

Block 7 — The wider library

• OWASP Summits — the working-session format this entry is really about https://owasp.org/ ↗
• The OWASP Top Ten — the artefact everyone knows, and a case study in what happens when a working document becomes a compliance requirement https://owasp.org/www-project-top-ten/ ↗
• David Rice — Geekonomics — the wider-library item belonging to the nested keynote entry https://www.oreilly.com/library/view/geekonomics-the-real/9780321477897/ ↗

The corpus evidence

CC BY 4.0 — Dinis Cruz, with AI co-authorship (Claude, Anthropic). The anchor work belongs to its author and is linked, not licensed here.