OpenPacket.org RC2

Thanks to yet more excellent, all-volunteer work by our developer Sharri Parsell, I am happy to notify you RC2 of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you to JJC of www.redsphereglobal.com for continuing to provide hosting. JJC will host the site until it appears that we are outgrowing his generosity. If you would like to sponsor us, please contact me (taosecurity at gmail dot com).

Please take another look at the site and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered RC2 quality. We plan to announce RELEASE on 20 February to coincide with the first day of Black Hat DC Briefings.

If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise. We appreciate those of you who did some XSS testing -- please try again and let us know what you find.

OpenPacket.org RC1

Thanks to even more excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you RC1 of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you to JJC of www.redsphereglobal.com for continuing to provide free temporary hosting. We are working on a more permanent solution, but if you have ideas now please let me know.

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered RC1 quality. We plan to announce RC2 on 18 January, followed by a public RELEASE on 1 February.

If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise. We appreciate those of you who did some XSS testing -- please try again and let us know what you find.

New Beta Site Live

Thanks to more excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you that a beta demo of OpenPacket.org is now available at

http://beta.openpacket.org:8080/

Thank you also to JJC of www.redsphereglobal.com for providing free temporary hosting. We are working on a more permanent solution, but if you have ideas now please let me know.

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered "beta," and we are getting closer to public announcements of the site. If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri and JJC to ensure your discoveries do not catch us by surprise.

New Alpha Site Live

Thanks to the excellent, all-volunteer work of our developer Sharri Parsell, I am happy to notify you that an alpha demo of OpenPacket.org is now available at Sharri's temporary site:

http://openpacket.spaceegg.net/

Please take a look and report feedback to the openpacket-devel@lists.sourceforge.net mailing list.

This site is considered an "alpha" because we are still working on functionality, administration, appearance, and so on. If you are interested in assessing the security of the site, please contact me directly. We can coordinate with Sharri to ensure your discoveries do not catch us by surprise.

OpenPacket.org Developments

I am happy to report that work on OpenPacket.org is back on track, thanks to a new volunteer Web application developer.

Several months ago Richard Fifarek put me in touch with his friend Sharri Parsell. She read the requirements document I wrote last year and discussed the project with me.

Today she showed me a pre-alpha version based on our discussions over the last few months. I was very impressed and we plan to have an alpha ready for review by openpacket-devel list members within the next two weeks. I've also contacted a few guys I trust who perform Web app assessments to review the site prior to general public availability.

If development stays on track we plan to have a beta available for the public prior to Black Hat at the end of this month.

Stay tuned to this mailing list and/or the OpenPacket.org Blog for more developments.

Thank you especially to Sharri for volunteering to do this work and getting us close to public availability!

Sincerely,

Richard

Alpha Demo Site Live

[Removed by request] has reactivated the OpenPacket alpha demo server. It is available at:

openpacket.dyndns.org:8000

The site will be live:

Monday from 7am to 5pm
Tuesday from 7am to 5pm

All times are EST (I believe).

To gain moderator status, visit

openpacket.dyndns.org:8000/makememoderator

[Removed by request] says:

Things that have been done since last demo:

- Moderators can dis/approve and leave comments
- A log is written each time a dis/approval is made
- Remoderation feature: moderators can re-approve a disapproved file or perm delete it (log is written)
- Number of downloads is now shown for each file
- A marker has been added if the file is sanitized
- You can sort when browsing files
- Searching features have been added for comments
- Searching features have been added for parsed information of files
- Clicking a user brings a page with all the files that user uploaded
- Moderators can put "final comments" on a file. This comment will be highlighted
- Categories have been added

What needs to be done:
- Tagging
- Rating of files
- Rating of users
- Checksums
- Validate that the uploaded file is a pcap file
- Add the openpacket logo

Please give the demo a try and post your feedback to the openpacket-devel list.

Thank you [Removed by request], and thank you testers!

Another Round of Alpha Demo Testing Soon

[Removed by request] is coding the suggestions made since the demo last month. He expects to be done within a week. When the demo site is available again, I will post a notice here and on the openpacket-devel mailing list. Thank you.

OpenPacket Alpha Demo Available

[Removed by request] has made an alpha demo of OpenPacket.org available at http://roach4.no-ip.org:8000/ for the following limited times:

Friday: 4pm to 11pm Eastern
Monday: 1pm to 5pm Eastern

If you have comments on the site, please join the openpacket-devel mailing list and post them to openpacket-devel [at] lists [dot] sourceforge.net. You can see the archives here.

Remember this is a very rough first cut, so we are open to suggestions, feature requests, and help.

Draft Proposal Available

I just posted the first draft of a document describing OpenPacket.org.

openpacket_req_doc_draft_21jul06.pdf

Please take a look and provide comments and suggestions. Those of you who want to help might want to announce yourselves on the openpacket-devel list to facilitate collaboration.

I did not assign any timelines because I am not sure of the level of effort required to make this a reality. At the very least this document is a starting point.

Thank you!

OpenPacket.org Already Under Construction?

I received an email today from a long-time TaoSecurity Blog reader saying he had started assembling a site for OpenPacket.org. This is great news. I am going to work on a requirements doc this week and try to get it to this benefactor by week's end. I'll let him reveal his own name since I am not sure if he wants to publicize his involvement yet.

Please Post Functionality Requests to Mailing List

Wow, I am already getting offers of help from two people. Thank you!

Please post any ideas you have regarding desired functionality to the openpacket-devel@lists.sourceforge.net mailing list.

Mailing Lists Created

I just created two mailing lists:

1. openpacket-users


2. openpacket-devel

Since there are no users yet, devel is the best place to discuss how to build OpenPacket.org.

Both are hosted by SourceForge and require joining prior to posting.

OpenPacket.org Update

It's been a very long time since I've said anything about OpenPacket.org at my TaoSecurity Blog. Although I am no closer to launching OpenPacket.org, I thought I would explain what's been happening. In short, I announced the project two months after starting my own company, TaoSecurity. Since then I have been exceedingly busy doing the business and technical work of running an independent consultancy, as well as being a real person in the non-security world.

I would still like to get OpenPacket.org going, but at the moment I have had no concrete offers of help with creating the site. Around the beginning of the project there was a possibility of corporate development and hosting support, but that fell through due to concerns over ownership. I became concerned the project would end up the intellectual property of a big company when the potential partner announced acquisition plans.

Several people have promised to contribute traces, but actually building a Web site with the necessary infrastructure and back end is still a problem I am being forced to solve. That would be ok if I had any experience in Web development, but I don't. Therefore, OpenPacket.org will not launch until I figure out how to build it. I have considered hiring a developer, but I am not sure if I could raise enough money to pay for the project. Ongoing maintenance might also be an issue.

If you have any thoughts on this matter, please feel free to post them below. Thank you.

OpenPacket Blog Launched

Welcome to the pre-alpha version of OpenPacket.org. We will use this site to collect packet traces in Libpcap format prior to the formal launch of OpenPacket.org. Keep your eye on this site for future developments.