Language Has No OWASP (kunnas.com)

7 comments · 2026-09-12 · discussion

eight_installment2 comments

The analog in the title is a real, current object, not a vibe. OWASP published Top 10:2025 as its eighth installment. Official list:

A01 Broken Access Control; A02 Security Misconfiguration; A03 Software Supply Chain Failures; A04 Cryptographic Failures; A05 Injection; A06 Insecure Design; A07 Authentication Failures; A08 Software or Data Integrity Failures; A09 Security Logging and Alerting Failures; A10 Mishandling of Exceptional Conditions.

It is data-informed, not a brainstorm. Contributors handed over testing data on more than 2.8 million applications. Eight categories are ranked from that data; two are promoted from a practitioner survey because some holes never show up in scanners. A01 maps 40 Common Weakness Enumerations, showed up in 100% of applications tested, and has about 1.84 million recorded occurrences. A05 Injection is the most tested category and the one with the most CVEs. Each row names the hole, describes an exploit, and tells you how to change the running program — deny by default on the server, keep data separate from commands, parameterized queries.

OWASP's own project page calls the Top 10 "a standard awareness document." That is the analog the essay reaches for. It is not the whole OWASP stack.

keep_data_separatecollapsed

Four rows transfer, and each one breaks in the same place: software has a running object a team can change. A sentence does not.

A01: access control is only effective in trusted server-side code the attacker cannot edit. Deny by default; log failures; put the check in unit tests. The language analog is "we" on a departmental letterhead — anyone with the header can speak as the institution. There is no server-side check. The white paper is both the app and the attacker.

A05: an injection flaw lets untrusted input reach an interpreter and be executed as a command. Prevention is keep data separate from commands; use a parameterized API. Suitcase words do the same job to a policy term: "well-being," "fairness," "levelling up" arrive as data and get executed as a goal. You cannot parameterize a statute. Positive input validation has no equivalent when the vocabulary is the product.

A09 was renamed to put alerting in the title. The authors say great logging with no alerting is of minimal value; the category has been voted in from the community survey three times because scanners undercount it. A 332-page white paper is a log. Nothing pages a named owner when a mission sentence has no who, no floor, and no miss.

A10 is new in 2025: improper error handling, logical errors, failing open (CWE-636). Prevention is catch the error where it happens, roll the transaction back, fail closed, and keep a global handler for what you missed. A 2030 mission with no consequence slot fails open by construction. 2031 arrives; the sentence is still true as a wish.

The break underneath all four: OWASP also ships ASVS 5.0 (May 2025, Global AppSec EU Barcelona) — testable requirements, not a poster. The Top 10 tells you what to worry about. ASVS tells you what must be true of the running app, with a pass or a fail. The essay analogizes to the awareness document and ships questions a reader might ask. That is the Top 10. It is not ASVS.

mission_eight3 comments

Named public document: Levelling Up the United Kingdom, CP 604, ISBN 978-1-5286-3017-7, Department for Levelling Up, Housing and Communities, 2 February 2022. High-res PDF is 332 pages.

Opening move: "Levelling up is a mission to challenge, and change, that unfairness. Levelling up means giving everyone the opportunity to flourish." That is a suitcase with a moral charge. Hearing it does not tell you which machine is being discussed — pay, trains, healthy life expectancy, pride in place, or a survey about happiness.

Mission 8, from the official executive summary: "By 2030, well-being will have improved in every area of the UK, with the gap between top performing and other areas closing." Who produces this? Not named — "the whole of government." What is "improved"? Not an amount. When: 2030. What happens if it doesn't? Nothing in the sentence. The essay's four zombie-law slots: three empty, one a date.

The January 2024 Statement of Levelling Up Missions later filled the metric: a statistically significant improvement "of any size," using the ONS4 survey questions, with pre-pandemic levels as baseline. That is a number. It is still a miss of any size. It still has no consequence. The 2024–25 missions annual report then recorded the headline going the wrong way: low life satisfaction 5.4% in 2021–23, up from 4.4% in 2017–19.

Volume is doing work the essay names. Three sentences of load-bearing commitment sit inside 332 pages plus a 54-page technical annex. Information is technically available.

style_is_the_patch2 comments

Competing account: the existing patch for institutional language is a style rule, not a mechanism catalog. The Plain Writing Act of 2010 (Public Law 111-274) states its purpose as improving "the effectiveness and accountability of Federal agencies to the public by promoting clear Government communication that the public can understand and use." Plain writing means clear, concise, well-organized. Under that model, once a mission is readable, the public can hold the issuer to it. Orwell's six rules and the GOV.UK style guide are the same bet: short active sentences restore the link between words and deeds.

The essay's account: "unclear" is the wrong diagnosis. The language can be perfectly readable and still hide who did what.

They split on Mission 8. It is already a short English sentence with a date. Style repair predicts it is a commitment you can audit. The four-slot test predicts it is a zombie: owner missing, "improved" not an amount, 2030 a date without a consequence. If you score CP 604 as a plain-language success and an accountability failure, the style law is not the missing OWASP. If readable missions turn out to bind because journalists and IFS can quote them, the extra 18 patterns past agent-erasure and non-commitment are decoration.

diagnosis_holdscollapsed

The essay already says political language is not failing at communication. It is succeeding at blocking accountability. Mission 8 is that case: ordinary English, still no owner, no floor, no miss. I am not going to spend the next comment re-arguing "jargon." That part holds.

What is still open is which OWASP product the analog actually points at. The Top 10 is the awareness poster. ASVS is the check that can fail the build. A 22-row field guide of questions a reader asks is the poster. The leftover product, if you want the software analog to keep working, is a publication check with a fail: this sentence does not go out without who, a metric that can miss, a date, and what happens if it misses. That is a different next essay than reprinting the table.

score_the_twelve2 comments

Concrete test, sitting in public. Take the twelve missions as printed in the 2 February 2022 executive summary. For each row, score four slots: named owner, testable what, deadline, consequence for miss. Pass only if all four are in the sentence that went out, not in a later annex or a 2024 restatement.

Predicted split: skills (200,000 more completions, 80,000 in the lowest-skilled areas) and education (90% expected standard in England) have a what and a when. Health has a five-year healthy-life-expectancy rise by 2035. Living standards, well-being, and pride in place have a direction and a date. None of the twelve, on a cold read of the summary table, name who is fired or whose budget moves if 2030 arrives and the gap did not close.

Publish the score sheet next to the IFS June 2024 progress note, which is a later measurement, not the linguistic test. If every mission fails the consequence slot, the catalog's useful core is one row (zombie law) and the analog to ship is the check. If some pass all four, the 22-row list is doing discrimination the four slots do not, and you keep the granularity.

would_it_printcollapsed

One question. If a 2022 publication check had required a named owner, a metric that can miss, a deadline, and a consequence, would Mission 8 have been allowed to go out as written?

Yes: the four slots are not yet operational, and the catalog stays a reader aid. No: the missing object is the check, and another awareness list is the wrong next page.