OWASP Media Project

Jump to: navigation, search
OWASP Project Header.jpg

OWASP Media Project

OWASP Media Project is an infrastructure project that gather, consolidate and promote OWASP content in video format on a central appealing hub. The main instance of the project is a YouTube channel for publishing global content and major conference recordings.


We are trying to be the global link between all video content produced at OWASP intended for global audience. We do guidance for live event video capture and recording as well as some publishing. This project by itself doesn't provide the content directly.

Are you a chapter or project and want access on YouTube?

While some sporadic content can be uploaded to the main channel, we strongly suggest that leaders create their own channel to be linked from the front page if they plan to publish regular content. Send us an email into our project mailing list to be added. The main reason is that YouTube unfortunately doesn't scale well for access management and you'll find rapidly that having your own channel will give you the control you need.


OWASP Media Project is distributing content that is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

AppSecUSA 2018 playlist

AppSecEU 2018 playlist

AppSecUSA 2017 playlist

AppSecEU 2017 playlist

AppSecUSA 2016 playlist

AppSecEU 2016 playlist

AppSecUSA 2015 playlist

AppSecEU 2015 playlist

Live from AppSecUSA 2014 playlist

Live from AppSecEU 2014 playlist

Quick Access

YouTube Official OWASP Channel

What is OWASP Media Project?

OWASP Media Project provides:

Project Leaders

  • Amelia Graycen
  • Jonathan Marcil

See Project About for contributors.

Mailing List


News and Events

  • [Mar 24 2017] Reached 500,000 views on YouTube!
  • [Jul 26 2015] Reached 200,000 views on YouTube!
  • [Nov 21 2014] Reached 100,000 views on YouTube!
  • [Apr 07 2014] Wiki page updated to new template.
  • [Sep 14 2013] Creation of the project


Team San Francisco #downtown Owaspmediaprojectteamdowntown.jpg

Team Denver #appsecstreaming Appsecstreaming-denver.jpg

Academic Partner Münster University of Applied Sciences IT Security Lab

Logo international vollton itseclab.png

Related Projects

On this page: Help for YouTube uploading, publishing and source recording.

Guidelines and standards for YouTube

Access management is currently given to OWASP Media Project leaders and OWASP Global Staff. Make sure you:

  • Send an email to the project mailing list when adding or removing access
  • Move back to communication manager any manager that are not posting video content actively
  • Periodically audit and clean up the accesses given to people
  • You can access the manage permissions page while logged in with the correct Google account on Brand Account details

In order to achieve an acceptable level of quality and consistence trought the videos upload on the channel, each uploaded videos must meet theses requirements :

  • Comply with YouTube Copyright regulations http://youtube.com/yt/copyright/what-is-copyright.html
    • Fun introduction https://www.youtube.com/copyright_school
    • Basically, do not upload any content or partial content that are from another source, that includes music, TV show captures, clips from movies/TV.
    • If we get Copyright strikes, after 3 we are out and will be ban from YouTube. We are at one strike before the writing of the current requirements and lost some advantages of our partnership with Google. Current resolution of status is due April 2013.
    • Deleting an infringement strike trigger (it's automated) videos won't help removing the strike.
  • Respect basic quality standards for uploaded videos.
    • 720p minimum, upload in 1080p Full HD if available (YouTube will create lesser resolutions versions automatically)
    • Slides must be readable in 480p (for mobile usage and default web view).
    • Sound must be clear and with no electronic noise or with minimal white noise.
    • Editing must be professional level or very minimal with YouTube tools or absent.
  • Upload videos only with consent from the source even if it's OWASP (like a chapter or a conference).
  • For meta data information:
    • Put the subject and the speaker name in the title
      • If the subject is too long, the speaker name can be omitted
    • Link to the source on owasp.org Wiki and then any links you want
    • Put the abstract if available and speaker BIO in the description
    • Leave the OWASP Media Project signature
    • Use the default tags (currently #owasp and #appsec) and optionally add some if desired
  • If videos are from a logical batch, associate it with a playlist (Example: AppSecEU2013 playlist)

YouTube uploading procedure


  • Have a Google account, preferably an @owasp.org one, that is added as a manager of OWASPGLOBAL YouTube channel
  • If you plan to upload content regularly, you must be subscribed to our OWASP Media Project mailing list
  • Read the "Guidelines and standards for YouTube" especially about copyright


  • Use another browser or profile than your normal browser in order to upload to YouTube. If you browse YouTube as "OWASP", all history, likes and favorites will be shared with the channel.
  • Take special care of your account because it is now having all access to a front-facing OWASP asset


  • Login as OWASP on YouTube with the top right account change widget
  • As OWASP, Create a playlist with the name of your contribution
  • Upload the video using https://www.youtube.com/upload
    • In Privacy settings, make it "Unlisted" or "Private" if you don't want it to be shown right away
    • As it upload and process, set the correct title and description (please leave the Media Project signature)
    • Add tags related to the subject or the contribution. These are like keywords.
    • You can use the Video Manager in order to tag many videos at once
    • Save and wait until it is completely uploaded
  • View the video and add it to your playlist
    • Change the Privacy settings to Public if it was Private or Unlisted
    • Review title and description
  • Share the video as you wish on Twitter, LinkedIn, Facebook, etc.
    • Use embed code to share it in HTML
    • Use wiki code #ev:youtube|VIDEO-ID or #ev:youtubeplaylist|PLAYLIST-ID between {{}} for owasp.org wiki

YouTube + Hangout streaming procedure

This is partially oudated as of 2018

You must already be familiar with Google Hangout On Air to follow these steps. https://support.google.com/plus/answer/2553119?hl=en

It is strongly encouraged that you try an event on your own channel/Google+ before attempting to do something on OWASP official channel.

Also, any speakers must try to do a "Hangout" before the real deal even if it's not On Air just to test the setup and install plugins.


  • Have a Google account, preferably an @owasp.org Google Apps.
  • If you plan to broadcast content regularly, you must be subscribed to our OWASP Media Project mailing list
  • Read the "Guidelines and standards for YouTube" especially about copyright


  • Use another browser or profile than your normal browser in order to upload to YouTube. If you browse YouTube as "OWASP", all history, likes and favorites will be shared with the channel.
  • Take special care of your account because it is now having all access to a front-facing OWASP asset
  • Do not mix the two kind of links you'll have, "Link to share" starting with "https://plus.google.com/hangouts/_/hoaevent/" is for participants and "YouTube Page" starting with "http://youtu.be/" or "Event Page" starting with "https://plus.google.com/events/" is for viewers.


  • Login to Google+ and then switch to "OWASP Google+ Page" account
  • Access the Hangout section of Google+ as "OWASP" https://plus.google.com/b/114897759028714798478/hangouts
  • Start a "Hangout on Air" with the right title and description (will be the same on YouTube)
    • You can schedule it for later in order to gather the required links in advance for attendees and viewers, see Media:Mediaproject-screencap1.png
    • The Audience is really for the viewers and not the same as participants in the Hangout
    • You will be next redirected to the Event Page on Google+
  • In the event page of Google+, you can click on "Start" button to lunch the Hangout interface, see Media:Mediaproject-screencap5.png
    • If it's a scheduled event, you can still click to see the interface, but don't click on "Start broadcast" until you are ready to be live
    • You can also enable Q&A app and add a trailer to it, but this will have no effect on YouTube, it's just for Google+ so keep that in mind.
    • Once in the Hangout interface, feel free to skip the invites Media:Mediaproject-screencap2.png and use the "Link to share" described bellow.
    • People will see you as "OWASP", if they see your name, you are not doing it right.
  • Make sure you have the right microphone selected in "Settings" and that it is working, see Media:Mediaproject-screencap6.png
    • If you have a USB microphone or console and good Internet connection, change the quality to "Studio" in "Settings".
    • If you don't plan to use your webcam, use the "Turn camera off" button, it will show the OWASP logo from the OWASP account
  • Screen sharing is available in the Hangout app and works on Mac/Windows/Linux, see Media:Mediaproject-screencap8.png
    • You can share only one application that you select, if you close the app it will fall back to webcam or default icon
    • Share your whole screen if you are unsure or using a full screen PowerPoint
    • You can also share a secondary screen (if you have a projector that is not mirrored for example)
  • If you want other participants that just yourself, you can invite them with the "Invite People" button, but it is generally simpler to give them the "Link to share" by IM or email, see Media:Mediaproject-screencap3.png
    • Note that anyone with the link may join the call. Be careful.
    • Feel free to use the control room during the event to manage sound from participants
  • In the Google+ Hangout interface, bottom right, click on "Links" and share the the "YouTube Page" link with viewers. This will be the same link as the offline recording of your broadcast. See Media:Mediaproject-screencap4.png
    • This is the same as the "YouTube page" from the event page on Google+, you can also share the "Event Page" itself, but it is recommended to use just the YouTube link to avoid confusion.
  • Click on "Start broadcast" at the bottom to start publishing on YouTube
    • It can have a little delay to start
    • Everything is automatically recorded into YouTube and will be published as a normal YouTube video once you stop the broadcast.
    • If you stop the broadcast, you will not be able to restart it. It is a one shot deal. Note that it is possible to edit the recorded video on YouTube and cut parts of it if needed.
    • If you leave the call, it will ask you for confirmation and the broadcast will be over
    • If you close the Hangout window or crash, you'll be able to rejoin the live broadcast by clicking Start on the event page again (make sure you are as OWASP into Google+ when you do so)
  • After broadcasting, make sure you are not using Google+ or YouTube as "OWASP" anymore by switching back to your account.

Hardware and other software

In order to get the best "bang for the bucks" hardware possible, we have used and tested many devices. We apologize to direct you to specific products but some people needed direct suggestions.


If the presenter is in front of a presentation laptop, use the microphone on that laptop. If it happens to be a MacBook Pro, you'll get great sound. If not, any USB microphone that is around the 100$USD mark will do the job. The H1 Zoom has been reported as worked on Mac, Windows and Ubuntu is a plug-n-play manner. It can also used as an stand-alone offline recorder (event with a pro lapel mic).

Note that any phone devices (dials in, Bluetooth) will reduce the sound quality and that might be problematic if you are aiming for the better quality.

Also, wireless is great, but costly. If you have a budget between 500-1000$USD for sound and operating staff, go for it, if not you're better with wired equipment.

Video capture

For low budget recording, we strongly recommend using software screen recorder and no hardware. You can use Open Broadcaster Software to stream and locally records any content. It's free and open source and for Win/Linux/Mac but we have tested only the Windows version. It also supports captures cards and webcams.

If you want an hardware soluion, you can input from a dedicated capture card. Many of them are branded for gaming recording purpose and will do real fine. The main advantage of the capture card is that you don't need to install any stand-alone software or plugins on the presenter's laptop. You'll quicker results and quality won't be touched much, except if you are still using VGA instead of HDMI. Some cards can "wiretap" by offering a bypass between the projector and the computer.

OWASP has in stock a few X-CAPTURE-1 to capture from HDMI and VGA, all with bypass features. It's biggest limitation is that it is Windows (DirectX) compatible only (need a Core i7 or higher, no i5) but they capture the greatest range of outputs for that price (around 350$USD). For official big OWASP events those cards are available from Konik. However, in 2018, many cheaper and better solutions are available. Some of them even have on-board recording without the need for a computer. Just make sure you are recording in HDMI.

Conference Guidelines

OWASP Media Project used to provide on site recording for talks during major OWASP conferences (20+ speakers), but this is now a thing of the past. In order to achieve a respectable results in quality of content, dealing with an experienced professional vendor is now a must.

Note that OWASP Media Project will still provide support on uploading, publishing and marketing of the video content as of 2018. Vendor could still be required to upload to YouTube, this is particularly useful if they don't deliver on physical media by the end of the event.

In order to assure painless success some hard requirements are to be followed:

  • Use HDMI for screen capture
  • Do not record the slides using a video camera and use that as final publishing
  • Require the vendor to have experience with recording presentations

And some somewhat flexible requirements (downplaying them will jeopardize quality):

  • Require the vendor to have experience with online publications
    • Have the vendor send a prior sample of their work
  • Coordinate the recording vendor with the audio vendor
    • Some hotels will enforce their own audio vendor, fight them or make sure that they have a SLA in the contract
    • Most of the problems you'll have at this point will be audio, be prepared, but don't go as silly as have dual microphones, unless it's a huge keynote.
  • Have the vendor do live post-production. That means that talks are ready at the end of the conference, not 2-4 weeks after
  • If they do post-production with music, make sure it has been tested on YouTube to not generate copyright strikes.
  • If recording of the speaker is done, make sure it's with professional grade camera
  • Prioritize keynotes on budget for recording and additional marketing efforts

What to NOT do:

  • Do not use your own laptop for presentations with software recording
    • We actually suggest software recording for smaller or single talk event, but in a big conference that's a guaranteed headache
  • Do not publish all content at once
  • Do not expect 100% quality from any vendor
    • A 5% failure rate is to be expected; you'll loose some recordings, sound will be bad on some, aspect ratio might be weird, HDCP might ruin everything.
    • Some talks will be beyond salvage. We published them in the past but with 700+ videos online now, we think it's unnecessary unless there's a direct demand from the community to see the talk anyways.
  • Do not wait to publish talks more than ~3 months after the event.
    • With global events overlapping, you also don't want to publish one event over the other.

Last but not least, be ready to pay the price. We suggest that you look for sponsors in order to cover the costs. Be aware that you might break YouTube EULA by adding ads inside the videos, especially when using permanent logos. You can however add a comment bellow in text, or do sponsored content in a stand alone video or inside the content.

If you are lucky, you might find a local enthusiast that will do it for free. In this case, we suggest to have professional recording of the keynotes, and make sure you handle the risk you are taking by having exceptional communication between them and the conference team.

Next goal

Getting www.youtube.com/owasp for the channel.


  1. ✓ Create and setup an official YouTube channel with a non-profit partnership with Google
    1. Get youtube.com/owasp
    2. ✗ Connect YouTube with official OWASP Twitter account - this is now done manually
  2. Transfer to OWASP Global organisation for access management and social media engagement
    1. ✗✗ This has been done 2 times so far.. without much success. 3rd time's a charm?
    2. ✓ We do have access management backed up by the global organization and Matt is getting more involved
    3. ✓ We do like having an hybrid where the community/volunteer can help as well
  3. ✓ Use the channel to publish live webcasts (Google Hangout) contents from OWASP Global Chapter Meetings project
  4. ✓ Gather videos from all around the web and put in into the channel and make them searchable and shareable easily
    1. ✓ Film on location at AppSecUSA Plan for more conferences, have teams, and synchronize with organizers
      1. ✓ Projects Summit interviews
      2. ✓ Interviews with Mark Miller during the conference with people of interest
      3. ✓ Find and uploads recording of talks ASAP (<12h after) (achieved <24h)
    2. ✓ Assimilate OWASP Webinar Series (Hangout+YouTube vs. GotoMeeting) done!
      1. ✓ Try a webinar with GotoMeeting
      2. ✓ Contact Webinar organizers - Live webinars will be on GotoMeeting for registration and viewers tracking purpose and recordings will be uploaded to YouTube.
      3. ✓ Webinar presentation about the new system (January) done!
  5. ✓ Link with other channels on YouTube, promote them into the channel
    1. other OWASP channels As playlists
    2. ✓ Some OWASP chapters Channels
    3. ✓ Some OWASP projects Channels
    4. AppSec Tutorial Series (Jerry Hoff)
    5. ✓ Old OWASP uploads Christiaan008
  6. ✗ Get more contributors and add them as channel managers - this has shown to wear off pretty quick, people are now encouraged to make their own channel
    1. OWASP Community Update, Michael Coates
    2. OWASP en Español, Fabio Cerullo
  7. ✗ Motivate people to make videos and provide a way of publishing them on the channel - people are now encouraged to make their own channel
    1. ✗ Idea : open Webinars; send us your videos we'll publish (YouTube) and promote (Connector) - people are now encouraged to make their own channel
  8. ✓ In the long term: expand our team by having more central hubs (other than YouTube, or language specific channels) - people are now encouraged to make their own channel, we did OWASP LATAM
  9. ✗ If it needs to get bigger: recruit people with video editing skills, make shows, etc - the media project is not looking to produce content anymore
  10. ✓ Provide an appealing video central (out of YouTube) for owasp.org in place of the old one
  11. ✓ Document requirements for good A/V recordings during a conference

What does this OWASP project offer you?
What releases are available for this project?
what is this project?
Name: OWASP Media Project
Purpose: The OWASP Media Project is an infrastructure project that gather, consolidate and promote OWASP content in video format on a central appealing hub.

The first and main instance of the project will be a YouTube channel.

License: Creative Commons Attribution ShareAlike 3.0 License (best for documentation projects)
who is working on this project?
Project Leader(s):
Project Contributor(s):
  • OWASP Global Chapter Meetings Project: Yvan Boily
  • Nirmal Lama Titung & Ahmed Neil (inactive)
  • AppSec California Team: Kristian Erik Hermansen, Neil Matatall, Alexander Braehler
  • EU Students Team: Christian Dresen, Julian Held, Rene Boeing, Maik Dankel
  • USA Denver Team: Amelia Graycen, Tom Joy, Niko, Zach Lummis, Kyle Archer
  • USA San Francisco Team: Amelia Graycen, Katherine Carpenter, Neal Mueller
  • Ian Gorrie (AppSecCali & transition)
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
YouTube OWASP Channel
last reviewed release
Not Yet Reviewed

other releases