Dev on Duty is a program where the CRS project assigns a team member the role to be a first responder for incoming new issues.

-> Infos on Invoicing

• Being a first responder to inquiries coming in as GitHub issues.
• Being a first responder to inquiries coming in via the CRS Google Group Mailing list.
• Being a first responder to inquiries coming in via the ModSecurity Mailing list if they touch on CRS.
• Being a first responder to inquiries coming in via the #coreruleset channel on Slack.
• Being a first responder to inquiries coming in via Stack Overflow / Stack Exchange / Server Fault if they touch on CRS.
• Being a first responder to inquiries (!) appearing on Twitter. See below for a list of queries. And no need to respond on links and what not. All we want to really address is support questions.

First response means to respond within 24 hours and cover the following items:

• Check out the response templates to see if there one available for this question. If yes: copy&paste, edit and respond.
• If there is a simple answer, then respond and close the issue (obviously closing on github)
• If the issues is incomplete and we need additional infos, then there is a response template for that.
• If it is a real issue, then test it (-> demo/sandbox!) and confirm if possible.
• If it is a real issue and it's on the Google Group Mailinglist, ModSecurity mailinglist, Slack, Twitter or Stack Overflow, then ask the reporter to open an issue on GH. If that does not work, then open the issue yourself.
• Tagging original authors or people where you think they can help in comments on github would be helpful. Actively approach people to make sure we find a solution quickly!
• If you do not see anybody jumping on the issue and you can not easily solve it, then make sure the issue is scheduled for the next issue chat.

All combined: Try to think for yourself, we are not providing paid support but we try to be helpful. This is best effort.

Before you can start your duty for the first time, you need to do following steps:

• Sign up for GitHub and watch, at least, issues in coreruleset repository.
• Create a Google account and join CRS Google Group Mailing list.
• Join the ModSecurity Mailinglist
• Sign up for OWASP on Slack and join #coreruleset channel.
• Sign up for Stack Overflow.
• Sign up on twitter or ask for the @CoreRuleSet twitter account (-> @lifeforms / @dune73)

We cover the following keywords / queries on Stack Overflow and Security Stack Exchange. Feel free to concentrate on CRS related questions and skip the ModSecurity stuff if it gets too much:

• SE: owasp-crs
• SO: owasp-crs
• SO: Core Rule Set
• SO: CoreRuleSet
• SO: Mod Security
• SO: ModSecurity
• SO: Mod-Security
• SO: Mod-Security2
• SO RSS mod-security
• SO RSS mod-security2
• SE: OWASP
• SE: mod-security
• SV: mod-security

It is also possible to search for questions created only during your duty using date filtering. Example search for keyword CoreRuleSet is here.

Hint: Log in to bypass captcha checks.

• Feel free to use your own twitter account and sign with #CRSDevOnDuty
• If you prefer, you can also ask for the @CoreRuleSet twitter account
• There is a response template for twitter for everything that does not fit into 240 chars.

Please cover the following hashtags / queries:

• ModSecurity (covers #ModSecurity hashtag + account @ModSecurity as well)
• CoreRuleSet (covers #CoreRuleSet hashtag + account @CoreRuleSet as well)
• Core Rule Set

Queries for CRS3, ModSec and the like brings too much noise.

We need to make sure we get the hand-over correct.

• Hand-over is organised between the previous and the new dev-on-duty. It's perfectly OK to ask if somebody could keep the duty a day longer or if you could hand over a day early (because you are on holiday or whatever. But you need to talk!)
• The new period starts when the new dev-on-duty fills out the "assumed duty" column above. Of course this is meant to happen on the day indicated above, but you can not silently assume the new dev-on-duty has taken over without formal confirmation.
• Please indicate the date and the rough time of the hand-over

Starting Oct 2021, we agreed on 200 USD per week of duty. Payment will be organized by the project leads via OWASP HQ. This may take a bit of time in the beginning until the process works.

-> Dev-on-Duty:-Response-Templates

This can auto-generate a schedule for a whole year if you wish.

Change start_week and end_week as required. Note that this one-liner sets the shell locale to "C" to cause the months to be written in English.

start_week=45 ; end_week=50 ; export LC_ALL="C" ; i=1 ; while [ $(date --date "$(date +%Y)-01-$i" +%A) != "Monday" ] ; do i=$((i+1)) ; done ; echo -e "\n| *Period*                    | *Dev-on-duty* | *Assumed duty*      | *Payment*          | *Remarks*                                  |" ; echo "| --------------------------- | ------------- | ------------------- | ------------------ | ------------------------------------------ |" ; while [ $start_week -le $end_week ] ; do printf "%-30s" "$(echo -n "| Week $start_week<br/>" ; date --date "$(date +%Y)-01-$i +$((start_week-1)) weeks" "+%-d %b - " | tr -d '\n' ; date --date "$(date +%Y)-01-$i +$((start_week-1)) weeks +6 days" "+%-d %b " | tr -d '\n')" ; echo "| ...           |                     |                    | GH: <br/>SO: <br/>ML: <br/>TW: <br/>Slack: |" ; start_week=$((start_week+1)) ; done ; echo

Variant to manually set a different year, i.e. to generate next year's schedule:

year=2026 ; start_week=1 ; end_week=52 ; export LC_ALL="C" ; i=1 ; while [ $(date --date "$year-01-$i" +%A) != "Monday" ] ; do i=$((i+1)) ; done ; echo -e "\n| *Period*                    | *Dev-on-duty* | *Assumed duty*      | *Payment*          | *Remarks*                                  |" ; echo "| --------------------------- | ------------- | ------------------- | ------------------ | ------------------------------------------ |" ; while [ $start_week -le $end_week ] ; do printf "%-30s" "$(echo -n "| Week $start_week<br/>" ; date --date "$year-01-$i +$((start_week-1)) weeks" "+%-d %b - " | tr -d '\n' ; date --date "$year-01-$i +$((start_week-1)) weeks +6 days" "+%-d %b " | tr -d '\n')" ; echo "| ...           |                     |                    | GH: <br/>SO: <br/>ML: <br/>TW: <br/>Slack: |" ; start_week=$((start_week+1)) ; done ; echo

The historical Dev on Duty schedules covering previous years are kept in a separate archive document for tidiness.