cold boot attack

Jason Cohen's MicroConf talk on designing a bootstrapped business by starting from your own strengths, goals and constraints. He works backward to the business model, pricing, market and product that fit, with practical points like annual prepay and pricing tiers.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Brian Krebs and Lance James present research on DDoS booter services at Black Hat 2013, including the SWATting Krebs suffered. HN knows it mainly for a later exchange between Krebs and Cloudflare's Matthew Prince.

David Heinemeier Hansson's talk at Startup School 2008 on building a profitable startup. He argues for bootstrapping and small, well-run companies instead of chasing investment and exits.

Jonathan Blow's Reboot Develop 2017 talk on making game programming less terrible, discussing software bloat, slowness and the design goals behind his own programming language.

Ronald Minnich of Google explains how UEFI firmware is a large closed attack surface and describes Google's work replacing it with Linux-based boot firmware. It also touches on Intel ME and other security coprocessors.

Maciej Ceglowski's talk at Web Directions argues that small teams and lone programmers can build sustainable businesses without chasing Silicon Valley's grow-or-die model. He offers alternative, more achievable definitions of success.

David Heinemeier Hansson, creator of Ruby on Rails and partner at 37signals, argues that planning is guessing and startups should focus on today. He says constraints are an advantage and that startups can bootstrap profitably in sizable markets.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Pieter Levels talks at Dojo Bali about building startups without venture capital through bootstrapping, persistence and learning many skills as a generalist. He reviews his own past projects.

Matthew Garrett's linux.conf.au 2012 talk covers EFI and UEFI from the Linux point of view: why the PC BIOS was bad, what EFI changes, the issues it brings, and Secure Boot.

Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.

Steve Blank tells how World War II, Stanford's Frederick Terman and military and intelligence agencies shaped the rise of Silicon Valley. The talk centers on the Cold War electronic warfare and signals intelligence work that seeded the region's tech industry.

Jason Scott of Archive Team describes how a loose band of volunteers rushes to copy sites like Geocities, Friendster and Yahoo Video before their owners delete them. The talk covers the tactics they use and the argument that this data is history worth saving.

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

Jake Vanderplas's PyCon 2016 talk shows how sampling-based methods such as simulation, shuffling and bootstrapping make statistics intuitive. His pitch is that if you can write a for-loop, you can do statistics.

David Rosen of Wolfire Games explains how simple procedural techniques can produce fluid, interactive character animation from very few keyframes. Examples come from Overgrowth, Receiver and Black Shades, from his 2014 GDC session.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

A dotJS 2012 conference talk by Fat (of Twitter Bootstrap fame) on what open source really means and why maintainers feel guilty about it. It covers the obligations, expectations and burnout that come with releasing popular open source software, delivered with humor.

A 35C3 talk presenting a proof-of-concept SPI bus hardware implant with capabilities like those alleged in the Bloomberg Supermicro story, plus countermeasures for detecting such modchips.

A Netflix engineer describes how Netflix uses Java in 2025, including Spring Boot, DGS/GraphQL, gRPC and keeping over 3000 services on the latest JDK. It covers generational ZGC upgrade experiences.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

John Rauser's Strata 2014 keynote argues that programmers can learn statistics quickly by simulating random processes and shuffling data. He explains p-values through resampling rather than formulas.

Ian Miers' Devcon4 talk on failures in on-chain privacy for Bitcoin and Ethereum. It covers attacks on transparent and decoy-based schemes, including how Monero-style privacy can be eroded over repeated transactions.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

FreeBSD developer Benno Rice traces the history of init and bootstrap systems at linux.conf.au 2019 to explain why systemd was seen as necessary and why it provokes such strong reactions. He also discusses why change is scary.

Bryan Cantrill's GOTO Chicago 2017 talk on debugging production systems under pressure, centered on the incident where an operator's mistyped command rebooted an entire Joyent datacenter. It covers human factors, automation and architecture.

Casey Muratori's long talk arguing that modern software has ballooned to tens of millions of lines because of hardware and OS diversity. He proposes a stable ISA for entire system-on-a-chip packages and recalls when games shipped with their own boot disk.

Christopher Hitchens delivers a speech defending freedom of speech, including the right of audiences to hear offensive speakers and a take on the fire-in-a-crowded-theatre line. It is framed around the Charlie Hebdo attack.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

A DEF CON 23 talk showing how weak controls in electronic death registration systems let someone virtually kill a person and obtain a real death certificate, with consequences for their identity and life.

A DEF CON 21 talk by Karl Koscher and Eric Butler on how SIM cards work, including Java Card applets, the SIM toolkit and the OS running on the card. It shows how much control the network and the card have independent of the phone.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Netanel Rubin's 31C3 talk chains Perl's syntax quirks into a powerful remote code execution attack, taking down popular Perl-based projects.

Nicholas Carlini of Anthropic talks at [un]prompted 2026 about how adversaries could misuse current LLMs for attacks. He shows recent models finding zero-day vulnerabilities in heavily tested software, including a SQL injection in Ghost.

Troy Hunt argues that even static, non-secret websites need HTTPS, demonstrating attacks such as injected content and China's Great Cannon. It accompanies his blog post of the same name.

Connor Krukosky, an 18-year-old college student and vintage computer collector, tells how he bought an IBM z890 mainframe and got it running at home. The talk was given at SHARE in San Antonio in March 2016.

John Romero's 2016 GDC Europe talk recounts the early days of id Software and the programming principles behind Doom and Quake, including fast iteration and keeping the game bootable.