software security

Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

Karen Sandler, then Executive Director of the GNOME Foundation, talks at OSCON 2011 about the risks of proprietary, closed-source software in implanted medical devices like her own pacemaker-defibrillator.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Bryan Cantrill's Craft 2019 talk on the ethical dilemmas software engineers face as software eats the world. He explores cases where engineering thinking conflicts with the law or personal morals, including Facebook's news feed experiments.

Richard Stallman's TEDxGeneva 2014 talk describing how nonfree programs give companies control over users and what users can do to regain control. It introduces the free software movement and the four freedoms.

Glenn Vanderburg asks whether software development can be real engineering, surveying other engineering disciplines and decades of programming experience. He envisions what a software engineering worthy of the name might look like.

Lock-picking YouTuber Bill Johnson (BosnianBill) explains how to choose a high-security lock and why, showing examples and comparing designs. It covers what makes some padlocks more pick-resistant than others.

Simon Brown's Agile on the Beach 2019 talk presents the C4 model, a lightweight approach to diagramming software architecture with a shared vocabulary and simple notation.

A Wendover Productions explainer on how airport security is designed, covering screening layers, x-ray scanning, and the contrast with Israel's profiling-based approach. It walks through the logic behind why security works the way it does.

Karen Sandler's keynote at Linux.conf.au 2012 on the software running inside medical devices such as her own pacemaker-defibrillator. She discusses the difficulty of learning what code runs in life-sustaining devices and why open source matters there.

Glenn Vanderburg argues at the O'Reilly Software Architecture Conference that software development is an engineering discipline, even if immature. He contends the discredited body of knowledge called software engineering has led people to wrongly reject the label.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Asianometry examines why Japan's software industry has lagged despite its hardware strengths. It looks at dependence on US software and the low prestige of programming.

Eben Moglen of the Software Freedom Conservancy speaks at the 2009 Law of the Commons Conference about free and open software as a model for a new intellectual commons. The talk covers the legal and social case for sharing knowledge.

A ten-minute clip from Jonathan Blow's talk on preventing the collapse of civilization, arguing that software quality and the knowledge to build it are in decline.

Andrej Karpathy's Databricks talk on Software 2.0, the shift from human-written code to code produced by neural network training. It covers how developer work moves toward curating datasets, the advantages and challenges, and opportunities for new tooling.

A short clip of Richard Stallman singing the free software song, recorded during a visit to Ecuador.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

A one-minute clip from the All Things D conference in which Steve Jobs says Apple is fundamentally a software company, with iPod, Mac and iPhone all being software. He says the hardware is where the money is but the value is in the software.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Bryan Cantrill's Monktoberfest 2016 talk on how software engineers pass knowledge down through oral tradition, from folk rhymes to programmer lore and stories like why C lacks a logical XOR. He argues for writing software with future generations in mind.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Glenn Vanderburg argues at Lone Star Ruby Conference 2010 that university-style software engineering does not work, and asks what real software engineering would look like. He revisits the waterfall model and what engineering means in other fields.

A HandmadeCon 2016 panel where Chris Hecker, John Miles, Sean Barrett and Chris Green give an oral history of software texture mapping in 90s games.

Andrej Karpathy's keynote at AI Startup School laying out software 1.0, 2.0 and 3.0, with LLMs seen as utilities, fabs and operating systems. It covers LLM quirks, partial-autonomy apps and keeping a human in the generate-and-verify loop.

Lieutenant General Mark Hertling gives a TEDx talk arguing that obesity and poor youth fitness are a national security problem because too few young Americans can meet military physical requirements.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Tantacrul dissects the UX and UI of Avid's Sibelius music notation software, going through a long list of bad design choices. The review is both a comic rant and a practical lesson in interface design.

Greg Wilson surveys what empirical research actually shows about software development, why we believe it, and how to share that knowledge more widely. It covers evidence on practices such as TDD and design patterns.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

A short clip of the Super Mario Bros 3 proof-of-concept PC port built by id Software's founders to pitch Nintendo on a PC version. Nintendo passed, and the same technology led to Commander Keen.

A short Apple Get a Mac ad that mocks Windows Vista's constant security pop-up prompts.

JPL's David Cummings presents at the 2025 Flight Software Workshop how the team diagnosed and fixed the 2023 Voyager 1 anomaly from billions of miles away. It walks through the flight computer and the memory fix.

Rich Hickey's Strange Loop 2011 keynote distinguishing 'simple' (not intertwined) from 'easy' (familiar or near at hand). It argues that software complexity comes from complecting things and that we should pick simple constructs.

A DevGAMM talk by Jonathan Blow arguing that civilizations can lose technological capability and that software quality is already deteriorating. He discusses how knowledge fails to transfer between generations.

Casey Muratori's long talk arguing that modern software has ballooned to tens of millions of lines because of hardware and OS diversity. He proposes a stable ISA for entire system-on-a-chip packages and recalls when games shipped with their own boot disk.

John Ousterhout, Stanford professor and creator of Tcl, presents the ideas of his book A Philosophy of Software Design in a Talks at Google session. He covers managing complexity, deep modules and interfaces, and what he teaches in his Stanford software design course.