software security

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Asianometry examines why Japan's software industry has lagged despite its hardware strengths. It looks at dependence on US software and the low prestige of programming.

A ten-minute clip from Jonathan Blow's talk on preventing the collapse of civilization, arguing that software quality and the knowledge to build it are in decline.

Andrej Karpathy's keynote at AI Startup School laying out software 1.0, 2.0 and 3.0, with LLMs seen as utilities, fabs and operating systems. It covers LLM quirks, partial-autonomy apps and keeping a human in the generate-and-verify loop.

Greg Wilson surveys what empirical research actually shows about software development, why we believe it, and how to share that knowledge more widely. It covers evidence on practices such as TDD and design patterns.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

JPL's David Cummings presents at the 2025 Flight Software Workshop how the team diagnosed and fixed the 2023 Voyager 1 anomaly from billions of miles away. It walks through the flight computer and the memory fix.

Rich Hickey's Strange Loop 2011 keynote distinguishing 'simple' (not intertwined) from 'easy' (familiar or near at hand). It argues that software complexity comes from complecting things and that we should pick simple constructs.

Tantacrul critiques the UX and UI of Steinberg's Dorico music notation software, comparing it with Sibelius and user testing it with real musicians alongside his own attempt to compose in it.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

Hillel Wayne reports on interviews with 17 people who have worked as both software and traditional engineers. He argues the fields are fundamentally the same and have much to learn from each other.

Internet of Bugs analyzes Cognition's Devin demo frame by frame, arguing the video did not show Devin completing paid Upwork jobs as claimed, and showing what the task required versus what Devin produced.

Part one of Capt. Grace Hopper's 1982 NSA lecture on the future of data, hardware, software and people. It includes her humor, her nanosecond demonstration and views on scaling and resisting old ways of doing things.

Rich Hickey's Strange Loop 2011 keynote separates 'simple' (not intertwined) from 'easy' (familiar or near at hand) and argues that software complexity comes from complecting things. It offers a vocabulary for judging designs and abstractions.

The Lock Picking Lawyer tests the supposedly unpickable lock designs built by the Stuff Made Here channel. He looks for bypasses and weaknesses in the novel anti-picking mechanisms.

Casey Muratori responds on-stream to a dismissive Twitter post by demonstrating how slow Visual Studio's startup and debugger watch window are, comparing it to much older software and machines. It is a long rant about software performance and bloat.

Robert Wills of TNMoC explains the Apollo Guidance Computer hardware and software, then walks through the Apollo 11 landing procedure step by step, including the 1202 alarms.

Casey Muratori's lecture, originally given at the Technical University of Madrid, arguing that Conway's Law is the only viable candidate for a true law of software architecture. He explains how software mimics the organization over time, using examples like Windows' multiple volume controls.

Benn Jordan details security vulnerabilities in Flock Safety license-plate-reading cameras and how easily they can be compromised. It includes citations from security researchers and discussion of police surveillance.

Tantacrul walks through how the MuseScore 4 team was built and how design decisions were made for the overhaul of a huge legacy notation app. It covers playback and engraving quality improvements.

Casey Muratori's invited lecture on where bad code comes from, rebroadcast from a Twitch stream. He critiques conventional wisdom such as SOLID and Clean Code and argues about how those habits lead to slow, poorly structured software.

Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.

Casey Muratori's two-hour talk tracing the history of object-oriented programming back to the 1960s and examining how its ideas, and later entity component systems, came about. It is followed by a Q&A.

Brian Karis's SIGGRAPH 2021 talk explains how Unreal Engine 5's Nanite virtualized geometry works. It covers mesh import, the data structures, streaming, decompression, culling, software and hardware rasterization, and shading.

Casey Muratori's first refterm lecture lays out philosophies of optimization, distinguishing optimization from non-pessimization, which means avoiding needless work. It uses his fast terminal renderer project to show how fast computers really are.

Casey Muratori shows how fast a terminal renderer can run, building a simple reference renderer that handles Unicode and colored text far quicker than Windows Terminal. He argues that common excuses for slow terminals do not hold up.

Casey Muratori's University of Twente guest lecture is a case study in how straightforward code can cut thousands of lines and tens of seconds of runtime down to a few dozen lines running in under a second. It uses concrete examples to show why software is often an order of magnitude slower than it should be.

Joran Dirk Greef's Systems Distributed '23 talk on TigerStyle, the engineering methodology behind TigerBeetle. It covers designing safer systems in less time through up-front design, assertions, and deterministic simulation.

Keith Packard traces the 35-year history of the X Window System at linux.conf.au 2020. He uses X to examine licensing, corporate interests and community dynamics in free software, including Unix workstation vendors and Stallman's influence.

Casey Muratori follows up his refterm proof-of-concept, a GPU-based terminal renderer, with a second part covering memory usage, glyph sizing and correct Unicode and VT handling. It is built to show that a terminal can be fast and correct without heroic effort.

A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.

Bruce Waggoner of the Voyager team describes how engineers diagnosed Voyager 1's 2023 loss of telemetry and patched its flight software from 15 billion miles away. The talk covers the spacecraft's architecture and the scarcity of old documentation.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Nicholas Carlini of Anthropic talks at [un]prompted 2026 about how adversaries could misuse current LLMs for attacks. He shows recent models finding zero-day vulnerabilities in heavily tested software, including a SQL injection in Ghost.

Jake Archibald argues that URLs are nearly impossible for humans to interpret, especially for security. He walks through what browsers do about it, including highlighting the registrable domain, and floats a possible better design.

Sal Mercogliano of What's Going on With Shipping? discusses a debate between the Center for Maritime Strategy and the Heritage Foundation over whether the Jones Act helps or harms American shipping and national security.

A 49-minute demo of Palantir Foundry by its chief architect. It walks through data integration, ML and AI workflows, analytics, and application building across the platform.

Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.

Tantacrul tells the story of Audacity, the widely used free audio editor, and announces his involvement in the project. It includes an interview with the original developers and a look at the software's usability.