software security

Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Bryan Cantrill's Craft 2019 talk on the ethical dilemmas software engineers face as software eats the world. He explores cases where engineering thinking conflicts with the law or personal morals, including Facebook's news feed experiments.

Simon Brown's Agile on the Beach 2019 talk presents the C4 model, a lightweight approach to diagramming software architecture with a shared vocabulary and simple notation.

Karen Sandler's keynote at Linux.conf.au 2012 on the software running inside medical devices such as her own pacemaker-defibrillator. She discusses the difficulty of learning what code runs in life-sustaining devices and why open source matters there.

Glenn Vanderburg argues at the O'Reilly Software Architecture Conference that software development is an engineering discipline, even if immature. He contends the discredited body of knowledge called software engineering has led people to wrongly reject the label.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Bryan Cantrill's Monktoberfest 2016 talk on how software engineers pass knowledge down through oral tradition, from folk rhymes to programmer lore and stories like why C lacks a logical XOR. He argues for writing software with future generations in mind.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Glenn Vanderburg argues at Lone Star Ruby Conference 2010 that university-style software engineering does not work, and asks what real software engineering would look like. He revisits the waterfall model and what engineering means in other fields.

Andrej Karpathy's keynote at AI Startup School laying out software 1.0, 2.0 and 3.0, with LLMs seen as utilities, fabs and operating systems. It covers LLM quirks, partial-autonomy apps and keeping a human in the generate-and-verify loop.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Tantacrul dissects the UX and UI of Avid's Sibelius music notation software, going through a long list of bad design choices. The review is both a comic rant and a practical lesson in interface design.

Greg Wilson surveys what empirical research actually shows about software development, why we believe it, and how to share that knowledge more widely. It covers evidence on practices such as TDD and design patterns.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

Jeff Vogel of Spiderweb Software gives a GDC 2018 retrospective on surviving as an indie game maker since 1994, from shareware days through Steam. It covers business realities, costs and sustaining a comfortable living without chasing riches.

Kevlin Henney's GOTO 2018 talk argues that much of what looks new in software is a recycling of concepts with long histories. It draws on history to show the slow, steady current beneath constant churn in frameworks and trends.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Bryan Cantrill's Scale By The Bay 2019 talk on software after Moore's Law. He covers the end of easy scaling and the move toward specialized, emerging architectures.

John Romero's 2016 GDC Europe talk recounts the early days of id Software and the programming principles behind Doom and Quake, including fast iteration and keeping the game bootable.

Hillel Wayne reports on interviews with 17 people who have worked as both software and traditional engineers. He argues the fields are fundamentally the same and have much to learn from each other.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

Internet of Bugs analyzes Cognition's Devin demo frame by frame, arguing the video did not show Devin completing paid Upwork jobs as claimed, and showing what the task required versus what Devin produced.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Part one of Capt. Grace Hopper's 1982 NSA lecture on the future of data, hardware, software and people. It includes her humor, her nanosecond demonstration and views on scaling and resisting old ways of doing things.

Stuart Halloway's satirical talk describes how to protect yourself from industry change by spreading complexity through systems while following idiomatic practice. It uses this inversion to catalog software design anti-patterns.

Matt Might's Curry On talk on ending errors in code, both software and the human genome. He covers conservative approximation of the halting problem via static analysis and a computational approach to precision medicine.

Patricia Aas's EuroBSDCon keynote is about ethics for people who build software, covering how the tech industry got to its current state and what engineers can do about it. It steps back from technical detail to the bigger picture.

Casey Muratori responds on-stream to a dismissive Twitter post by demonstrating how slow Visual Studio's startup and debugger watch window are, comparing it to much older software and machines. It is a long rant about software performance and bloat.

A HOPE conference talk by Howard Payne and Deviant Ollam on common keys, such as elevator and fire service keys, that open many buildings. It covers physical security weaknesses from shared key standards.

Netanel Rubin's 31C3 talk chains Perl's syntax quirks into a powerful remote code execution attack, taking down popular Perl-based projects.