unix security

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

A 1982 Bell Labs film hosted by Victor Vyssotsky on the origins and design philosophy of the UNIX operating system, with appearances by Kernighan, Thompson and Ritchie. It shows pipes, filters and a shell one-liner spell checker being built.

A short animated simulation comparing how Multics and Unix were developed, showing why Unix's small composable programs and pipes gave it a efficiency advantage. It frames Unix as a moonshot achievable by a small team.

A 1982 AT&T Bell Labs film for students about the Unix system and how it can be used practically. It includes Lorinda Cherry building a talking calculator by piping together Unix commands, and a spell checker made from Unix utilities.

Benno Rice's linux.conf.au 2020 talk asks whether UNIX was the best design we could have had. He looks at what alternatives existed, what was gained and lost, and what could be re-learned, including the limits of treating everything as a file.

Stephen Kell's Strange Loop talk argues that C and Unix already contain Smalltalk-like dynamism and introspection that can be exposed. He presents his liballocs research on bridging dynamic and compiled languages.

Lock-picking YouTuber Bill Johnson (BosnianBill) explains how to choose a high-security lock and why, showing examples and comparing designs. It covers what makes some padlocks more pick-resistant than others.

Gary Bernhardt's Cascadia Ruby Conference 2011 talk on using the Unix shell for practical problem solving. He builds pipelines interactively by iterative refinement, using small tools as levers.

A Wendover Productions explainer on how airport security is designed, covering screening layers, x-ray scanning, and the contrast with Israel's profiling-based approach. It walks through the logic behind why security works the way it does.

Bryan Cantrill presents Manta, an object store with in-situ compute that lets tools like grep, awk, and sed run map-reduce style over huge data. He frames it as bringing the Unix philosophy to big data.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Rob Pike gives an insider's account of the history of Unix and the development of key pieces of modern computing, including Bell Labs anecdotes.

Robert Watson presents the Capsicum paper at USENIX Security 2010, describing practical capability-based sandboxing for UNIX. The paper won Best Student Paper.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Lex Fridman interviews Brian Kernighan, co-author of The C Programming Language and co-creator of AWK and AMPL. They discuss Unix, C, Go and his memoir on the history of Unix.

Lieutenant General Mark Hertling gives a TEDx talk arguing that obesity and poor youth fitness are a national security problem because too few young Americans can meet military physical requirements.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

A short Apple Get a Mac ad that mocks Windows Vista's constant security pop-up prompts.

A clip from Jurassic Park in which Lex says, "It's a Unix system, I know this," while navigating a 3D file system view.

Brian Kernighan interviews Unix co-creator Ken Thompson at VCF East 2019. Thompson recounts how he was hired at Bell Labs, writing the Unix kernel in about three weeks, the origins of B and TMG, pipes, and other anecdotes.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Rusty Russell and Matt Evans examine why Unix utilities like ls and cat grew from a few kilobytes to over a hundred kilobytes. They take apart common tools to see where the growth comes from.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

John Oliver's Last Week Tonight segment on US voting machines, covering how they work, their security weaknesses, and how elections could be made more secure.

LockPickingLawyer picks an Amazon's Choice 'high security' padlock in about two seconds.

Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.

A one-minute clip of the Jurassic Park scene where a girl navigates the FSN 3D file manager on an SGI system and declares it a Unix system.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.