web security

A talk by Yuri Iozzelli at a WebAssembly meetup on CheerpX, an x86 virtual machine running in the browser. It uses a JIT compiler that emits WebAssembly at runtime to run real native applications. It covers the architecture and demos such as porting a multiplayer C++ game.

A one-minute archive video of the 2Advanced Studios v2 website from 2001, a showcase of the elaborate futuristic Flash interfaces the agency was known for.

A short archival capture of the 2001 Flash website of 2Advanced Studios, an agency known for high-end Flash design. It is part of the Web Design Museum's collection of early web design.

Photopea founder Ivan Kutskir talks about developing a free browser-based photo editor, one of the most complex JavaScript programs ever written, and the web technologies behind it.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Dylan Beattie's entertaining NDC talk imagines an alternate history of the web, asking what if different decisions had been made on operating systems, browsers and standards. It blends real history with humor.

LearnCode.academy presents a roadmap of web development technologies to learn in 2016 and 2017, spanning front-end, back-end and DevOps tools.

Lock-picking YouTuber Bill Johnson (BosnianBill) explains how to choose a high-security lock and why, showing examples and comparing designs. It covers what makes some padlocks more pick-resistant than others.

A Wendover Productions explainer on how airport security is designed, covering screening layers, x-ray scanning, and the contrast with Israel's profiling-based approach. It walks through the logic behind why security works the way it does.

Michael Wesch's five-minute video about Web 2.0, showing how the read/write web, XML and user-generated content change how people create and share information.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Leptos creator Greg Johnston examines Rust/WebAssembly frontend frameworks against JavaScript frameworks using the JS framework benchmark. He argues that WASM is no longer too slow for DOM-heavy rendering.

A short Techquickie explainer on why laptop webcams are much worse than phone cameras. It covers sensor size, image processing, and the interface differences between laptops and phones, with input from a Logitech engineer.

John McCutchan of Google explains how Dart and the Dart VM expose SIMD instructions to speed up web software. He covers what SIMD is and how it applies to graphics and games.

Andrew Rota of Wayfair argues at React.js Conf 2015 that React and native Web Components complement each other. He shows how they can be combined for complex web applications.

A one-minute clip about Paul Otlet, the Belgian bibliographer who in 1934 imagined users accessing a remote database through an electric telescope over a phone line. It presents his vision as a precursor of the web.

Maciej Ceglowski's Web Directions 2015 keynote on website bloat, arguing that pages have grown far heavier than their content justifies. This is a re-upload of the original talk.

Full-day livestream of the 2016 Decentralized Web Summit at the Internet Archive, with speakers including Vint Cerf, Tim Berners-Lee, Brewster Kahle, Cory Doctorow and Mitchell Baker. It explores the technology and impact of a decentralized web.

A two-minute clip of Steve Jobs at WWDC 2007 introducing the plan for iPhone third-party apps as web apps built on Safari and Ajax. It shows the original vision before the native SDK and App Store.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

David Beazley's PyCon India closing keynote, in which he live-codes a stack machine and grows it into an interpreter that runs WebAssembly, then uses it to play a Rust-written game. It requires no prior WebAssembly knowledge.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

James Mickens's 2015 Harvard colloquium argues that browsers are bloated and insecure because feature races trump clean interface design. He presents a cleaner, more secure browser architecture (Atlantis) with a much smaller API surface.

DIY Perks builds a webcam mod using a two-way mirror in a box so the camera sits behind the screen image. This allows real eye contact on video calls.

Troy Hunt argues that even static, non-secret websites need HTTPS, demonstrating attacks such as injected content and China's Great Cannon. It accompanies his blog post of the same name.

Lieutenant General Mark Hertling gives a TEDx talk arguing that obesity and poor youth fitness are a national security problem because too few young Americans can meet military physical requirements.

A Google I/O 2011 talk by Andrew Gerrand and Rob Pike on building and deploying a web application in Go. It argues that Go offers speed, reliability and simplicity together.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

Real Engineering explains the engineering behind the James Webb Space Telescope, including its folding mirror, sunshield, orbit and cooling systems, and why deployment was so difficult.

A Google Tech Talk on Yahoo's 14 rules for faster web pages and the YSlow tool. It covers front-end practices like avoiding @import and fixing ETags, with live analysis of popular sites.

Netanel Rubin's 31C3 talk chains Perl's syntax quirks into a powerful remote code execution attack, taking down popular Perl-based projects.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

An excerpt from a Bay Area Rust meetup on Servo's WebRender, which renders CSS display lists on the GPU at very high frame rates. It explains the approach and demos rendering at around 500 FPS.

A sketch from That Mitchell and Webb Sound in which a caller learns that identity theft is, in effect, a bank robbery in which the bank blames the customer. It runs about two minutes.

A short Apple Get a Mac ad that mocks Windows Vista's constant security pop-up prompts.

A demo excerpt from a 2016 Bay Area Rust meetup showing Servo's WebRender drawing CSS on the GPU at very high frame rates. It presents the promise of GPU-based browser rendering.

A short side-by-side recording by Jake Archibald of the same animation demo running in Chrome, Firefox, Safari and Servo WebRender nightlies on a 60Hz display. It shows the smoothness difference of GPU-based rendering.