web security

A talk by Yuri Iozzelli at a WebAssembly meetup on CheerpX, an x86 virtual machine running in the browser. It uses a JIT compiler that emits WebAssembly at runtime to run real native applications. It covers the architecture and demos such as porting a multiplayer C++ game.

Photopea founder Ivan Kutskir talks about developing a free browser-based photo editor, one of the most complex JavaScript programs ever written, and the web technologies behind it.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Dylan Beattie's entertaining NDC talk imagines an alternate history of the web, asking what if different decisions had been made on operating systems, browsers and standards. It blends real history with humor.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Leptos creator Greg Johnston examines Rust/WebAssembly frontend frameworks against JavaScript frameworks using the JS framework benchmark. He argues that WASM is no longer too slow for DOM-heavy rendering.

John McCutchan of Google explains how Dart and the Dart VM expose SIMD instructions to speed up web software. He covers what SIMD is and how it applies to graphics and games.

Andrew Rota of Wayfair argues at React.js Conf 2015 that React and native Web Components complement each other. He shows how they can be combined for complex web applications.

Maciej Ceglowski's Web Directions 2015 keynote on website bloat, arguing that pages have grown far heavier than their content justifies. This is a re-upload of the original talk.

Full-day livestream of the 2016 Decentralized Web Summit at the Internet Archive, with speakers including Vint Cerf, Tim Berners-Lee, Brewster Kahle, Cory Doctorow and Mitchell Baker. It explores the technology and impact of a decentralized web.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

David Beazley's PyCon India closing keynote, in which he live-codes a stack machine and grows it into an interpreter that runs WebAssembly, then uses it to play a Rust-written game. It requires no prior WebAssembly knowledge.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

James Mickens's 2015 Harvard colloquium argues that browsers are bloated and insecure because feature races trump clean interface design. He presents a cleaner, more secure browser architecture (Atlantis) with a much smaller API surface.

Troy Hunt argues that even static, non-secret websites need HTTPS, demonstrating attacks such as injected content and China's Great Cannon. It accompanies his blog post of the same name.

Lieutenant General Mark Hertling gives a TEDx talk arguing that obesity and poor youth fitness are a national security problem because too few young Americans can meet military physical requirements.

A Google I/O 2011 talk by Andrew Gerrand and Rob Pike on building and deploying a web application in Go. It argues that Go offers speed, reliability and simplicity together.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

A Google Tech Talk on Yahoo's 14 rules for faster web pages and the YSlow tool. It covers front-end practices like avoiding @import and fixing ETags, with live analysis of popular sites.

Netanel Rubin's 31C3 talk chains Perl's syntax quirks into a powerful remote code execution attack, taking down popular Perl-based projects.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

An excerpt from a Bay Area Rust meetup on Servo's WebRender, which renders CSS display lists on the GPU at very high frame rates. It explains the approach and demos rendering at around 500 FPS.

Jeff Vogel of Spiderweb Software gives a GDC 2018 retrospective on surviving as an indie game maker since 1994, from shareware days through Steam. It covers business realities, costs and sustaining a comfortable living without chasing riches.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Steven Wittens' JSConf US 2013 talk on drawing with WebGL, using animated visuals to walk through vectors, matrices and the rendering pipeline. Despite the title, it works as a visual primer on the linear algebra behind 3D graphics.

Alex Russell's Chrome Dev Summit 2016 talk on building web experiences that work on slow, flaky networks and low-power devices. It argues developers should focus on the performance of real-world mobile hardware rather than desktop machines.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Luke Wagner of Fastly explains what a WebAssembly component is, how it relates to familiar concepts, and what the Component Model enables. It emphasizes security, composability and modularity.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Clay Shirky argues at Web 2.0 Expo NY that the problem online is not information overload but filter failure. He says the real challenge is building better ways to filter and organize what we see.

Rich Harris's Svelte Summit 2020 talk on what a modern web development workflow could look like. It announced that Sapper would give way to what became SvelteKit.

Aaron Boodman of Replicache asks why sync engines have not yet fixed web app complexity and what is missing for them to go mainstream. The talk lays out the ideas that led to the Zero sync engine.

Morten Rand-Hendriksen argues that CSS Grid changes web layout, showing how to place content in cells independent of HTML source order and reshape layouts with media queries. It makes the case for using Grid now that browsers support it.

Justine Tunney presents Redbean, a web server distributed as a single actually portable executable that runs on multiple operating systems. It embeds Lua, SQLite and MbedTLS in a fork-based server.