zero

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Herb Sutter's CppCon 2019 talk on the split in the C++ community over exceptions and RTTI. He proposes making exceptions cheaper and more usable, including a zero-overhead, Result-like design.

A two-hour Computer History Museum oral history interview with Bjarne Stroustrup, conducted by Paul McJones in 2015. It covers his youth, education at Aarhus and Cambridge, his career at Bell Labs and elsewhere, and the design and evolution of C++.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Frank Abagnale, the real subject of Catch Me If You Can, speaks at Google about his life as a con man turned FBI fraud and cybersecurity expert, including advice on fraud, breaches and credit cards.

The Grugq's Hack In The Box 2012 talk on operational security for hackers, drawing on hacker indictments and counter-intelligence research. It reviews OPSEC goals and methods for avoiding detection and arrest, with case studies of how hackers got caught.

Dan Olson's roughly two-hour video essay critiques NFTs, cryptocurrency, and Web3, covering their technical, economic, and ideological flaws. It is heavily sourced and ends with the advice to ask whether a project needs crypto to work.

A DEF CON 26 talk by investigative journalists and hackers on the fake science industry, with bogus conferences and predatory journals that give studies false credibility. It draws on a large investigation into the money behind them.

A Google Tech Talk by Steve Weis that introduces modern cryptography and its use in practice and at Google. It covers proofs of security and security definitions and a special topic. HN commenters treat it as a talk on verifiable electronic voting.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.

Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

A HOPE X talk giving an in-depth explanation of how elevators work, from their history in hacker culture to using their control systems to bypass building security. It covers features and abilities of elevators that most people never see.

David Kriesel's 31C3 talk, in German, on the discovery that Xerox scanner-copiers silently replace digits and letters in scanned documents. He explains how the bug stayed unnoticed in the wild for years.

Dan Olson of Folding Ideas spends months in the virtual world Decentraland and delivers a long critique of the metaverse, NFTs and DAOs, and why virtual worlds fail as places.

Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.

James Mickens's 2015 Harvard colloquium argues that browsers are bloated and insecure because feature races trump clean interface design. He presents a cleaner, more secure browser architecture (Atlantis) with a much smaller API surface.

A GDC 2018 talk by Valve's John McDonald on VACNet, a deep learning system that analyzes CS:GO gameplay to detect cheaters. It covers how the model is trained on human-reviewed Overwatch cases and how its output feeds human moderation.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

Lex Fridman interviews Ethereum co-creator Vitalik Buterin about Ethereum, cryptocurrency and the future of money. The conversation also touches on technical topics such as quantum computing and mining.

Christopher Domas's REcon 2013 talk on dynamic binary visualization for reverse engineering. He shows how rendering binary data as interactive visual maps and trigraphs reveals structure that hex dumps hide, leading to his Cantor.dust tool.

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

Christof Paar's university lecture introducing Galois fields and finite-field arithmetic as used in AES. It covers the mathematics behind the AES S-box.

Daniel J. Bernstein and Tanja Lange survey recent highlights in post-quantum cryptography at 35C3, covering the NIST competition, network protocol experiments, and broken candidates.

John McCall of Apple's Swift team presents at CppNow 2023 on introducing a memory-safe successor language into large C++ code bases. He argues incremental improvement of C++ hits hard limits and explains Swift's C++ interoperability for gradual migration.

Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.

Part 2 of a Q&A workshop with security researcher Jacob Appelbaum from April 2012, covering mobile phone security, cellphone forensics, state repression and surveillance. Topics include booting Tails from USB and surveillance self-defense resources.

Deviant Ollam gives a long talk on risk and preparedness: get a lawyer, passport, locksmith and other resources before you need them. It covers practical steps to build defenses against serious problems in life.

A 2016 House Judiciary Committee hearing on encryption, held during the Apple and FBI iPhone dispute. It features testimony from Apple, the FBI and outside experts including Susan Landau, and runs over five hours.

A long Lex Fridman podcast conversation with Austrian economist Saifedean Ammous, author of The Bitcoin Standard. They cover Bitcoin, fiat money, anarchy and Austrian economics.

The opening lecture of MIT's Blockchain and Money course taught by Gary Gensler, covering the course plan, the history of failed digital currencies, cryptography and what a blockchain is.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

Dan Tentler shows a rapid-fire tour of insecure things found on the open internet using Shodan and his own scanning, from unprotected VNC endpoints to industrial controls. The emphasis is on how little security was considered before connecting them.

Ang Cui and Jonathan Voris present firmware modification attacks on networked printers at 28c3, showing how HP printers can be compromised and used as footholds for malware inside sensitive networks.

Joanna Rutkowska's 32C3 talk asks whether trustworthy client systems can be built on x86 hardware, and what realistically can be done about the challenges, such as Intel ME.

Tobias Engel's 31C3 talk shows how weaknesses in the SS7 telephone signaling network let companies and attackers locate, track and manipulate phones from anywhere in the world, with precision down to about 50 meters.

Bryan Cantrill's QCon SF 2019 talk asking whether operating systems should be rewritten in Rust. He draws on his systems experience to discuss C, memory safety and Rust's fit for system software.

A 2013 lecture in which Vitalik Buterin explains what quantum computers are and what they can and cannot do. He then discusses what they could mean for Bitcoin's cryptography.

A 37C3 talk on how a series of Polish electric trains stopped working after servicing by an independent company. The speakers explain how train control systems work and how they reverse-engineered the software lockouts.