zero

Without Boats, a Rust language team member, explains the design of Rust's async/await at RustLatam 2019. He covers the history and constraints behind zero-cost, allocation-free async state machines.

Fernando Rojo explains how BeatGig reached $10M in sales with one frontend engineer by sharing code between React Native and Next.js, covering navigation, animation, theming and performance.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Aaron Boodman of Replicache asks why sync engines have not yet fixed web app complexity and what is missing for them to go mainstream. The talk lays out the ideas that led to the Zero sync engine.

Herb Sutter's CppCon 2019 talk on the split in the C++ community over exceptions and RTTI. He proposes making exceptions cheaper and more usable, including a zero-overhead, Result-like design.

A two-hour Computer History Museum oral history interview with Bjarne Stroustrup, conducted by Paul McJones in 2015. It covers his youth, education at Aarhus and Cambridge, his career at Bell Labs and elsewhere, and the design and evolution of C++.

Moxie Marlinspike's DEF CON 18 talk on changing threats to privacy argues that surveillance arrived through convenient services and network effects, so opting out is not a real solution. It also includes his framing of getting social democracy rather than the fascism people feared.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

Christopher Domas's Derbycon 2015 talk on the M/o/Vfuscator, a compiler that emits only x86 mov instructions, showing mov is Turing complete. It explains how a full machine is built from mov and why the output is a nightmare to reverse engineer.

Moxie Marlinspike's BlackHat 2011 talk examines weaknesses of SSL and the certificate authority system and proposes Convergence, a decentralized notary approach with trust agility.

James Mickens of Harvard gives a funny lecture at HBS's Future Assembly arguing that blockchains are a very bad idea. He covers their trust, legal and practical shortcomings for real-world problems.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

A Google Tech Talk by Steve Weis that introduces modern cryptography and its use in practice and at Google. It covers proofs of security and security definitions and a special topic. HN commenters treat it as a talk on verifiable electronic voting.

Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.

A HOPE X talk giving an in-depth explanation of how elevators work, from their history in hacker culture to using their control systems to bypass building security. It covers features and abilities of elevators that most people never see.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Christopher Domas presents his Cantor Dust tool at Derbycon 2012, a 3D visual approach to reverse engineering binaries by visualizing their structure dynamically.

Mike Hearn's talk at the 2012 London Bitcoin Conference on the future of Bitcoin, new applications and rebuilding the banking system. He covers lesser-known protocol features such as contracts, escrow and scripting.

Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.

Poul-Henning Kamp's FOSDEM 2014 talk is a hypothetical account of how an intelligence agency such as the NSA would sabotage open source software, standards and online discussion. It covers Skype's history, OpenSSL and psyops against standards.

Kim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.

James Mickens's 2015 Harvard colloquium argues that browsers are bloated and insecure because feature races trump clean interface design. He presents a cleaner, more secure browser architecture (Atlantis) with a much smaller API surface.

Moxie Marlinspike's DEF CON 19 talk on the weaknesses of SSL and the certificate authority system. He explains how CA trust became a problem and proposes an alternative that removes the CA oligopoly without reducing security.

Ronald Minnich of Google explains how UEFI firmware is a large closed attack surface and describes Google's work replacing it with Linux-based boot firmware. It also touches on Intel ME and other security coprocessors.

A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.

Moxie Marlinspike's DEF CON 18 talk argues that privacy threats have shifted from centralized state databases like TIA to corporate data collection by companies like Google, despite wins in strong cryptography and decentralization.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

Christopher Domas's REcon 2013 talk on dynamic binary visualization for reverse engineering. He shows how rendering binary data as interactive visual maps and trigraphs reveals structure that hex dumps hide, leading to his Cantor.dust tool.

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

A documentary from Swan Bitcoin exploring Bitcoin's relationship with energy, featuring Lyn Alden and others, and arguing that mining is a net positive for the environment and not wasteful.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Moxie Marlinspike speaks at Next Generation Threats 2014 about the challenges of encrypted communication and how Signal addresses them. He also draws on American action movies as narrative for secure communications.

Peter Rizun and Andrew Stone present results of tests running 1 GB blocks on a Bitcoin test network at Scaling Bitcoin Stanford. The talk argues for big-block scaling and discusses its consequences.

Journalist Matthew Cole's Black Hat 2013 talk on the CIA's operational security failures in the 2003 Milan kidnapping. Phone and location metadata exposed the team and led to arrest warrants.