Keynote Presentation: Escaping Cantor's Find-Fix Cycle
summary
Argues that recurring vulnerabilities fall into an eight‑level hierarchy from immediate constraint violations up to undecidable or societal specification failures, and that LangSec constrained interfaces plus recognizer patterns shrink the attack surface; low‑level classes respond to fuzzers and static analysis while higher classes need lightweight formal methods and policy work; cites Android master key, X.509 nulls, PDF rendering quirks, glitching and zip bombs as concrete examples and notes Rice/diagonalization implies an effectively infinite search space.
AI-written summary · about
chapters (9)
- 0:00Cantor's diagonalization in security
- 3:21Complexity drives vulnerabilities
- 10:20Eight-layer bug framework
- 20:30Why testing fails on vulnerabilities
- 27:08Static analysis vs unit tests
- 34:54Language design for input safety
- 40:28Limits of filtering and resilience
- 45:03Beyond low-level vulnerability hunting
- 47:13Q&A
related talks
18mKeynote
53mKeynote: Philippe De Ryck - AppSec is too hard?
15mKeynote: The Security Symphony
56mKeynote: AppSec: From Outsiders to Allies
58mKeynote: What Got Us Here Wont Get Us There
35mKeynote: Think Like a Hacker
01h 00mKeynote - Our Kryptonite: A Defendable Internet
23mKeynote: Fireside Chat with Window Snyder & Katherine Druckman