Secure Designs, UX Dragons, Vuln Dungeons...
summary
Live podcast digs into concrete tradeoffs: a secure-by-design white paper plus a public pledge that lands 300 companies pledged, the claim that memory-unsafe languages are a bad practice (rewrite in safer languages or accept risk), real incidents like Log4j and SSRF leading to years-long fixes such as IMDSv2 migration took years, tooling wins like React and Let's Encrypt, common exploit classes (SQLi, command injection, auth flaws), a surprising UX bug where 40% copied placeholder DNS and LLMs that currently hallucinate more than they threat-model.
AI-written summary · about
chapters (9)
- 0:00Introductions and welcome
- 1:50Secure design philosophy
- 5:17Transparency and accountability
- 9:46Balancing security and growth
- 14:05Legacy, tools, and incentives
- 19:16Threat modeling and UX
- 23:31Quantifying security outcomes
- 31:10AI in development
- 37:12LLMs and future takeaways
related talks
29mSecurity by(e) Design?
58mPractical Secure Development and Operations with JavaScript in 2020
52mSecure by Design, Revisited - Insights & Pitfalls
33mInterview with
27mSecurity: The Thing That Everyone...
50mSecure and Privacy by Design Converge with Threat Modeling
22mDiscussion - White Hat Hacking, Session 7
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders