A landscape of unintended consequences
summary
History of Shockwave/Flash teaches concrete failures: Flash reaches 90% of browsers in 1.5 years, accrues 1,172 CVEs (2001–2009) mostly memory‑safety bugs, and a Target‑style breach chains eight vulnerabilities to steal 40 million cards. Modern fixes include adopting memory‑safe languages (Rust), treating APIs as the long‑lived surface to protect, doing API audits after releases, avoiding bespoke parsers or crypto, assuming breach, and hardening supply chains (example: malicious npm dependency caught before deployment).
AI-written summary · about
chapters (39)
- 0:00Intro
- 4:27Shockwave
- 4:48Flash
- 6:00Doug Engelbert
- 8:06Flash had fewer vulnerabilities
- 8:51The number of vulnerabilities isnt significant
- 9:57Memory safety
- 11:05Classes of errors
- 11:44Memory safety vulnerabilities
- 13:01Casting a variable
- 14:41Unexpected context
- 16:20Parsing validation
- 17:44Rust
- 18:22Ingo
- 19:07Youre the API
- 20:18The dark ages
- 21:01Machines in basements
- 21:13Interfaces
- 21:47EKG machine
- 22:58Firewalls
- 23:15Energy efficiency
- 23:33Huge growth market
- 23:46The internet is scary
- 25:02Protect your software
- 25:22Modern software systems
- 25:56Humans make mistakes
- 26:13The world is changing
- 26:25The fundamentals of security
- 27:00Target attack
- 31:37Assume youll get breached
- 32:00Supply chain attack
- 33:06Summary
- 33:41Positive takeaways
- 34:12Dont assume you wont be successful
- 35:05The world needs lots of awesome software
- 35:24Just carve out some time
- 35:42Memorysafe languages
- 36:25Checklists
- 38:16Resources
related talks
40mThe Year in Flash
51mWindows 10 Mitigation Improvements
01h 05mFinding and Fixing Security Bugs in Flash
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
32mJavaScript security: a retrospective
28mLearning from High Profile Failures
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015