When Many Eyes Fail You
summary
Argues that open review helps sometimes but often fails: a webcrypto W3C candidate recommendation gets almost no attention then later hundreds of public comments that the committee must resolve, including heated SHA‑1 debates. Shows real projects and tradeoffs: building Crosswalk/XDK native APIs exposes mobile and car attack surfaces, automated scanners exist but are hard to deploy, and simple steps (paid reviewers, bug bounties, clear requirements and testcases) materially improve security outcomes.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:06Can we fox web security?
- 13:27Let me tell you a story about WebCrypto...
- 18:23Let me continue my story about WebCrypto...
- 20:51Does openness make us secure?
related talks
40mSecurity: Why It _has_to Be Open Source
37mStrengthening the Cybersecurity Ecosystem
17mA Sneak Peak Into Security Reviews with the Community
21mÜber Tech Lead On Code Revi
43mApplication Security is a Community Effort
16mKeynote: There Is Just One Way to Do Open Source Security: Together
44mNavigating Open Source and Open Standards for Better Cybersecurity
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.