WEBVTT

1
00:00:02.265 --> 00:00:04.795
<00:00:02.265>Alright, <00:00:02.615>uh, <00:00:02.965>thank <00:00:03.315>you, <00:00:03.665>uh,

2
00:00:04.935 --> 00:00:06.675
<00:00:04.935>for <00:00:05.168>having <00:00:05.401>me <00:00:05.635>at <00:00:05.868>the <00:00:06.101>Weir <00:00:06.334>Developers.

3
00:00:06.675 --> 00:00:08.515
<00:00:06.675>It's <00:00:06.908>actually <00:00:07.141>the <00:00:07.375>third <00:00:07.608>talk <00:00:07.841>I'm <00:00:08.074>doing,

4
00:00:08.775 --> 00:00:10.395
<00:00:08.775>um, <00:00:09.241>for <00:00:09.708>weir <00:00:10.175>developers.

5
00:00:10.455 --> 00:00:12.155
<00:00:10.455>I'm <00:00:10.735>really <00:00:11.015>proud <00:00:11.295>of <00:00:11.575>that. <00:00:11.855>Uh,

6
00:00:12.185 --> 00:00:14.755
<00:00:12.185>today's <00:00:12.360>gonna <00:00:12.535>be <00:00:12.710>about <00:00:12.885>software <00:00:13.060>security <00:00:13.235>1 <00:00:13.410>0 <00:00:13.585>1.

7
00:00:15.455 --> 00:00:19.035
<00:00:15.455>So <00:00:15.610>if <00:00:15.766>we <00:00:15.921>build <00:00:16.077>houses, <00:00:16.232>the <00:00:16.388>way <00:00:16.543>we <00:00:16.699>build <00:00:16.855>software,

8
00:00:19.905 --> 00:00:23.035
<00:00:19.905>then <00:00:20.080>sometimes <00:00:20.255>bricks <00:00:20.430>would <00:00:20.605>be <00:00:20.780>falling <00:00:20.955>on <00:00:21.130>our <00:00:21.305>heads,

9
00:00:23.375 --> 00:00:25.035
<00:00:23.375>and <00:00:23.575>we <00:00:23.775>will <00:00:23.975>soon, <00:00:24.175>we <00:00:24.375>would <00:00:24.575>soon <00:00:24.775>notice

10
00:00:25.065 --> 00:00:26.315
<00:00:25.065>that <00:00:25.346>something <00:00:25.627>is <00:00:25.908>wrong <00:00:26.190>and,

11
00:00:26.335 --> 00:00:28.875
<00:00:26.335>and <00:00:26.490>that <00:00:26.646>would <00:00:26.801>have <00:00:26.957>real <00:00:27.112>physical <00:00:27.268>impact <00:00:27.423>in <00:00:27.579>our <00:00:27.735>lives.

12
00:00:29.455 --> 00:00:31.995
<00:00:29.455>Now, <00:00:29.805>software, <00:00:30.154>when <00:00:30.505>it's <00:00:30.854>insecure,

13
00:00:32.425 --> 00:00:33.835
<00:00:32.424>does <00:00:32.636>have <00:00:32.848>an <00:00:33.059>impact <00:00:33.271>in <00:00:33.482>our <00:00:33.694>lives,

14
00:00:33.935 --> 00:00:35.355
<00:00:33.935>but <00:00:34.254>it's <00:00:34.574>not <00:00:34.893>as <00:00:35.212>tangible

15
00:00:35.495 --> 00:00:37.595
<00:00:35.495>as <00:00:35.728>something <00:00:35.961>falling <00:00:36.195>on <00:00:36.428>our <00:00:36.661>bodies, <00:00:36.894>right?

16
00:00:38.215 --> 00:00:41.155
<00:00:38.215>But <00:00:38.370>still, <00:00:38.526>um, <00:00:38.681>it <00:00:38.837>is <00:00:38.992>a, <00:00:39.148>um, <00:00:39.303>a <00:00:39.459>big <00:00:39.615>problem

17
00:00:41.155 --> 00:00:44.195
<00:00:41.155>because <00:00:41.310>it <00:00:41.466>affects, <00:00:41.621>or <00:00:41.777>it <00:00:41.932>can <00:00:42.088>affect <00:00:42.243>all <00:00:42.399>of <00:00:42.555>society.

18
00:00:44.895 --> 00:00:47.035
<00:00:44.895>So, <00:00:45.095>some <00:00:45.295>of <00:00:45.495>those <00:00:45.695>principles <00:00:45.895>that <00:00:46.095>we <00:00:46.295>apply

19
00:00:47.035 --> 00:00:49.395
<00:00:47.035>to <00:00:47.235>when <00:00:47.434>we <00:00:47.635>build <00:00:47.834>houses, <00:00:48.035>we <00:00:48.235>have <00:00:48.434>laws

20
00:00:49.425 --> 00:00:53.235
<00:00:49.425>that <00:00:49.775>mandate <00:00:50.125>some <00:00:50.474>safety <00:00:50.824>prerequisites.

21
00:00:53.255 --> 00:00:54.755
<00:00:53.255>We <00:00:53.423>cannot <00:00:53.592>just <00:00:53.761>build <00:00:53.930>houses <00:00:54.098>the <00:00:54.267>way <00:00:54.436>we <00:00:54.605>want.

22
00:00:54.755 --> 00:00:55.955
<00:00:54.755>We <00:00:54.935>have <00:00:55.115>some <00:00:55.295>things <00:00:55.475>that <00:00:55.655>we <00:00:55.835>need

23
00:00:55.955 --> 00:00:57.595
<00:00:55.955>to <00:00:56.188>consider <00:00:56.421>in <00:00:56.655>terms <00:00:56.888>of <00:00:57.121>safety, <00:00:57.355>right?

24
00:00:58.135 --> 00:01:00.195
<00:00:58.135>Uh, <00:00:58.290>we <00:00:58.446>need <00:00:58.601>to <00:00:58.757>go <00:00:58.912>the <00:00:59.068>same <00:00:59.223>direction <00:00:59.379>with <00:00:59.535>software.

25
00:01:00.415 --> 00:01:02.475
<00:01:00.415>Now, <00:01:00.589>today <00:01:00.765>we're <00:01:00.940>gonna <00:01:01.115>talk <00:01:01.290>about <00:01:01.464>the <00:01:01.640>coding <00:01:01.815>level,

26
00:01:02.495 --> 00:01:03.635
<00:01:02.495>the <00:01:03.007>implementation <00:01:03.521>part.

27
00:01:04.615 --> 00:01:07.115
<00:01:04.614>Um, <00:01:04.848>and <00:01:05.081>I'm <00:01:05.315>quickly <00:01:05.548>gonna <00:01:05.781>present <00:01:06.015>myself.

28
00:01:07.135 --> 00:01:09.555
<00:01:07.135>My <00:01:07.290>name <00:01:07.446>is <00:01:07.601>Thomas <00:01:07.757>Kade. <00:01:07.912>Most <00:01:08.068>people <00:01:08.223>call <00:01:08.379>me <00:01:08.535>Tom.

29
00:01:10.075 --> 00:01:13.355
<00:01:10.075>I <00:01:10.250>work <00:01:10.425>for <00:01:10.600>an <00:01:10.775>information <00:01:10.950>security <00:01:11.125>research <00:01:11.300>center <00:01:11.475>called

30
00:01:13.715 --> 00:01:18.115
<00:01:13.715>SBA <00:01:13.870>Research <00:01:14.026>that's <00:01:14.181>in <00:01:14.337>Vienna, <00:01:14.492>and <00:01:14.648>I <00:01:14.803>do <00:01:14.959>software <00:01:15.115>security.

31
00:01:18.175 --> 00:01:21.275
<00:01:18.175>So <00:01:18.302>I <00:01:18.429>started <00:01:18.556>out <00:01:18.684>as <00:01:18.811>a <00:01:18.938>penetration <00:01:19.065>tester <00:01:19.193>11 <00:01:19.320>years <00:01:19.447>ago, <00:01:19.575>11

32
00:01:21.415 --> 00:01:23.035
<00:01:21.414>and <00:01:21.764>a <00:01:22.115>half <00:01:22.464>years <00:01:22.815>ago.

33
00:01:23.815 --> 00:01:27.275
<00:01:23.815>And, <00:01:23.955>um, <00:01:24.095>now <00:01:24.235>I <00:01:24.375>do <00:01:24.515>more <00:01:24.655>and <00:01:24.795>more <00:01:24.935>software <00:01:25.075>development <00:01:25.215>myself.

34
00:01:27.475 --> 00:01:29.675
<00:01:27.475>I <00:01:27.708>do <00:01:27.941>security <00:01:28.175>training <00:01:28.408>for <00:01:28.641>software <00:01:28.875>developers,

35
00:01:29.815 --> 00:01:32.435
<00:01:29.815>and <00:01:29.955>I'm <00:01:30.095>one <00:01:30.235>of <00:01:30.375>the <00:01:30.515>founders <00:01:30.655>of <00:01:30.795>the <00:01:30.935>software <00:01:31.075>dev <00:01:31.215>conference,

36
00:01:32.435 --> 00:01:34.795
<00:01:32.435>the <00:01:32.668>boot <00:01:32.901>bootcamp, <00:01:33.135>which <00:01:33.368>is <00:01:33.601>a <00:01:33.835>conference

37
00:01:35.415 --> 00:01:38.675
<00:01:35.414>for <00:01:35.589>developers <00:01:35.764>about <00:01:35.940>security, <00:01:36.115>not <00:01:36.289>for <00:01:36.464>security <00:01:36.639>people, <00:01:36.815>just

38
00:01:38.675 --> 00:01:40.035
<00:01:38.675>for <00:01:38.981>them, <00:01:39.286>but <00:01:39.593>for <00:01:39.899>developers.

39
00:01:40.085 --> 00:01:43.315
<00:01:40.085>Check <00:01:40.240>it <00:01:40.396>out. <00:01:40.551>Um, <00:01:40.707>sec <00:01:40.862>for <00:01:41.018>IO <00:01:41.173>is <00:01:41.329>the <00:01:41.485>website.

40
00:01:44.215 --> 00:01:48.195
<00:01:44.215>So <00:01:44.370>today's <00:01:44.526>agenda, <00:01:44.681>uh, <00:01:44.837>we're <00:01:44.992>gonna <00:01:45.148>start <00:01:45.303>out <00:01:45.459>with <00:01:45.615>terms

41
00:01:48.215 --> 00:01:50.155
<00:01:48.215>and <00:01:48.415>principles <00:01:48.615>that <00:01:48.815>we <00:01:49.015>need <00:01:49.215>to <00:01:49.415>be <00:01:49.615>able

42
00:01:50.155 --> 00:01:51.835
<00:01:50.155>to <00:01:50.435>communicate <00:01:50.715>with <00:01:50.995>each <00:01:51.275>other, <00:01:51.555>right?

43
00:01:52.545 --> 00:01:54.755
<00:01:52.545>Many <00:01:52.895>people <00:01:53.245>sometimes <00:01:53.595>have <00:01:53.945>problems

44
00:01:54.755 --> 00:01:56.075
<00:01:54.755>with <00:01:55.349>communicating <00:01:55.943>problems

45
00:01:56.075 --> 00:01:58.195
<00:01:56.075>with <00:01:56.425>the <00:01:56.775>security <00:01:57.125>responsible <00:01:57.475>person

46
00:01:58.735 --> 00:02:00.035
<00:01:58.735>or <00:01:59.125>the <00:01:59.515>security <00:01:59.905>department.

47
00:02:00.415 --> 00:02:04.075
<00:02:00.415>Now, <00:02:00.542>here <00:02:00.669>we <00:02:00.796>have <00:02:00.924>some <00:02:01.051>basic <00:02:01.178>terms <00:02:01.305>that <00:02:01.433>we <00:02:01.560>need <00:02:01.687>to, <00:02:01.815>uh,

48
00:02:04.085 --> 00:02:07.875
<00:02:04.085>understand, <00:02:04.259>uh, <00:02:04.434>for, <00:02:04.610>you <00:02:04.785>know, <00:02:04.960>abstraction <00:02:05.134>of <00:02:05.309>principles <00:02:05.485>so

49
00:02:07.875 --> 00:02:09.315
<00:02:07.875>that <00:02:08.060>we <00:02:08.245>can <00:02:08.430>talk <00:02:08.615>to <00:02:08.800>each <00:02:08.985>other <00:02:09.170>efficiently.

50
00:02:09.975 --> 00:02:12.635
<00:02:09.975>Um, <00:02:10.208>then <00:02:10.441>we're <00:02:10.674>gonna <00:02:10.908>talk <00:02:11.141>about <00:02:11.375>how

51
00:02:12.795 --> 00:02:14.675
<00:02:12.795>to <00:02:13.144>choose <00:02:13.494>a <00:02:13.845>secure <00:02:14.195>language.

52
00:02:15.615 --> 00:02:20.315
<00:02:15.615>Um, <00:02:15.755>so <00:02:15.895>what, <00:02:16.035>what <00:02:16.175>are <00:02:16.315>criteria <00:02:16.455>that <00:02:16.595>I <00:02:16.735>can <00:02:16.875>take <00:02:17.015>so

53
00:02:20.315 --> 00:02:22.955
<00:02:20.315>that <00:02:20.431>I <00:02:20.548>I <00:02:20.665>I <00:02:20.781>make <00:02:20.898>a <00:02:21.015>good <00:02:21.131>choice <00:02:21.248>in <00:02:21.365>terms <00:02:21.481>of <00:02:21.598>security, <00:02:21.715>right?

54
00:02:23.615 --> 00:02:25.795
<00:02:23.615>Um, <00:02:23.790>then <00:02:23.965>we're <00:02:24.140>gonna <00:02:24.315>talk <00:02:24.490>about <00:02:24.665>secure <00:02:24.840>coding <00:02:25.015>practices.

55
00:02:25.795 --> 00:02:28.075
<00:02:25.795>So <00:02:25.922>these <00:02:26.049>are <00:02:26.176>things <00:02:26.304>that <00:02:26.431>you <00:02:26.558>can <00:02:26.685>apply <00:02:26.813>in <00:02:26.940>your <00:02:27.067>daily <00:02:27.195>work

56
00:02:28.335 --> 00:02:31.115
<00:02:28.335>to <00:02:28.568>right, <00:02:28.801>more <00:02:29.035>robust <00:02:29.268>and <00:02:29.501>secure <00:02:29.735>software.

57
00:02:31.335 --> 00:02:34.075
<00:02:31.335>And <00:02:31.535>they <00:02:31.735>are <00:02:31.935>most <00:02:32.135>of <00:02:32.335>them, <00:02:32.535>basically <00:02:32.735>independent

58
00:02:34.075 --> 00:02:36.835
<00:02:34.075>of <00:02:34.355>the <00:02:34.635>concrete, <00:02:34.915>uh, <00:02:35.195>programming <00:02:35.475>language.

59
00:02:37.695 --> 00:02:39.115
<00:02:37.695>Uh, <00:02:38.014>in <00:02:38.334>the <00:02:38.653>fourth <00:02:38.973>step,

60
00:02:39.115 --> 00:02:40.875
<00:02:39.115>we're <00:02:39.348>gonna <00:02:39.581>talk <00:02:39.815>about <00:02:40.048>common <00:02:40.281>vulnerability <00:02:40.515>classes.

61
00:02:41.655 --> 00:02:43.315
<00:02:41.655>Uh, <00:02:41.888>so <00:02:42.121>there <00:02:42.355>are <00:02:42.588>these <00:02:42.821>top <00:02:43.055>lists,

62
00:02:43.455 --> 00:02:45.315
<00:02:43.454>and <00:02:43.630>we <00:02:43.804>will <00:02:43.980>have <00:02:44.154>a <00:02:44.329>quick <00:02:44.505>look <00:02:44.679>at <00:02:44.855>them

63
00:02:45.315 --> 00:02:46.475
<00:02:45.315>and <00:02:45.523>what <00:02:45.732>they <00:02:45.941>are <00:02:46.150>all <00:02:46.358>about.

64
00:02:47.055 --> 00:02:50.675
<00:02:47.055>Now, <00:02:47.195>uh, <00:02:47.335>most <00:02:47.475>of <00:02:47.615>your <00:02:47.755>code <00:02:47.895>probably <00:02:48.035>isn't <00:02:48.175>your <00:02:48.315>own <00:02:48.455>code.

65
00:02:51.055 --> 00:02:53.555
<00:02:51.055>It <00:02:51.521>probably <00:02:51.988>is <00:02:52.455>dependencies.

66
00:02:53.615 --> 00:02:55.675
<00:02:53.615>So <00:02:53.815>libraries <00:02:54.015>and <00:02:54.215>frameworks <00:02:54.415>that <00:02:54.615>you <00:02:54.815>pull <00:02:55.015>in,

67
00:02:56.015 --> 00:02:58.315
<00:02:56.015>and <00:02:56.190>they <00:02:56.364>can <00:02:56.540>have <00:02:56.714>vulnerabilities <00:02:56.890>and <00:02:57.065>flaws <00:02:57.239>as <00:02:57.415>well.

68
00:02:58.455 --> 00:03:00.925
<00:02:58.454>So <00:02:58.571>how <00:02:58.688>can <00:02:58.804>we <00:02:58.921>go <00:02:59.038>about <00:02:59.154>that? <00:02:59.271>What <00:02:59.388>can <00:02:59.505>we <00:02:59.621>do <00:02:59.738>about <00:02:59.855>this?

69
00:03:01.105 --> 00:03:02.125
<00:03:01.105>That's <00:03:01.411>the <00:03:01.716>fifth <00:03:02.023>part.

70
00:03:02.905 --> 00:03:04.605
<00:03:02.905>Uh, <00:03:03.185>then <00:03:03.465>in <00:03:03.745>the <00:03:04.025>sixth <00:03:04.305>part,

71
00:03:04.605 --> 00:03:06.805
<00:03:04.605>we're <00:03:04.804>gonna <00:03:05.005>talk <00:03:05.204>about <00:03:05.405>the <00:03:05.605>whole, <00:03:05.804>very <00:03:06.005>quickly,

72
00:03:06.805 --> 00:03:08.405
<00:03:06.805>about <00:03:07.085>the <00:03:07.365>whole <00:03:07.645>software <00:03:07.925>development <00:03:08.205>process.

73
00:03:08.995 --> 00:03:10.325
<00:03:08.995>This <00:03:09.294>is <00:03:09.593>about <00:03:09.892>secure <00:03:10.191>coding,

74
00:03:10.745 --> 00:03:13.445
<00:03:10.745>but, <00:03:10.900>uh, <00:03:11.056>at <00:03:11.211>the <00:03:11.367>end <00:03:11.522>of <00:03:11.678>this <00:03:11.833>talk, <00:03:11.989>I <00:03:12.145>want

75
00:03:13.445 --> 00:03:14.605
<00:03:13.445>to <00:03:13.594>have <00:03:13.743>a <00:03:13.892>look <00:03:14.041>at <00:03:14.190>the <00:03:14.339>bigger <00:03:14.488>picture.

76
00:03:14.715 --> 00:03:17.885
<00:03:14.715>What <00:03:14.842>else <00:03:14.969>is <00:03:15.096>there <00:03:15.224>that <00:03:15.351>we <00:03:15.478>can <00:03:15.605>do <00:03:15.733>in <00:03:15.860>terms <00:03:15.987>of <00:03:16.115>activities

77
00:03:17.905 --> 00:03:19.285
<00:03:17.905>to <00:03:18.153>make <00:03:18.401>our <00:03:18.650>software <00:03:18.898>more <00:03:19.147>secure?

78
00:03:19.945 --> 00:03:22.765
<00:03:19.945>And <00:03:20.061>I <00:03:20.178>will <00:03:20.295>give <00:03:20.411>you <00:03:20.528>a <00:03:20.644>very <00:03:20.761>quick <00:03:20.878>overview <00:03:20.995>of <00:03:21.111>the <00:03:21.228>oasp <00:03:21.345>sum,

79
00:03:22.765 --> 00:03:25.805
<00:03:22.765>which <00:03:22.920>is <00:03:23.076>a <00:03:23.231>very <00:03:23.387>cool <00:03:23.542>project <00:03:23.698>that <00:03:23.853>is, <00:03:24.009>um, <00:03:24.165>that

80
00:03:26.345 --> 00:03:28.405
<00:03:26.345>has <00:03:26.578>touch <00:03:26.811>points <00:03:27.045>with <00:03:27.278>not <00:03:27.511>just <00:03:27.745>coding,

81
00:03:28.505 --> 00:03:31.285
<00:03:28.505>but <00:03:28.738>everything <00:03:28.971>else <00:03:29.204>around <00:03:29.438>the <00:03:29.671>coding <00:03:29.905>part.

82
00:03:31.945 --> 00:03:34.365
<00:03:31.945>And <00:03:32.072>then <00:03:32.199>at <00:03:32.326>the <00:03:32.454>end, <00:03:32.581>few <00:03:32.708>learning <00:03:32.835>resources <00:03:32.963>that <00:03:33.090>you <00:03:33.217>can <00:03:33.345>use

83
00:03:34.745 --> 00:03:36.605
<00:03:34.745>to <00:03:35.025>get <00:03:35.305>better <00:03:35.585>at <00:03:35.865>software <00:03:36.145>security.

84
00:03:38.385 --> 00:03:40.325
<00:03:38.385>Um, <00:03:38.618>so <00:03:38.851>you're <00:03:39.084>gonna <00:03:39.318>hear <00:03:39.551>a <00:03:39.785>lot

85
00:03:40.325 --> 00:03:41.765
<00:03:40.325>of <00:03:40.510>things <00:03:40.695>in <00:03:40.880>this <00:03:41.065>talk, <00:03:41.250>in <00:03:41.435>this <00:03:41.620>talk.

86
00:03:42.345 --> 00:03:43.445
<00:03:42.345>Um, <00:03:42.675>bear <00:03:43.005>in <00:03:43.334>mind

87
00:03:43.445 --> 00:03:46.125
<00:03:43.445>that <00:03:43.600>we <00:03:43.756>are <00:03:43.911>not <00:03:44.067>gonna <00:03:44.222>be <00:03:44.378>diving <00:03:44.533>extremely <00:03:44.689>deep <00:03:44.845>into

88
00:03:46.185 --> 00:03:47.365
<00:03:46.185>all <00:03:46.450>of <00:03:46.716>those <00:03:46.981>things, <00:03:47.247>right?

89
00:03:47.685 --> 00:03:49.205
<00:03:47.685>I <00:03:47.958>wanna <00:03:48.232>show <00:03:48.505>you <00:03:48.779>the <00:03:49.053>landscape.

90
00:03:49.285 --> 00:03:50.925
<00:03:49.285>I <00:03:49.484>wanna <00:03:49.685>show <00:03:49.885>you <00:03:50.085>the <00:03:50.285>cities <00:03:50.484>and <00:03:50.685>towns

91
00:03:50.925 --> 00:03:53.485
<00:03:50.925>and <00:03:51.158>the <00:03:51.391>major <00:03:51.625>suites <00:03:51.858>of <00:03:52.091>the <00:03:52.325>sec

92
00:03:53.485 --> 00:03:56.205
<00:03:53.485>of <00:03:53.718>the <00:03:53.951>software <00:03:54.185>security <00:03:54.418>implementation <00:03:54.651>landscape <00:03:54.885>so

93
00:03:56.205 --> 00:03:59.525
<00:03:56.204>that <00:03:56.344>you <00:03:56.484>know <00:03:56.624>where <00:03:56.765>you <00:03:56.904>need <00:03:57.045>to <00:03:57.184>dig <00:03:57.325>deeper <00:03:57.464>yourself <00:03:57.605>to,

94
00:03:59.545 --> 00:04:00.925
<00:03:59.545>to <00:03:59.793>get <00:04:00.041>better <00:04:00.290>at <00:04:00.538>software <00:04:00.787>security.

95
00:04:01.585 --> 00:04:04.485
<00:04:01.585>Uh, <00:04:01.740>so <00:04:01.896>you're <00:04:02.051>not <00:04:02.207>gonna <00:04:02.362>know <00:04:02.518>each <00:04:02.673>inhabitant, <00:04:02.829>each <00:04:02.985>corner,

96
00:04:04.945 --> 00:04:08.365
<00:04:04.945>uh, <00:04:05.100>each <00:04:05.256>small <00:04:05.411>shop <00:04:05.567>in <00:04:05.722>every <00:04:05.878>town <00:04:06.033>after <00:04:06.189>this <00:04:06.345>talk.

97
00:04:08.365 --> 00:04:10.685
<00:04:08.365>But <00:04:08.540>you, <00:04:08.715>you <00:04:08.890>will <00:04:09.065>know <00:04:09.240>better <00:04:09.415>how <00:04:09.590>to <00:04:09.765>navigate

98
00:04:11.075 --> 00:04:13.005
<00:04:11.075>through <00:04:11.424>the <00:04:11.774>landscape <00:04:12.125>software <00:04:12.475>security.

99
00:04:14.595 --> 00:04:16.935
<00:04:14.595>So <00:04:14.734>why <00:04:14.875>are <00:04:15.015>we <00:04:15.155>here? <00:04:15.295>Why <00:04:15.435>are <00:04:15.575>we <00:04:15.715>talking <00:04:15.855>about <00:04:15.995>this?

100
00:04:17.355 --> 00:04:19.335
<00:04:17.355>So, <00:04:17.588>there <00:04:17.821>might <00:04:18.055>be <00:04:18.288>some <00:04:18.521>customer <00:04:18.755>expectation.

101
00:04:19.335 --> 00:04:22.215
<00:04:19.334>People <00:04:19.490>expect <00:04:19.646>software <00:04:19.801>to <00:04:19.957>be <00:04:20.112>secure <00:04:20.268>in <00:04:20.423>a <00:04:20.579>certain <00:04:20.734>way.

102
00:04:22.215 --> 00:04:24.495
<00:04:22.215>They <00:04:22.390>expect <00:04:22.565>their <00:04:22.739>data <00:04:22.914>not <00:04:23.090>to <00:04:23.265>be <00:04:23.440>lost, <00:04:23.614>right?

103
00:04:25.065 --> 00:04:27.375
<00:04:25.065>There <00:04:25.220>might <00:04:25.376>be <00:04:25.531>some <00:04:25.687>expectation <00:04:25.842>of <00:04:25.998>your <00:04:26.153>company <00:04:26.309>that <00:04:26.465>says,

104
00:04:27.375 --> 00:04:29.695
<00:04:27.375>look, <00:04:27.608>we <00:04:27.841>wanna <00:04:28.075>produce <00:04:28.308>high <00:04:28.541>quality <00:04:28.775>software,

105
00:04:30.075 --> 00:04:33.175
<00:04:30.075>and <00:04:30.275>security <00:04:30.474>is <00:04:30.675>one <00:04:30.875>of <00:04:31.075>those <00:04:31.275>non-functional <00:04:31.474>properties.

106
00:04:33.585 --> 00:04:35.855
<00:04:33.585>There <00:04:33.818>might <00:04:34.051>even <00:04:34.284>be <00:04:34.518>laws <00:04:34.751>and <00:04:34.984>regulations.

107
00:04:36.705 --> 00:04:40.605
<00:04:36.705>Uh, <00:04:36.860>uh, <00:04:37.016>that's <00:04:37.171>called <00:04:37.327>compliance <00:04:37.482>that <00:04:37.638>you <00:04:37.793>need <00:04:37.949>to <00:04:38.104>fulfill.

108
00:04:41.185 --> 00:04:43.445
<00:04:41.185>Uh, <00:04:41.385>such <00:04:41.585>as, <00:04:41.785>for <00:04:41.985>example, <00:04:42.185>when <00:04:42.385>processing <00:04:42.585>credit,

109
00:04:43.445 --> 00:04:46.005
<00:04:43.445>credit <00:04:43.645>card <00:04:43.844>data, <00:04:44.045>that <00:04:44.245>could <00:04:44.445>be <00:04:44.645>P-C-I-D-S-S <00:04:44.844>requirements.

110
00:04:46.405 --> 00:04:49.965
<00:04:46.405>GDPR <00:04:46.580>probably <00:04:46.755>plays, <00:04:46.929>plays <00:04:47.104>a <00:04:47.280>role <00:04:47.455>when <00:04:47.630>processing, <00:04:47.804>um,

111
00:04:50.055 --> 00:04:52.605
<00:04:50.055>personally <00:04:50.335>identifiable <00:04:50.615>information <00:04:50.895>and <00:04:51.175>so <00:04:51.455>on.

112
00:04:53.035 --> 00:04:55.045
<00:04:53.034>There's <00:04:53.385>hopefully <00:04:53.734>some <00:04:54.085>intrinsic <00:04:54.434>motivation,

113
00:04:55.045 --> 00:04:57.285
<00:04:55.045>and <00:04:55.200>I <00:04:55.356>think <00:04:55.511>there <00:04:55.667>is <00:04:55.822>because <00:04:55.978>there <00:04:56.133>are <00:04:56.289>500 <00:04:56.445>people.

114
00:04:57.425 --> 00:05:02.205
<00:04:57.425>That's <00:04:57.565>crazy. <00:04:57.705>Um, <00:04:57.845>so <00:04:57.985>you <00:04:58.125>all, <00:04:58.265>I <00:04:58.405>suppose, <00:04:58.545>have <00:04:58.685>some <00:04:58.825>sort

115
00:05:02.205 --> 00:05:03.725
<00:05:02.205>of <00:05:02.546>intrinsic <00:05:02.889>motivation <00:05:03.231>to <00:05:03.573>also

116
00:05:04.295 --> 00:05:05.565
<00:05:04.295>write <00:05:04.580>software <00:05:04.866>that's <00:05:05.152>secure, <00:05:05.438>right?

117
00:05:05.775 --> 00:05:08.325
<00:05:05.775>There <00:05:05.974>might <00:05:06.174>also <00:05:06.375>be <00:05:06.575>some <00:05:06.775>imposed <00:05:06.974>security <00:05:07.174>poster.

118
00:05:08.915 --> 00:05:10.005
<00:05:08.915>What <00:05:09.111>do <00:05:09.307>I <00:05:09.503>mean <00:05:09.699>by <00:05:09.896>poster?

119
00:05:10.405 --> 00:05:13.885
<00:05:10.405>I <00:05:10.580>mean, <00:05:10.755>for <00:05:10.929>example, <00:05:11.104>you're <00:05:11.280>writing <00:05:11.455>a <00:05:11.630>messenger, <00:05:11.804>um,

120
00:05:14.305 --> 00:05:16.005
<00:05:14.305>signal <00:05:14.538>is <00:05:14.771>one <00:05:15.005>of <00:05:15.238>those <00:05:15.471>examples, <00:05:15.705>right?

121
00:05:16.515 --> 00:05:18.085
<00:05:16.515>They <00:05:16.981>have <00:05:17.448>end-to-end <00:05:17.914>encryption,

122
00:05:18.085 --> 00:05:20.445
<00:05:18.085>and <00:05:18.318>that's <00:05:18.551>what <00:05:18.784>they <00:05:19.018>tell <00:05:19.251>everybody, <00:05:19.484>right?

123
00:05:20.785 --> 00:05:21.805
<00:05:20.785>We <00:05:21.091>have <00:05:21.397>end-to-end <00:05:21.703>encryption.

124
00:05:21.805 --> 00:05:23.805
<00:05:21.805>The <00:05:22.005>messages <00:05:22.205>cannot <00:05:22.405>be <00:05:22.605>seen <00:05:22.805>by <00:05:23.005>the <00:05:23.205>administrators.

125
00:05:23.945 --> 00:05:28.485
<00:05:23.945>That's <00:05:24.072>a <00:05:24.199>security <00:05:24.326>poster <00:05:24.454>that <00:05:24.581>we <00:05:24.708>want <00:05:24.835>to, <00:05:24.963>uh, <00:05:25.090>you <00:05:25.217>know, <00:05:25.344>put,

126
00:05:28.625 --> 00:05:29.765
<00:05:28.625>um, <00:05:28.967>to <00:05:29.308>the <00:05:29.651>public

127
00:05:29.825 --> 00:05:32.365
<00:05:29.825>and <00:05:30.000>tell <00:05:30.175>everybody <00:05:30.349>so <00:05:30.525>that <00:05:30.700>they <00:05:30.875>use <00:05:31.050>our <00:05:31.224>product.

128
00:05:32.595 --> 00:05:34.365
<00:05:32.595>That <00:05:32.750>could <00:05:32.906>also <00:05:33.061>be <00:05:33.217>a <00:05:33.372>reason <00:05:33.528>why <00:05:33.683>we <00:05:33.839>are <00:05:33.995>here

129
00:05:34.465 --> 00:05:36.125
<00:05:34.465>and <00:05:34.665>we <00:05:34.865>want <00:05:35.065>to <00:05:35.265>learn <00:05:35.465>about <00:05:35.665>software <00:05:35.865>security.

130
00:05:37.525 --> 00:05:39.015
<00:05:37.525>Well, <00:05:37.860>software <00:05:38.195>is <00:05:38.530>everywhere, <00:05:38.866>right?

131
00:05:39.285 --> 00:05:41.735
<00:05:39.284>Most <00:05:39.460>of <00:05:39.635>the <00:05:39.809>companies <00:05:39.984>out <00:05:40.159>there <00:05:40.335>are <00:05:40.510>software <00:05:40.684>companies.

132
00:05:41.845 --> 00:05:44.695
<00:05:41.845>Some <00:05:41.985>of <00:05:42.125>them <00:05:42.265>realize <00:05:42.405>that <00:05:42.545>they <00:05:42.685>are, <00:05:42.825>others <00:05:42.965>do <00:05:43.105>not, <00:05:43.245>right?

133
00:05:45.355 --> 00:05:47.535
<00:05:45.355>Um, <00:05:45.821>so <00:05:46.288>software's <00:05:46.755>everywhere.

134
00:05:47.535 --> 00:05:49.255
<00:05:47.534>Everything <00:05:48.001>gets <00:05:48.468>more <00:05:48.934>interconnected.

135
00:05:49.755 --> 00:05:53.255
<00:05:49.755>And <00:05:49.930>if <00:05:50.105>you <00:05:50.280>don't <00:05:50.455>think <00:05:50.630>about <00:05:50.805>this <00:05:50.980>non-functional <00:05:51.155>requirement

136
00:05:53.255 --> 00:05:55.095
<00:05:53.255>of <00:05:53.605>security <00:05:53.955>from <00:05:54.305>the <00:05:54.655>beginning,

137
00:05:55.605 --> 00:05:58.405
<00:05:55.605>this <00:05:55.760>is <00:05:55.916>when <00:05:56.071>it <00:05:56.227>gets <00:05:56.382>expensive <00:05:56.538>at <00:05:56.693>the <00:05:56.849>end, <00:05:57.005>right?

138
00:05:58.795 --> 00:06:01.685
<00:05:58.795>It's <00:05:59.145>only <00:05:59.495>healthy <00:05:59.845>what, <00:06:00.195>uh,

139
00:06:02.045 --> 00:06:05.005
<00:06:02.045>possible <00:06:02.185>in <00:06:02.325>a <00:06:02.465>healthy <00:06:02.605>way <00:06:02.745>if <00:06:02.885>it's <00:06:03.025>considered <00:06:03.165>from <00:06:03.305>the <00:06:03.445>start.

140
00:06:05.225 --> 00:06:08.365
<00:06:05.225>And <00:06:05.365>if <00:06:05.505>it's <00:06:05.645>a <00:06:05.785>first <00:06:05.925>class <00:06:06.065>citizen <00:06:06.205>in <00:06:06.345>your, <00:06:06.485>uh, <00:06:06.625>daily

141
00:06:09.005 --> 00:06:10.565
<00:06:09.005>practice <00:06:09.238>of <00:06:09.471>a <00:06:09.705>software <00:06:09.938>being <00:06:10.171>software <00:06:10.405>developer.

142
00:06:11.145 --> 00:06:13.645
<00:06:11.145>Uh, <00:06:11.300>so <00:06:11.456>some <00:06:11.611>of <00:06:11.767>you <00:06:11.922>might <00:06:12.078>have <00:06:12.233>seen <00:06:12.389>this <00:06:12.544>curve

143
00:06:13.665 --> 00:06:16.925
<00:06:13.665>of <00:06:13.865>when <00:06:14.065>an <00:06:14.265>error <00:06:14.465>happens <00:06:14.665>during <00:06:14.865>coding <00:06:15.065>time

144
00:06:16.925 --> 00:06:20.005
<00:06:16.925>and <00:06:17.052>you <00:06:17.179>detect <00:06:17.306>the <00:06:17.434>error <00:06:17.561>during <00:06:17.688>coding <00:06:17.815>time, <00:06:17.943>it <00:06:18.070>is <00:06:18.197>very <00:06:18.325>easy

145
00:06:20.025 --> 00:06:23.485
<00:06:20.025>to <00:06:20.152>fix <00:06:20.279>because <00:06:20.406>your <00:06:20.534>head <00:06:20.661>is <00:06:20.788>in <00:06:20.915>this <00:06:21.043>part <00:06:21.170>of <00:06:21.297>the <00:06:21.424>code.

146
00:06:24.065 --> 00:06:26.365
<00:06:24.065>Uh, <00:06:24.415>your <00:06:24.765>understanding <00:06:25.115>what's <00:06:25.465>there,

147
00:06:26.545 --> 00:06:27.445
<00:06:26.545>it <00:06:26.747>doesn't <00:06:26.950>have <00:06:27.152>too <00:06:27.355>many

148
00:06:27.445 --> 00:06:29.085
<00:06:27.445>dependencies <00:06:27.678>to <00:06:27.911>other <00:06:28.145>parts <00:06:28.378>of <00:06:28.611>the <00:06:28.844>code.

149
00:06:29.265 --> 00:06:31.445
<00:06:29.265>So <00:06:29.498>the <00:06:29.731>earlier <00:06:29.965>you <00:06:30.198>fix <00:06:30.431>something, <00:06:30.664>uh,

150
00:06:31.445 --> 00:06:33.685
<00:06:31.445>the <00:06:31.600>less <00:06:31.756>expensive <00:06:31.911>it <00:06:32.067>is <00:06:32.222>in <00:06:32.378>terms <00:06:32.533>of <00:06:32.689>your <00:06:32.844>time.

151
00:06:33.845 --> 00:06:35.645
<00:06:33.845>You <00:06:34.000>don't <00:06:34.156>have <00:06:34.311>to <00:06:34.467>invest <00:06:34.622>so <00:06:34.778>much <00:06:34.933>of <00:06:35.089>your <00:06:35.245>time.

152
00:06:35.985 --> 00:06:38.605
<00:06:35.985>So <00:06:36.140>it's <00:06:36.296>most <00:06:36.451>cost <00:06:36.607>effective <00:06:36.762>in <00:06:36.918>the <00:06:37.073>long <00:06:37.229>term <00:06:37.385>when

153
00:06:38.605 --> 00:06:39.645
<00:06:38.605>it's <00:06:38.839>considered <00:06:39.073>from <00:06:39.307>the <00:06:39.541>start.

154
00:06:39.905 --> 00:06:43.805
<00:06:39.905>Now, <00:06:40.032>when <00:06:40.159>you <00:06:40.286>want, <00:06:40.414>if <00:06:40.541>you <00:06:40.668>want <00:06:40.795>to, <00:06:40.923>um, <00:06:41.050>convince <00:06:41.177>your, <00:06:41.304>uh,

155
00:06:43.805 --> 00:06:47.205
<00:06:43.805>company <00:06:43.980>leadership <00:06:44.155>team <00:06:44.330>of, <00:06:44.505>uh, <00:06:44.680>you <00:06:44.855>need <00:06:45.030>some <00:06:45.205>time

156
00:06:47.205 --> 00:06:49.965
<00:06:47.205>and <00:06:47.405>budget <00:06:47.604>to <00:06:47.805>invest <00:06:48.005>into <00:06:48.205>security, <00:06:48.405>tell <00:06:48.604>them

157
00:06:49.965 --> 00:06:52.805
<00:06:49.965>that <00:06:50.120>in <00:06:50.276>the <00:06:50.431>long <00:06:50.587>run, <00:06:50.742>it's <00:06:50.898>more <00:06:51.053>cost <00:06:51.209>effective <00:06:51.365>than

158
00:06:52.805 --> 00:06:53.845
<00:06:52.805>doing <00:06:53.273>it <00:06:53.741>later.

159
00:06:54.315 --> 00:06:57.045
<00:06:54.315>Getting <00:06:54.548>back <00:06:54.781>to <00:06:55.015>how <00:06:55.248>we <00:06:55.481>build <00:06:55.715>houses

160
00:06:57.145 --> 00:06:58.245
<00:06:57.145>and <00:06:57.392>how <00:06:57.640>we <00:06:57.887>build <00:06:58.135>software.

161
00:06:59.025 --> 00:07:01.845
<00:06:59.025>Uh, <00:06:59.200>detecting <00:06:59.375>something <00:06:59.549>very <00:06:59.724>late <00:06:59.900>in <00:07:00.075>the <00:07:00.250>development <00:07:00.424>stage

162
00:07:01.865 --> 00:07:06.005
<00:07:01.865>is <00:07:02.005>like, <00:07:02.145>uh, <00:07:02.285>I'm <00:07:02.425>trying <00:07:02.565>to <00:07:02.705>replace <00:07:02.845>the <00:07:02.985>wall <00:07:03.125>that's <00:07:03.265>beside

163
00:07:06.005 --> 00:07:07.885
<00:07:06.005>of <00:07:06.205>me <00:07:06.405>here <00:07:06.605>because <00:07:06.805>I <00:07:07.005>noticed <00:07:07.205>that <00:07:07.405>it's,

164
00:07:07.885 --> 00:07:09.525
<00:07:07.885>it <00:07:08.118>was <00:07:08.351>constructed <00:07:08.585>in <00:07:08.818>the <00:07:09.051>wrong <00:07:09.284>way.

165
00:07:10.025 --> 00:07:12.205
<00:07:10.025>If <00:07:10.224>I <00:07:10.424>do <00:07:10.625>that <00:07:10.825>now, <00:07:11.025>it's <00:07:11.224>very <00:07:11.424>expensive

166
00:07:12.205 --> 00:07:14.725
<00:07:12.205>because, <00:07:12.380>you <00:07:12.555>know, <00:07:12.729>the <00:07:12.905>building <00:07:13.080>needs <00:07:13.255>to <00:07:13.430>be <00:07:13.604>stabilized

167
00:07:14.725 --> 00:07:17.085
<00:07:14.725>because <00:07:14.852>that <00:07:14.979>wall <00:07:15.106>carries <00:07:15.234>a <00:07:15.361>part <00:07:15.488>of <00:07:15.615>the <00:07:15.743>building <00:07:15.870>and <00:07:15.997>so <00:07:16.125>on.

168
00:07:17.085 --> 00:07:18.325
<00:07:17.085>It's <00:07:17.364>getting <00:07:17.643>really, <00:07:17.921>really <00:07:18.200>expensive.

169
00:07:18.385 --> 00:07:21.645
<00:07:18.385>The <00:07:18.525>same <00:07:18.664>thing <00:07:18.805>in <00:07:18.945>software <00:07:19.085>is <00:07:19.224>many <00:07:19.365>parts <00:07:19.505>of <00:07:19.645>the <00:07:19.784>software.

170
00:07:21.645 --> 00:07:24.125
<00:07:21.645>Many <00:07:21.784>parts <00:07:21.924>of <00:07:22.065>my <00:07:22.205>system <00:07:22.344>depend <00:07:22.484>on <00:07:22.625>this <00:07:22.765>piece <00:07:22.905>of <00:07:23.044>software.

171
00:07:24.245 --> 00:07:26.885
<00:07:24.245>I <00:07:24.372>cannot <00:07:24.499>just <00:07:24.626>ditch <00:07:24.754>it <00:07:24.881>and, <00:07:25.008>and <00:07:25.135>write <00:07:25.263>it <00:07:25.390>from <00:07:25.517>the <00:07:25.645>start.

172
00:07:27.505 --> 00:07:30.045
<00:07:27.505>Um, <00:07:27.738>because <00:07:27.971>there, <00:07:28.205>there, <00:07:28.438>there <00:07:28.671>are <00:07:28.905>implications.

173
00:07:30.825 --> 00:07:33.765
<00:07:30.825>So <00:07:31.025>the <00:07:31.224>earlier <00:07:31.425>we <00:07:31.625>integrate <00:07:31.825>this, <00:07:32.025>the <00:07:32.224>better

174
00:07:33.865 --> 00:07:36.405
<00:07:33.865>and <00:07:34.065>the <00:07:34.265>more <00:07:34.465>efficient <00:07:34.665>and, <00:07:34.865>um, <00:07:35.065>the <00:07:35.265>cheaper.

175
00:07:38.335 --> 00:07:40.075
<00:07:38.335>Uh, <00:07:38.510>we're <00:07:38.685>gonna <00:07:38.859>start <00:07:39.034>out <00:07:39.210>with <00:07:39.385>some <00:07:39.560>basic <00:07:39.734>terms

176
00:07:40.075 --> 00:07:42.435
<00:07:40.075>and <00:07:40.215>principles <00:07:40.354>so <00:07:40.495>that <00:07:40.635>we <00:07:40.775>are <00:07:40.914>all <00:07:41.055>on <00:07:41.195>the <00:07:41.335>same <00:07:41.474>page

177
00:07:42.575 --> 00:07:44.995
<00:07:42.575>and <00:07:42.750>we <00:07:42.925>can <00:07:43.099>communicate <00:07:43.275>better <00:07:43.450>with, <00:07:43.625>with <00:07:43.800>each <00:07:43.974>other.

178
00:07:46.495 --> 00:07:48.355
<00:07:46.495>Um, <00:07:46.845>there <00:07:47.195>is <00:07:47.545>this <00:07:47.895>concept

179
00:07:48.575 --> 00:07:52.275
<00:07:48.575>or <00:07:48.750>this <00:07:48.925>idea <00:07:49.099>of <00:07:49.275>initial <00:07:49.450>velocity <00:07:49.625>versus <00:07:49.800>sustained <00:07:49.974>velocity,

180
00:07:53.145 --> 00:07:55.115
<00:07:53.145>also <00:07:53.344>known <00:07:53.544>as <00:07:53.745>we <00:07:53.945>will <00:07:54.145>add <00:07:54.344>security <00:07:54.544>later.

181
00:07:55.545 --> 00:07:58.595
<00:07:55.545>Well, <00:07:55.685>you <00:07:55.825>probably <00:07:55.965>won't <00:07:56.105>if <00:07:56.245>you <00:07:56.385>don't <00:07:56.525>consider <00:07:56.665>it <00:07:56.805>from <00:07:56.945>the

182
00:07:58.595 --> 00:08:00.035
<00:07:58.595>start, <00:07:58.811>it's <00:07:59.027>not <00:07:59.243>important <00:07:59.459>from <00:07:59.675>the <00:07:59.891>start,

183
00:08:00.215 --> 00:08:01.715
<00:08:00.215>it <00:08:00.484>will <00:08:00.755>probably <00:08:01.025>never <00:08:01.294>be <00:08:01.565>important

184
00:08:02.015 --> 00:08:04.235
<00:08:02.015>or <00:08:02.170>you <00:08:02.326>invest <00:08:02.481>a <00:08:02.637>lot <00:08:02.792>of <00:08:02.948>time <00:08:03.103>and, <00:08:03.259>and <00:08:03.414>money

185
00:08:04.235 --> 00:08:06.755
<00:08:04.235>and <00:08:04.468>resources <00:08:04.701>to <00:08:04.935>making <00:08:05.168>it <00:08:05.401>something <00:08:05.635>important.

186
00:08:07.695 --> 00:08:10.155
<00:08:07.695>Um, <00:08:07.928>so, <00:08:08.161>uh, <00:08:08.395>there <00:08:08.628>is <00:08:08.861>a <00:08:09.094>book

187
00:08:10.155 --> 00:08:11.435
<00:08:10.155>that's <00:08:10.443>called <00:08:10.731>Build <00:08:11.019>Building <00:08:11.307>Secure

188
00:08:11.435 --> 00:08:14.475
<00:08:11.435>and <00:08:11.610>Reliable <00:08:11.785>Systems, <00:08:11.960>uh, <00:08:12.135>recommendation <00:08:12.310>that <00:08:12.485>has <00:08:12.660>a <00:08:12.835>chapter

189
00:08:14.775 --> 00:08:17.235
<00:08:14.775>that's <00:08:15.008>called <00:08:15.241>Initial <00:08:15.474>Velocity <00:08:15.708>versus <00:08:15.941>Sustained <00:08:16.174>Velocity.

190
00:08:17.475 --> 00:08:20.435
<00:08:17.475>I <00:08:17.615>took <00:08:17.755>it <00:08:17.895>from <00:08:18.035>there. <00:08:18.175>And <00:08:18.315>they <00:08:18.455>basically <00:08:18.595>explain <00:08:18.735>the <00:08:18.875>concept

191
00:08:20.435 --> 00:08:23.435
<00:08:20.435>that <00:08:20.635>if <00:08:20.835>you <00:08:21.035>have <00:08:21.235>non-functional <00:08:21.435>requirements <00:08:21.635>like <00:08:21.835>security

192
00:08:23.975 --> 00:08:25.115
<00:08:23.975>not <00:08:24.231>considered <00:08:24.488>from <00:08:24.744>the <00:08:25.001>start,

193
00:08:25.695 --> 00:08:26.995
<00:08:25.695>it <00:08:25.929>will <00:08:26.163>give <00:08:26.397>you <00:08:26.631>initial <00:08:26.865>velocity

194
00:08:26.995 --> 00:08:30.595
<00:08:26.995>because <00:08:27.135>you <00:08:27.275>will <00:08:27.415>be <00:08:27.555>able <00:08:27.695>to <00:08:27.835>bring <00:08:27.975>out <00:08:28.115>the <00:08:28.255>product <00:08:28.395>faster.

195
00:08:30.895 --> 00:08:33.475
<00:08:30.895>It, <00:08:31.094>some <00:08:31.294>basic <00:08:31.495>functionality <00:08:31.695>will <00:08:31.895>be <00:08:32.095>done <00:08:32.294>faster,

196
00:08:33.775 --> 00:08:36.195
<00:08:33.775>but <00:08:33.930>you <00:08:34.086>do <00:08:34.241>it <00:08:34.397>at <00:08:34.552>the <00:08:34.708>cost <00:08:34.863>of <00:08:35.019>sustained <00:08:35.174>velocity.

197
00:08:36.335 --> 00:08:38.675
<00:08:36.335>So <00:08:36.535>later, <00:08:36.735>sometime <00:08:36.935>later <00:08:37.135>when <00:08:37.335>the, <00:08:37.535>the <00:08:37.735>bug

198
00:08:38.695 --> 00:08:39.795
<00:08:38.695>and <00:08:39.190>vulnerabilities <00:08:39.684>arise,

199
00:08:40.495 --> 00:08:43.235
<00:08:40.495>you <00:08:40.669>will <00:08:40.845>have <00:08:41.020>a <00:08:41.195>hard <00:08:41.370>time <00:08:41.544>keeping <00:08:41.720>pace, <00:08:41.895>right?

200
00:08:44.175 --> 00:08:47.115
<00:08:44.174>Let <00:08:44.330>me, <00:08:44.486>uh, <00:08:44.641>give <00:08:44.797>you <00:08:44.952>a <00:08:45.108>concrete <00:08:45.263>example <00:08:45.419>of <00:08:45.574>this.

201
00:08:47.815 --> 00:08:49.555
<00:08:47.815>Um, <00:08:47.990>let's <00:08:48.165>say <00:08:48.340>you <00:08:48.515>have <00:08:48.690>a <00:08:48.865>software, <00:08:49.040>you <00:08:49.215>have,

202
00:08:49.655 --> 00:08:51.435
<00:08:49.655>you <00:08:49.935>have, <00:08:50.214>say <00:08:50.495>a <00:08:50.775>web <00:08:51.055>application.

203
00:08:51.435 --> 00:08:52.875
<00:08:51.435>You <00:08:51.694>have <00:08:51.953>some <00:08:52.212>libraries <00:08:52.471>and <00:08:52.731>frameworks

204
00:08:52.875 --> 00:08:54.035
<00:08:52.875>that <00:08:53.223>you're <00:08:53.571>using, <00:08:53.919>right?

205
00:08:54.575 --> 00:08:58.445
<00:08:54.575>Um, <00:08:54.750>many <00:08:54.925>people <00:08:55.100>you <00:08:55.275>might <00:08:55.450>know <00:08:55.625>that, <00:08:55.800>but <00:08:55.975>if

206
00:08:58.975 --> 00:09:03.445
<00:08:58.975>after <00:08:59.102>two <00:08:59.229>or <00:08:59.356>three <00:08:59.484>years <00:08:59.611>into <00:08:59.738>the <00:08:59.865>start <00:08:59.993>of <00:09:00.120>the <00:09:00.247>project, <00:09:00.375>um,

207
00:09:03.505 --> 00:09:06.405
<00:09:03.505>you <00:09:03.705>have <00:09:03.905>some <00:09:04.105>major <00:09:04.305>version <00:09:04.505>upgrades <00:09:04.705>of <00:09:04.905>frameworks

208
00:09:06.405 --> 00:09:08.205
<00:09:06.405>that <00:09:06.755>you're <00:09:07.105>using, <00:09:07.454>and <00:09:07.805>then

209
00:09:08.745 --> 00:09:10.965
<00:09:08.745>the <00:09:08.900>framework <00:09:09.056>upgrade <00:09:09.211>is <00:09:09.367>gonna <00:09:09.522>use <00:09:09.678>a <00:09:09.833>lot <00:09:09.989>of <00:09:10.145>time

210
00:09:10.965 --> 00:09:12.365
<00:09:10.965>because <00:09:11.280>they <00:09:11.595>have <00:09:11.910>breaking <00:09:12.225>changes.

211
00:09:13.225 --> 00:09:14.885
<00:09:13.225>Um, <00:09:13.691>the <00:09:14.158>older <00:09:14.625>version

212
00:09:14.885 --> 00:09:17.205
<00:09:14.885>of <00:09:15.060>the <00:09:15.235>framework <00:09:15.410>might <00:09:15.585>not <00:09:15.760>even <00:09:15.935>be <00:09:16.110>supported <00:09:16.285>anymore.

213
00:09:17.865 --> 00:09:21.715
<00:09:17.865>So <00:09:18.098>the <00:09:18.331>longer <00:09:18.565>you <00:09:18.798>run <00:09:19.031>behind, <00:09:19.265>uh,

214
00:09:21.715 --> 00:09:22.915
<00:09:21.715>the <00:09:21.895>more <00:09:22.075>time <00:09:22.255>it's <00:09:22.435>gonna <00:09:22.615>cost <00:09:22.795>you.

215
00:09:23.905 --> 00:09:27.005
<00:09:23.905>So <00:09:24.045>if <00:09:24.185>you're, <00:09:24.324>if <00:09:24.464>you <00:09:24.605>compare <00:09:24.745>it <00:09:24.885>with, <00:09:25.025>with <00:09:25.165>a <00:09:25.305>wave

216
00:09:27.025 --> 00:09:30.685
<00:09:27.025>and <00:09:27.199>surfing, <00:09:27.375>um, <00:09:27.550>you, <00:09:27.725>uh, <00:09:27.900>are <00:09:28.074>always <00:09:28.250>running <00:09:28.425>behind

217
00:09:30.685 --> 00:09:32.005
<00:09:30.685>with <00:09:31.080>dependency <00:09:31.477>up <00:09:31.873>updates

218
00:09:32.005 --> 00:09:34.605
<00:09:32.005>because <00:09:32.238>you <00:09:32.471>fear, <00:09:32.705>uh, <00:09:32.938>breaking <00:09:33.171>something, <00:09:33.405>right?

219
00:09:34.825 --> 00:09:36.205
<00:09:34.825>You <00:09:35.073>don't <00:09:35.321>have <00:09:35.570>the <00:09:35.818>test <00:09:36.067>coverage.

220
00:09:36.465 --> 00:09:37.965
<00:09:36.465>You <00:09:36.633>cannot <00:09:36.802>be <00:09:36.971>sure <00:09:37.140>that <00:09:37.308>if <00:09:37.477>you <00:09:37.646>change <00:09:37.815>something,

221
00:09:37.965 --> 00:09:39.405
<00:09:37.965>there's <00:09:38.289>no <00:09:38.613>test <00:09:38.937>gonna <00:09:39.261>fail,

222
00:09:39.555 --> 00:09:41.205
<00:09:39.555>it's <00:09:39.788>just <00:09:40.021>gonna <00:09:40.255>fail <00:09:40.488>at <00:09:40.721>the <00:09:40.954>customer.

223
00:09:41.785 --> 00:09:42.965
<00:09:41.785>Um, <00:09:41.962>they <00:09:42.139>will <00:09:42.316>get <00:09:42.493>back <00:09:42.670>to <00:09:42.847>you.

224
00:09:42.965 --> 00:09:44.805
<00:09:42.965>It's, <00:09:43.120>it's <00:09:43.276>a <00:09:43.431>huge <00:09:43.587>cycle <00:09:43.742>that <00:09:43.898>you <00:09:44.053>need <00:09:44.209>to <00:09:44.365>take

225
00:09:44.805 --> 00:09:45.845
<00:09:44.805>to <00:09:45.039>fix <00:09:45.273>all <00:09:45.507>those <00:09:45.741>problems.

226
00:09:46.225 --> 00:09:48.485
<00:09:46.225>So <00:09:46.575>that's <00:09:46.925>lost <00:09:47.275>sustained <00:09:47.625>velocity

227
00:09:48.755 --> 00:09:51.885
<00:09:48.755>because <00:09:48.955>we <00:09:49.155>initially, <00:09:49.355>we <00:09:49.555>never <00:09:49.755>integrated <00:09:49.955>dependency <00:09:50.155>checks,

228
00:09:52.235 --> 00:09:54.205
<00:09:52.235>automated <00:09:52.585>checks <00:09:52.935>into <00:09:53.285>our <00:09:53.635>lifecycle.

229
00:09:55.185 --> 00:09:59.165
<00:09:55.185>So, <00:09:55.292>uh, <00:09:55.400>if <00:09:55.508>you <00:09:55.615>want <00:09:55.723>to <00:09:55.831>be <00:09:55.938>surfing <00:09:56.046>and <00:09:56.154>in <00:09:56.261>front <00:09:56.369>of <00:09:56.477>the <00:09:56.584>wave,

230
00:09:59.185 --> 00:10:01.725
<00:09:59.185>and <00:09:59.324>the <00:09:59.464>wave <00:09:59.604>push <00:09:59.744>you <00:09:59.885>at <00:10:00.025>least <00:10:00.165>most <00:10:00.305>of <00:10:00.444>the <00:10:00.584>time,

231
00:10:01.725 --> 00:10:03.405
<00:10:01.725>sometimes <00:10:02.005>the <00:10:02.285>wave <00:10:02.565>will <00:10:02.845>just <00:10:03.125>suck.

232
00:10:03.405 --> 00:10:05.805
<00:10:03.405>You <00:10:03.605>suck, <00:10:03.805>uh, <00:10:04.005>you <00:10:04.204>be <00:10:04.405>beneath, <00:10:04.605>uh, <00:10:04.805>itself.

233
00:10:06.505 --> 00:10:09.765
<00:10:06.505>Um, <00:10:06.680>so, <00:10:06.855>um, <00:10:07.030>is <00:10:07.205>having <00:10:07.380>a <00:10:07.555>great <00:10:07.730>test <00:10:07.905>coverage.

234
00:10:09.865 --> 00:10:11.925
<00:10:09.865>So <00:10:10.145>having <00:10:10.425>an <00:10:10.705>automated <00:10:10.985>means <00:10:11.265>of

235
00:10:12.605 --> 00:10:14.605
<00:10:12.605>checking <00:10:12.805>whether <00:10:13.005>the <00:10:13.205>software's <00:10:13.405>still <00:10:13.605>functioning <00:10:13.805>in <00:10:14.005>the

236
00:10:14.605 --> 00:10:17.445
<00:10:14.605>right <00:10:14.780>way <00:10:14.955>and <00:10:15.130>let <00:10:15.305>a <00:10:15.480>bot <00:10:15.655>do <00:10:15.830>the <00:10:16.005>updates.

237
00:10:17.585 --> 00:10:19.005
<00:10:17.585>So <00:10:17.840>you <00:10:18.096>have <00:10:18.351>a <00:10:18.607>definition <00:10:18.863>of,

238
00:10:19.645 --> 00:10:21.525
<00:10:19.645>I <00:10:19.845>want <00:10:20.045>this <00:10:20.245>major <00:10:20.444>version <00:10:20.645>of <00:10:20.845>this <00:10:21.045>library.

239
00:10:22.225 --> 00:10:24.045
<00:10:22.225>And <00:10:22.365>the <00:10:22.505>bot, <00:10:22.645>if <00:10:22.785>there's <00:10:22.925>a <00:10:23.065>new <00:10:23.205>version <00:10:23.345>of <00:10:23.485>the <00:10:23.625>library,

240
00:10:24.065 --> 00:10:26.965
<00:10:24.065>the <00:10:24.220>bot <00:10:24.376>is <00:10:24.531>gonna, <00:10:24.687>uh, <00:10:24.842>update <00:10:24.998>from <00:10:25.153>4 <00:10:25.309>6 <00:10:25.465>1

241
00:10:26.985 --> 00:10:29.285
<00:10:26.985>to <00:10:27.265>4 <00:10:27.545>6 <00:10:27.825>2 <00:10:28.105>completely <00:10:28.385>automatically.

242
00:10:29.345 --> 00:10:32.805
<00:10:29.345>If <00:10:29.485>the <00:10:29.625>tests <00:10:29.765>are <00:10:29.905>still <00:10:30.045>green, <00:10:30.185>you <00:10:30.325>can <00:10:30.465>do <00:10:30.605>that <00:10:30.745>automatically.

243
00:10:32.865 --> 00:10:34.525
<00:10:32.865>So <00:10:33.065>eight <00:10:33.265>out <00:10:33.465>of <00:10:33.665>10 <00:10:33.865>times <00:10:34.065>gonna <00:10:34.265>work.

244
00:10:34.665 --> 00:10:37.765
<00:10:34.665>Two <00:10:34.781>out <00:10:34.898>of <00:10:35.015>10 <00:10:35.131>times <00:10:35.248>you <00:10:35.365>might <00:10:35.481>have <00:10:35.598>to <00:10:35.714>do <00:10:35.831>some <00:10:35.948>manual <00:10:36.064>work,

245
00:10:38.345 --> 00:10:39.485
<00:10:38.345>but <00:10:38.550>still <00:10:38.755>that's <00:10:38.960>a <00:10:39.165>lot <00:10:39.371>better.

246
00:10:39.485 --> 00:10:41.765
<00:10:39.485>That's <00:10:39.835>80% <00:10:40.185>of <00:10:40.535>time <00:10:40.885>saved.

247
00:10:43.335 --> 00:10:46.315
<00:10:43.335>Uh, <00:10:43.510>and <00:10:43.685>that's <00:10:43.860>basically <00:10:44.035>the <00:10:44.210>definition <00:10:44.385>of <00:10:44.560>technical <00:10:44.735>debt.

248
00:10:46.935 --> 00:10:50.835
<00:10:46.935>So, <00:10:47.109>um, <00:10:47.285>if <00:10:47.459>parts <00:10:47.635>of <00:10:47.810>your <00:10:47.984>code <00:10:48.160>are, <00:10:48.334>uh,

249
00:10:51.315 --> 00:10:52.395
<00:10:51.315>rewritten <00:10:51.801>very <00:10:52.287>frequently

250
00:10:52.455 --> 00:10:54.035
<00:10:52.455>and <00:10:52.735>lots <00:10:53.015>of <00:10:53.295>dependencies <00:10:53.575>around <00:10:53.855>it,

251
00:10:54.615 --> 00:10:57.155
<00:10:54.615>and, <00:10:54.790>uh, <00:10:54.965>it's <00:10:55.140>very <00:10:55.315>hard <00:10:55.490>to <00:10:55.665>change <00:10:55.840>something <00:10:56.015>fundamentally,

252
00:10:57.495 --> 00:10:58.555
<00:10:57.495>that's <00:10:57.972>technical <00:10:58.449>debt.

253
00:10:58.855 --> 00:11:02.235
<00:10:58.855>So, <00:10:59.010>uh, <00:10:59.166>by <00:10:59.321>not <00:10:59.477>being <00:10:59.632>able <00:10:59.788>to <00:10:59.943>keep <00:11:00.099>it, <00:11:00.255>uh,

254
00:11:02.375 --> 00:11:05.075
<00:11:02.375>at <00:11:02.575>the <00:11:02.775>newest <00:11:02.975>level, <00:11:03.175>you <00:11:03.375>pay <00:11:03.575>interest <00:11:03.775>on

255
00:11:05.315 --> 00:11:07.515
<00:11:05.315>that <00:11:05.665>badly <00:11:06.015>structured <00:11:06.365>code, <00:11:06.715>right?

256
00:11:07.855 --> 00:11:09.715
<00:11:07.855>And <00:11:08.088>there's <00:11:08.321>also <00:11:08.555>security <00:11:08.788>related <00:11:09.021>technical <00:11:09.255>debt.

257
00:11:09.715 --> 00:11:10.955
<00:11:09.715>There <00:11:09.938>might <00:11:10.161>be <00:11:10.384>a <00:11:10.607>new <00:11:10.831>technology

258
00:11:10.955 --> 00:11:13.475
<00:11:10.955>that <00:11:11.188>automatically <00:11:11.421>saves <00:11:11.655>you <00:11:11.888>from <00:11:12.121>certain <00:11:12.355>vulnerabilities

259
00:11:13.475 --> 00:11:14.955
<00:11:13.475>abilities, <00:11:13.808>but <00:11:14.141>you <00:11:14.474>cannot <00:11:14.807>upgrade

260
00:11:14.955 --> 00:11:16.715
<00:11:14.955>because <00:11:15.155>of <00:11:15.355>the <00:11:15.555>problems <00:11:15.755>that <00:11:15.955>I <00:11:16.155>mentioned <00:11:16.355>before.

261
00:11:17.695 --> 00:11:20.875
<00:11:17.695>Um, <00:11:17.870>so, <00:11:18.045>um, <00:11:18.220>that's <00:11:18.395>the <00:11:18.570>definition <00:11:18.745>of <00:11:18.920>technical <00:11:19.095>debt.

262
00:11:20.895 --> 00:11:22.315
<00:11:20.895>That's <00:11:21.150>also <00:11:21.406>term <00:11:21.661>that <00:11:21.917>we <00:11:22.173>need

263
00:11:22.315 --> 00:11:25.395
<00:11:22.315>to <00:11:22.490>understand <00:11:22.665>when <00:11:22.840>communicating, <00:11:23.015>uh, <00:11:23.190>with <00:11:23.365>the, <00:11:23.540>you <00:11:23.715>know,

264
00:11:25.395 --> 00:11:27.475
<00:11:25.395>your <00:11:25.569>team, <00:11:25.745>lead <00:11:25.920>with <00:11:26.095>your <00:11:26.270>organization <00:11:26.444>and <00:11:26.620>so <00:11:26.795>on.

265
00:11:29.325 --> 00:11:31.705
<00:11:29.325>Um, <00:11:29.500>we <00:11:29.675>also <00:11:29.850>have <00:11:30.025>to <00:11:30.200>be <00:11:30.375>able <00:11:30.550>to <00:11:30.725>distinguish

266
00:11:31.705 --> 00:11:33.905
<00:11:31.705>between <00:11:32.171>flaws <00:11:32.638>and <00:11:33.105>bugs.

267
00:11:34.845 --> 00:11:37.865
<00:11:34.845>Now, <00:11:35.020>a <00:11:35.195>buck <00:11:35.370>is <00:11:35.545>something <00:11:35.720>that's <00:11:35.895>related <00:11:36.070>to <00:11:36.245>implementation.

268
00:11:37.865 --> 00:11:40.345
<00:11:37.865>That's <00:11:38.040>mostly <00:11:38.215>today. <00:11:38.390>We're <00:11:38.565>mostly <00:11:38.740>gonna <00:11:38.915>talk <00:11:39.090>about <00:11:39.265>bugs,

269
00:11:40.885 --> 00:11:42.305
<00:11:40.885>but <00:11:41.204>there's <00:11:41.524>also <00:11:41.843>another <00:11:42.163>concept

270
00:11:42.605 --> 00:11:44.665
<00:11:42.605>of <00:11:42.838>a <00:11:43.071>weakness <00:11:43.305>in <00:11:43.538>terms <00:11:43.771>of <00:11:44.005>security.

271
00:11:44.665 --> 00:11:46.905
<00:11:44.665>That's <00:11:44.898>called <00:11:45.131>a <00:11:45.365>flaw. <00:11:45.598>Now <00:11:45.831>a <00:11:46.064>flaw,

272
00:11:47.325 --> 00:11:48.625
<00:11:47.325>the <00:11:47.617>only <00:11:47.910>difference <00:11:48.202>is <00:11:48.495>basically

273
00:11:48.625 --> 00:11:50.625
<00:11:48.625>that <00:11:48.825>the <00:11:49.025>flaw <00:11:49.225>happens <00:11:49.425>on <00:11:49.625>the <00:11:49.825>design <00:11:50.025>layer.

274
00:11:51.085 --> 00:11:53.925
<00:11:51.085>So <00:11:51.365>in <00:11:51.645>the <00:11:51.925>concept <00:11:52.205>phase, <00:11:52.485>um,

275
00:11:54.705 --> 00:11:57.525
<00:11:54.705>before <00:11:54.905>we <00:11:55.105>even <00:11:55.305>started <00:11:55.505>coding, <00:11:55.705>the <00:11:55.905>mistake <00:11:56.105>happened.

276
00:11:58.065 --> 00:11:59.565
<00:11:58.065>Now <00:11:58.402>the <00:11:58.740>Tacoma <00:11:59.077>Narrows <00:11:59.415>bridge

277
00:11:59.565 --> 00:12:00.685
<00:11:59.565>that <00:11:59.709>you <00:11:59.853>can <00:11:59.997>see <00:12:00.141>here <00:12:00.285>on <00:12:00.429>the <00:12:00.573>picture,

278
00:12:01.425 --> 00:12:02.645
<00:12:01.425>had <00:12:01.608>a <00:12:01.790>flaw <00:12:01.973>in <00:12:02.156>not <00:12:02.339>a <00:12:02.523>bug.

279
00:12:03.065 --> 00:12:05.285
<00:12:03.065>So <00:12:03.205>it <00:12:03.345>broke <00:12:03.485>down, <00:12:03.625>I <00:12:03.765>think <00:12:03.905>that <00:12:04.045>was <00:12:04.185>in <00:12:04.325>the <00:12:04.465>forties

280
00:12:05.425 --> 00:12:06.605
<00:12:05.425>or <00:12:05.602>so, <00:12:05.779>so <00:12:05.956>it's <00:12:06.133>pretty <00:12:06.310>long <00:12:06.487>ago.

281
00:12:06.605 --> 00:12:07.645
<00:12:06.605>You <00:12:06.738>can <00:12:06.872>see <00:12:07.006>it's <00:12:07.139>a <00:12:07.273>black <00:12:07.407>white <00:12:07.540>picture.

282
00:12:08.585 --> 00:12:11.125
<00:12:08.585>Um, <00:12:08.818>and <00:12:09.051>it, <00:12:09.285>it <00:12:09.518>didn't <00:12:09.751>break <00:12:09.985>down

283
00:12:11.125 --> 00:12:13.005
<00:12:11.125>because <00:12:11.358>there <00:12:11.591>was <00:12:11.825>a <00:12:12.058>screw <00:12:12.291>missing <00:12:12.525>anywhere.

284
00:12:13.065 --> 00:12:14.685
<00:12:13.065>It <00:12:13.298>didn't <00:12:13.531>break <00:12:13.765>down <00:12:13.998>because <00:12:14.231>the <00:12:14.465>concrete

285
00:12:14.705 --> 00:12:15.805
<00:12:14.705>was <00:12:14.903>mixed <00:12:15.101>in <00:12:15.299>the <00:12:15.497>wrong <00:12:15.694>way.

286
00:12:15.825 --> 00:12:16.845
<00:12:15.825>It <00:12:16.054>didn't <00:12:16.284>break <00:12:16.513>down <00:12:16.743>because,

287
00:12:16.995 --> 00:12:19.605
<00:12:16.995>because <00:12:17.275>one <00:12:17.555>of <00:12:17.835>those <00:12:18.115>wires <00:12:18.395>broke

288
00:12:19.625 --> 00:12:21.285
<00:12:19.625>or <00:12:19.858>anything <00:12:20.091>like <00:12:20.325>that, <00:12:20.558>it <00:12:20.791>broke <00:12:21.025>down

289
00:12:21.285 --> 00:12:25.405
<00:12:21.285>because <00:12:21.440>it <00:12:21.596>was <00:12:21.751>not <00:12:21.907>conceptually <00:12:22.062>made <00:12:22.218>for <00:12:22.373>the <00:12:22.529>strong <00:12:22.685>winds

290
00:12:25.405 --> 00:12:26.885
<00:12:25.405>that <00:12:25.627>were <00:12:25.848>blowing <00:12:26.071>through <00:12:26.293>this <00:12:26.515>valley <00:12:26.737>here.

291
00:12:27.585 --> 00:12:30.085
<00:12:27.585>So <00:12:27.760>the <00:12:27.935>error <00:12:28.110>didn't <00:12:28.285>happen <00:12:28.460>on <00:12:28.635>the <00:12:28.810>implementation <00:12:28.985>layer,

292
00:12:30.105 --> 00:12:33.085
<00:12:30.105>so <00:12:30.305>people <00:12:30.505>constructing <00:12:30.705>the <00:12:30.905>bridge, <00:12:31.105>but <00:12:31.305>it <00:12:31.505>happened

293
00:12:33.085 --> 00:12:35.885
<00:12:33.085>before <00:12:33.260>when <00:12:33.435>people <00:12:33.610>made <00:12:33.785>the <00:12:33.960>concept <00:12:34.135>and <00:12:34.310>the <00:12:34.485>design

294
00:12:35.885 --> 00:12:37.205
<00:12:35.885>and <00:12:36.122>the <00:12:36.360>architecture <00:12:36.597>of <00:12:36.835>the <00:12:37.073>bridge.

295
00:12:37.785 --> 00:12:39.925
<00:12:37.785>So <00:12:37.912>this <00:12:38.039>is <00:12:38.166>a <00:12:38.294>flaw, <00:12:38.421>this <00:12:38.548>is <00:12:38.675>the <00:12:38.803>definition <00:12:38.930>of <00:12:39.057>a <00:12:39.185>flaw.

296
00:12:40.065 --> 00:12:42.685
<00:12:40.065>And <00:12:40.192>the <00:12:40.319>bug <00:12:40.446>would <00:12:40.574>be, <00:12:40.701>I <00:12:40.828>forgot <00:12:40.955>to <00:12:41.083>put <00:12:41.210>in <00:12:41.337>the <00:12:41.465>screw

297
00:12:42.685 --> 00:12:44.325
<00:12:42.685>and <00:12:42.918>it <00:12:43.151>broke <00:12:43.385>exactly <00:12:43.618>at <00:12:43.851>that <00:12:44.084>place.

298
00:12:44.465 --> 00:12:48.335
<00:12:44.465>And <00:12:44.665>the <00:12:44.865>bridge <00:12:45.065>breaks <00:12:45.265>down <00:12:45.465>important <00:12:45.665>to <00:12:45.865>distinguish,

299
00:12:49.515 --> 00:12:54.055
<00:12:49.515>um, <00:12:49.715>some <00:12:49.915>security <00:12:50.115>principles <00:12:50.314>that, <00:12:50.515>uh, <00:12:50.715>everything <00:12:50.915>relates

300
00:12:54.055 --> 00:12:55.495
<00:12:54.055>to <00:12:54.271>everything <00:12:54.487>that <00:12:54.703>we <00:12:54.919>do <00:12:55.135>in <00:12:55.351>security,

301
00:12:56.155 --> 00:12:59.175
<00:12:56.155>be <00:12:56.388>it <00:12:56.621>fine <00:12:56.855>vulnerabilities, <00:12:57.088>fixing <00:12:57.321>them, <00:12:57.555>uh,

302
00:12:59.345 --> 00:13:00.735
<00:12:59.345>automation <00:12:59.762>and <00:13:00.179>so <00:13:00.596>on.

303
00:13:01.525 --> 00:13:04.895
<00:13:01.525>When <00:13:01.758>I <00:13:01.991>categorize <00:13:02.225>weaknesses <00:13:02.458>in <00:13:02.691>software, <00:13:02.925>then

304
00:13:05.525 --> 00:13:07.815
<00:13:05.525>they <00:13:05.758>all <00:13:05.991>boil <00:13:06.225>down <00:13:06.458>to <00:13:06.691>those <00:13:06.925>principles.

305
00:13:08.395 --> 00:13:09.615
<00:13:08.395>The <00:13:08.761>first <00:13:09.127>one's <00:13:09.493>confidentiality.

306
00:13:09.775 --> 00:13:13.455
<00:13:09.775>I <00:13:09.891>don't <00:13:10.008>want <00:13:10.125>anybody <00:13:10.241>else <00:13:10.358>to <00:13:10.475>be <00:13:10.591>able <00:13:10.708>to <00:13:10.824>read <00:13:10.941>or <00:13:11.058>see <00:13:11.175>data.

307
00:13:14.035 --> 00:13:17.455
<00:13:14.035>For <00:13:14.235>example, <00:13:14.435>I <00:13:14.635>have <00:13:14.834>personal <00:13:15.035>identifiable <00:13:15.235>information <00:13:15.435>stored

308
00:13:17.555 --> 00:13:19.215
<00:13:17.555>in <00:13:17.834>an <00:13:18.114>app <00:13:18.395>that's <00:13:18.675>stored <00:13:18.954>somewhere

309
00:13:19.215 --> 00:13:20.255
<00:13:19.215>in <00:13:19.402>the <00:13:19.589>database, <00:13:19.776>in <00:13:19.963>the <00:13:20.151>backend.

310
00:13:20.815 --> 00:13:23.215
<00:13:20.815>I <00:13:20.942>don't <00:13:21.069>want <00:13:21.196>anybody <00:13:21.324>else <00:13:21.451>to <00:13:21.578>read <00:13:21.705>to <00:13:21.833>be <00:13:21.960>able <00:13:22.087>to <00:13:22.215>see

311
00:13:23.215 --> 00:13:25.015
<00:13:23.215>that <00:13:23.448>data <00:13:23.681>because <00:13:23.915>it's <00:13:24.148>my <00:13:24.381>private <00:13:24.615>data.

312
00:13:25.135 --> 00:13:26.175
<00:13:25.135>That's <00:13:26.070>confidentiality.

313
00:13:26.565 --> 00:13:30.495
<00:13:26.565>Integrity <00:13:26.692>is <00:13:26.819>also <00:13:26.946>a <00:13:27.074>type <00:13:27.201>of, <00:13:27.328>uh, <00:13:27.455>access <00:13:27.583>that <00:13:27.710>I <00:13:27.837>don't <00:13:27.965>want.

314
00:13:30.635 --> 00:13:33.095
<00:13:30.635>So <00:13:30.985>integrity <00:13:31.335>is, <00:13:31.685>that's <00:13:32.035>one.

315
00:13:33.095 --> 00:13:35.815
<00:13:33.095>Integrity <00:13:33.375>is <00:13:33.655>an, <00:13:33.935>um, <00:13:34.215>a <00:13:34.495>property

316
00:13:35.815 --> 00:13:38.495
<00:13:35.815>that <00:13:36.048>I <00:13:36.281>cannot <00:13:36.515>change <00:13:36.748>the <00:13:36.981>data, <00:13:37.215>right?

317
00:13:38.875 --> 00:13:41.095
<00:13:38.875>Unless <00:13:39.050>I <00:13:39.225>have <00:13:39.400>the <00:13:39.575>explicit <00:13:39.750>permission <00:13:39.925>to <00:13:40.100>do <00:13:40.275>so.

318
00:13:41.875 --> 00:13:45.615
<00:13:41.875>Um, <00:13:42.015>so <00:13:42.155>if <00:13:42.295>somebody <00:13:42.435>else <00:13:42.575>is <00:13:42.715>able <00:13:42.855>to, <00:13:42.995>to <00:13:43.135>manipulate <00:13:43.275>data

319
00:13:45.615 --> 00:13:47.615
<00:13:45.615>that <00:13:45.815>our <00:13:46.015>data, <00:13:46.215>they're <00:13:46.415>not <00:13:46.615>supposed <00:13:46.815>to <00:13:47.015>write,

320
00:13:47.795 --> 00:13:49.295
<00:13:47.795>that's <00:13:48.245>an <00:13:48.694>integrity <00:13:49.145>breach.

321
00:13:50.075 --> 00:13:52.935
<00:13:50.075>And <00:13:50.250>then <00:13:50.425>there's <00:13:50.600>a <00:13:50.775>third <00:13:50.950>one <00:13:51.125>that's <00:13:51.300>sometimes <00:13:51.475>not

322
00:13:52.955 --> 00:13:55.495
<00:13:52.955>so <00:13:53.421>classically, <00:13:53.888>um, <00:13:54.355>attached

323
00:13:55.515 --> 00:13:58.455
<00:13:55.515>to <00:13:55.642>the <00:13:55.769>security <00:13:55.896>world <00:13:56.024>is <00:13:56.151>I <00:13:56.278>want <00:13:56.405>the <00:13:56.533>system <00:13:56.660>to <00:13:56.787>be <00:13:56.915>available.

324
00:13:58.555 --> 00:14:01.055
<00:13:58.555>If <00:13:58.682>a <00:13:58.809>system <00:13:58.936>goes <00:13:59.064>down, <00:13:59.191>I <00:13:59.318>have <00:13:59.445>a <00:13:59.573>security <00:13:59.700>problem <00:13:59.827>as <00:13:59.954>well.

325
00:14:01.215 --> 00:14:03.975
<00:14:01.215>I <00:14:01.370>denial <00:14:01.526>service <00:14:01.681>attack <00:14:01.837>is <00:14:01.992>a <00:14:02.148>security <00:14:02.303>problem <00:14:02.459>as <00:14:02.615>well.

326
00:14:04.895 --> 00:14:07.655
<00:14:04.895>Nobody's <00:14:05.022>gonna <00:14:05.149>be <00:14:05.276>able <00:14:05.404>to <00:14:05.531>read <00:14:05.658>the <00:14:05.785>data <00:14:05.913>of <00:14:06.040>the <00:14:06.167>system <00:14:06.295>just

327
00:14:07.655 --> 00:14:09.175
<00:14:07.655>because <00:14:07.850>they <00:14:08.045>do <00:14:08.241>a <00:14:08.436>denial <00:14:08.632>of <00:14:08.827>service <00:14:09.022>attack,

328
00:14:09.195 --> 00:14:11.615
<00:14:09.195>but <00:14:09.428>still <00:14:09.661>it <00:14:09.895>is <00:14:10.128>a <00:14:10.361>security <00:14:10.595>problem.

329
00:14:12.875 --> 00:14:16.415
<00:14:12.875>Um, <00:14:13.075>some <00:14:13.275>other, <00:14:13.475>uh, <00:14:13.675>core <00:14:13.875>security <00:14:14.075>concepts, <00:14:14.275>authentication.

330
00:14:16.535 --> 00:14:19.815
<00:14:16.535>I <00:14:16.690>only <00:14:16.846>want <00:14:17.001>to <00:14:17.157>see, <00:14:17.312>um, <00:14:17.468>people <00:14:17.623>in <00:14:17.779>my <00:14:17.935>system

331
00:14:19.815 --> 00:14:22.655
<00:14:19.815>that <00:14:19.970>have <00:14:20.126>authenticated, <00:14:20.281>so <00:14:20.437>they <00:14:20.592>have <00:14:20.748>proven <00:14:20.903>that <00:14:21.059>they <00:14:21.215>are

332
00:14:23.355 --> 00:14:24.535
<00:14:23.355>who <00:14:23.620>they <00:14:23.886>claim <00:14:24.151>to <00:14:24.416>be.

333
00:14:24.755 --> 00:14:26.535
<00:14:24.755>So <00:14:25.035>for <00:14:25.314>example, <00:14:25.595>with <00:14:25.875>username, <00:14:26.155>password,

334
00:14:26.535 --> 00:14:29.815
<00:14:26.535>and <00:14:26.885>multifactor <00:14:27.235>authentication, <00:14:27.584>that's <00:14:27.935>authentication.

335
00:14:29.925 --> 00:14:32.375
<00:14:29.925>Then <00:14:30.099>we <00:14:30.275>have <00:14:30.449>authorization. <00:14:30.625>That's <00:14:30.800>not <00:14:30.974>the <00:14:31.150>same <00:14:31.324>thing.

336
00:14:32.485 --> 00:14:33.655
<00:14:32.485>It's <00:14:32.836>two <00:14:33.187>different <00:14:33.538>concepts.

337
00:14:33.805 --> 00:14:36.895
<00:14:33.805>Authorization <00:14:34.005>means <00:14:34.204>I, <00:14:34.405>I <00:14:34.604>have <00:14:34.805>already <00:14:35.005>logged <00:14:35.204>in.

338
00:14:37.075 --> 00:14:38.375
<00:14:37.075>The <00:14:37.309>system <00:14:37.543>knows <00:14:37.777>who <00:14:38.011>I <00:14:38.245>am,

339
00:14:39.035 --> 00:14:40.415
<00:14:39.035>and <00:14:39.656>authorization <00:14:40.276>means

340
00:14:40.975 --> 00:14:42.855
<00:14:40.975>I <00:14:41.150>can <00:14:41.325>only <00:14:41.500>access <00:14:41.675>the <00:14:41.850>parts <00:14:42.025>of <00:14:42.200>the <00:14:42.375>application.

341
00:14:42.975 --> 00:14:45.815
<00:14:42.975>I <00:14:43.150>can <00:14:43.325>only, <00:14:43.500>uh, <00:14:43.675>access <00:14:43.850>the <00:14:44.025>data <00:14:44.200>inside <00:14:44.375>application

342
00:14:45.845 --> 00:14:50.655
<00:14:45.845>that <00:14:45.985>I <00:14:46.125>have <00:14:46.265>explicit, <00:14:46.405>uh, <00:14:46.545>privileges <00:14:46.685>to, <00:14:46.825>to <00:14:46.965>read <00:14:47.105>and <00:14:47.245>write.

343
00:14:50.875 --> 00:14:54.525
<00:14:50.875>So <00:14:51.030>authorization <00:14:51.186>is <00:14:51.341>what <00:14:51.497>can <00:14:51.652>I <00:14:51.808>see <00:14:51.963>inside <00:14:52.119>the <00:14:52.275>application?

344
00:14:54.525 --> 00:14:58.125
<00:14:54.525>Application? <00:14:54.680>Who <00:14:54.836>am <00:14:54.991>I, <00:14:55.147>I <00:14:55.302>have <00:14:55.458>to <00:14:55.613>prove <00:14:55.769>myself <00:14:55.925>authorization.

345
00:14:58.555 --> 00:14:59.605
<00:14:58.555>What <00:14:58.870>data, <00:14:59.185>what <00:14:59.500>parts

346
00:14:59.605 --> 00:15:01.125
<00:14:59.605>of <00:14:59.800>the <00:14:59.995>application <00:15:00.191>do <00:15:00.386>I <00:15:00.582>have <00:15:00.777>access <00:15:00.973>to?

347
00:15:02.395 --> 00:15:03.725
<00:15:02.395>There's <00:15:02.993>also <00:15:03.592>accountability.

348
00:15:04.305 --> 00:15:07.645
<00:15:04.305>So <00:15:04.444>when <00:15:04.584>I <00:15:04.724>have, <00:15:04.864>for <00:15:05.005>example, <00:15:05.145>we <00:15:05.285>are <00:15:05.425>creating <00:15:05.564>an <00:15:05.704>application

349
00:15:07.645 --> 00:15:10.485
<00:15:07.645>that <00:15:07.878>has <00:15:08.111>very <00:15:08.345>sensitive <00:15:08.578>data <00:15:08.811>inside, <00:15:09.045>um,

350
00:15:10.665 --> 00:15:12.485
<00:15:10.665>and <00:15:10.944>people <00:15:11.224>access <00:15:11.505>the <00:15:11.785>data, <00:15:12.064>read

351
00:15:12.485 --> 00:15:15.045
<00:15:12.485>or <00:15:12.765>write <00:15:13.045>access, <00:15:13.325>I <00:15:13.605>want <00:15:13.885>accountability.

352
00:15:15.265 --> 00:15:19.085
<00:15:15.265>So <00:15:15.405>that <00:15:15.545>boils <00:15:15.685>down <00:15:15.824>to, <00:15:15.965>for <00:15:16.105>example, <00:15:16.245>writing <00:15:16.385>into <00:15:16.525>a <00:15:16.665>log,

353
00:15:19.185 --> 00:15:22.485
<00:15:19.185>who <00:15:19.324>access <00:15:19.464>the <00:15:19.604>data <00:15:19.744>which <00:15:19.885>way, <00:15:20.025>when <00:15:20.165>from <00:15:20.305>which <00:15:20.444>device <00:15:20.584>so

354
00:15:22.485 --> 00:15:24.925
<00:15:22.485>that, <00:15:22.640>uh, <00:15:22.796>they <00:15:22.951>can <00:15:23.107>be <00:15:23.262>held <00:15:23.418>accountable <00:15:23.573>if <00:15:23.729>they <00:15:23.885>change

355
00:15:24.925 --> 00:15:26.805
<00:15:24.925>something <00:15:25.158>that <00:15:25.391>they're <00:15:25.625>supposed <00:15:25.858>to <00:15:26.091>be <00:15:26.324>changing.

356
00:15:27.345 --> 00:15:28.445
<00:15:27.345>So <00:15:27.840>that's <00:15:28.335>accountability.

357
00:15:30.585 --> 00:15:35.325
<00:15:30.585>Um, <00:15:30.760>let's <00:15:30.935>talk <00:15:31.110>about <00:15:31.285>also <00:15:31.460>a <00:15:31.635>few <00:15:31.810>security <00:15:31.985>principles

358
00:15:35.795 --> 00:15:37.565
<00:15:35.795>that <00:15:36.145>are <00:15:36.495>related <00:15:36.844>to <00:15:37.194>design.

359
00:15:37.625 --> 00:15:39.285
<00:15:37.625>So <00:15:37.975>not <00:15:38.325>implementation, <00:15:38.675>but <00:15:39.025>before.

360
00:15:39.305 --> 00:15:41.925
<00:15:39.305>So <00:15:39.538>in <00:15:39.771>the <00:15:40.005>architecture <00:15:40.238>phase, <00:15:40.471>um, <00:15:40.704>so

361
00:15:41.925 --> 00:15:44.205
<00:15:41.925>that <00:15:42.064>we <00:15:42.204>all <00:15:42.344>understand <00:15:42.484>them, <00:15:42.625>we <00:15:42.765>all <00:15:42.905>know <00:15:43.045>what <00:15:43.185>they <00:15:43.324>mean.

362
00:15:45.095 --> 00:15:49.125
<00:15:45.095>These <00:15:45.295>privileged <00:15:45.495>first <00:15:45.695>one <00:15:45.895>least <00:15:46.095>privilege <00:15:46.295>means, <00:15:46.495>um,

363
00:15:49.765 --> 00:15:53.485
<00:15:49.765>a <00:15:49.965>person, <00:15:50.165>a <00:15:50.365>role, <00:15:50.564>a <00:15:50.765>process, <00:15:50.965>whichever <00:15:51.165>layer

364
00:15:54.185 --> 00:15:57.645
<00:15:54.185>has <00:15:54.385>the <00:15:54.584>least <00:15:54.785>possible <00:15:54.984>principle, <00:15:55.185>uh, <00:15:55.385>privileges <00:15:55.584>so

365
00:15:57.645 --> 00:15:59.165
<00:15:57.645>that <00:15:57.872>they <00:15:58.101>can <00:15:58.329>still <00:15:58.557>do <00:15:58.785>their <00:15:59.012>job

366
00:15:59.865 --> 00:16:01.245
<00:15:59.865>on <00:16:00.175>the <00:16:00.486>operating <00:16:00.796>system <00:16:01.107>level.

367
00:16:01.245 --> 00:16:03.685
<00:16:01.245>That <00:16:01.385>would <00:16:01.525>mean <00:16:01.665>that <00:16:01.805>the <00:16:01.945>web <00:16:02.085>server <00:16:02.225>is, <00:16:02.365>is <00:16:02.505>not <00:16:02.645>running

368
00:16:03.705 --> 00:16:05.805
<00:16:03.705>as <00:16:03.880>root, <00:16:04.055>but <00:16:04.230>it's <00:16:04.405>running <00:16:04.580>as <00:16:04.755>a <00:16:04.930>separate <00:16:05.105>user

369
00:16:05.805 --> 00:16:09.285
<00:16:05.805>that <00:16:05.960>only <00:16:06.116>can <00:16:06.271>see <00:16:06.427>its <00:16:06.582>own <00:16:06.738>directory <00:16:06.893>where, <00:16:07.049>uh, <00:16:07.204>the,

370
00:16:09.385 --> 00:16:11.125
<00:16:09.385>the <00:16:09.665>web <00:16:09.944>server <00:16:10.225>files <00:16:10.505>are <00:16:10.785>located.

371
00:16:11.825 --> 00:16:13.645
<00:16:11.825>On <00:16:12.000>a <00:16:12.175>personal <00:16:12.350>level, <00:16:12.525>it <00:16:12.700>could <00:16:12.875>mean <00:16:13.050>that <00:16:13.225>I

372
00:16:13.645 --> 00:16:17.725
<00:16:13.645>as <00:16:13.785>a <00:16:13.925>person <00:16:14.064>only <00:16:14.204>have <00:16:14.345>access <00:16:14.485>to <00:16:14.625>the <00:16:14.765>files <00:16:14.905>of <00:16:15.045>projects

373
00:16:17.725 --> 00:16:19.365
<00:16:17.725>that <00:16:17.958>I'm <00:16:18.191>working <00:16:18.425>in <00:16:18.658>and <00:16:18.891>not <00:16:19.125>any,

374
00:16:19.785 --> 00:16:21.925
<00:16:19.785>all <00:16:20.135>the <00:16:20.485>other <00:16:20.834>projects, <00:16:21.185>right?

375
00:16:21.925 --> 00:16:23.245
<00:16:21.925>So <00:16:22.222>this <00:16:22.519>is <00:16:22.816>lease <00:16:23.113>privilege.

376
00:16:24.225 --> 00:16:27.525
<00:16:24.225>Um, <00:16:24.400>separation <00:16:24.575>of <00:16:24.750>duties <00:16:24.925>is <00:16:25.100>somewhat <00:16:25.275>related <00:16:25.450>to <00:16:25.625>this.

377
00:16:28.025 --> 00:16:29.325
<00:16:28.025>Um, <00:16:28.259>it <00:16:28.493>means <00:16:28.727>that, <00:16:28.961>for <00:16:29.195>example,

378
00:16:29.385 --> 00:16:32.205
<00:16:29.385>if <00:16:29.540>I <00:16:29.696>have <00:16:29.851>a <00:16:30.007>very <00:16:30.162>high <00:16:30.318>profile <00:16:30.473>transaction <00:16:30.629>to <00:16:30.785>do,

379
00:16:32.225 --> 00:16:34.645
<00:16:32.225>for <00:16:32.400>example, <00:16:32.575>I <00:16:32.750>have <00:16:32.925>to <00:16:33.100>transfer <00:16:33.275>lots <00:16:33.450>of <00:16:33.625>money

380
00:16:34.645 --> 00:16:38.845
<00:16:34.645>to <00:16:34.800>another <00:16:34.956>account, <00:16:35.111>um, <00:16:35.267>that <00:16:35.422>starting <00:16:35.578>from <00:16:35.733>a <00:16:35.889>certain <00:16:36.045>level,

381
00:16:38.945 --> 00:16:42.645
<00:16:38.945>it <00:16:39.145>needs <00:16:39.345>two <00:16:39.545>people <00:16:39.745>that <00:16:39.945>approve <00:16:40.145>the <00:16:40.345>transaction.

382
00:16:42.705 --> 00:16:44.845
<00:16:42.705>So <00:16:42.905>that <00:16:43.105>one <00:16:43.305>single <00:16:43.505>person <00:16:43.705>cannot <00:16:43.905>do <00:16:44.105>it

383
00:16:45.215 --> 00:16:46.565
<00:16:45.215>above <00:16:45.458>a <00:16:45.701>certain <00:16:45.944>level, <00:16:46.187>for <00:16:46.430>example.

384
00:16:46.565 --> 00:16:48.205
<00:16:46.565>That's <00:16:46.765>a, <00:16:46.965>that's <00:16:47.165>an <00:16:47.365>example <00:16:47.565>of <00:16:47.765>separation <00:16:47.965>duties.

385
00:16:48.915 --> 00:16:51.845
<00:16:48.915>Defense <00:16:49.042>in <00:16:49.169>depth <00:16:49.296>means <00:16:49.424>that <00:16:49.551>I <00:16:49.678>don't <00:16:49.805>have <00:16:49.933>any, <00:16:50.060>only <00:16:50.187>one <00:16:50.314>layer

386
00:16:51.905 --> 00:16:55.605
<00:16:51.905>of, <00:16:52.079>um, <00:16:52.255>of <00:16:52.430>defense, <00:16:52.605>but <00:16:52.780>multiple <00:16:52.954>layers <00:16:53.130>of <00:16:53.305>defense.

387
00:16:55.955 --> 00:16:59.005
<00:16:55.955>Basically <00:16:56.110>a <00:16:56.266>castle <00:16:56.421>with <00:16:56.577>not, <00:16:56.732>with <00:16:56.888>not <00:16:57.043>just <00:16:57.199>one <00:16:57.355>wall,

388
00:16:59.005 --> 00:17:01.925
<00:16:59.005>but <00:16:59.238>multiple <00:16:59.471>walls, <00:16:59.705>um, <00:16:59.938>to <00:17:00.171>the <00:17:00.405>inside.

389
00:17:02.045 --> 00:17:04.845
<00:17:02.045>A <00:17:02.185>classic <00:17:02.324>example <00:17:02.464>of <00:17:02.604>this <00:17:02.745>would <00:17:02.885>be <00:17:03.025>if <00:17:03.165>you, <00:17:03.305>you <00:17:03.444>know,

390
00:17:04.845 --> 00:17:06.205
<00:17:04.845>you're <00:17:05.151>writing <00:17:05.456>a <00:17:05.762>web <00:17:06.069>application

391
00:17:06.385 --> 00:17:08.365
<00:17:06.385>and <00:17:06.618>defense <00:17:06.851>in <00:17:07.085>depth <00:17:07.318>would <00:17:07.551>be, <00:17:07.785>uh,

392
00:17:08.365 --> 00:17:10.285
<00:17:08.365>implementing <00:17:08.714>a <00:17:09.065>content <00:17:09.415>security <00:17:09.765>policy

393
00:17:10.385 --> 00:17:12.645
<00:17:10.385>that's <00:17:10.585>defense <00:17:10.785>in <00:17:10.984>depth <00:17:11.185>against <00:17:11.385>cross <00:17:11.585>side <00:17:11.785>scripting.

394
00:17:12.905 --> 00:17:14.365
<00:17:12.905>You <00:17:13.167>can <00:17:13.430>google <00:17:13.693>content <00:17:13.956>security <00:17:14.219>policy.

395
00:17:14.365 --> 00:17:17.005
<00:17:14.365>That's <00:17:14.565>a <00:17:14.765>very <00:17:14.964>classic <00:17:15.165>defense <00:17:15.365>in <00:17:15.565>depth, <00:17:15.765>uh,

396
00:17:17.115 --> 00:17:18.925
<00:17:17.115>fail <00:17:17.464>secure <00:17:17.815>versus <00:17:18.165>fail <00:17:18.515>safe.

397
00:17:19.745 --> 00:17:22.725
<00:17:19.744>Um, <00:17:19.978>so <00:17:20.211>there's <00:17:20.444>a <00:17:20.678>versus <00:17:20.911>in <00:17:21.145>between.

398
00:17:22.725 --> 00:17:24.885
<00:17:22.724>So <00:17:23.074>they <00:17:23.425>are <00:17:23.774>sometimes <00:17:24.125>contradictory.

399
00:17:25.705 --> 00:17:30.125
<00:17:25.704>Um, <00:17:25.845>so <00:17:25.984>one <00:17:26.125>physical <00:17:26.264>example <00:17:26.405>would <00:17:26.544>be, <00:17:26.685>say <00:17:26.824>I <00:17:26.964>have, <00:17:27.105>um,

400
00:17:30.645 --> 00:17:32.805
<00:17:30.645>a <00:17:30.785>room <00:17:30.925>with <00:17:31.065>servers <00:17:31.205>and <00:17:31.345>there's <00:17:31.485>all <00:17:31.625>my <00:17:31.764>data <00:17:31.905>on <00:17:32.045>it,

401
00:17:33.145 --> 00:17:35.685
<00:17:33.145>and <00:17:33.345>I <00:17:33.545>have, <00:17:33.745>uh, <00:17:33.945>electronic <00:17:34.145>doors <00:17:34.345>that <00:17:34.545>open

402
00:17:36.075 --> 00:17:38.045
<00:17:36.075>with <00:17:36.355>a <00:17:36.635>biometric <00:17:36.915>system, <00:17:37.195>for <00:17:37.475>example,

403
00:17:38.625 --> 00:17:41.325
<00:17:38.625>and <00:17:38.905>say, <00:17:39.185>um, <00:17:39.465>electricity <00:17:39.745>goes <00:17:40.025>down.

404
00:17:41.665 --> 00:17:44.565
<00:17:41.665>What's <00:17:41.820>gonna <00:17:41.976>happen <00:17:42.131>with <00:17:42.287>the <00:17:42.442>door? <00:17:42.598>Is <00:17:42.753>it <00:17:42.909>gonna <00:17:43.065>open?

405
00:17:44.745 --> 00:17:48.165
<00:17:44.745>That's <00:17:44.885>fail <00:17:45.024>safe? <00:17:45.165>Is <00:17:45.304>it <00:17:45.445>gonna <00:17:45.584>close? <00:17:45.725>Is <00:17:45.864>that's <00:17:46.004>fail <00:17:46.145>secure?

406
00:17:48.865 --> 00:17:51.125
<00:17:48.865>Um, <00:17:49.040>so <00:17:49.215>there, <00:17:49.390>there <00:17:49.565>are <00:17:49.740>solutions <00:17:49.915>to <00:17:50.090>this <00:17:50.265>problem

407
00:17:51.225 --> 00:17:53.525
<00:17:51.225>and <00:17:51.365>to, <00:17:51.504>to <00:17:51.645>this <00:17:51.784>concrete <00:17:51.925>problem <00:17:52.064>that <00:17:52.205>I'm <00:17:52.344>saying <00:17:52.485>right <00:17:52.625>now.

408
00:17:53.865 --> 00:17:56.205
<00:17:53.865>But <00:17:53.992>just <00:17:54.119>to <00:17:54.246>give <00:17:54.374>you <00:17:54.501>the, <00:17:54.628>an <00:17:54.755>idea <00:17:54.883>of <00:17:55.010>what's <00:17:55.137>the <00:17:55.265>difference

409
00:17:57.315 --> 00:17:58.645
<00:17:57.315>economy <00:17:57.913>of <00:17:58.512>mechanisms,

410
00:17:58.645 --> 00:18:00.605
<00:17:58.645>that's <00:17:58.925>my <00:17:59.205>favorite <00:17:59.485>design <00:17:59.764>security <00:18:00.045>concept.

411
00:18:00.825 --> 00:18:03.205
<00:18:00.825>It <00:18:01.058>basically <00:18:01.291>says, <00:18:01.525>says, <00:18:01.758>keep <00:18:01.991>it <00:18:02.225>simple.

412
00:18:03.825 --> 00:18:07.365
<00:18:03.825>The <00:18:03.952>more <00:18:04.079>complex <00:18:04.206>a <00:18:04.334>system, <00:18:04.461>the <00:18:04.588>more <00:18:04.715>prone <00:18:04.843>to <00:18:04.970>error <00:18:05.097>it <00:18:05.225>is.

413
00:18:08.455 --> 00:18:11.275
<00:18:08.455>Uh, <00:18:08.610>on <00:18:08.766>the <00:18:08.921>other <00:18:09.077>hand, <00:18:09.232>that <00:18:09.388>means <00:18:09.543>that, <00:18:09.699>uh, <00:18:09.855>hygiene

414
00:18:12.035 --> 00:18:15.315
<00:18:12.035>measures, <00:18:12.210>throwing <00:18:12.385>away <00:18:12.560>codes <00:18:12.735>that <00:18:12.910>I <00:18:13.085>don't <00:18:13.260>need <00:18:13.435>anymore,

415
00:18:15.995 --> 00:18:19.035
<00:18:15.995>throwing <00:18:16.169>away <00:18:16.344>systems <00:18:16.520>that <00:18:16.695>I'm <00:18:16.870>not <00:18:17.044>using <00:18:17.219>anymore, <00:18:17.395>um,

416
00:18:19.295 --> 00:18:20.475
<00:18:19.295>is <00:18:19.560>something <00:18:19.826>that's <00:18:20.091>very <00:18:20.357>important.

417
00:18:20.585 --> 00:18:24.435
<00:18:20.585>Because <00:18:20.818>the, <00:18:21.051>the <00:18:21.285>longer <00:18:21.518>I <00:18:21.751>change <00:18:21.985>software

418
00:18:24.945 --> 00:18:27.315
<00:18:24.945>evolves <00:18:25.178>software, <00:18:25.411>the <00:18:25.645>less <00:18:25.878>satisfactory <00:18:26.111>it's <00:18:26.345>gonna,

419
00:18:27.385 --> 00:18:29.635
<00:18:27.385>it's <00:18:27.560>gonna <00:18:27.735>be <00:18:27.910>'cause <00:18:28.085>it's <00:18:28.260>gonna <00:18:28.435>be <00:18:28.610>more <00:18:28.785>complex.

420
00:18:29.635 --> 00:18:31.235
<00:18:29.635>There <00:18:29.915>are <00:18:30.195>fewer <00:18:30.475>people <00:18:30.754>who <00:18:31.035>understand

421
00:18:31.975 --> 00:18:33.595
<00:18:31.975>and <00:18:32.441>understanding <00:18:32.908>is <00:18:33.375>key

422
00:18:33.615 --> 00:18:35.315
<00:18:33.615>to <00:18:33.848>assessing <00:18:34.081>the <00:18:34.315>security <00:18:34.548>of <00:18:34.781>the <00:18:35.015>system.

423
00:18:35.535 --> 00:18:38.995
<00:18:35.535>So <00:18:35.735>keep <00:18:35.935>it <00:18:36.135>simple. <00:18:36.335>Uh, <00:18:36.535>throw <00:18:36.735>away <00:18:36.935>stuff

424
00:18:38.995 --> 00:18:40.795
<00:18:38.995>that's <00:18:39.344>really <00:18:39.695>deleting <00:18:40.044>code <00:18:40.395>is

425
00:18:40.795 --> 00:18:43.475
<00:18:40.795>among <00:18:41.028>my <00:18:41.261>favorite <00:18:41.495>actions <00:18:41.728>in <00:18:41.961>software <00:18:42.195>development.

426
00:18:43.995 --> 00:18:45.755
<00:18:43.995>I <00:18:44.195>love <00:18:44.395>deleting <00:18:44.594>stuff <00:18:44.794>I <00:18:44.995>don't <00:18:45.195>need <00:18:45.395>anymore.

427
00:18:46.035 --> 00:18:47.475
<00:18:46.035>I <00:18:46.220>like <00:18:46.405>to <00:18:46.590>keep <00:18:46.775>it <00:18:46.960>simple <00:18:47.145>and <00:18:47.331>small.

428
00:18:48.935 --> 00:18:50.675
<00:18:48.935>Uh, <00:18:49.215>the <00:18:49.495>principle <00:18:49.774>of <00:18:50.054>complete <00:18:50.335>mediation,

429
00:18:50.725 --> 00:18:52.555
<00:18:50.725>we're <00:18:50.899>gonna <00:18:51.074>dive <00:18:51.250>a <00:18:51.425>bit <00:18:51.600>deeper <00:18:51.774>into <00:18:51.949>this <00:18:52.125>one.

430
00:18:52.615 --> 00:18:55.315
<00:18:52.615>Uh, <00:18:52.790>as <00:18:52.965>one <00:18:53.140>of <00:18:53.315>the <00:18:53.490>zq <00:18:53.665>coding <00:18:53.840>practices <00:18:54.015>later,

431
00:18:56.015 --> 00:18:58.195
<00:18:56.015>it <00:18:56.248>means <00:18:56.481>access <00:18:56.715>control <00:18:56.948>at <00:18:57.181>every <00:18:57.415>request.

432
00:18:58.455 --> 00:19:00.235
<00:18:58.455>You <00:18:58.804>can <00:18:59.155>never <00:18:59.504>suppose, <00:18:59.855>um,

433
00:19:00.305 --> 00:19:03.315
<00:19:00.305>that <00:19:00.460>an <00:19:00.616>attacker <00:19:00.771>doesn't <00:19:00.927>know <00:19:01.082>a <00:19:01.238>certain <00:19:01.393>URL, <00:19:01.549>for <00:19:01.705>example.

434
00:19:03.615 --> 00:19:05.715
<00:19:03.615>You <00:19:03.815>have <00:19:04.015>to <00:19:04.215>control <00:19:04.415>access <00:19:04.615>at <00:19:04.815>every <00:19:05.015>request,

435
00:19:05.815 --> 00:19:07.715
<00:19:05.815>not <00:19:06.048>just <00:19:06.281>the <00:19:06.515>first <00:19:06.748>step <00:19:06.981>after <00:19:07.215>login.

436
00:19:07.775 --> 00:19:09.075
<00:19:07.775>And <00:19:07.942>then <00:19:08.109>they <00:19:08.276>can <00:19:08.443>do <00:19:08.610>whatever <00:19:08.777>they <00:19:08.945>want,

437
00:19:09.775 --> 00:19:11.835
<00:19:09.775>but <00:19:10.125>make <00:19:10.475>it <00:19:10.825>every <00:19:11.175>time.

438
00:19:12.505 --> 00:19:17.435
<00:19:12.505>Open <00:19:12.680>design <00:19:12.855>is, <00:19:13.030>uh, <00:19:13.205>basically <00:19:13.380>the, <00:19:13.555>the <00:19:13.730>opposite <00:19:13.905>of,

439
00:19:18.175 --> 00:19:19.915
<00:19:18.175>uh, <00:19:18.641>security <00:19:19.108>by <00:19:19.575>security.

440
00:19:20.055 --> 00:19:22.835
<00:19:20.055>So <00:19:20.288>it <00:19:20.521>means <00:19:20.755>the <00:19:20.988>system <00:19:21.221>must <00:19:21.455>not

441
00:19:22.835 --> 00:19:24.355
<00:19:22.835>or <00:19:23.108>should <00:19:23.382>not <00:19:23.655>be <00:19:23.929>insecure <00:19:24.203>just

442
00:19:24.355 --> 00:19:27.675
<00:19:24.355>because <00:19:24.510>I, <00:19:24.666>for <00:19:24.821>example, <00:19:24.977>open <00:19:25.132>source, <00:19:25.288>its <00:19:25.443>code, <00:19:25.599>the <00:19:25.755>security

443
00:19:27.675 --> 00:19:30.555
<00:19:27.675>of <00:19:27.850>the <00:19:28.024>system <00:19:28.200>should <00:19:28.375>not <00:19:28.550>depend <00:19:28.725>on <00:19:28.899>whether <00:19:29.075>the

444
00:19:30.555 --> 00:19:32.115
<00:19:30.555>adversary <00:19:30.835>knows <00:19:31.115>the <00:19:31.395>code <00:19:31.675>or <00:19:31.955>not.

445
00:19:32.165 --> 00:19:35.115
<00:19:32.165>There <00:19:32.320>are <00:19:32.476>multiple <00:19:32.631>open <00:19:32.787>source <00:19:32.942>pieces <00:19:33.098>of <00:19:33.253>software <00:19:33.409>out <00:19:33.565>there

446
00:19:35.115 --> 00:19:37.155
<00:19:35.115>that <00:19:35.315>are <00:19:35.515>secure <00:19:35.715>or <00:19:35.915>that <00:19:36.115>are <00:19:36.315>considered <00:19:36.515>secure

447
00:19:37.155 --> 00:19:38.515
<00:19:37.155>or <00:19:37.399>have <00:19:37.644>a <00:19:37.889>high <00:19:38.134>security <00:19:38.379>level.

448
00:19:39.095 --> 00:19:41.915
<00:19:39.095>Um, <00:19:39.270>they're <00:19:39.445>not <00:19:39.620>insecure <00:19:39.795>just <00:19:39.970>because <00:19:40.145>they're <00:19:40.320>open, <00:19:40.495>right?

449
00:19:42.265 --> 00:19:44.555
<00:19:42.265>Most <00:19:42.545>cryptographic <00:19:42.825>algorithms <00:19:43.105>are <00:19:43.385>open <00:19:43.665>source.

450
00:19:44.615 --> 00:19:47.115
<00:19:44.615>You <00:19:44.755>can <00:19:44.895>just, <00:19:45.035>you <00:19:45.175>can <00:19:45.315>write <00:19:45.455>your <00:19:45.595>own <00:19:45.735>implementation <00:19:45.875>of <00:19:46.015>it.

451
00:19:48.215 --> 00:19:50.355
<00:19:48.215>Uh, <00:19:48.564>least <00:19:48.915>common <00:19:49.264>mechanisms <00:19:49.615>means

452
00:19:50.665 --> 00:19:52.715
<00:19:50.665>that <00:19:50.820>if <00:19:50.976>you <00:19:51.131>have <00:19:51.287>two <00:19:51.442>sys <00:19:51.598>parts <00:19:51.753>of <00:19:51.909>the <00:19:52.065>system

453
00:19:52.715 --> 00:19:54.195
<00:19:52.715>that <00:19:53.048>have <00:19:53.380>different <00:19:53.714>privilege <00:19:54.047>levels,

454
00:19:54.295 --> 00:19:57.075
<00:19:54.295>say <00:19:54.450>you <00:19:54.606>have <00:19:54.761>a <00:19:54.917>web <00:19:55.072>application <00:19:55.228>that <00:19:55.383>has <00:19:55.539>one <00:19:55.695>login

455
00:19:57.135 --> 00:19:59.715
<00:19:57.135>for <00:19:57.335>end <00:19:57.535>users <00:19:57.735>and <00:19:57.935>another <00:19:58.135>one <00:19:58.335>for <00:19:58.535>administrators.

456
00:20:00.125 --> 00:20:02.355
<00:20:00.125>These <00:20:00.405>common <00:20:00.685>mechanisms <00:20:00.965>would <00:20:01.245>mean, <00:20:01.525>uh,

457
00:20:03.035 --> 00:20:04.315
<00:20:03.035>separate <00:20:03.419>those <00:20:03.803>two <00:20:04.187>parts

458
00:20:04.315 --> 00:20:05.675
<00:20:04.315>of <00:20:04.519>the <00:20:04.723>application <00:20:04.927>as <00:20:05.131>much <00:20:05.335>as <00:20:05.539>possible.

459
00:20:05.685 --> 00:20:08.075
<00:20:05.685>Don't <00:20:05.840>let <00:20:05.996>them <00:20:06.151>use <00:20:06.307>the <00:20:06.462>same <00:20:06.618>library, <00:20:06.773>the <00:20:06.929>same <00:20:07.085>computer,

460
00:20:08.215 --> 00:20:09.835
<00:20:08.215>the <00:20:08.448>same <00:20:08.681>container, <00:20:08.915>the <00:20:09.148>same, <00:20:09.381>you <00:20:09.615>know,

461
00:20:09.855 --> 00:20:11.195
<00:20:09.855>the <00:20:10.096>same <00:20:10.337>parts <00:20:10.578>of <00:20:10.819>the <00:20:11.061>system.

462
00:20:11.655 --> 00:20:15.155
<00:20:11.655>So <00:20:11.771>that <00:20:11.888>if <00:20:12.004>there <00:20:12.121>is <00:20:12.238>a <00:20:12.355>vulnerability <00:20:12.471>in <00:20:12.588>one <00:20:12.705>of <00:20:12.821>those, <00:20:12.938>um, <00:20:13.055>one

463
00:20:15.155 --> 00:20:18.195
<00:20:15.155>of <00:20:15.355>those <00:20:15.555>components, <00:20:15.754>it <00:20:15.955>doesn't <00:20:16.155>affect <00:20:16.355>every <00:20:16.555>part,

464
00:20:18.195 --> 00:20:19.715
<00:20:18.195>including <00:20:18.537>the <00:20:18.879>high <00:20:19.221>privileged <00:20:19.562>one.

465
00:20:21.455 --> 00:20:23.995
<00:20:21.455>Uh, <00:20:21.804>psychological <00:20:22.155>acceptability <00:20:22.504>means <00:20:22.855>usability.

466
00:20:24.415 --> 00:20:28.035
<00:20:24.415>So <00:20:24.648>when <00:20:24.881>we <00:20:25.115>design <00:20:25.348>security <00:20:25.581>systems, <00:20:25.815>one

467
00:20:28.035 --> 00:20:30.795
<00:20:28.035>of <00:20:28.210>the <00:20:28.385>biggest <00:20:28.560>challenges <00:20:28.735>is <00:20:28.910>to <00:20:29.085>keep <00:20:29.260>a <00:20:29.435>balance

468
00:20:30.795 --> 00:20:32.115
<00:20:30.795>between <00:20:31.191>usability <00:20:31.587>and <00:20:31.983>security.

469
00:20:32.275 --> 00:20:34.595
<00:20:32.275>I <00:20:32.450>can <00:20:32.625>always <00:20:32.800>make <00:20:32.975>everything <00:20:33.150>as <00:20:33.325>secure <00:20:33.500>as <00:20:33.675>possible.

470
00:20:34.595 --> 00:20:36.755
<00:20:34.595>That <00:20:34.828>would <00:20:35.061>mean <00:20:35.295>shut <00:20:35.528>it <00:20:35.761>down, <00:20:35.995>right?

471
00:20:37.135 --> 00:20:38.875
<00:20:37.135>If <00:20:37.335>I <00:20:37.535>want <00:20:37.735>to <00:20:37.935>ensure <00:20:38.135>confidentiality <00:20:38.335>of <00:20:38.535>data,

472
00:20:38.875 --> 00:20:40.955
<00:20:38.875>just <00:20:39.155>make <00:20:39.435>it <00:20:39.715>not <00:20:39.995>accessible, <00:20:40.275>uh,

473
00:20:41.095 --> 00:20:43.155
<00:20:41.095>but <00:20:41.375>you <00:20:41.655>know, <00:20:41.935>that's <00:20:42.215>not <00:20:42.495>it.

474
00:20:43.335 --> 00:20:44.995
<00:20:43.335>Uh, <00:20:43.535>that's <00:20:43.735>not <00:20:43.935>the <00:20:44.135>solution <00:20:44.335>to <00:20:44.535>the <00:20:44.735>problem.

475
00:20:45.135 --> 00:20:48.285
<00:20:45.135>So <00:20:45.275>I <00:20:45.415>have <00:20:45.555>to <00:20:45.695>have <00:20:45.835>a <00:20:45.975>balance <00:20:46.115>between <00:20:46.254>usability <00:20:46.395>and <00:20:46.535>security.

476
00:20:49.505 --> 00:20:51.925
<00:20:49.505>Um, <00:20:49.738>weakest <00:20:49.971>link <00:20:50.205>is <00:20:50.438>basically <00:20:50.671>the <00:20:50.905>opposite

477
00:20:51.925 --> 00:20:53.245
<00:20:51.925>of <00:20:52.222>a <00:20:52.519>design <00:20:52.815>security <00:20:53.112>concept.

478
00:20:53.355 --> 00:20:54.405
<00:20:53.355>It's <00:20:53.670>basically <00:20:53.985>a <00:20:54.300>flaw.

479
00:20:54.955 --> 00:20:57.845
<00:20:54.955>It's <00:20:55.129>when <00:20:55.304>I <00:20:55.480>have <00:20:55.655>multiple, <00:20:55.830>uh, <00:20:56.004>steps <00:20:56.179>of <00:20:56.355>security

480
00:20:58.145 --> 00:21:00.765
<00:20:58.145>and, <00:20:58.378>um, <00:20:58.611>the <00:20:58.845>weakest <00:20:59.078>link's <00:20:59.311>gonna <00:20:59.545>decide

481
00:21:00.765 --> 00:21:02.445
<00:21:00.765>how <00:21:01.045>secure <00:21:01.325>my <00:21:01.605>system <00:21:01.885>is <00:21:02.165>overall.

482
00:21:03.515 --> 00:21:05.645
<00:21:03.515>Then <00:21:03.795>we <00:21:04.075>have <00:21:04.355>leveraging <00:21:04.635>existing <00:21:04.915>components.

483
00:21:05.755 --> 00:21:09.085
<00:21:05.755>That <00:21:06.035>means <00:21:06.315>that's <00:21:06.595>a <00:21:06.875>contradictory, <00:21:07.155>uh,

484
00:21:09.085 --> 00:21:10.925
<00:21:09.085>design <00:21:09.365>security <00:21:09.645>concept <00:21:09.925>to <00:21:10.205>one <00:21:10.485>of,

485
00:21:10.985 --> 00:21:12.565
<00:21:10.985>of <00:21:11.334>those <00:21:11.685>we <00:21:12.034>discussed <00:21:12.385>before.

486
00:21:13.185 --> 00:21:17.285
<00:21:13.185>Um, <00:21:13.385>because <00:21:13.585>leveraging <00:21:13.784>existing <00:21:13.985>components <00:21:14.185>mean <00:21:14.385>means <00:21:14.585>having

487
00:21:17.585 --> 00:21:20.485
<00:21:17.585>one <00:21:17.935>standardized <00:21:18.285>and <00:21:18.635>tested <00:21:18.985>component

488
00:21:20.505 --> 00:21:22.765
<00:21:20.505>and <00:21:20.738>does <00:21:20.971>one <00:21:21.205>thing, <00:21:21.438>for <00:21:21.671>example, <00:21:21.905>authentication

489
00:21:23.145 --> 00:21:26.645
<00:21:23.145>and <00:21:23.320>then <00:21:23.495>reuse <00:21:23.670>it <00:21:23.845>over <00:21:24.020>multiple <00:21:24.195>systems <00:21:24.370>as <00:21:24.545>opposed

490
00:21:26.705 --> 00:21:29.085
<00:21:26.705>to <00:21:26.938>everybody <00:21:27.171>is <00:21:27.405>doing <00:21:27.638>their <00:21:27.871>own <00:21:28.105>thing

491
00:21:29.145 --> 00:21:32.045
<00:21:29.145>and <00:21:29.345>in, <00:21:29.545>in <00:21:29.745>various <00:21:29.945>levels <00:21:30.145>of <00:21:30.345>insecurity, <00:21:30.545>right?

492
00:21:32.045 --> 00:21:34.725
<00:21:32.045>So <00:21:32.278>having <00:21:32.511>one <00:21:32.745>centralized <00:21:32.978>component <00:21:33.211>is <00:21:33.445>sometimes

493
00:21:34.725 --> 00:21:35.765
<00:21:34.725>better <00:21:34.959>in <00:21:35.193>terms <00:21:35.427>of <00:21:35.661>security.

494
00:21:36.185 --> 00:21:38.925
<00:21:36.185>It <00:21:36.360>is <00:21:36.534>a <00:21:36.710>contradiction <00:21:36.885>to <00:21:37.060>least <00:21:37.235>common <00:21:37.409>mechanisms, <00:21:37.585>right?

495
00:21:40.105 --> 00:21:44.005
<00:21:40.105>So, <00:21:40.260>okay, <00:21:40.416>I <00:21:40.571>want <00:21:40.727>you <00:21:40.882>to <00:21:41.038>understand <00:21:41.193>the <00:21:41.349>basic <00:21:41.505>ideas

496
00:21:44.425 --> 00:21:46.085
<00:21:44.425>behind <00:21:44.891>those <00:21:45.358>uh, <00:21:45.825>terms,

497
00:21:46.865 --> 00:21:49.285
<00:21:46.865>but <00:21:46.992>you <00:21:47.119>are <00:21:47.246>gonna <00:21:47.374>see <00:21:47.501>that <00:21:47.628>you <00:21:47.755>cannot <00:21:47.883>do <00:21:48.010>all <00:21:48.137>of <00:21:48.265>them.

498
00:21:50.045 --> 00:21:53.725
<00:21:50.045>Absolutely. <00:21:50.220>Some <00:21:50.395>of <00:21:50.570>them <00:21:50.745>are <00:21:50.920>contradictory, <00:21:51.095>some <00:21:51.270>of <00:21:51.445>them

499
00:21:54.945 --> 00:21:56.765
<00:21:54.945>are <00:21:55.178>impossible <00:21:55.411>to <00:21:55.645>implement <00:21:55.878>in <00:21:56.111>certain <00:21:56.345>environments.

500
00:21:57.625 --> 00:22:01.525
<00:21:57.625>Um, <00:21:57.765>and <00:21:57.905>you <00:21:58.045>will <00:21:58.185>never <00:21:58.325>have <00:21:58.465>100% <00:21:58.605>for <00:21:58.745>each <00:21:58.885>of <00:21:59.025>those,

501
00:22:02.065 --> 00:22:05.165
<00:22:02.065>but <00:22:02.220>there <00:22:02.376>will <00:22:02.531>be <00:22:02.687>environments <00:22:02.842>where <00:22:02.998>certain <00:22:03.153>ones <00:22:03.309>make <00:22:03.465>sense

502
00:22:06.775 --> 00:22:08.945
<00:22:06.775>just <00:22:06.915>so <00:22:07.055>that <00:22:07.195>we <00:22:07.335>are <00:22:07.475>on <00:22:07.615>the <00:22:07.755>same <00:22:07.895>page <00:22:08.035>in <00:22:08.175>terms

503
00:22:09.045 --> 00:22:10.065
<00:22:09.045>of <00:22:09.504>these <00:22:09.963>criteria.

504
00:22:10.615 --> 00:22:14.445
<00:22:10.615>Okay? <00:22:10.815>Let's <00:22:11.015>get <00:22:11.215>to <00:22:11.415>the <00:22:11.615>next <00:22:11.815>part, <00:22:12.015>um,

505
00:22:14.945 --> 00:22:18.285
<00:22:14.945>of <00:22:15.120>this <00:22:15.294>talk <00:22:15.470>security <00:22:15.645>criteria <00:22:15.820>for <00:22:15.995>choosing <00:22:16.169>a <00:22:16.345>language.

506
00:22:19.585 --> 00:22:22.645
<00:22:19.585>Um, <00:22:20.051>a <00:22:20.518>little <00:22:20.985>spoiler.

507
00:22:25.205 --> 00:22:28.265
<00:22:25.205>You <00:22:25.405>can <00:22:25.605>write <00:22:25.804>secure <00:22:26.004>software <00:22:26.205>in <00:22:26.405>any <00:22:26.605>language.

508
00:22:29.075 --> 00:22:32.145
<00:22:29.075>There <00:22:29.215>are <00:22:29.355>just <00:22:29.495>languages <00:22:29.635>out <00:22:29.775>there <00:22:29.915>that <00:22:30.055>are <00:22:30.195>not <00:22:30.335>so <00:22:30.475>famous

509
00:22:32.405 --> 00:22:34.945
<00:22:32.405>for, <00:22:32.605>uh, <00:22:32.805>their <00:22:33.004>secure <00:22:33.205>pieces <00:22:33.405>of <00:22:33.605>software <00:22:33.805>that,

510
00:22:35.015 --> 00:22:36.505
<00:22:35.015>that <00:22:35.238>come <00:22:35.462>from <00:22:35.685>them <00:22:35.909>and <00:22:36.132>so <00:22:36.356>on.

511
00:22:37.005 --> 00:22:38.225
<00:22:37.005>But <00:22:37.279>that's <00:22:37.554>not <00:22:37.828>the <00:22:38.102>reason,

512
00:22:38.365 --> 00:22:40.225
<00:22:38.365>the <00:22:38.565>reason <00:22:38.765>it's <00:22:38.965>not <00:22:39.165>the <00:22:39.365>language <00:22:39.565>itself <00:22:39.765>mostly.

513
00:22:41.245 --> 00:22:44.585
<00:22:41.245>Um, <00:22:41.445>so <00:22:41.645>some <00:22:41.844>languages <00:22:42.044>protect <00:22:42.245>against <00:22:42.445>certain <00:22:42.645>vulnerability

514
00:22:44.585 --> 00:22:46.305
<00:22:44.585>classes, <00:22:45.051>sorry, <00:22:45.518>by <00:22:45.985>design.

515
00:22:46.805 --> 00:22:50.105
<00:22:46.805>So <00:22:47.038>some <00:22:47.271>languages <00:22:47.505>don't <00:22:47.738>have <00:22:47.971>buffer <00:22:48.205>overflows

516
00:22:50.105 --> 00:22:51.745
<00:22:50.105>because <00:22:50.338>they <00:22:50.571>have <00:22:50.805>memory <00:22:51.038>management, <00:22:51.271>for <00:22:51.505>example.

517
00:22:52.765 --> 00:22:55.785
<00:22:52.765>Um, <00:22:52.920>but <00:22:53.076>you <00:22:53.231>can <00:22:53.387>write <00:22:53.542>secure <00:22:53.698>software <00:22:53.853>in <00:22:54.009>any <00:22:54.165>language.

518
00:22:56.765 --> 00:22:59.305
<00:22:56.765>So <00:22:56.998>mastering <00:22:57.231>the <00:22:57.465>language <00:22:57.698>in <00:22:57.931>its <00:22:58.165>concepts

519
00:22:59.965 --> 00:23:01.385
<00:22:59.965>is <00:23:00.284>mastering <00:23:00.604>security <00:23:00.923>as <00:23:01.243>well,

520
00:23:01.385 --> 00:23:03.905
<00:23:01.385>because <00:23:01.540>then <00:23:01.696>you're <00:23:01.851>gonna <00:23:02.007>understand <00:23:02.162>what <00:23:02.318>could <00:23:02.473>go <00:23:02.629>wrong <00:23:02.785>in

521
00:23:03.905 --> 00:23:04.945
<00:23:03.905>that <00:23:04.373>specific <00:23:04.841>language.

522
00:23:05.805 --> 00:23:08.145
<00:23:05.805>So <00:23:06.038>just <00:23:06.271>because <00:23:06.505>there <00:23:06.738>is <00:23:06.971>these <00:23:07.205>criteria

523
00:23:08.145 --> 00:23:11.265
<00:23:08.145>that <00:23:08.300>I'm <00:23:08.456>gonna <00:23:08.611>show <00:23:08.767>you, <00:23:08.922>and <00:23:09.078>maybe <00:23:09.233>the, <00:23:09.389>the <00:23:09.545>software

524
00:23:11.285 --> 00:23:13.545
<00:23:11.285>or <00:23:11.440>the <00:23:11.596>program <00:23:11.751>language <00:23:11.907>that <00:23:12.062>you're <00:23:12.218>writing <00:23:12.373>your <00:23:12.529>software <00:23:12.685>in

525
00:23:13.545 --> 00:23:15.345
<00:23:13.545>doesn't <00:23:13.720>match <00:23:13.895>some <00:23:14.070>of <00:23:14.245>those, <00:23:14.420>doesn't <00:23:14.595>mean <00:23:14.770>you <00:23:14.945>have

526
00:23:15.345 --> 00:23:16.625
<00:23:15.345>to <00:23:15.575>ditch <00:23:15.805>everything <00:23:16.036>and <00:23:16.266>start <00:23:16.497>over

527
00:23:16.625 --> 00:23:17.985
<00:23:16.625>with <00:23:16.931>a <00:23:17.236>different <00:23:17.543>one, <00:23:17.849>right?

528
00:23:18.895 --> 00:23:20.305
<00:23:18.895>It's <00:23:19.318>more, <00:23:19.741>more <00:23:20.164>important

529
00:23:20.305 --> 00:23:23.425
<00:23:20.305>that <00:23:20.480>you <00:23:20.655>master <00:23:20.830>the <00:23:21.005>language <00:23:21.180>than <00:23:21.355>the <00:23:21.530>language <00:23:21.705>itself.

530
00:23:23.815 --> 00:23:25.385
<00:23:23.815>Okay? <00:23:24.165>That's, <00:23:24.515>that's <00:23:24.865>the <00:23:25.215>most

531
00:23:25.385 --> 00:23:26.625
<00:23:25.385>important <00:23:25.608>takeaway <00:23:25.831>of <00:23:26.054>this <00:23:26.277>part <00:23:26.501>here.

532
00:23:27.445 --> 00:23:28.465
<00:23:27.445>So, <00:23:27.674>but <00:23:27.904>why <00:23:28.133>is <00:23:28.362>there

533
00:23:28.465 --> 00:23:31.345
<00:23:28.465>so <00:23:28.639>much <00:23:28.814>low <00:23:28.990>quality <00:23:29.165>code <00:23:29.340>in <00:23:29.514>some <00:23:29.689>languages, <00:23:29.865>right?

534
00:23:31.345 --> 00:23:33.345
<00:23:31.345>There <00:23:31.500>are <00:23:31.656>some <00:23:31.811>language <00:23:31.967>out <00:23:32.122>there <00:23:32.278>that <00:23:32.433>everybody <00:23:32.589>says, <00:23:32.745>oh,

535
00:23:33.345 --> 00:23:34.985
<00:23:33.345>that's, <00:23:33.695>that's <00:23:34.045>a <00:23:34.395>bad <00:23:34.745>language.

536
00:23:35.085 --> 00:23:37.105
<00:23:35.085>So <00:23:35.318>much, <00:23:35.551>so <00:23:35.785>many <00:23:36.018>libraries <00:23:36.251>out <00:23:36.485>there

537
00:23:37.105 --> 00:23:38.585
<00:23:37.105>that <00:23:37.371>are <00:23:37.637>written <00:23:37.904>in <00:23:38.170>bad <00:23:38.437>quality.

538
00:23:39.215 --> 00:23:41.905
<00:23:39.215>Well, <00:23:39.370>some <00:23:39.526>of <00:23:39.681>those <00:23:39.837>language <00:23:39.992>have <00:23:40.148>very <00:23:40.303>low <00:23:40.459>entry <00:23:40.615>errors,

539
00:23:41.905 --> 00:23:43.825
<00:23:41.905>and <00:23:42.080>that <00:23:42.254>means <00:23:42.430>more <00:23:42.605>people <00:23:42.780>are <00:23:42.955>gonna <00:23:43.129>write <00:23:43.305>software.

540
00:23:44.195 --> 00:23:46.685
<00:23:44.195>Maybe <00:23:44.395>also <00:23:44.595>less <00:23:44.794>skilled <00:23:44.995>people <00:23:45.195>will <00:23:45.395>be <00:23:45.595>writing

541
00:23:46.965 --> 00:23:48.005
<00:23:46.965>software <00:23:47.199>and <00:23:47.433>publishing <00:23:47.667>that <00:23:47.901>code.

542
00:23:48.905 --> 00:23:50.405
<00:23:48.905>It <00:23:49.097>doesn't <00:23:49.290>mean <00:23:49.483>that <00:23:49.676>the <00:23:49.869>language <00:23:50.062>is <00:23:50.254>bad.

543
00:23:51.195 --> 00:23:52.855
<00:23:51.195>It, <00:23:51.428>it <00:23:51.661>just <00:23:51.895>means <00:23:52.128>that <00:23:52.361>more <00:23:52.595>people

544
00:23:52.925 --> 00:23:55.695
<00:23:52.925>with <00:23:53.158>less <00:23:53.391>skill <00:23:53.625>are <00:23:53.858>probably <00:23:54.091>writing <00:23:54.325>software

545
00:23:55.695 --> 00:23:56.735
<00:23:55.695>in <00:23:56.006>that <00:23:56.319>language, <00:23:56.630>right?

546
00:23:57.395 --> 00:23:59.455
<00:23:57.395>We <00:23:57.570>need <00:23:57.745>those <00:23:57.920>languages <00:23:58.095>that <00:23:58.270>have <00:23:58.445>low <00:23:58.620>entry <00:23:58.795>barriers

547
00:23:59.455 --> 00:24:01.535
<00:23:59.455>because <00:23:59.688>those <00:23:59.921>people <00:24:00.155>will <00:24:00.388>get <00:24:00.621>more <00:24:00.855>skilled

548
00:24:01.595 --> 00:24:03.575
<00:24:01.595>and <00:24:01.875>will <00:24:02.155>get <00:24:02.435>skilled <00:24:02.715>software <00:24:02.995>developers.

549
00:24:03.575 --> 00:24:05.975
<00:24:03.575>Everybody <00:24:03.808>is <00:24:04.041>looking <00:24:04.275>for <00:24:04.508>good <00:24:04.741>developers, <00:24:04.975>right?

550
00:24:05.975 --> 00:24:08.455
<00:24:05.975>And <00:24:06.208>everybody <00:24:06.441>starts <00:24:06.675>out <00:24:06.908>as <00:24:07.141>a <00:24:07.375>not

551
00:24:08.455 --> 00:24:09.455
<00:24:08.455>so <00:24:08.754>good <00:24:09.054>software <00:24:09.355>developer.

552
00:24:09.595 --> 00:24:12.455
<00:24:09.595>You <00:24:09.795>never <00:24:09.995>start <00:24:10.195>with <00:24:10.395>100%, <00:24:10.595>uh, <00:24:10.795>skill <00:24:10.995>level.

553
00:24:13.275 --> 00:24:14.695
<00:24:13.275>So <00:24:13.594>it's <00:24:13.914>not <00:24:14.233>the <00:24:14.553>language,

554
00:24:15.125 --> 00:24:17.175
<00:24:15.125>it's <00:24:15.280>just <00:24:15.436>a <00:24:15.591>low <00:24:15.747>entry <00:24:15.902>area <00:24:16.058>most <00:24:16.213>of <00:24:16.369>the <00:24:16.525>time.

555
00:24:18.665 --> 00:24:21.005
<00:24:18.665>But <00:24:18.898>we <00:24:19.131>were <00:24:19.365>talking <00:24:19.598>about <00:24:19.831>security <00:24:20.065>criteria.

556
00:24:21.005 --> 00:24:23.165
<00:24:21.005>There <00:24:21.205>are <00:24:21.405>some <00:24:21.605>criteria <00:24:21.805>that <00:24:22.005>you <00:24:22.205>can <00:24:22.405>take

557
00:24:23.625 --> 00:24:24.805
<00:24:23.625>and <00:24:23.890>apply <00:24:24.156>to <00:24:24.421>your <00:24:24.687>language

558
00:24:24.825 --> 00:24:27.205
<00:24:24.825>to <00:24:24.952>see <00:24:25.079>whether <00:24:25.206>it <00:24:25.334>is <00:24:25.461>a <00:24:25.588>good <00:24:25.715>choice <00:24:25.843>in <00:24:25.970>terms <00:24:26.097>of <00:24:26.225>security.

559
00:24:27.655 --> 00:24:31.895
<00:24:27.655>There <00:24:27.830>is <00:24:28.004>memory <00:24:28.180>safety, <00:24:28.355>uh, <00:24:28.530>there <00:24:28.705>is <00:24:28.879>type <00:24:29.055>safety

560
00:24:32.075 --> 00:24:33.335
<00:24:32.075>or <00:24:32.642>type <00:24:33.209>strictness.

561
00:24:33.335 --> 00:24:34.575
<00:24:33.335>That's <00:24:33.614>a <00:24:33.893>very <00:24:34.172>difficult <00:24:34.451>topic.

562
00:24:34.755 --> 00:24:37.775
<00:24:34.755>Uh, <00:24:34.895>I <00:24:35.035>discussed <00:24:35.175>this <00:24:35.315>with <00:24:35.455>a <00:24:35.595>colleague <00:24:35.735>about <00:24:35.875>two <00:24:36.015>hours <00:24:36.155>ago's

563
00:24:37.775 --> 00:24:40.055
<00:24:37.775>very <00:24:37.930>hard <00:24:38.086>to <00:24:38.241>come <00:24:38.397>up <00:24:38.552>with <00:24:38.708>what's, <00:24:38.863>what's <00:24:39.019>type <00:24:39.175>safe

564
00:24:40.195 --> 00:24:42.975
<00:24:40.195>and <00:24:40.350>what's <00:24:40.506>not <00:24:40.661>really <00:24:40.817>hard <00:24:40.972>to <00:24:41.128>define, <00:24:41.283>but <00:24:41.439>I'll <00:24:41.595>try.

565
00:24:43.835 --> 00:24:45.695
<00:24:43.835>Um, <00:24:44.301>there's <00:24:44.768>also <00:24:45.235>languages

566
00:24:45.695 --> 00:24:47.695
<00:24:45.695>that <00:24:46.044>have <00:24:46.395>better <00:24:46.745>parallelization <00:24:47.095>support.

567
00:24:47.745 --> 00:24:49.975
<00:24:47.745>We're <00:24:47.945>not <00:24:48.145>gonna <00:24:48.344>go <00:24:48.544>very <00:24:48.745>deep <00:24:48.945>into <00:24:49.145>this

568
00:24:49.975 --> 00:24:52.175
<00:24:49.975>because <00:24:50.175>it's <00:24:50.375>not <00:24:50.574>so <00:24:50.774>much <00:24:50.975>related <00:24:51.175>to <00:24:51.375>security.

569
00:24:52.325 --> 00:24:55.975
<00:24:52.325>It's <00:24:52.500>maybe <00:24:52.675>has <00:24:52.850>some <00:24:53.025>integrity, <00:24:53.200>uh, <00:24:53.375>concepts <00:24:53.550>behind <00:24:53.725>it,

570
00:24:55.975 --> 00:24:59.215
<00:24:55.975>but, <00:24:56.149>uh, <00:24:56.324>it's <00:24:56.500>not <00:24:56.675>so <00:24:56.850>firsthand <00:24:57.024>security <00:24:57.199>related, <00:24:57.375>so

571
00:24:59.235 --> 00:25:00.855
<00:24:59.235>that's <00:24:59.514>not <00:24:59.794>gonna <00:25:00.074>be <00:25:00.354>very <00:25:00.635>deep.

572
00:25:01.395 --> 00:25:03.535
<00:25:01.395>But <00:25:01.745>sandbox <00:25:02.095>support <00:25:02.445>is <00:25:02.795>important.

573
00:25:03.675 --> 00:25:07.415
<00:25:03.675>So <00:25:03.815>can <00:25:03.955>I <00:25:04.095>sandbox <00:25:04.235>a <00:25:04.375>process <00:25:04.514>that <00:25:04.655>is <00:25:04.794>running, <00:25:04.935>um, <00:25:05.075>so

574
00:25:07.415 --> 00:25:09.935
<00:25:07.415>that <00:25:07.615>if <00:25:07.815>it, <00:25:08.014>if <00:25:08.215>it <00:25:08.415>gets <00:25:08.615>compromised, <00:25:08.815>uh,

575
00:25:09.955 --> 00:25:11.935
<00:25:09.955>the <00:25:10.188>attacker <00:25:10.421>cannot <00:25:10.655>break <00:25:10.888>out <00:25:11.121>of <00:25:11.355>it.

576
00:25:12.515 --> 00:25:14.895
<00:25:12.515>Uh, <00:25:12.715>and <00:25:12.915>also <00:25:13.115>the <00:25:13.315>availability <00:25:13.515>of <00:25:13.715>secure <00:25:13.915>frameworks.

577
00:25:14.895 --> 00:25:18.135
<00:25:14.895>Most <00:25:15.070>people <00:25:15.245>are <00:25:15.420>not <00:25:15.595>writing <00:25:15.770>just <00:25:15.945>vanilla <00:25:16.120>code <00:25:16.295>in,

578
00:25:18.475 --> 00:25:19.535
<00:25:18.475>in <00:25:18.952>specific <00:25:19.429>languages,

579
00:25:19.535 --> 00:25:21.575
<00:25:19.535>but <00:25:19.690>they, <00:25:19.846>they <00:25:20.001>will <00:25:20.157>be <00:25:20.312>taking <00:25:20.468>some <00:25:20.623>sort <00:25:20.779>of <00:25:20.935>library

580
00:25:21.635 --> 00:25:23.135
<00:25:21.635>or <00:25:21.972>framework <00:25:22.310>for <00:25:22.647>their <00:25:22.985>software.

581
00:25:23.135 --> 00:25:25.095
<00:25:23.135>So <00:25:23.335>it's <00:25:23.535>also <00:25:23.735>a <00:25:23.935>big, <00:25:24.135>an <00:25:24.335>important <00:25:24.535>criteria.

582
00:25:26.515 --> 00:25:30.055
<00:25:26.515>Memory <00:25:26.670>safety <00:25:26.826>is <00:25:26.981>the <00:25:27.137>first <00:25:27.292>criteria. <00:25:27.448>It <00:25:27.603>has <00:25:27.759>many <00:25:27.915>flavors.

583
00:25:30.075 --> 00:25:33.375
<00:25:30.075>So <00:25:30.250>there, <00:25:30.425>there <00:25:30.600>is <00:25:30.775>almost <00:25:30.950>no <00:25:31.125>language <00:25:31.300>out <00:25:31.475>there

584
00:25:33.375 --> 00:25:36.455
<00:25:33.375>that <00:25:33.608>has <00:25:33.841>100% <00:25:34.075>or <00:25:34.308>0% <00:25:34.541>memory <00:25:34.775>safety.

585
00:25:36.605 --> 00:25:38.215
<00:25:36.605>It's <00:25:36.885>almost <00:25:37.165>always <00:25:37.445>something <00:25:37.725>in <00:25:38.005>between.

586
00:25:38.875 --> 00:25:41.615
<00:25:38.875>For <00:25:39.075>example, <00:25:39.275>array <00:25:39.475>bounce <00:25:39.675>checks <00:25:39.875>when <00:25:40.075>defining <00:25:40.275>an

587
00:25:41.615 --> 00:25:42.655
<00:25:41.615>array <00:25:41.927>with <00:25:42.239>certain <00:25:42.551>length.

588
00:25:42.795 --> 00:25:45.975
<00:25:42.795>Can <00:25:42.935>I <00:25:43.075>write, <00:25:43.215>you <00:25:43.355>know, <00:25:43.495>beyond <00:25:43.635>the <00:25:43.775>size <00:25:43.915>of <00:25:44.055>the <00:25:44.195>array,

589
00:25:46.645 --> 00:25:47.895
<00:25:46.645>pointer <00:25:47.770>arithmetic.

590
00:25:47.955 --> 00:25:50.695
<00:25:47.955>So <00:25:48.155>can <00:25:48.355>I <00:25:48.554>just, <00:25:48.754>uh, <00:25:48.955>have <00:25:49.155>a <00:25:49.355>pointer

591
00:25:50.755 --> 00:25:52.295
<00:25:50.755>to <00:25:51.032>a <00:25:51.309>variable <00:25:51.586>in, <00:25:51.863>in <00:25:52.141>memory?

592
00:25:52.295 --> 00:25:53.935
<00:25:52.295>Like <00:25:52.435>you <00:25:52.575>can <00:25:52.715>see <00:25:52.855>on <00:25:52.995>a <00:25:53.135>picture <00:25:53.275>here <00:25:53.415>on <00:25:53.555>the <00:25:53.695>right.

593
00:25:54.595 --> 00:25:56.495
<00:25:54.595>Can <00:25:54.795>I <00:25:54.995>just <00:25:55.195>increase <00:25:55.395>that <00:25:55.595>pointer <00:25:55.795>by <00:25:55.995>one?

594
00:25:56.495 --> 00:25:58.575
<00:25:56.495>It's <00:25:56.650>gonna <00:25:56.806>be <00:25:56.961>pointing <00:25:57.117>to <00:25:57.272>the <00:25:57.428>next <00:25:57.583>point <00:25:57.739>in <00:25:57.895>memory.

595
00:25:58.635 --> 00:25:59.775
<00:25:58.635>Or <00:25:58.977>is <00:25:59.319>it <00:25:59.661>impossible?

596
00:26:01.185 --> 00:26:03.355
<00:26:01.185>Also, <00:26:01.385>are, <00:26:01.585>are <00:26:01.784>there <00:26:01.985>null <00:26:02.185>pointers <00:26:02.385>or <00:26:02.585>not?

597
00:26:04.055 --> 00:26:08.715
<00:26:04.055>Um, <00:26:04.230>also <00:26:04.405>if <00:26:04.580>there <00:26:04.755>is <00:26:04.930>some <00:26:05.105>unallocated <00:26:05.280>or <00:26:05.455>deallocated

598
00:26:08.815 --> 00:26:11.795
<00:26:08.815>or <00:26:08.970>uni <00:26:09.126>initialized <00:26:09.281>memory, <00:26:09.437>can <00:26:09.592>I <00:26:09.748>point <00:26:09.903>a <00:26:10.059>pointer <00:26:10.215>to

599
00:26:11.795 --> 00:26:14.115
<00:26:11.795>that <00:26:12.028>part <00:26:12.261>of <00:26:12.495>the, <00:26:12.728>of <00:26:12.961>memory, <00:26:13.195>right?

600
00:26:14.445 --> 00:26:16.795
<00:26:14.445>There <00:26:14.620>are <00:26:14.794>languages <00:26:14.970>that <00:26:15.145>give <00:26:15.320>you <00:26:15.495>control <00:26:15.669>over <00:26:15.845>that,

601
00:26:17.045 --> 00:26:18.715
<00:26:17.045>where <00:26:17.245>you <00:26:17.445>can <00:26:17.645>shift <00:26:17.845>pointers <00:26:18.045>up <00:26:18.245>and <00:26:18.445>down.

602
00:26:18.715 --> 00:26:20.435
<00:26:18.715>There <00:26:18.915>are <00:26:19.115>others <00:26:19.314>where <00:26:19.514>you <00:26:19.715>cannot <00:26:19.915>do <00:26:20.115>that.

603
00:26:21.495 --> 00:26:24.835
<00:26:21.495>Um, <00:26:21.622>so <00:26:21.749>why <00:26:21.876>do <00:26:22.004>we <00:26:22.131>bother? <00:26:22.258>Why <00:26:22.385>is <00:26:22.513>that <00:26:22.640>important <00:26:22.767>for <00:26:22.895>security?

604
00:26:25.495 --> 00:26:28.195
<00:26:25.495>Uh, <00:26:25.728>some <00:26:25.961>non-member <00:26:26.195>safe <00:26:26.428>languages <00:26:26.661>are <00:26:26.895>susceptible

605
00:26:28.195 --> 00:26:30.075
<00:26:28.195>to <00:26:28.475>some <00:26:28.754>vulnerability <00:26:29.034>classes <00:26:29.314>by <00:26:29.595>design.

606
00:26:30.135 --> 00:26:33.875
<00:26:30.135>So <00:26:30.275>you <00:26:30.415>could, <00:26:30.555>there <00:26:30.695>are <00:26:30.835>things <00:26:30.975>that <00:26:31.115>could <00:26:31.254>go <00:26:31.395>wrong, <00:26:31.535>uh,

607
00:26:33.895 --> 00:26:35.275
<00:26:33.895>and <00:26:34.102>these <00:26:34.309>things <00:26:34.516>that <00:26:34.723>could <00:26:34.930>go <00:26:35.137>wrong

608
00:26:35.275 --> 00:26:37.315
<00:26:35.275>with <00:26:35.508>non-member <00:26:35.741>save <00:26:35.975>languages <00:26:36.208>are, <00:26:36.441>for <00:26:36.675>example,

609
00:26:37.375 --> 00:26:38.875
<00:26:37.375>the <00:26:37.825>classic <00:26:38.275>buffer <00:26:38.725>overflows

610
00:26:39.015 --> 00:26:41.035
<00:26:39.015>or <00:26:39.365>heap <00:26:39.715>overflows, <00:26:40.065>memory <00:26:40.415>leaks,

611
00:26:41.035 --> 00:26:42.635
<00:26:41.035>dangling <00:26:41.501>pointers, <00:26:41.968>former <00:26:42.435>string.

612
00:26:43.185 --> 00:26:46.325
<00:26:43.185>So <00:26:43.325>all <00:26:43.465>those <00:26:43.605>things <00:26:43.745>where <00:26:43.885>you <00:26:44.024>can <00:26:44.165>mess <00:26:44.304>with <00:26:44.445>the <00:26:44.585>memory,

613
00:26:46.505 --> 00:26:49.245
<00:26:46.505>you <00:26:46.680>can <00:26:46.855>mess <00:26:47.030>with <00:26:47.205>pointers, <00:26:47.380>um, <00:26:47.555>and <00:26:47.730>so <00:26:47.905>on.

614
00:26:49.245 --> 00:26:51.405
<00:26:49.245>You <00:26:49.478>can <00:26:49.711>write <00:26:49.945>beyond <00:26:50.178>what's <00:26:50.411>reserved <00:26:50.645>for

615
00:26:51.405 --> 00:26:52.765
<00:26:51.405>that <00:26:51.711>variable <00:26:52.017>and <00:26:52.323>so <00:26:52.629>on.

616
00:26:53.605 --> 00:26:55.225
<00:26:53.605>So <00:26:53.838>that's <00:26:54.071>why <00:26:54.305>it's <00:26:54.538>important <00:26:54.771>for <00:26:55.005>security.

617
00:26:55.405 --> 00:26:58.185
<00:26:55.405>The <00:26:55.638>most <00:26:55.871>important <00:26:56.105>security <00:26:56.338>vulnerability <00:26:56.571>being <00:26:56.805>buffer

618
00:26:58.255 --> 00:27:00.545
<00:26:58.255>overflows <00:26:58.430>in <00:26:58.605>that <00:26:58.780>case, <00:26:58.955>or <00:26:59.130>the <00:26:59.305>most <00:26:59.480>common <00:26:59.655>ones.

619
00:27:01.925 --> 00:27:06.585
<00:27:01.925>Um, <00:27:02.065>so <00:27:02.205>the <00:27:02.345>languages <00:27:02.485>that <00:27:02.625>have <00:27:02.764>no <00:27:02.905>memory <00:27:03.044>safety <00:27:03.185>as <00:27:03.325>c

620
00:27:06.585 --> 00:27:08.865
<00:27:06.585>and <00:27:06.785>c <00:27:06.985>plus <00:27:07.185>plus, <00:27:07.385>you <00:27:07.585>have <00:27:07.785>pointer <00:27:07.985>arithmetics.

621
00:27:08.865 --> 00:27:12.225
<00:27:08.865>You <00:27:09.020>can <00:27:09.176>let <00:27:09.331>them <00:27:09.487>point, <00:27:09.642>uh, <00:27:09.798>to <00:27:09.953>an <00:27:10.109>arbitrary, <00:27:10.265>uh,

622
00:27:12.555 --> 00:27:13.945
<00:27:12.555>place <00:27:12.805>in <00:27:13.055>memory <00:27:13.305>within <00:27:13.555>your <00:27:13.806>process.

623
00:27:14.645 --> 00:27:17.225
<00:27:14.645>Um, <00:27:14.800>also <00:27:14.956>machine <00:27:15.111>code, <00:27:15.267>of <00:27:15.422>course, <00:27:15.578>you <00:27:15.733>can <00:27:15.889>do <00:27:16.045>everything

624
00:27:17.225 --> 00:27:19.625
<00:27:17.225>with <00:27:17.458>machine <00:27:17.691>code <00:27:17.925>and <00:27:18.158>there <00:27:18.391>are <00:27:18.625>language

625
00:27:19.625 --> 00:27:21.185
<00:27:19.625>with <00:27:19.905>some <00:27:20.185>form <00:27:20.465>of <00:27:20.745>memory <00:27:21.025>safety.

626
00:27:21.455 --> 00:27:24.265
<00:27:21.455>It's, <00:27:21.629>for <00:27:21.804>example, <00:27:21.980>Chava <00:27:22.155>and <00:27:22.330>C <00:27:22.504>sharp, <00:27:22.679>uh, <00:27:22.855>rust

627
00:27:24.285 --> 00:27:28.105
<00:27:24.285>and <00:27:24.412>go <00:27:24.539>to <00:27:24.666>new <00:27:24.794>kids <00:27:24.921>on <00:27:25.048>the <00:27:25.175>block, <00:27:25.303>uh, <00:27:25.430>that <00:27:25.557>are <00:27:25.685>somewhere

628
00:27:28.105 --> 00:27:30.585
<00:27:28.105>between <00:27:28.305>the <00:27:28.505>world <00:27:28.705>of <00:27:28.905>Java <00:27:29.105>and <00:27:29.305>C <00:27:29.505>sharp

629
00:27:30.685 --> 00:27:32.825
<00:27:30.685>and <00:27:30.860>the <00:27:31.034>low <00:27:31.210>level <00:27:31.385>world <00:27:31.560>of <00:27:31.735>CNC <00:27:31.909>plus <00:27:32.085>plus.

630
00:27:33.615 --> 00:27:38.385
<00:27:33.615>They, <00:27:33.755>uh, <00:27:33.895>they <00:27:34.035>save <00:27:34.175>of <00:27:34.315>themselves <00:27:34.455>that <00:27:34.595>they <00:27:34.735>are <00:27:34.875>very, <00:27:35.015>uh,

631
00:27:38.655 --> 00:27:39.985
<00:27:38.655>fast <00:27:39.851>languages.

632
00:27:39.985 --> 00:27:41.865
<00:27:39.985>So <00:27:40.264>the, <00:27:40.544>the <00:27:40.824>binary <00:27:41.104>that's, <00:27:41.385>um,

633
00:27:42.245 --> 00:27:45.425
<00:27:42.245>the <00:27:42.400>compiled <00:27:42.556>binary <00:27:42.711>is <00:27:42.867>gonna <00:27:43.022>be <00:27:43.178>very <00:27:43.333>fast, <00:27:43.489>somewhere <00:27:43.645>close

634
00:27:45.525 --> 00:27:48.705
<00:27:45.525>to, <00:27:45.680>but <00:27:45.836>not <00:27:45.991>really <00:27:46.147>one <00:27:46.302>level <00:27:46.458>above <00:27:46.613>CNC <00:27:46.769>plus <00:27:46.925>plus,

635
00:27:49.245 --> 00:27:51.545
<00:27:49.245>but <00:27:49.478>they <00:27:49.711>come <00:27:49.945>with <00:27:50.178>mostly <00:27:50.411>memory <00:27:50.645>safety.

636
00:27:51.555 --> 00:27:52.865
<00:27:51.555>There <00:27:51.849>are, <00:27:52.144>they <00:27:52.439>have <00:27:52.734>constructs

637
00:27:52.865 --> 00:27:54.785
<00:27:52.865>where <00:27:53.098>you <00:27:53.331>still <00:27:53.565>have <00:27:53.798>this <00:27:54.031>point <00:27:54.265>arithmetics.

638
00:27:54.785 --> 00:27:57.905
<00:27:54.785>So <00:27:55.018>you <00:27:55.251>can, <00:27:55.485>uh, <00:27:55.718>basically, <00:27:55.951>uh, <00:27:56.185>work

639
00:27:57.965 --> 00:27:59.705
<00:27:57.965>around <00:27:58.431>this <00:27:58.898>protection <00:27:59.365>mechanisms,

640
00:27:59.705 --> 00:28:02.945
<00:27:59.705>but <00:27:59.845>at <00:27:59.985>least <00:28:00.125>you <00:28:00.264>can <00:28:00.405>look <00:28:00.544>specifically <00:28:00.685>at <00:28:00.824>those <00:28:00.965>places <00:28:01.105>in

641
00:28:02.945 --> 00:28:04.545
<00:28:02.945>the <00:28:03.120>code <00:28:03.294>where <00:28:03.470>you <00:28:03.645>don't <00:28:03.820>have <00:28:03.995>the <00:28:04.169>memory <00:28:04.345>safety

642
00:28:04.605 --> 00:28:05.865
<00:28:04.605>and <00:28:04.794>you <00:28:04.983>have, <00:28:05.172>you <00:28:05.361>can <00:28:05.550>check <00:28:05.739>it.

643
00:28:06.365 --> 00:28:08.065
<00:28:06.365>Uh, <00:28:06.598>with <00:28:06.831>CNC <00:28:07.065>plus <00:28:07.298>plus <00:28:07.531>code <00:28:07.765>basis,

644
00:28:08.125 --> 00:28:09.265
<00:28:08.125>you <00:28:08.296>have <00:28:08.467>to <00:28:08.638>look <00:28:08.809>at <00:28:08.980>many <00:28:09.151>spots.

645
00:28:09.265 --> 00:28:11.105
<00:28:09.265>There <00:28:09.545>are <00:28:09.825>many <00:28:10.105>different, <00:28:10.385>uh, <00:28:10.665>possibilities

646
00:28:11.245 --> 00:28:12.905
<00:28:11.245>to <00:28:11.478>have <00:28:11.711>a <00:28:11.945>buffer <00:28:12.178>overflow, <00:28:12.411>for <00:28:12.645>example,

647
00:28:13.765 --> 00:28:16.625
<00:28:13.765>and <00:28:13.965>interpreted <00:28:14.165>languages <00:28:14.365>like <00:28:14.565>PHB, <00:28:14.765>Python <00:28:14.965>and <00:28:15.165>Ruby.

648
00:28:16.855 --> 00:28:17.865
<00:28:16.855>They <00:28:17.158>have <00:28:17.461>memory <00:28:17.764>safety.

649
00:28:17.925 --> 00:28:19.985
<00:28:17.925>So <00:28:18.065>there's <00:28:18.205>no <00:28:18.345>point <00:28:18.485>or <00:28:18.625>arithmetic <00:28:18.764>that <00:28:18.905>you <00:28:19.044>can <00:28:19.185>do <00:28:19.325>there.

650
00:28:21.525 --> 00:28:24.625
<00:28:21.525>Oh, <00:28:21.725>alright. <00:28:21.925>Pipe <00:28:22.125>system. <00:28:22.325>That's <00:28:22.525>the <00:28:22.725>difficult <00:28:22.925>part.

651
00:28:24.725 --> 00:28:26.705
<00:28:24.725>Uh, <00:28:24.865>I <00:28:25.004>will <00:28:25.145>try <00:28:25.284>to <00:28:25.425>get <00:28:25.564>as <00:28:25.705>close <00:28:25.844>to <00:28:25.985>the <00:28:26.125>truth

652
00:28:26.765 --> 00:28:28.545
<00:28:26.765>as <00:28:27.231>I <00:28:27.698>humanly <00:28:28.165>can.

653
00:28:29.045 --> 00:28:30.585
<00:28:29.045>Um, <00:28:29.507>so <00:28:29.969>type <00:28:30.431>strictness,

654
00:28:30.745 --> 00:28:33.025
<00:28:30.745>I <00:28:30.919>call <00:28:31.094>it <00:28:31.270>touch <00:28:31.445>strictness <00:28:31.620>has <00:28:31.794>two <00:28:31.969>different <00:28:32.145>flavors.

655
00:28:33.685 --> 00:28:35.865
<00:28:33.685>We <00:28:33.965>have <00:28:34.245>static <00:28:34.524>versus <00:28:34.804>dynamic <00:28:35.085>typing,

656
00:28:36.125 --> 00:28:38.545
<00:28:36.125>and <00:28:36.300>we <00:28:36.475>have <00:28:36.650>strong <00:28:36.825>versus <00:28:37.000>loose <00:28:37.175>or <00:28:37.350>weak <00:28:37.525>typing.

657
00:28:39.365 --> 00:28:41.465
<00:28:39.365>Uh, <00:28:39.645>that's <00:28:39.925>two <00:28:40.205>different <00:28:40.485>things <00:28:40.765>really.

658
00:28:42.355 --> 00:28:44.705
<00:28:42.355>Let's <00:28:42.530>have <00:28:42.705>a <00:28:42.880>look <00:28:43.055>at <00:28:43.230>static <00:28:43.405>versus <00:28:43.580>dynamic <00:28:43.755>typing.

659
00:28:44.845 --> 00:28:48.585
<00:28:44.845>So <00:28:45.045>static <00:28:45.245>types <00:28:45.445>are <00:28:45.645>checked <00:28:45.845>during <00:28:46.045>compile <00:28:46.245>time.

660
00:28:48.725 --> 00:28:50.905
<00:28:48.725>So <00:28:48.880>if <00:28:49.036>you <00:28:49.191>look <00:28:49.347>at <00:28:49.502>this <00:28:49.658>code <00:28:49.813>sample <00:28:49.969>down <00:28:50.125>here,

661
00:28:50.905 --> 00:28:52.105
<00:28:50.905>for <00:28:51.175>example, <00:28:51.445>that's <00:28:51.715>CAVA <00:28:51.985>code.

662
00:28:52.885 --> 00:28:56.185
<00:28:52.885>Um, <00:28:53.025>you <00:28:53.165>can <00:28:53.305>see <00:28:53.445>that <00:28:53.585>this <00:28:53.725>ad <00:28:53.865>function <00:28:54.004>takes <00:28:54.145>an <00:28:54.285>integer

663
00:28:56.205 --> 00:28:58.225
<00:28:56.205>and <00:28:56.438>another <00:28:56.671>integer <00:28:56.905>and <00:28:57.138>adds <00:28:57.371>those <00:28:57.605>two

664
00:28:58.285 --> 00:29:00.145
<00:28:58.285>and <00:28:58.635>it <00:28:58.985>returns <00:28:59.335>an <00:28:59.685>integer.

665
00:29:01.325 --> 00:29:05.545
<00:29:01.325>Now, <00:29:01.465>um, <00:29:01.605>if <00:29:01.745>I <00:29:01.885>call <00:29:02.025>this <00:29:02.165>function <00:29:02.305>here <00:29:02.445>with <00:29:02.585>a <00:29:02.725>string

666
00:29:05.545 --> 00:29:08.105
<00:29:05.545>and <00:29:05.745>a <00:29:05.945>string, <00:29:06.145>it's <00:29:06.345>not <00:29:06.545>gonna <00:29:06.745>work <00:29:06.945>first,

667
00:29:08.365 --> 00:29:10.265
<00:29:08.365>but <00:29:08.598>when <00:29:08.831>is <00:29:09.065>the <00:29:09.298>problem <00:29:09.531>gonna <00:29:09.765>arise?

668
00:29:10.295 --> 00:29:12.185
<00:29:10.295>It's <00:29:10.528>gonna <00:29:10.761>arise <00:29:10.995>at <00:29:11.228>compile <00:29:11.461>time <00:29:11.695>When,

669
00:29:12.185 --> 00:29:13.385
<00:29:12.185>so <00:29:12.400>when <00:29:12.617>I <00:29:12.833>compile <00:29:13.049>this <00:29:13.264>program,

670
00:29:14.085 --> 00:29:15.505
<00:29:14.085>the <00:29:14.298>compiler <00:29:14.511>is <00:29:14.724>gonna <00:29:14.937>throw <00:29:15.150>an <00:29:15.363>error,

671
00:29:15.565 --> 00:29:17.905
<00:29:15.565>so <00:29:15.705>I <00:29:15.845>will <00:29:15.985>never <00:29:16.125>have <00:29:16.265>the <00:29:16.405>ability <00:29:16.545>to <00:29:16.685>run <00:29:16.825>this <00:29:16.965>software.

672
00:29:19.205 --> 00:29:22.505
<00:29:19.205>Uh, <00:29:19.360>so <00:29:19.516>that's <00:29:19.671>static <00:29:19.827>typing. <00:29:19.982>Then <00:29:20.138>I <00:29:20.293>have <00:29:20.449>dynamic <00:29:20.605>typing.

673
00:29:22.965 --> 00:29:24.785
<00:29:22.965>So <00:29:23.198>the <00:29:23.431>types <00:29:23.665>of <00:29:23.898>checked <00:29:24.131>during <00:29:24.365>runtime.

674
00:29:25.165 --> 00:29:28.705
<00:29:25.165>So <00:29:25.305>this <00:29:25.445>is <00:29:25.585>a <00:29:25.725>PHP <00:29:25.865>script <00:29:26.004>and <00:29:26.145>I <00:29:26.284>have <00:29:26.425>this <00:29:26.565>function

675
00:29:28.725 --> 00:29:30.705
<00:29:28.725>and <00:29:28.925>I <00:29:29.125>have <00:29:29.324>two <00:29:29.524>variables <00:29:29.725>that <00:29:29.925>are <00:29:30.125>added.

676
00:29:31.685 --> 00:29:35.745
<00:29:31.685>Um, <00:29:31.812>and <00:29:31.939>there <00:29:32.066>is <00:29:32.194>no, <00:29:32.321>uh, <00:29:32.448>definition <00:29:32.575>of <00:29:32.703>what <00:29:32.830>those <00:29:32.957>types <00:29:33.085>are.

677
00:29:36.045 --> 00:29:38.145
<00:29:36.045>So <00:29:36.185>this <00:29:36.325>could, <00:29:36.465>could <00:29:36.605>be <00:29:36.745>a <00:29:36.885>string, <00:29:37.025>could <00:29:37.165>be <00:29:37.305>an <00:29:37.445>editor,

678
00:29:38.145 --> 00:29:39.665
<00:29:38.145>it <00:29:38.340>could <00:29:38.535>be <00:29:38.731>a <00:29:38.926>float, <00:29:39.122>could <00:29:39.317>be <00:29:39.513>anything.

679
00:29:40.485 --> 00:29:44.045
<00:29:40.485>Um, <00:29:40.659>so <00:29:40.834>there's <00:29:41.010>no <00:29:41.185>compilation. <00:29:41.360>It's <00:29:41.534>an <00:29:41.709>interpreted <00:29:41.885>language.

680
00:29:44.505 --> 00:29:45.685
<00:29:44.505>Um, <00:29:44.859>but <00:29:45.213>even <00:29:45.567>during

681
00:29:45.685 --> 00:29:47.765
<00:29:45.685>that <00:29:45.860>translation <00:29:46.034>phase, <00:29:46.210>it's <00:29:46.385>not <00:29:46.560>gonna <00:29:46.735>throw <00:29:46.909>an <00:29:47.085>error.

682
00:29:47.765 --> 00:29:50.165
<00:29:47.765>It's <00:29:47.920>only <00:29:48.076>gonna <00:29:48.231>throw <00:29:48.387>an <00:29:48.542>error <00:29:48.698>when <00:29:48.853>calling <00:29:49.009>that <00:29:49.165>function

683
00:29:50.195 --> 00:29:51.405
<00:29:50.195>with <00:29:50.558>the <00:29:50.921>wrong <00:29:51.283>types

684
00:29:52.025 --> 00:29:54.845
<00:29:52.025>or, <00:29:52.180>um, <00:29:52.336>most <00:29:52.491>of <00:29:52.647>the <00:29:52.802>types <00:29:52.958>are <00:29:53.113>even <00:29:53.269>gonna <00:29:53.425>work.

685
00:29:54.965 --> 00:29:57.525
<00:29:54.965>I <00:29:55.105>can <00:29:55.245>add <00:29:55.385>a <00:29:55.524>string <00:29:55.665>to <00:29:55.804>an <00:29:55.945>integer <00:29:56.084>with <00:29:56.225>a <00:29:56.365>plus.

686
00:29:58.305 --> 00:30:00.325
<00:29:58.305>Uh, <00:29:58.585>it's <00:29:58.865>gonna <00:29:59.145>gimme <00:29:59.425>weird <00:29:59.705>results.

687
00:30:00.435 --> 00:30:02.925
<00:30:00.435>It's <00:30:00.575>even <00:30:00.715>not <00:30:00.855>going <00:30:00.995>to <00:30:01.135>give <00:30:01.274>me <00:30:01.415>an <00:30:01.554>error <00:30:01.695>probably <00:30:01.835>in

688
00:30:02.925 --> 00:30:03.965
<00:30:02.925>some <00:30:03.393>situations, <00:30:03.860>right?

689
00:30:04.505 --> 00:30:07.405
<00:30:04.505>So <00:30:04.680>with <00:30:04.855>static <00:30:05.030>typing, <00:30:05.205>everything <00:30:05.380>happens <00:30:05.555>at <00:30:05.730>compile <00:30:05.905>time

690
00:30:07.435 --> 00:30:11.965
<00:30:07.435>with <00:30:07.668>dynamic <00:30:07.901>typing, <00:30:08.135>um, <00:30:08.368>happens <00:30:08.601>during <00:30:08.835>runtime,

691
00:30:12.995 --> 00:30:15.285
<00:30:12.995>then <00:30:13.169>I <00:30:13.344>have <00:30:13.520>strong <00:30:13.695>versus <00:30:13.870>weak <00:30:14.044>or <00:30:14.219>loose <00:30:14.395>typing.

692
00:30:16.465 --> 00:30:19.965
<00:30:16.465>Um, <00:30:16.665>and <00:30:16.865>that <00:30:17.064>means <00:30:17.264>the <00:30:17.465>strong <00:30:17.665>versus <00:30:17.865>weak.

693
00:30:20.095 --> 00:30:23.365
<00:30:20.095>Everything <00:30:20.328>goes <00:30:20.561>towards <00:30:20.795>the <00:30:21.028>type <00:30:21.261>coer <00:30:21.495>coercion.

694
00:30:23.985 --> 00:30:27.725
<00:30:23.985>Um, <00:30:24.159>so <00:30:24.334>it <00:30:24.510>means <00:30:24.685>that <00:30:24.860>during <00:30:25.034>runtime, <00:30:25.209>the <00:30:25.385>types

695
00:30:27.785 --> 00:30:31.965
<00:30:27.785>of <00:30:28.065>variables <00:30:28.345>can <00:30:28.625>be <00:30:28.905>basically <00:30:29.185>forcibly

696
00:30:32.635 --> 00:30:36.325
<00:30:32.635>cast <00:30:32.775>to <00:30:32.915>another <00:30:33.055>type, <00:30:33.195>and <00:30:33.335>it's <00:30:33.475>gonna <00:30:33.615>give <00:30:33.754>me <00:30:33.895>weird <00:30:34.035>results.

697
00:30:36.785 --> 00:30:39.085
<00:30:36.785>So <00:30:37.065>in, <00:30:37.345>in <00:30:37.625>some <00:30:37.905>situations, <00:30:38.185>um,

698
00:30:39.465 --> 00:30:41.205
<00:30:39.465>in <00:30:39.698>c <00:30:39.931>plus <00:30:40.165>plus, <00:30:40.398>it's <00:30:40.631>not <00:30:40.865>possible.

699
00:30:41.205 --> 00:30:42.445
<00:30:41.205>So <00:30:41.428>if <00:30:41.651>I <00:30:41.874>define <00:30:42.097>an <00:30:42.321>integer

700
00:30:42.745 --> 00:30:45.965
<00:30:42.745>and <00:30:42.885>I've <00:30:43.024>tried <00:30:43.165>to <00:30:43.304>assign <00:30:43.445>a <00:30:43.584>string, <00:30:43.725>uh, <00:30:43.864>this <00:30:44.004>is <00:30:44.145>going

701
00:30:45.965 --> 00:30:47.765
<00:30:45.965>to <00:30:46.198>yield <00:30:46.431>the <00:30:46.665>problem <00:30:46.898>during <00:30:47.131>compile <00:30:47.365>time.

702
00:30:48.465 --> 00:30:50.365
<00:30:48.465>Uh, <00:30:48.665>and <00:30:48.865>here, <00:30:49.064>uh, <00:30:49.264>this <00:30:49.465>is <00:30:49.665>gonna <00:30:49.865>work

703
00:30:50.365 --> 00:30:54.565
<00:30:50.365>because, <00:30:50.492>uh, <00:30:50.619>you <00:30:50.746>know, <00:30:50.874>if <00:30:51.001>I <00:30:51.128>have <00:30:51.255>an <00:30:51.383>integer <00:30:51.510>plus <00:30:51.637>a <00:30:51.765>string

704
00:30:55.185 --> 00:30:57.845
<00:30:55.185>in <00:30:55.465>JavaScript, <00:30:55.745>which <00:30:56.024>is <00:30:56.304>loosely <00:30:56.585>typed,

705
00:30:58.115 --> 00:31:01.005
<00:30:58.115>this <00:30:58.270>is <00:30:58.426>gonna <00:30:58.581>yield <00:30:58.737>a <00:30:58.892>result <00:30:59.048>that's <00:30:59.203>maybe <00:30:59.359>not <00:30:59.515>expected.

706
00:31:01.145 --> 00:31:04.565
<00:31:01.145>Or, <00:31:01.378>you <00:31:01.611>know, <00:31:01.845>that's, <00:31:02.078>uh, <00:31:02.311>only <00:31:02.545>detectable

707
00:31:04.565 --> 00:31:05.685
<00:31:04.565>during <00:31:04.817>runtime <00:31:05.069>in <00:31:05.321>this <00:31:05.572>case.

708
00:31:06.625 --> 00:31:09.835
<00:31:06.625>So <00:31:06.780>there <00:31:06.936>are <00:31:07.091>languages <00:31:07.247>that <00:31:07.402>have <00:31:07.558>a <00:31:07.713>strict <00:31:07.869>type <00:31:08.025>system.

709
00:31:09.835 --> 00:31:11.515
<00:31:09.835>There <00:31:10.010>are <00:31:10.185>languages <00:31:10.360>that <00:31:10.535>have <00:31:10.710>a <00:31:10.885>loose <00:31:11.060>type <00:31:11.235>system.

710
00:31:11.855 --> 00:31:13.795
<00:31:11.855>Why <00:31:12.055>do <00:31:12.255>we <00:31:12.455>care? <00:31:12.655>We're <00:31:12.855>talking <00:31:13.055>about <00:31:13.255>security

711
00:31:13.795 --> 00:31:14.795
<00:31:13.795>and <00:31:14.095>secure <00:31:14.395>coding, <00:31:14.695>right?

712
00:31:15.655 --> 00:31:18.515
<00:31:15.655>So <00:31:15.888>stricter <00:31:16.121>type <00:31:16.355>systems <00:31:16.588>have <00:31:16.821>long-term <00:31:17.055>advantages.

713
00:31:19.125 --> 00:31:23.035
<00:31:19.125>There <00:31:19.300>are <00:31:19.475>more <00:31:19.650>errors <00:31:19.825>gonna <00:31:20.000>happen <00:31:20.175>during <00:31:20.350>compile <00:31:20.525>time,

714
00:31:23.175 --> 00:31:26.555
<00:31:23.175>but <00:31:23.315>tend, <00:31:23.455>so <00:31:23.595>they <00:31:23.735>tend <00:31:23.875>to <00:31:24.014>have <00:31:24.155>less <00:31:24.294>problems <00:31:24.435>during <00:31:24.575>runtime.

715
00:31:26.935 --> 00:31:28.635
<00:31:26.935>So <00:31:27.135>we <00:31:27.335>have <00:31:27.534>le <00:31:27.735>less <00:31:27.935>of <00:31:28.135>those <00:31:28.335>unexpected

716
00:31:28.655 --> 00:31:30.075
<00:31:28.655>and <00:31:28.974>hard <00:31:29.294>to <00:31:29.613>debug <00:31:29.933>errors.

717
00:31:30.745 --> 00:31:34.995
<00:31:30.745>Also, <00:31:30.978>uh, <00:31:31.211>you <00:31:31.445>know, <00:31:31.678>speaking <00:31:31.911>of, <00:31:32.145>uh,

718
00:31:35.385 --> 00:31:38.555
<00:31:35.385>initial <00:31:35.665>velocity <00:31:35.945>versus <00:31:36.225>sustained <00:31:36.504>velocity, <00:31:36.785>um,

719
00:31:38.945 --> 00:31:41.195
<00:31:38.945>when <00:31:39.178>we <00:31:39.411>have <00:31:39.645>a <00:31:39.878>stricter <00:31:40.111>type <00:31:40.345>system,

720
00:31:41.745 --> 00:31:43.595
<00:31:41.745>refactoring <00:31:42.094>is <00:31:42.445>gonna <00:31:42.794>happen <00:31:43.145>faster.

721
00:31:43.655 --> 00:31:46.235
<00:31:43.655>So <00:31:43.855>I <00:31:44.055>can <00:31:44.254>refactor <00:31:44.455>my <00:31:44.655>code <00:31:44.855>easier <00:31:45.055>also

722
00:31:46.235 --> 00:31:49.955
<00:31:46.235>because <00:31:46.375>my, <00:31:46.514>uh, <00:31:46.655>IDE <00:31:46.794>is <00:31:46.935>gonna <00:31:47.074>tell <00:31:47.215>me <00:31:47.354>things <00:31:47.495>like, <00:31:47.635>uh,

723
00:31:49.955 --> 00:31:51.395
<00:31:49.955>what <00:31:50.214>type <00:31:50.473>is <00:31:50.732>this <00:31:50.991>gonna <00:31:51.251>be?

724
00:31:52.135 --> 00:31:55.515
<00:31:52.135>Um, <00:31:52.275>everyone <00:31:52.415>who <00:31:52.555>has <00:31:52.695>tried <00:31:52.835>to <00:31:52.975>code <00:31:53.115>some <00:31:53.254>ECMO <00:31:53.395>script <00:31:53.535>five

725
00:31:55.535 --> 00:31:57.835
<00:31:55.535>or <00:31:55.815>vanilla <00:31:56.095>JavaScript <00:31:56.375>with <00:31:56.655>an <00:31:56.935>IDE

726
00:31:58.295 --> 00:32:01.475
<00:31:58.295>and <00:31:58.470>expected <00:31:58.645>some <00:31:58.820>type <00:31:58.995>hints <00:31:59.170>that <00:31:59.345>makes <00:31:59.520>sense, <00:31:59.695>knows

727
00:32:01.475 --> 00:32:03.555
<00:32:01.475>that <00:32:01.708>it's <00:32:01.941>very <00:32:02.175>hard <00:32:02.408>with, <00:32:02.641>with <00:32:02.875>JavaScript

728
00:32:03.555 --> 00:32:05.315
<00:32:03.555>as <00:32:03.755>languages <00:32:03.955>is <00:32:04.155>a <00:32:04.355>very <00:32:04.555>loose <00:32:04.755>type <00:32:04.955>system.

729
00:32:05.655 --> 00:32:07.395
<00:32:05.655>As <00:32:05.855>opposed <00:32:06.055>to <00:32:06.254>when <00:32:06.455>I <00:32:06.655>write <00:32:06.855>J <00:32:07.055>software

730
00:32:07.395 --> 00:32:10.355
<00:32:07.395>and <00:32:07.550>Java, <00:32:07.706>for <00:32:07.861>example, <00:32:08.017>the <00:32:08.172>type <00:32:08.328>hints <00:32:08.483>are <00:32:08.639>very <00:32:08.795>reliable.

731
00:32:10.615 --> 00:32:12.955
<00:32:10.615>That's <00:32:10.815>because <00:32:11.015>Java <00:32:11.215>has <00:32:11.415>a <00:32:11.615>stricter <00:32:11.815>type <00:32:12.015>system.

732
00:32:14.055 --> 00:32:15.755
<00:32:14.055>Now, <00:32:14.335>still <00:32:14.615>not <00:32:14.895>talking <00:32:15.175>about <00:32:15.455>security,

733
00:32:16.135 --> 00:32:17.355
<00:32:16.135>but <00:32:16.409>now <00:32:16.684>I, <00:32:16.958>I <00:32:17.233>get

734
00:32:17.355 --> 00:32:20.075
<00:32:17.355>to <00:32:17.530>the <00:32:17.705>point <00:32:17.880>we <00:32:18.055>have <00:32:18.230>better <00:32:18.405>tools <00:32:18.580>support <00:32:18.755>also

735
00:32:20.075 --> 00:32:21.075
<00:32:20.075>for <00:32:20.525>security <00:32:20.975>tools.

736
00:32:21.655 --> 00:32:24.795
<00:32:21.655>Uh, <00:32:21.830>SAS <00:32:22.004>is <00:32:22.180>short <00:32:22.355>for <00:32:22.530>static <00:32:22.705>application <00:32:22.879>security <00:32:23.055>testing.

737
00:32:25.535 --> 00:32:27.795
<00:32:25.535>That's <00:32:25.815>tools <00:32:26.095>that <00:32:26.375>analyze <00:32:26.655>your <00:32:26.935>software,

738
00:32:28.535 --> 00:32:30.515
<00:32:28.535>not <00:32:28.815>while <00:32:29.095>it's <00:32:29.375>running, <00:32:29.655>but <00:32:29.935>statically.

739
00:32:30.535 --> 00:32:32.675
<00:32:30.535>So <00:32:30.815>it's <00:32:31.095>basically <00:32:31.375>building <00:32:31.655>your <00:32:31.935>software

740
00:32:33.415 --> 00:32:35.395
<00:32:33.415>and <00:32:33.648>it's <00:32:33.881>building <00:32:34.115>an <00:32:34.348>abstract <00:32:34.581>syn <00:32:34.815>tree.

741
00:32:35.395 --> 00:32:37.955
<00:32:35.395>That's <00:32:35.595>basically <00:32:35.795>all <00:32:35.995>the <00:32:36.195>ways <00:32:36.395>that <00:32:36.595>it <00:32:36.795>has

742
00:32:37.955 --> 00:32:41.365
<00:32:37.955>through <00:32:38.095>your <00:32:38.235>code <00:32:38.375>from <00:32:38.514>input <00:32:38.655>to <00:32:38.794>a <00:32:38.935>sync <00:32:39.074>to <00:32:39.215>something <00:32:39.355>that,

743
00:32:41.385 --> 00:32:43.525
<00:32:41.385>for <00:32:41.618>example, <00:32:41.851>yields <00:32:42.085>an <00:32:42.318>SGL <00:32:42.551>L <00:32:42.785>statement.

744
00:32:43.905 --> 00:32:46.845
<00:32:43.905>Now, <00:32:44.045>if <00:32:44.185>you <00:32:44.325>have <00:32:44.465>an <00:32:44.605>a <00:32:44.745>not <00:32:44.885>so <00:32:45.024>strict <00:32:45.165>type <00:32:45.305>system,

745
00:32:47.355 --> 00:32:50.085
<00:32:47.355>this <00:32:47.530>app <00:32:47.705>six <00:32:47.880>industry <00:32:48.055>tends <00:32:48.230>to <00:32:48.405>be <00:32:48.580>very <00:32:48.755>complex.

746
00:32:50.145 --> 00:32:52.725
<00:32:50.145>It <00:32:50.300>tends <00:32:50.456>to <00:32:50.611>blow <00:32:50.767>up, <00:32:50.922>but <00:32:51.078>only <00:32:51.233>one <00:32:51.389>or <00:32:51.545>two

747
00:32:52.725 --> 00:32:55.845
<00:32:52.725>or <00:32:52.880>three <00:32:53.036>of <00:32:53.191>those <00:32:53.347>ways <00:32:53.502>are <00:32:53.658>actually <00:32:53.813>relevant <00:32:53.969>during <00:32:54.125>runtime

748
00:32:55.845 --> 00:32:58.445
<00:32:55.845>because <00:32:56.000>it's <00:32:56.156>always <00:32:56.311>gonna <00:32:56.467>be <00:32:56.622>used <00:32:56.778>through <00:32:56.933>this <00:32:57.089>and <00:32:57.245>this

749
00:32:58.445 --> 00:33:01.045
<00:32:58.445>and <00:32:58.585>this <00:32:58.725>way, <00:32:58.865>and <00:32:59.004>not <00:32:59.145>the, <00:32:59.284>under <00:32:59.425>the <00:32:59.564>other <00:32:59.705>97 <00:32:59.845>ways

750
00:33:02.025 --> 00:33:03.245
<00:33:02.025>for <00:33:02.391>stricter <00:33:02.757>type <00:33:03.122>systems.

751
00:33:03.345 --> 00:33:07.325
<00:33:03.345>It <00:33:03.472>is <00:33:03.599>easier <00:33:03.726>because, <00:33:03.854>um, <00:33:03.981>the <00:33:04.108>SaaS <00:33:04.235>tool <00:33:04.363>is <00:33:04.490>gonna <00:33:04.617>know <00:33:04.745>where

752
00:33:07.985 --> 00:33:09.565
<00:33:07.985>the <00:33:08.159>data <00:33:08.334>is <00:33:08.510>coming <00:33:08.685>from, <00:33:08.860>where <00:33:09.034>it's <00:33:09.209>going <00:33:09.385>to,

753
00:33:09.565 --> 00:33:10.605
<00:33:09.565>what <00:33:09.799>are <00:33:10.033>the <00:33:10.267>possible <00:33:10.501>ways,

754
00:33:11.185 --> 00:33:14.485
<00:33:11.185>and <00:33:11.312>it's <00:33:11.439>gonna <00:33:11.566>boil <00:33:11.694>down <00:33:11.821>to <00:33:11.948>only <00:33:12.075>the <00:33:12.203>ways <00:33:12.330>that <00:33:12.457>are <00:33:12.585>actually

755
00:33:15.085 --> 00:33:16.365
<00:33:15.085>relevant <00:33:15.469>also <00:33:15.853>during <00:33:16.237>runtime.

756
00:33:16.745 --> 00:33:19.125
<00:33:16.745>So <00:33:16.945>for <00:33:17.145>stricter <00:33:17.344>type <00:33:17.544>systems, <00:33:17.745>we <00:33:17.945>have <00:33:18.145>better

757
00:33:19.675 --> 00:33:20.885
<00:33:19.675>automated <00:33:20.219>tool <00:33:20.764>support.

758
00:33:20.905 --> 00:33:24.965
<00:33:20.905>So <00:33:21.060>that's <00:33:21.216>why <00:33:21.371>this <00:33:21.527>is <00:33:21.682>also <00:33:21.838>indirectly <00:33:21.993>a <00:33:22.149>security <00:33:22.305>criteria.

759
00:33:26.605 --> 00:33:29.345
<00:33:26.605>Um, <00:33:26.780>parallelization, <00:33:26.955>as <00:33:27.130>I <00:33:27.305>said, <00:33:27.480>that's <00:33:27.655>an <00:33:27.830>advanced <00:33:28.005>topic

760
00:33:29.345 --> 00:33:31.305
<00:33:29.345>that's <00:33:29.695>not <00:33:30.045>directly <00:33:30.395>security <00:33:30.745>related,

761
00:33:31.565 --> 00:33:33.945
<00:33:31.565>but <00:33:31.798>some <00:33:32.031>languages <00:33:32.265>are <00:33:32.498>designed <00:33:32.731>for <00:33:32.965>robust

762
00:33:34.585 --> 00:33:37.145
<00:33:34.585>parallel <00:33:34.760>computing, <00:33:34.935>and <00:33:35.110>you <00:33:35.285>can <00:33:35.460>see <00:33:35.635>some <00:33:35.810>examples <00:33:35.985>here.

763
00:33:37.545 --> 00:33:39.545
<00:33:37.545>Closure, <00:33:37.895>elixir, <00:33:38.245>ellan, <00:33:38.595>haskell, <00:33:38.945>rust.

764
00:33:40.115 --> 00:33:43.185
<00:33:40.115>These <00:33:40.290>are <00:33:40.465>languages <00:33:40.640>that <00:33:40.815>are <00:33:40.990>designed <00:33:41.165>for <00:33:41.340>parallel <00:33:41.515>computing

765
00:33:43.685 --> 00:33:46.385
<00:33:43.685>and, <00:33:43.825>uh, <00:33:43.965>you <00:33:44.105>know, <00:33:44.245>updating <00:33:44.385>and <00:33:44.524>keeping <00:33:44.665>state <00:33:44.804>and <00:33:44.945>so <00:33:45.085>on.

766
00:33:46.885 --> 00:33:48.425
<00:33:46.885>Uh, <00:33:47.116>others <00:33:47.347>have <00:33:47.578>less <00:33:47.809>focus <00:33:48.040>on <00:33:48.271>that.

767
00:33:48.965 --> 00:33:51.785
<00:33:48.965>Um, <00:33:49.198>if, <00:33:49.431>if <00:33:49.665>that's <00:33:49.898>an <00:33:50.131>important <00:33:50.365>criteria,

768
00:33:52.095 --> 00:33:55.185
<00:33:52.095>then <00:33:52.250>inform <00:33:52.406>yourself <00:33:52.561>what <00:33:52.717>might <00:33:52.872>be <00:33:53.028>a <00:33:53.183>language <00:33:53.339>that <00:33:53.495>works.

769
00:33:55.685 --> 00:33:59.465
<00:33:55.685>Um, <00:33:55.840>it <00:33:55.996>doesn't <00:33:56.151>have <00:33:56.307>so <00:33:56.462>much, <00:33:56.618>uh, <00:33:56.773>directly <00:33:56.929>security <00:33:57.085>related,

770
00:34:00.205 --> 00:34:03.145
<00:34:00.205>uh, <00:34:00.485>things <00:34:00.764>on <00:34:01.044>it <00:34:01.324>sandbox <00:34:01.605>support.

771
00:34:04.165 --> 00:34:06.665
<00:34:04.165>Uh, <00:34:04.340>when <00:34:04.514>we <00:34:04.690>write <00:34:04.865>software, <00:34:05.040>we <00:34:05.215>have <00:34:05.389>to <00:34:05.565>suppose

772
00:34:06.665 --> 00:34:09.625
<00:34:06.665>that <00:34:06.820>there <00:34:06.976>will <00:34:07.131>be <00:34:07.287>vulnerabilities, <00:34:07.442>so <00:34:07.598>there <00:34:07.753>will <00:34:07.909>be <00:34:08.065>bugs

773
00:34:09.625 --> 00:34:11.185
<00:34:09.625>that <00:34:09.975>have <00:34:10.324>a <00:34:10.675>security <00:34:11.025>impact.

774
00:34:12.085 --> 00:34:16.315
<00:34:12.085>Um, <00:34:12.284>attack <00:34:12.485>surface <00:34:12.685>reduction <00:34:12.885>is <00:34:13.085>very <00:34:13.284>important <00:34:13.485>when

775
00:34:16.315 --> 00:34:20.995
<00:34:16.315>designing <00:34:16.490>systems <00:34:16.665>so <00:34:16.840>that <00:34:17.014>when <00:34:17.190>your <00:34:17.365>process <00:34:17.540>gets, <00:34:17.715>um,

776
00:34:21.105 --> 00:34:23.995
<00:34:21.105>gets <00:34:21.304>compromised <00:34:21.505>or <00:34:21.705>your, <00:34:21.905>your <00:34:22.105>application <00:34:22.304>gets <00:34:22.505>compromised,

777
00:34:24.735 --> 00:34:26.635
<00:34:24.735>um, <00:34:24.935>it's <00:34:25.135>important <00:34:25.335>to <00:34:25.535>limit <00:34:25.735>the <00:34:25.935>blast <00:34:26.135>radius.

778
00:34:26.635 --> 00:34:28.315
<00:34:26.635>So <00:34:26.810>what <00:34:26.985>an <00:34:27.160>attacker <00:34:27.335>might <00:34:27.510>be <00:34:27.685>able <00:34:27.860>to <00:34:28.035>do

779
00:34:28.465 --> 00:34:30.475
<00:34:28.465>with <00:34:28.698>your <00:34:28.931>process <00:34:29.165>when <00:34:29.398>they <00:34:29.631>control <00:34:29.865>it.

780
00:34:31.135 --> 00:34:33.395
<00:34:31.135>Um, <00:34:31.415>so <00:34:31.695>locking <00:34:31.975>the <00:34:32.255>process <00:34:32.535>down

781
00:34:33.395 --> 00:34:36.435
<00:34:33.395>to <00:34:33.594>only <00:34:33.795>the <00:34:33.995>necessary <00:34:34.195>capabilities <00:34:34.395>is <00:34:34.594>a <00:34:34.795>key

782
00:34:36.455 --> 00:34:38.275
<00:34:36.455>to <00:34:36.921>hardening <00:34:37.388>your <00:34:37.855>environment.

783
00:34:38.885 --> 00:34:41.235
<00:34:38.885>There <00:34:39.060>are, <00:34:39.235>there <00:34:39.410>are <00:34:39.585>sandbox <00:34:39.760>technology <00:34:39.935>that <00:34:40.110>can <00:34:40.285>help.

784
00:34:41.385 --> 00:34:42.795
<00:34:41.385>Just <00:34:41.638>to <00:34:41.892>give <00:34:42.146>you <00:34:42.400>some <00:34:42.654>hints.

785
00:34:43.005 --> 00:34:46.315
<00:34:43.005>Again, <00:34:43.285>um, <00:34:43.565>this <00:34:43.845>is <00:34:44.125>this <00:34:44.405>course

786
00:34:46.315 --> 00:34:48.035
<00:34:46.315>or <00:34:46.548>this <00:34:46.781>training <00:34:47.014>is <00:34:47.248>made <00:34:47.481>for, <00:34:47.715>uh,

787
00:34:48.055 --> 00:34:50.315
<00:34:48.054>you <00:34:48.254>writing <00:34:48.455>down <00:34:48.654>what's <00:34:48.855>you <00:34:49.054>think <00:34:49.254>is <00:34:49.455>relevant

788
00:34:50.335 --> 00:34:52.355
<00:34:50.335>or <00:34:50.490>could <00:34:50.646>help <00:34:50.801>you <00:34:50.957>secure <00:34:51.112>a <00:34:51.268>software <00:34:51.423>and <00:34:51.579>then <00:34:51.735>go

789
00:34:52.455 --> 00:34:54.315
<00:34:52.455>and <00:34:52.630>also <00:34:52.804>do <00:34:52.980>some <00:34:53.154>deeper <00:34:53.330>research <00:34:53.505>on <00:34:53.679>those <00:34:53.855>things.

790
00:34:54.425 --> 00:34:57.155
<00:34:54.425>Here <00:34:54.580>I <00:34:54.736>give <00:34:54.891>you <00:34:55.047>some <00:34:55.202>hints <00:34:55.358>on, <00:34:55.513>uh, <00:34:55.669>sandbox <00:34:55.825>technology

791
00:34:57.665 --> 00:35:00.515
<00:34:57.665>that <00:34:57.865>can <00:34:58.065>help, <00:34:58.265>uh, <00:34:58.465>you <00:34:58.665>lock <00:34:58.865>down <00:34:59.065>processes.

792
00:35:01.135 --> 00:35:03.195
<00:35:01.135>Up <00:35:01.335>Armour <00:35:01.535>is <00:35:01.735>one <00:35:01.935>that <00:35:02.135>comes <00:35:02.335>with, <00:35:02.535>uh,

793
00:35:03.195 --> 00:35:07.115
<00:35:03.195>the <00:35:03.370>Ubuntu <00:35:03.545>Linux <00:35:03.720>distribution <00:35:03.895>SE <00:35:04.070>Linux, <00:35:04.245>uh, <00:35:04.420>is <00:35:04.595>also

794
00:35:07.675 --> 00:35:10.435
<00:35:07.675>a <00:35:07.875>Linux <00:35:08.075>Chrome <00:35:08.275>feature <00:35:08.475>feature <00:35:08.675>just <00:35:08.875>as, <00:35:09.075>uh,

795
00:35:10.535 --> 00:35:11.635
<00:35:10.535>sec <00:35:10.865>comp <00:35:11.195>for <00:35:11.525>example.

796
00:35:11.775 --> 00:35:13.915
<00:35:11.775>You <00:35:11.950>can, <00:35:12.125>uh, <00:35:12.300>limit <00:35:12.475>the <00:35:12.650>capabilities <00:35:12.825>in <00:35:13.000>terms <00:35:13.175>of,

797
00:35:13.915 --> 00:35:16.355
<00:35:13.915>for <00:35:14.070>example, <00:35:14.226>which <00:35:14.381>ports <00:35:14.537>can <00:35:14.692>be <00:35:14.848>opened <00:35:15.003>by <00:35:15.159>the <00:35:15.315>process,

798
00:35:16.405 --> 00:35:18.395
<00:35:16.405>which <00:35:16.560>files <00:35:16.716>can <00:35:16.871>be <00:35:17.027>read <00:35:17.182>or <00:35:17.338>written <00:35:17.493>by <00:35:17.649>the <00:35:17.805>process.

799
00:35:18.945 --> 00:35:22.835
<00:35:18.945>What <00:35:19.085>this <00:35:19.225>calls <00:35:19.365>basically, <00:35:19.505>uh, <00:35:19.645>it <00:35:19.785>can <00:35:19.925>call <00:35:20.065>it <00:35:20.205>can <00:35:20.345>use

800
00:35:23.805 --> 00:35:28.245
<00:35:23.805>CH <00:35:23.944>route, <00:35:24.085>uh, <00:35:24.225>can <00:35:24.365>be <00:35:24.504>used <00:35:24.645>to <00:35:24.785>sandbox <00:35:24.924>the <00:35:25.065>file <00:35:25.205>system.

801
00:35:28.265 --> 00:35:30.125
<00:35:28.265>So <00:35:28.464>giving <00:35:28.665>the <00:35:28.865>process <00:35:29.065>of <00:35:29.265>virtual <00:35:29.464>file <00:35:29.665>system

802
00:35:30.145 --> 00:35:32.525
<00:35:30.145>and <00:35:30.285>it, <00:35:30.425>it <00:35:30.565>looks <00:35:30.705>like <00:35:30.845>it's <00:35:30.985>only <00:35:31.125>seeing <00:35:31.265>these <00:35:31.405>three <00:35:31.545>files,

803
00:35:33.005 --> 00:35:35.325
<00:35:33.005>although <00:35:33.145>it <00:35:33.285>is <00:35:33.425>running <00:35:33.565>on <00:35:33.705>an <00:35:33.845>operating <00:35:33.985>system <00:35:34.125>that <00:35:34.265>has <00:35:34.405>more

804
00:35:36.585 --> 00:35:37.685
<00:35:36.585>on <00:35:36.915>the <00:35:37.245>platform <00:35:37.575>level.

805
00:35:37.905 --> 00:35:40.125
<00:35:37.905>The <00:35:38.138>browser <00:35:38.371>is <00:35:38.605>also <00:35:38.838>a <00:35:39.071>sandbox, <00:35:39.305>right?

806
00:35:40.155 --> 00:35:42.845
<00:35:40.155>With <00:35:40.505>JavaScript, <00:35:40.855>you <00:35:41.205>cannot <00:35:41.555>read

807
00:35:42.845 --> 00:35:46.045
<00:35:42.845>and <00:35:43.020>write <00:35:43.194>arbitrary <00:35:43.370>files <00:35:43.544>without <00:35:43.720>user <00:35:43.895>interaction <00:35:44.069>from <00:35:44.245>your

808
00:35:46.045 --> 00:35:49.765
<00:35:46.045>file <00:35:46.220>system, <00:35:46.395>although <00:35:46.570>the <00:35:46.745>language <00:35:46.920>itself <00:35:47.095>might <00:35:47.270>be <00:35:47.445>able

809
00:35:49.765 --> 00:35:51.405
<00:35:49.765>to <00:35:49.920>even <00:35:50.076>give <00:35:50.231>you <00:35:50.387>that <00:35:50.542>feature, <00:35:50.698>but <00:35:50.853>JavaScript <00:35:51.009>in <00:35:51.165>the

810
00:35:51.405 --> 00:35:52.445
<00:35:51.405>browser <00:35:51.561>is <00:35:51.717>not <00:35:51.873>gonna <00:35:52.029>give <00:35:52.185>you <00:35:52.341>that.

811
00:35:52.445 --> 00:35:56.845
<00:35:52.445>So <00:35:52.620>that's <00:35:52.795>basically <00:35:52.970>also <00:35:53.145>sandboxing <00:35:53.320>On <00:35:53.495>the <00:35:53.670>language <00:35:53.845>level,

812
00:35:56.935 --> 00:35:58.165
<00:35:56.935>there <00:35:57.304>are <00:35:57.673>different <00:35:58.042>languages

813
00:35:58.165 --> 00:35:59.605
<00:35:58.165>that <00:35:58.381>give <00:35:58.596>you <00:35:58.813>sandbox <00:35:59.029>support <00:35:59.245>as <00:35:59.461>well.

814
00:35:59.605 --> 00:36:03.245
<00:35:59.605>There's <00:35:59.805>a.net <00:36:00.005>code <00:36:00.205>access <00:36:00.405>security, <00:36:00.605>that's <00:36:00.805>same <00:36:01.005>concept

815
00:36:03.785 --> 00:36:04.845
<00:36:03.785>as <00:36:04.103>the <00:36:04.421>other <00:36:04.738>above,

816
00:36:04.945 --> 00:36:07.325
<00:36:04.945>but, <00:36:05.120>uh, <00:36:05.295>the <00:36:05.470>language <00:36:05.645>itself <00:36:05.820>gives <00:36:05.995>you <00:36:06.170>the <00:36:06.345>feature

817
00:36:07.705 --> 00:36:10.005
<00:36:07.705>and <00:36:07.904>the <00:36:08.105>Java <00:36:08.305>security <00:36:08.505>manager <00:36:08.705>also <00:36:08.904>gives <00:36:09.105>you,

818
00:36:10.005 --> 00:36:12.165
<00:36:10.005>gives <00:36:10.180>you <00:36:10.355>the <00:36:10.530>opportunity <00:36:10.705>to <00:36:10.880>lock <00:36:11.055>down <00:36:11.230>your <00:36:11.405>process

819
00:36:12.225 --> 00:36:13.245
<00:36:12.225>to <00:36:12.531>only <00:36:12.837>what's <00:36:13.143>necessary.

820
00:36:15.705 --> 00:36:17.925
<00:36:15.705>Uh, <00:36:15.904>and <00:36:16.105>last <00:36:16.305>but <00:36:16.505>not <00:36:16.705>least, <00:36:16.904>the <00:36:17.105>availability

821
00:36:17.925 --> 00:36:18.965
<00:36:17.925>of <00:36:18.393>secure <00:36:18.861>frameworks

822
00:36:18.965 --> 00:36:22.605
<00:36:18.965>because <00:36:19.120>you <00:36:19.276>know, <00:36:19.431>you, <00:36:19.587>you <00:36:19.742>might <00:36:19.898>be <00:36:20.053>using <00:36:20.209>some <00:36:20.365>sort

823
00:36:22.605 --> 00:36:25.845
<00:36:22.605>of <00:36:22.745>framework <00:36:22.885>for <00:36:23.025>your <00:36:23.165>coding, <00:36:23.305>so <00:36:23.445>do <00:36:23.585>not <00:36:23.725>reinvent <00:36:23.865>the <00:36:24.005>wheel.

824
00:36:25.975 --> 00:36:27.405
<00:36:25.975>Build <00:36:26.404>on <00:36:26.833>proven <00:36:27.262>technology

825
00:36:27.405 --> 00:36:29.165
<00:36:27.405>that <00:36:27.638>helps <00:36:27.871>you <00:36:28.105>also <00:36:28.338>solve <00:36:28.571>security <00:36:28.805>problems.

826
00:36:29.985 --> 00:36:32.365
<00:36:29.985>Um, <00:36:30.218>we're <00:36:30.451>gonna <00:36:30.685>talk <00:36:30.918>about <00:36:31.151>dependencies <00:36:31.385>later

827
00:36:32.365 --> 00:36:35.165
<00:36:32.365>because <00:36:32.520>people <00:36:32.676>tend <00:36:32.831>to <00:36:32.987>pull <00:36:33.142>in <00:36:33.298>way <00:36:33.453>too <00:36:33.609>many <00:36:33.765>things

828
00:36:35.305 --> 00:36:36.885
<00:36:35.305>and <00:36:35.538>then <00:36:35.771>way <00:36:36.004>too <00:36:36.238>many <00:36:36.471>moving <00:36:36.705>parts.

829
00:36:37.465 --> 00:36:39.525
<00:36:37.465>Uh, <00:36:37.665>so <00:36:37.865>also <00:36:38.065>keep <00:36:38.265>it <00:36:38.465>simple, <00:36:38.665>keep <00:36:38.865>it

830
00:36:39.525 --> 00:36:40.765
<00:36:39.525>to <00:36:39.804>only <00:36:40.083>the <00:36:40.362>necessary <00:36:40.641>stuff,

831
00:36:41.065 --> 00:36:44.845
<00:36:41.065>but <00:36:41.240>the <00:36:41.415>frameworks <00:36:41.590>will <00:36:41.765>help <00:36:41.940>you <00:36:42.115>solve <00:36:42.290>some <00:36:42.465>security

832
00:36:45.005 --> 00:36:46.365
<00:36:45.005>problems <00:36:45.311>such <00:36:45.617>as, <00:36:45.923>for <00:36:46.229>example,

833
00:36:46.855 --> 00:36:49.045
<00:36:46.855>frameworks <00:36:47.321>often <00:36:47.788>support <00:36:48.255>authentication,

834
00:36:49.045 --> 00:36:51.965
<00:36:49.045>session <00:36:49.325>management <00:36:49.605>authorization <00:36:49.885>and <00:36:50.165>so <00:36:50.445>on.

835
00:36:51.965 --> 00:36:54.445
<00:36:51.965>So <00:36:52.165>they <00:36:52.365>have <00:36:52.565>things <00:36:52.765>they <00:36:52.965>come <00:36:53.165>with <00:36:53.365>features

836
00:36:54.445 --> 00:36:55.845
<00:36:54.445>that <00:36:54.865>have <00:36:55.285>security <00:36:55.705>impact.

837
00:36:57.335 --> 00:36:59.745
<00:36:57.335>Some <00:36:57.615>examples <00:36:57.895>for <00:36:58.175>good <00:36:58.455>frameworks, <00:36:58.735>uh,

838
00:36:59.805 --> 00:37:02.065
<00:36:59.805>in <00:37:00.004>the <00:37:00.205>JavaScript <00:37:00.404>world, <00:37:00.605>we <00:37:00.805>have <00:37:01.004>express <00:37:01.205>gs,

839
00:37:02.065 --> 00:37:03.225
<00:37:02.065>for <00:37:02.326>example, <00:37:02.587>on <00:37:02.848>the <00:37:03.109>backend.

840
00:37:03.285 --> 00:37:04.545
<00:37:03.285>So <00:37:03.511>that's <00:37:03.738>running <00:37:03.965>on <00:37:04.192>no <00:37:04.419>js.

841
00:37:04.925 --> 00:37:07.785
<00:37:04.925>On <00:37:05.065>the <00:37:05.205>front <00:37:05.345>end <00:37:05.485>side, <00:37:05.625>we <00:37:05.765>have <00:37:05.905>Angular <00:37:06.045>React <00:37:06.185>view <00:37:06.325>js

842
00:37:08.405 --> 00:37:11.385
<00:37:08.405>in <00:37:08.580>terms <00:37:08.755>of <00:37:08.930>security, <00:37:09.105>I'm <00:37:09.280>just <00:37:09.455>speaking <00:37:09.630>of <00:37:09.805>security,

843
00:37:11.785 --> 00:37:13.465
<00:37:11.785>angular <00:37:11.984>is <00:37:12.185>the <00:37:12.384>best <00:37:12.585>one <00:37:12.785>of <00:37:12.984>those <00:37:13.185>three

844
00:37:13.465 --> 00:37:15.985
<00:37:13.465>because <00:37:13.640>it <00:37:13.815>comes <00:37:13.990>with <00:37:14.165>an, <00:37:14.340>uh, <00:37:14.515>with <00:37:14.690>a <00:37:14.865>sanitizer

845
00:37:16.005 --> 00:37:17.825
<00:37:16.005>and <00:37:16.180>talk <00:37:16.355>about <00:37:16.530>that <00:37:16.705>later <00:37:16.880>also <00:37:17.055>in <00:37:17.230>more <00:37:17.405>detail.

846
00:37:18.365 --> 00:37:20.825
<00:37:18.365>But <00:37:18.564>all <00:37:18.765>three <00:37:18.964>are <00:37:19.165>solid <00:37:19.365>frameworks <00:37:19.564>in <00:37:19.765>channel.

847
00:37:20.845 --> 00:37:22.505
<00:37:20.845>We <00:37:21.125>have <00:37:21.404>spring <00:37:21.685>that <00:37:21.964>has, <00:37:22.245>uh,

848
00:37:22.505 --> 00:37:25.305
<00:37:22.505>dedicated <00:37:22.738>project <00:37:22.971>spring <00:37:23.205>security <00:37:23.438>where <00:37:23.671>you <00:37:23.905>can

849
00:37:25.905 --> 00:37:27.305
<00:37:25.905>configure <00:37:26.220>your <00:37:26.535>application <00:37:26.850>with <00:37:27.165>security,

850
00:37:27.645 --> 00:37:29.185
<00:37:27.645>uh, <00:37:27.843>features <00:37:28.041>and <00:37:28.239>turn <00:37:28.437>'em <00:37:28.634>on <00:37:28.833>and <00:37:29.031>off.

851
00:37:29.725 --> 00:37:31.505
<00:37:29.725>In <00:37:29.958>the <00:37:30.191>PHP <00:37:30.424>world, <00:37:30.658>we <00:37:30.891>have <00:37:31.125>Symphony

852
00:37:31.505 --> 00:37:33.825
<00:37:31.505>and <00:37:31.705>Laravel <00:37:31.905>that <00:37:32.105>are <00:37:32.305>two <00:37:32.505>very <00:37:32.705>good <00:37:32.905>frameworks.

853
00:37:34.205 --> 00:37:36.785
<00:37:34.205>And <00:37:34.380>Ruby, <00:37:34.555>we <00:37:34.730>have <00:37:34.904>rails, <00:37:35.080>we <00:37:35.255>have <00:37:35.430>dotnet <00:37:35.605>core

854
00:37:36.785 --> 00:37:38.145
<00:37:36.785>and <00:37:36.989>the <00:37:37.192>C <00:37:37.397>world <00:37:37.601>and <00:37:37.805>so <00:37:38.009>on.

855
00:37:38.145 --> 00:37:40.065
<00:37:38.145>So <00:37:38.300>there <00:37:38.456>are <00:37:38.611>many <00:37:38.767>more <00:37:38.922>that <00:37:39.078>it's <00:37:39.233>just, <00:37:39.389>you <00:37:39.545>know,

856
00:37:40.065 --> 00:37:41.705
<00:37:40.065>that's <00:37:40.265>the <00:37:40.465>ones <00:37:40.665>that <00:37:40.865>came <00:37:41.065>to <00:37:41.265>my <00:37:41.465>mind

857
00:37:41.705 --> 00:37:44.665
<00:37:41.705>and <00:37:41.821>that, <00:37:41.938>that <00:37:42.055>I <00:37:42.171>tend <00:37:42.288>to <00:37:42.404>work <00:37:42.521>with <00:37:42.638>when <00:37:42.755>I <00:37:42.871>do <00:37:42.988>code <00:37:43.105>reviews.

858
00:37:45.205 --> 00:37:48.425
<00:37:45.205>Um, <00:37:45.345>and <00:37:45.485>that <00:37:45.625>I <00:37:45.765>know <00:37:45.904>a <00:37:46.045>little <00:37:46.185>bit <00:37:46.325>their <00:37:46.465>their <00:37:46.605>security

859
00:37:48.425 --> 00:37:50.665
<00:37:48.425>poster, <00:37:48.705>but <00:37:48.985>there <00:37:49.265>are <00:37:49.545>many <00:37:49.825>more.

860
00:37:51.045 --> 00:37:53.065
<00:37:51.045>Um, <00:37:51.325>it's <00:37:51.605>a <00:37:51.885>good <00:37:52.165>first <00:37:52.445>start.

861
00:37:53.285 --> 00:37:56.465
<00:37:53.285>Uh, <00:37:53.412>when <00:37:53.539>looking <00:37:53.666>at <00:37:53.794>whether <00:37:53.921>a <00:37:54.048>framework <00:37:54.175>is <00:37:54.303>a <00:37:54.430>good <00:37:54.557>one <00:37:54.685>in

862
00:37:56.465 --> 00:37:58.825
<00:37:56.465>terms <00:37:56.665>of <00:37:56.865>security, <00:37:57.065>is <00:37:57.265>whether <00:37:57.465>they <00:37:57.665>have <00:37:57.865>security

863
00:37:59.105 --> 00:38:02.065
<00:37:59.105>documentation, <00:37:59.260>whether <00:37:59.416>they <00:37:59.571>have <00:37:59.727>a, <00:37:59.882>a <00:38:00.038>list <00:38:00.193>where <00:38:00.349>they <00:38:00.505>have,

864
00:38:02.405 --> 00:38:05.585
<00:38:02.405>uh, <00:38:02.580>where <00:38:02.755>they <00:38:02.930>publish <00:38:03.105>security <00:38:03.280>problems <00:38:03.455>that <00:38:03.630>were <00:38:03.805>found

865
00:38:05.585 --> 00:38:06.625
<00:38:05.585>by <00:38:06.053>security <00:38:06.521>researchers.

866
00:38:06.685 --> 00:38:09.545
<00:38:06.685>If <00:38:06.812>there's <00:38:06.939>no <00:38:07.066>such, <00:38:07.194>if <00:38:07.321>security <00:38:07.448>is <00:38:07.575>not <00:38:07.703>a <00:38:07.830>word <00:38:07.957>that <00:38:08.085>is,

867
00:38:09.545 --> 00:38:12.825
<00:38:09.545>appears <00:38:09.720>in <00:38:09.895>the <00:38:10.070>docs, <00:38:10.245>run <00:38:10.420>and <00:38:10.595>take <00:38:10.770>another <00:38:10.945>one.

868
00:38:15.255 --> 00:38:17.305
<00:38:15.255>Okay, <00:38:15.488>so <00:38:15.721>summing <00:38:15.955>up <00:38:16.188>the <00:38:16.421>security <00:38:16.655>criteria

869
00:38:17.325 --> 00:38:18.585
<00:38:17.325>for <00:38:17.608>choosing <00:38:17.892>the <00:38:18.175>language, <00:38:18.459>again,

870
00:38:18.765 --> 00:38:22.825
<00:38:18.765>you <00:38:18.920>can <00:38:19.076>write <00:38:19.231>secure <00:38:19.387>software <00:38:19.542>in <00:38:19.698>any <00:38:19.853>language <00:38:20.009>as <00:38:20.165>long

871
00:38:22.825 --> 00:38:26.065
<00:38:22.825>as <00:38:23.058>you <00:38:23.291>know <00:38:23.524>and <00:38:23.758>master <00:38:23.991>that <00:38:24.225>language

872
00:38:26.065 --> 00:38:29.185
<00:38:26.065>because <00:38:26.240>knowing <00:38:26.415>the <00:38:26.590>core <00:38:26.765>principles <00:38:26.940>behind <00:38:27.115>it <00:38:27.290>is <00:38:27.465>key

873
00:38:29.185 --> 00:38:30.825
<00:38:29.185>to <00:38:29.418>understanding <00:38:29.651>whether <00:38:29.884>or <00:38:30.118>not <00:38:30.351>this <00:38:30.585>line

874
00:38:30.825 --> 00:38:32.545
<00:38:30.825>of <00:38:31.000>code <00:38:31.174>is <00:38:31.350>gonna <00:38:31.524>gimme <00:38:31.700>any <00:38:31.875>problems <00:38:32.049>or <00:38:32.225>not.

875
00:38:33.285 --> 00:38:35.765
<00:38:33.285>But <00:38:33.518>if <00:38:33.751>you <00:38:33.984>know <00:38:34.218>many <00:38:34.451>different <00:38:34.685>languages

876
00:38:35.905 --> 00:38:37.005
<00:38:35.905>and <00:38:36.152>you <00:38:36.400>want <00:38:36.647>some <00:38:36.895>criteria

877
00:38:37.105 --> 00:38:39.605
<00:38:37.105>to <00:38:37.260>choose <00:38:37.416>whether <00:38:37.571>the <00:38:37.727>specific <00:38:37.882>specific <00:38:38.038>one <00:38:38.193>is <00:38:38.349>a <00:38:38.505>good

878
00:38:39.605 --> 00:38:43.605
<00:38:39.605>choice, <00:38:39.760>you <00:38:39.916>can <00:38:40.071>take, <00:38:40.227>take <00:38:40.382>memory <00:38:40.538>safety, <00:38:40.693>you <00:38:40.849>know, <00:38:41.005>pointer,

879
00:38:43.845 --> 00:38:48.125
<00:38:43.845>arithmetics, <00:38:44.000>uh, <00:38:44.156>can <00:38:44.311>I, <00:38:44.467>uh, <00:38:44.622>can <00:38:44.778>I <00:38:44.933>mangle <00:38:45.089>with <00:38:45.245>pointers?

880
00:38:48.145 --> 00:38:50.125
<00:38:48.145>Do <00:38:48.425>I <00:38:48.705>have <00:38:48.985>disability <00:38:49.265>even, <00:38:49.545>uh,

881
00:38:50.315 --> 00:38:51.845
<00:38:50.315>type <00:38:50.659>safety <00:38:51.003>or <00:38:51.347>type <00:38:51.692>strictness.

882
00:38:51.945 --> 00:38:55.645
<00:38:51.945>So, <00:38:52.085>uh, <00:38:52.225>art <00:38:52.365>of <00:38:52.505>text <00:38:52.645>done <00:38:52.785>during, <00:38:52.925>during, <00:38:53.065>uh, <00:38:53.205>compile <00:38:53.345>time

883
00:38:55.665 --> 00:38:59.125
<00:38:55.665>or <00:38:55.898>runtime <00:38:56.131>parallelization <00:38:56.365>support <00:38:56.598>is <00:38:56.831>something <00:38:57.065>very

884
00:38:59.365 --> 00:39:01.925
<00:38:59.365>specific, <00:38:59.714>not <00:39:00.064>really <00:39:00.415>secure <00:39:00.765>related.

885
00:39:02.425 --> 00:39:03.645
<00:39:02.425>Is <00:39:02.699>there <00:39:02.974>a <00:39:03.248>sandbox <00:39:03.523>support?

886
00:39:03.645 --> 00:39:06.805
<00:39:03.645>So <00:39:03.761>can <00:39:03.878>a <00:39:03.995>sandbox <00:39:04.111>not <00:39:04.228>process <00:39:04.345>to <00:39:04.461>only <00:39:04.578>what <00:39:04.695>it <00:39:04.811>needs <00:39:04.928>to <00:39:05.045>run?

887
00:39:07.385 --> 00:39:10.285
<00:39:07.385>And <00:39:07.585>of <00:39:07.785>course <00:39:07.985>the <00:39:08.185>availability <00:39:08.385>of <00:39:08.585>secure <00:39:08.785>frameworks.

888
00:39:10.495 --> 00:39:12.965
<00:39:10.495>Again, <00:39:10.670>look <00:39:10.845>at <00:39:11.020>the <00:39:11.194>security <00:39:11.370>documentation <00:39:11.545>of <00:39:11.720>the <00:39:11.895>framework

889
00:39:12.965 --> 00:39:15.605
<00:39:12.965>to <00:39:13.092>see <00:39:13.219>whether <00:39:13.346>they <00:39:13.474>care <00:39:13.601>about <00:39:13.728>the <00:39:13.855>topic <00:39:13.983>of <00:39:14.110>security <00:39:14.237>or <00:39:14.365>not.

890
00:39:16.305 --> 00:39:19.445
<00:39:16.305>That's <00:39:16.585>a <00:39:16.865>good <00:39:17.145>first <00:39:17.424>step. <00:39:17.705>Okay,

891
00:39:24.685 --> 00:39:29.545
<00:39:24.685>We <00:39:24.825>are <00:39:24.965>getting <00:39:25.105>closer <00:39:25.245>to <00:39:25.384>actual <00:39:25.525>coding, <00:39:25.665>um, <00:39:25.805>in <00:39:25.945>this <00:39:26.085>chapter.

892
00:39:30.085 --> 00:39:33.345
<00:39:30.085>Um, <00:39:30.225>I <00:39:30.365>wanna <00:39:30.505>go <00:39:30.645>through <00:39:30.785>the, <00:39:30.925>some <00:39:31.065>of <00:39:31.205>the <00:39:31.345>basic <00:39:31.485>concepts

893
00:39:33.345 --> 00:39:35.065
<00:39:33.345>of <00:39:33.578>secure <00:39:33.811>coding <00:39:34.044>that <00:39:34.278>can <00:39:34.511>be <00:39:34.745>applied

894
00:39:35.245 --> 00:39:37.545
<00:39:35.245>to <00:39:35.525>basically <00:39:35.805>every <00:39:36.085>language <00:39:36.365>out <00:39:36.645>there.

895
00:39:37.575 --> 00:39:38.705
<00:39:37.575>They <00:39:37.913>are <00:39:38.252>not, <00:39:38.592>some

896
00:39:38.705 --> 00:39:40.865
<00:39:38.705>of <00:39:38.880>the <00:39:39.055>examples <00:39:39.230>will <00:39:39.404>be <00:39:39.580>in <00:39:39.755>some <00:39:39.930>specific <00:39:40.105>language,

897
00:39:40.885 --> 00:39:43.985
<00:39:40.885>but <00:39:41.040>you <00:39:41.196>can <00:39:41.351>apply <00:39:41.507>them <00:39:41.662>to <00:39:41.818>other <00:39:41.973>languages <00:39:42.129>as <00:39:42.285>well.

898
00:39:44.925 --> 00:39:47.465
<00:39:44.925>So <00:39:45.125>we're <00:39:45.325>gonna <00:39:45.525>talk <00:39:45.725>about <00:39:45.925>these <00:39:46.125>input, <00:39:46.325>handling

899
00:39:48.005 --> 00:39:50.385
<00:39:48.005>up <00:39:48.285>everything, <00:39:48.565>input, <00:39:48.845>validation, <00:39:49.125>and <00:39:49.405>others.

900
00:39:50.635 --> 00:39:53.665
<00:39:50.635>There <00:39:50.810>are <00:39:50.985>others <00:39:51.160>that <00:39:51.335>are <00:39:51.510>very <00:39:51.685>important <00:39:51.860>output <00:39:52.035>handling,

901
00:39:53.665 --> 00:39:55.385
<00:39:53.665>that's <00:39:54.015>in <00:39:54.365>terms <00:39:54.715>of <00:39:55.065>security.

902
00:39:55.385 --> 00:39:57.145
<00:39:55.385>Even <00:39:55.618>more <00:39:55.851>important, <00:39:56.085>I'll <00:39:56.318>tell <00:39:56.551>you <00:39:56.785>why.

903
00:39:57.965 --> 00:40:00.545
<00:39:57.965>Um, <00:39:58.140>we <00:39:58.315>have <00:39:58.490>some <00:39:58.665>pitfalls <00:39:58.840>in <00:39:59.015>low <00:39:59.190>level <00:39:59.365>languages

904
00:40:00.775 --> 00:40:03.985
<00:40:00.775>that <00:40:00.930>don't <00:40:01.086>have <00:40:01.241>any <00:40:01.397>memory <00:40:01.552>safety <00:40:01.708>or <00:40:01.863>limited <00:40:02.019>memory <00:40:02.175>safety.

905
00:40:05.285 --> 00:40:07.505
<00:40:05.285>Uh, <00:40:05.484>we <00:40:05.685>talk <00:40:05.884>more <00:40:06.085>specifically <00:40:06.285>about <00:40:06.484>the <00:40:06.685>principle

906
00:40:07.505 --> 00:40:10.025
<00:40:07.505>of <00:40:07.705>complete <00:40:07.905>mediation <00:40:08.105>that <00:40:08.305>I <00:40:08.505>told <00:40:08.705>you, <00:40:08.905>uh,

907
00:40:10.045 --> 00:40:12.745
<00:40:10.045>before, <00:40:10.245>is <00:40:10.445>basically <00:40:10.645>access <00:40:10.845>control, <00:40:11.045>that <00:40:11.245>every <00:40:11.445>request.

908
00:40:14.195 --> 00:40:16.945
<00:40:14.195>We'll <00:40:14.335>talk <00:40:14.475>very <00:40:14.615>quickly <00:40:14.755>about <00:40:14.895>cryptography <00:40:15.035>and <00:40:15.175>how <00:40:15.315>to <00:40:15.455>use <00:40:15.595>it

909
00:40:16.945 --> 00:40:18.425
<00:40:16.945>and <00:40:17.135>more <00:40:17.325>importantly, <00:40:17.515>how <00:40:17.706>not <00:40:17.896>to <00:40:18.086>use <00:40:18.277>it.

910
00:40:19.205 --> 00:40:20.505
<00:40:19.205>We <00:40:19.497>talk <00:40:19.790>about <00:40:20.082>session <00:40:20.375>management

911
00:40:20.505 --> 00:40:23.725
<00:40:20.505>because <00:40:20.705>when <00:40:20.905>you <00:40:21.105>have <00:40:21.305>a <00:40:21.505>multi-tier, <00:40:21.705>uh, <00:40:21.905>system

912
00:40:23.735 --> 00:40:25.885
<00:40:23.735>where <00:40:23.935>you <00:40:24.135>have <00:40:24.335>an <00:40:24.535>untrusted <00:40:24.735>part, <00:40:24.935>for <00:40:25.135>example,

913
00:40:25.905 --> 00:40:26.965
<00:40:25.905>the <00:40:26.095>web <00:40:26.286>browser <00:40:26.477>of <00:40:26.668>the <00:40:26.859>user

914
00:40:27.505 --> 00:40:30.525
<00:40:27.505>and <00:40:27.660>the <00:40:27.816>trusted <00:40:27.971>part, <00:40:28.127>which <00:40:28.282>is <00:40:28.438>your <00:40:28.593>backend <00:40:28.749>application, <00:40:28.905>uh,

915
00:40:30.625 --> 00:40:32.365
<00:40:30.625>how <00:40:30.858>am <00:40:31.091>I <00:40:31.325>gonna <00:40:31.558>maintain <00:40:31.791>a <00:40:32.025>session

916
00:40:32.385 --> 00:40:34.405
<00:40:32.385>and <00:40:32.735>what's <00:40:33.085>important <00:40:33.435>to, <00:40:33.785>um,

917
00:40:35.305 --> 00:40:36.965
<00:40:35.305>to <00:40:35.585>consider <00:40:35.865>when <00:40:36.145>doing <00:40:36.424>session <00:40:36.705>management?

918
00:40:37.705 --> 00:40:40.765
<00:40:37.705>And, <00:40:37.880>um, <00:40:38.055>last <00:40:38.230>but <00:40:38.404>not <00:40:38.580>least, <00:40:38.755>integrity <00:40:38.930>related <00:40:39.105>concurrency.

919
00:40:40.945 --> 00:40:42.885
<00:40:40.945>So <00:40:41.178>two <00:40:41.411>people <00:40:41.645>accessing <00:40:41.878>the <00:40:42.111>same <00:40:42.345>function

920
00:40:42.885 --> 00:40:44.245
<00:40:42.885>or <00:40:43.191>writing <00:40:43.497>the <00:40:43.803>same <00:40:44.109>object.

921
00:40:44.945 --> 00:40:47.205
<00:40:44.945>Uh, <00:40:45.085>how <00:40:45.225>can <00:40:45.365>I <00:40:45.505>ensure <00:40:45.645>that <00:40:45.785>we <00:40:45.925>don't <00:40:46.065>have <00:40:46.205>an <00:40:46.345>integrity

922
00:40:47.205 --> 00:40:48.645
<00:40:47.205>problem <00:40:47.636>after <00:40:48.069>doing <00:40:48.501>so?

923
00:40:49.755 --> 00:40:52.205
<00:40:49.755>Alright, <00:40:50.105>first <00:40:50.455>one, <00:40:50.805>input <00:40:51.155>handling.

924
00:40:52.505 --> 00:40:55.685
<00:40:52.505>Now <00:40:52.660>this <00:40:52.816>might <00:40:52.971>seem <00:40:53.127>like, <00:40:53.282>you <00:40:53.438>know, <00:40:53.593>let's <00:40:53.749>turn <00:40:53.905>off,

925
00:40:55.685 --> 00:40:57.445
<00:40:55.685>let's <00:40:55.918>take <00:40:56.151>my <00:40:56.384>smartphone <00:40:56.618>and <00:40:56.851>check <00:40:57.085>Twitter

926
00:40:57.445 --> 00:40:59.485
<00:40:57.445>because <00:40:57.620>I <00:40:57.795>know <00:40:57.970>input <00:40:58.145>handling, <00:40:58.320>I <00:40:58.495>bet <00:40:58.670>there's <00:40:58.845>not,

927
00:40:59.825 --> 00:41:01.685
<00:40:59.825>not <00:41:00.058>every <00:41:00.291>aspect <00:41:00.524>is <00:41:00.758>known <00:41:00.991>that <00:41:01.225>everybody,

928
00:41:01.935 --> 00:41:05.325
<00:41:01.935>there <00:41:02.090>are <00:41:02.246>a <00:41:02.401>few <00:41:02.557>things <00:41:02.712>that, <00:41:02.868>uh, <00:41:03.023>are <00:41:03.179>really <00:41:03.335>not

929
00:41:05.325 --> 00:41:06.765
<00:41:05.325>so <00:41:05.649>easy <00:41:05.973>to, <00:41:06.297>to <00:41:06.621>spot.

930
00:41:06.865 --> 00:41:08.485
<00:41:06.865>So <00:41:07.145>impending <00:41:07.424>consists <00:41:07.705>of <00:41:07.984>three <00:41:08.265>things.

931
00:41:09.825 --> 00:41:12.365
<00:41:09.825>The <00:41:09.980>the <00:41:10.136>second <00:41:10.291>one, <00:41:10.447>the <00:41:10.602>middle <00:41:10.758>one <00:41:10.913>is <00:41:11.069>not <00:41:11.225>optional,

932
00:41:12.505 --> 00:41:13.645
<00:41:12.505>the <00:41:12.847>others <00:41:13.189>are <00:41:13.531>optional.

933
00:41:14.135 --> 00:41:18.005
<00:41:14.135>Let's <00:41:14.275>have <00:41:14.415>a <00:41:14.555>closer <00:41:14.695>look. <00:41:14.835>Canonization, <00:41:14.975>why <00:41:15.115>do <00:41:15.255>we <00:41:15.395>need <00:41:15.535>this?

934
00:41:18.005 --> 00:41:20.365
<00:41:18.005>And <00:41:18.285>what <00:41:18.565>is <00:41:18.845>that? <00:41:19.125>Um, <00:41:19.405>question.

935
00:41:21.345 --> 00:41:23.685
<00:41:21.345>Are <00:41:21.578>these <00:41:21.811>two <00:41:22.044>email <00:41:22.278>addresses <00:41:22.511>the <00:41:22.745>same?

936
00:41:25.765 --> 00:41:29.985
<00:41:25.765>Um, <00:41:25.892>I'm <00:41:26.019>gonna <00:41:26.146>answer <00:41:26.274>this <00:41:26.401>for <00:41:26.528>you. <00:41:26.655>Uh, <00:41:26.783>it's <00:41:26.910>a <00:41:27.037>clear <00:41:27.165>answer.

937
00:41:30.095 --> 00:41:34.685
<00:41:30.095>It's <00:41:30.211>yes <00:41:30.328>and <00:41:30.444>no. <00:41:30.561>Um, <00:41:30.678>so <00:41:30.794>according <00:41:30.911>to <00:41:31.028>the <00:41:31.145>standard <00:41:31.261>to <00:41:31.378>the <00:41:31.495>RFC

938
00:41:34.685 --> 00:41:37.845
<00:41:34.685>that <00:41:34.840>defines <00:41:34.996>how <00:41:35.151>an <00:41:35.307>email, <00:41:35.462>an <00:41:35.618>email <00:41:35.773>address <00:41:35.929>is <00:41:36.085>composed.

939
00:41:38.435 --> 00:41:41.365
<00:41:38.435>They're <00:41:38.610>not <00:41:38.785>the <00:41:38.960>same, <00:41:39.134>they're <00:41:39.310>two <00:41:39.485>different <00:41:39.660>email <00:41:39.835>addresses.

940
00:41:41.985 --> 00:41:43.685
<00:41:41.985>But <00:41:42.265>this <00:41:42.545>didn't <00:41:42.825>work <00:41:43.105>in <00:41:43.385>practice

941
00:41:43.685 --> 00:41:46.365
<00:41:43.685>because <00:41:43.918>people <00:41:44.151>registered <00:41:44.384>email <00:41:44.618>addresses <00:41:44.851>with <00:41:45.085>uppercase,

942
00:41:46.365 --> 00:41:48.125
<00:41:46.365>lowercase <00:41:47.064>existing <00:41:47.765>accounts

943
00:41:48.225 --> 00:41:51.365
<00:41:48.225>and <00:41:48.505>basically, <00:41:48.785>uh, <00:41:49.065>then <00:41:49.345>received <00:41:49.625>emails

944
00:41:51.365 --> 00:41:52.925
<00:41:51.365>that <00:41:51.564>were <00:41:51.765>supposed <00:41:51.964>to <00:41:52.165>go <00:41:52.365>to <00:41:52.564>another <00:41:52.765>person.

945
00:41:53.145 --> 00:41:56.085
<00:41:53.145>So <00:41:53.285>we <00:41:53.425>basically <00:41:53.565>all <00:41:53.705>agree <00:41:53.845>that <00:41:53.985>it <00:41:54.125>makes <00:41:54.265>sense <00:41:54.405>to <00:41:54.545>just

946
00:41:57.285 --> 00:42:00.445
<00:41:57.285>canonize <00:41:57.460>them <00:41:57.634>and <00:41:57.810>maybe <00:41:57.984>lowercase <00:41:58.160>them <00:41:58.335>so <00:41:58.509>that, <00:41:58.685>uh,

947
00:42:00.445 --> 00:42:03.685
<00:42:00.445>these <00:42:00.600>two <00:42:00.756>are <00:42:00.911>not <00:42:01.067>different, <00:42:01.222>but <00:42:01.378>the <00:42:01.533>same <00:42:01.689>email <00:42:01.845>address.

948
00:42:04.865 --> 00:42:06.965
<00:42:04.865>Why <00:42:05.040>should <00:42:05.214>we <00:42:05.390>care? <00:42:05.564>Aren't <00:42:05.740>we <00:42:05.915>talking <00:42:06.089>about <00:42:06.265>software

949
00:42:07.205 --> 00:42:08.365
<00:42:07.205>security <00:42:07.466>and <00:42:07.727>secure <00:42:07.988>coding <00:42:08.249>practices?

950
00:42:08.875 --> 00:42:11.765
<00:42:08.875>Well, <00:42:09.075>um, <00:42:09.275>in <00:42:09.475>case <00:42:09.675>of <00:42:09.875>the <00:42:10.075>email <00:42:10.275>address,

951
00:42:12.025 --> 00:42:14.365
<00:42:12.025>the <00:42:12.305>uniqueness <00:42:12.585>is <00:42:12.865>important <00:42:13.145>for <00:42:13.425>security

952
00:42:14.365 --> 00:42:16.805
<00:42:14.365>because <00:42:14.540>if <00:42:14.714>a <00:42:14.890>person <00:42:15.064>registers <00:42:15.240>with <00:42:15.415>an <00:42:15.589>email <00:42:15.765>address

953
00:42:17.225 --> 00:42:19.965
<00:42:17.225>and <00:42:17.400>another <00:42:17.575>person <00:42:17.750>can <00:42:17.924>register <00:42:18.100>with <00:42:18.275>basically <00:42:18.450>the <00:42:18.625>same

954
00:42:20.025 --> 00:42:22.165
<00:42:20.025>but <00:42:20.305>not <00:42:20.585>same <00:42:20.865>email <00:42:21.145>address, <00:42:21.425>uh,

955
00:42:22.165 --> 00:42:23.845
<00:42:22.165>that <00:42:22.445>could <00:42:22.725>give <00:42:23.005>me <00:42:23.285>security <00:42:23.565>problems.

956
00:42:24.665 --> 00:42:26.835
<00:42:24.665>Imagine <00:42:24.840>you <00:42:25.015>have <00:42:25.190>a <00:42:25.365>database <00:42:25.540>table <00:42:25.715>with <00:42:25.890>a <00:42:26.065>column

957
00:42:26.905 --> 00:42:30.355
<00:42:26.905>that <00:42:27.032>says <00:42:27.159>email <00:42:27.286>and <00:42:27.414>you <00:42:27.541>have <00:42:27.668>a <00:42:27.795>unique <00:42:27.923>key <00:42:28.050>constraint <00:42:28.177>on <00:42:28.305>it

958
00:42:30.355 --> 00:42:31.995
<00:42:30.355>so <00:42:30.555>that <00:42:30.755>this <00:42:30.955>email <00:42:31.155>address <00:42:31.355>can <00:42:31.555>only <00:42:31.755>appear

959
00:42:31.995 --> 00:42:33.035
<00:42:31.995>once <00:42:32.229>in <00:42:32.462>the <00:42:32.696>user <00:42:32.931>list.

960
00:42:33.615 --> 00:42:35.875
<00:42:33.615>Uh, <00:42:33.814>but <00:42:34.015>you <00:42:34.214>don't <00:42:34.415>account <00:42:34.615>account <00:42:34.814>for <00:42:35.015>uppercase,

961
00:42:35.875 --> 00:42:37.115
<00:42:35.875>lowercase <00:42:36.247>and <00:42:36.618>other <00:42:36.991>things.

962
00:42:37.115 --> 00:42:39.395
<00:42:37.115>There <00:42:37.254>are <00:42:37.395>things <00:42:37.535>like <00:42:37.674>the <00:42:37.814>plus <00:42:37.955>sign <00:42:38.095>that <00:42:38.234>you <00:42:38.375>can <00:42:38.515>use

963
00:42:39.395 --> 00:42:42.475
<00:42:39.395>for <00:42:39.550>Gmail <00:42:39.706>accounts <00:42:39.861>to <00:42:40.017>add <00:42:40.172>different <00:42:40.328>accounts <00:42:40.483>for <00:42:40.639>the <00:42:40.795>same,

964
00:42:43.055 --> 00:42:44.875
<00:42:43.055>you <00:42:43.230>know, <00:42:43.404>different <00:42:43.580>email <00:42:43.754>addresses <00:42:43.930>for <00:42:44.105>the <00:42:44.279>same <00:42:44.455>account.

965
00:42:45.615 --> 00:42:48.435
<00:42:45.615>Uh, <00:42:45.895>so <00:42:46.174>this <00:42:46.455>is <00:42:46.734>security <00:42:47.015>relevant

966
00:42:48.435 --> 00:42:51.315
<00:42:48.435>because <00:42:48.785>people <00:42:49.134>might <00:42:49.485>be <00:42:49.835>re-registering

967
00:42:51.315 --> 00:42:53.355
<00:42:51.315>with <00:42:51.548>the <00:42:51.781>same <00:42:52.015>already <00:42:52.248>existing <00:42:52.481>email <00:42:52.715>address.

968
00:42:54.005 --> 00:42:55.875
<00:42:54.005>Other <00:42:54.355>examples <00:42:54.705>are <00:42:55.055>IP <00:42:55.405>addresses.

969
00:42:56.015 --> 00:43:00.075
<00:42:56.015>Try <00:42:56.142>to <00:42:56.269>ping <00:42:56.396>this <00:42:56.524>e <00:42:56.651>uh, <00:42:56.778>IP <00:42:56.905>address <00:42:57.033>on <00:42:57.160>your <00:42:57.287>command <00:42:57.415>line.

970
00:43:00.895 --> 00:43:04.075
<00:43:00.895>Uh, <00:43:01.095>it's <00:43:01.295>gonna <00:43:01.495>yield <00:43:01.695>this <00:43:01.895>one, <00:43:02.095>right, <00:43:02.295>these,

971
00:43:04.175 --> 00:43:07.395
<00:43:04.175>and <00:43:04.375>these <00:43:04.575>are <00:43:04.775>the <00:43:04.975>same <00:43:05.175>IP <00:43:05.375>address, <00:43:05.575>um,

972
00:43:07.395 --> 00:43:09.475
<00:43:07.395>because <00:43:07.570>you <00:43:07.745>can <00:43:07.920>write <00:43:08.095>IP <00:43:08.270>address <00:43:08.445>in <00:43:08.620>different <00:43:08.795>way.

973
00:43:10.395 --> 00:43:12.125
<00:43:10.395>This <00:43:10.595>could <00:43:10.795>also <00:43:10.995>be <00:43:11.195>important <00:43:11.395>when, <00:43:11.595>for <00:43:11.795>example,

974
00:43:12.445 --> 00:43:15.445
<00:43:12.445>blocking <00:43:12.620>certain <00:43:12.795>or <00:43:12.970>allowing <00:43:13.145>only <00:43:13.320>certain <00:43:13.495>IP <00:43:13.670>address <00:43:13.845>ranges.

975
00:43:15.985 --> 00:43:19.565
<00:43:15.985>The <00:43:16.140>same <00:43:16.296>goes <00:43:16.451>for <00:43:16.607>URLs <00:43:16.762>when, <00:43:16.918>uh, <00:43:17.073>allow <00:43:17.229>listing <00:43:17.385>URLs.

976
00:43:19.565 --> 00:43:23.645
<00:43:19.565>You <00:43:19.765>could <00:43:19.965>write <00:43:20.165>it <00:43:20.365>a.com <00:43:20.565>or <00:43:20.765>a.com/or <00:43:20.965>a.com.

977
00:43:24.465 --> 00:43:28.165
<00:43:24.465>Uh, <00:43:24.605>semicolon <00:43:24.745>4, <00:43:24.885>4 <00:43:25.025>3, <00:43:25.165>uh, <00:43:25.305>sorry. <00:43:25.445>Column <00:43:25.585>4, <00:43:25.725>4, <00:43:25.865>3.

978
00:43:28.765 --> 00:43:31.565
<00:43:28.765>Implicit <00:43:28.998>port, <00:43:29.231>no <00:43:29.464>implicit <00:43:29.698>port, <00:43:29.931>explicit <00:43:30.165>port.

979
00:43:31.955 --> 00:43:33.365
<00:43:31.955>They <00:43:32.208>are <00:43:32.462>all <00:43:32.716>the <00:43:32.970>same <00:43:33.223>URL,

980
00:43:33.385 --> 00:43:35.005
<00:43:33.385>but <00:43:33.618>they <00:43:33.851>are <00:43:34.085>written <00:43:34.318>the <00:43:34.551>same <00:43:34.785>way.

981
00:43:35.145 --> 00:43:37.125
<00:43:35.145>So <00:43:35.320>if, <00:43:35.495>if <00:43:35.670>you <00:43:35.845>do <00:43:36.020>a <00:43:36.195>direct <00:43:36.370>stream <00:43:36.545>comparison,

982
00:43:37.125 --> 00:43:38.325
<00:43:37.125>they're <00:43:37.395>gonna <00:43:37.665>yield <00:43:37.935>different <00:43:38.205>results,

983
00:43:38.385 --> 00:43:39.845
<00:43:38.385>but <00:43:38.647>in <00:43:38.910>practice <00:43:39.173>they're <00:43:39.436>the <00:43:39.698>same.

984
00:43:40.425 --> 00:43:43.045
<00:43:40.425>So <00:43:40.705>that's <00:43:40.985>why <00:43:41.265>we <00:43:41.545>need <00:43:41.825>canonization.

985
00:43:43.505 --> 00:43:45.805
<00:43:43.505>So <00:43:43.680>bringing <00:43:43.855>them <00:43:44.030>into <00:43:44.205>the <00:43:44.380>always <00:43:44.555>the <00:43:44.730>same <00:43:44.905>format,

986
00:43:47.605 --> 00:43:50.145
<00:43:47.605>so <00:43:47.780>when <00:43:47.955>the <00:43:48.130>uniqueness <00:43:48.305>of <00:43:48.480>that <00:43:48.655>field <00:43:48.830>is <00:43:49.005>important,

987
00:43:50.485 --> 00:43:51.785
<00:43:50.485>do <00:43:51.654>canonization.

988
00:43:54.515 --> 00:43:56.005
<00:43:54.515>Alright, <00:43:54.783>that <00:43:55.051>brings <00:43:55.319>me <00:43:55.587>to <00:43:55.856>the,

989
00:43:56.065 --> 00:43:57.645
<00:43:56.065>the <00:43:56.345>old <00:43:56.625>classic <00:43:56.905>of <00:43:57.185>input <00:43:57.465>validation.

990
00:43:57.825 --> 00:44:02.565
<00:43:57.825>So <00:43:58.000>we <00:43:58.174>should <00:43:58.350>check <00:43:58.524>our <00:43:58.700>inputs <00:43:58.875>against <00:43:59.049>certain <00:43:59.225>formats.

991
00:44:02.925 --> 00:44:05.605
<00:44:02.925>I <00:44:03.125>think <00:44:03.325>that's <00:44:03.525>a <00:44:03.725>pretty <00:44:03.925>clear, <00:44:04.125>clear <00:44:04.325>requirement.

992
00:44:06.185 --> 00:44:08.605
<00:44:06.185>Um, <00:44:06.651>but <00:44:07.118>the <00:44:07.585>main,

993
00:44:08.605 --> 00:44:09.965
<00:44:08.605>the <00:44:08.849>most <00:44:09.094>important <00:44:09.339>question <00:44:09.584>we <00:44:09.829>are

994
00:44:09.965 --> 00:44:11.085
<00:44:09.965>talking <00:44:10.301>about <00:44:10.637>software <00:44:10.973>security.

995
00:44:11.305 --> 00:44:13.325
<00:44:11.305>Why <00:44:11.538>is <00:44:11.771>it <00:44:12.004>even <00:44:12.238>software <00:44:12.471>security <00:44:12.705>relevant?

996
00:44:13.955 --> 00:44:16.685
<00:44:13.955>Does <00:44:14.188>input <00:44:14.421>validation <00:44:14.654>help <00:44:14.888>against <00:44:15.121>specific <00:44:15.355>vulnerabilities?

997
00:44:17.845 --> 00:44:19.905
<00:44:17.845>No, <00:44:18.125>it <00:44:18.404>doesn't. <00:44:18.685>It <00:44:18.964>usually <00:44:19.245>doesn't.

998
00:44:20.165 --> 00:44:22.425
<00:44:20.165>So <00:44:20.340>for <00:44:20.515>example, <00:44:20.690>if <00:44:20.865>you <00:44:21.040>have, <00:44:21.215>if <00:44:21.390>you <00:44:21.565>want

999
00:44:22.425 --> 00:44:25.945
<00:44:22.425>to <00:44:22.600>protect <00:44:22.775>yourself <00:44:22.950>against <00:44:23.125>an <00:44:23.300>SQL <00:44:23.475>injection <00:44:23.650>attack, <00:44:23.825>uh,

1000
00:44:26.005 --> 00:44:27.145
<00:44:26.005>you're <00:44:26.261>not <00:44:26.518>gonna <00:44:26.774>do <00:44:27.031>it

1001
00:44:27.335 --> 00:44:30.185
<00:44:27.335>with <00:44:27.568>just <00:44:27.801>blocking <00:44:28.035>the <00:44:28.268>single <00:44:28.501>tick <00:44:28.735>character

1002
00:44:30.185 --> 00:44:34.325
<00:44:30.185>that's <00:44:30.340>often <00:44:30.496>used <00:44:30.651>in <00:44:30.807>attacking, <00:44:30.962>um, <00:44:31.118>for <00:44:31.273>uh, <00:44:31.429>SQL <00:44:31.585>injection

1003
00:44:34.715 --> 00:44:37.685
<00:44:34.715>because <00:44:34.948>you <00:44:35.181>might <00:44:35.415>need <00:44:35.648>a <00:44:35.881>single <00:44:36.115>quote.

1004
00:44:37.825 --> 00:44:40.405
<00:44:37.825>You <00:44:37.964>might, <00:44:38.105>uh, <00:44:38.245>want <00:44:38.384>to <00:44:38.524>enable <00:44:38.665>the <00:44:38.805>users <00:44:38.944>to <00:44:39.085>enter <00:44:39.225>that.

1005
00:44:40.405 --> 00:44:42.645
<00:44:40.405>What's, <00:44:40.638>if <00:44:40.871>my <00:44:41.105>name <00:44:41.338>is <00:44:41.571>Mike <00:44:41.805>O'Connell,

1006
00:44:42.675 --> 00:44:45.445
<00:44:42.675>then <00:44:42.908>I <00:44:43.141>need <00:44:43.375>the <00:44:43.608>single <00:44:43.841>tick, <00:44:44.075>right?

1007
00:44:45.545 --> 00:44:48.325
<00:44:45.545>So <00:44:45.700>I <00:44:45.856>cannot <00:44:46.011>just <00:44:46.167>block <00:44:46.322>it. <00:44:46.478>Um, <00:44:46.633>that's <00:44:46.789>just <00:44:46.945>wrong.

1008
00:44:48.385 --> 00:44:49.725
<00:44:48.385>That's <00:44:48.686>not <00:44:48.988>right. <00:44:49.289>I <00:44:49.591>have

1009
00:44:49.725 --> 00:44:52.605
<00:44:49.725>to <00:44:49.900>allow <00:44:50.075>every <00:44:50.250>character <00:44:50.424>maybe <00:44:50.600>in <00:44:50.775>a <00:44:50.950>text <00:44:51.125>field.

1010
00:44:53.505 --> 00:44:58.405
<00:44:53.505>So <00:44:53.680>input <00:44:53.855>validation <00:44:54.030>still <00:44:54.205>has <00:44:54.380>a <00:44:54.555>value <00:44:54.730>in <00:44:54.905>security

1011
00:44:58.405 --> 00:45:00.765
<00:44:58.405>because <00:44:58.638>it's <00:44:58.871>gonna <00:44:59.105>reduce <00:44:59.338>the <00:44:59.571>attack <00:44:59.805>surface.

1012
00:45:01.595 --> 00:45:02.685
<00:45:01.595>When <00:45:01.840>I <00:45:02.085>have <00:45:02.330>an <00:45:02.576>integer,

1013
00:45:02.845 --> 00:45:04.365
<00:45:02.845>I <00:45:03.073>should <00:45:03.301>check <00:45:03.529>whether <00:45:03.756>it's <00:45:03.984>really <00:45:04.212>integer

1014
00:45:04.715 --> 00:45:09.005
<00:45:04.715>because <00:45:04.870>then <00:45:05.026>by <00:45:05.181>design <00:45:05.337>no <00:45:05.492>one <00:45:05.648>can <00:45:05.803>misuse <00:45:05.959>that <00:45:06.115>parameter

1015
00:45:09.005 --> 00:45:10.605
<00:45:09.005>to <00:45:09.238>do <00:45:09.471>an <00:45:09.705>injection <00:45:09.938>attack, <00:45:10.171>for <00:45:10.405>example,

1016
00:45:11.155 --> 00:45:12.765
<00:45:11.155>it's <00:45:11.435>gonna <00:45:11.715>lower <00:45:11.995>the <00:45:12.275>attack <00:45:12.555>surface.

1017
00:45:12.995 --> 00:45:15.805
<00:45:12.995>It's <00:45:13.194>a <00:45:13.395>good <00:45:13.595>generic <00:45:13.795>measure <00:45:13.995>that <00:45:14.194>makes <00:45:14.395>your

1018
00:45:16.595 --> 00:45:17.885
<00:45:16.595>application <00:45:17.175>more <00:45:17.756>robust,

1019
00:45:17.905 --> 00:45:21.165
<00:45:17.905>but <00:45:18.080>it's <00:45:18.255>not <00:45:18.430>gonna <00:45:18.605>help <00:45:18.780>you <00:45:18.955>against <00:45:19.130>specific <00:45:19.305>vulnerabilities

1020
00:45:21.865 --> 00:45:24.925
<00:45:21.865>do <00:45:21.992>it, <00:45:22.119>but <00:45:22.246>not <00:45:22.374>in <00:45:22.501>order <00:45:22.628>to <00:45:22.755>protect <00:45:22.883>against <00:45:23.010>a <00:45:23.137>specific <00:45:23.265>one,

1021
00:45:24.925 --> 00:45:27.245
<00:45:24.925>but <00:45:25.158>to <00:45:25.391>have <00:45:25.625>a <00:45:25.858>lower <00:45:26.091>text <00:45:26.325>surface.

1022
00:45:28.435 --> 00:45:31.245
<00:45:28.435>Also, <00:45:28.610>uh, <00:45:28.785>people <00:45:28.960>often <00:45:29.134>ask <00:45:29.310>me, <00:45:29.485>is <00:45:29.660>it <00:45:29.835>okay

1023
00:45:31.245 --> 00:45:33.605
<00:45:31.245>to <00:45:31.444>have <00:45:31.645>input <00:45:31.845>validation <00:45:32.045>on <00:45:32.245>the <00:45:32.444>client <00:45:32.645>side?

1024
00:45:34.345 --> 00:45:37.365
<00:45:34.345>So <00:45:34.472>do <00:45:34.599>it <00:45:34.726>in <00:45:34.854>JavaScript <00:45:34.981>in <00:45:35.108>the <00:45:35.235>web <00:45:35.363>browser, <00:45:35.490>for <00:45:35.617>example, <00:45:35.745>yes,

1025
00:45:38.025 --> 00:45:40.485
<00:45:38.025>um, <00:45:38.200>it <00:45:38.375>is, <00:45:38.550>okay, <00:45:38.725>so <00:45:38.900>there, <00:45:39.075>there's <00:45:39.250>nothing <00:45:39.425>wrong

1026
00:45:40.485 --> 00:45:42.125
<00:45:40.485>with <00:45:40.718>having <00:45:40.951>a <00:45:41.185>client <00:45:41.418>side <00:45:41.651>input <00:45:41.885>validation.

1027
00:45:42.125 --> 00:45:43.165
<00:45:42.125>It's <00:45:42.359>even <00:45:42.593>good <00:45:42.827>for <00:45:43.061>security.

1028
00:45:43.165 --> 00:45:44.205
<00:45:43.165>It's <00:45:43.477>good <00:45:43.788>for <00:45:44.101>availability

1029
00:45:44.205 --> 00:45:46.565
<00:45:44.205>because <00:45:44.438>your <00:45:44.671>application <00:45:44.904>is <00:45:45.138>gonna <00:45:45.371>be <00:45:45.605>faster.

1030
00:45:46.945 --> 00:45:49.325
<00:45:46.945>You <00:45:47.100>don't <00:45:47.256>need <00:45:47.411>a <00:45:47.567>round <00:45:47.722>trip <00:45:47.878>through <00:45:48.033>the <00:45:48.189>server <00:45:48.345>always

1031
00:45:49.425 --> 00:45:51.085
<00:45:49.425>to <00:45:49.658>check <00:45:49.891>whether <00:45:50.125>the <00:45:50.358>input <00:45:50.591>is <00:45:50.825>okay.

1032
00:45:52.065 --> 00:45:55.125
<00:45:52.065>Um, <00:45:52.265>but <00:45:52.465>you <00:45:52.665>need <00:45:52.865>a <00:45:53.065>server <00:45:53.265>side <00:45:53.465>counterpart

1033
00:45:55.125 --> 00:45:57.805
<00:45:55.125>because <00:45:55.358>the <00:45:55.591>browser <00:45:55.825>is <00:45:56.058>under <00:45:56.291>my <00:45:56.525>control

1034
00:45:58.025 --> 00:46:01.205
<00:45:58.025>as <00:45:58.165>a <00:45:58.305>potential <00:45:58.445>attacker <00:45:58.585>so <00:45:58.725>I <00:45:58.865>can <00:45:59.005>control <00:45:59.145>what <00:45:59.285>is <00:45:59.425>sent

1035
00:46:01.205 --> 00:46:02.405
<00:46:01.205>to <00:46:01.565>the <00:46:01.925>server, <00:46:02.285>right?

1036
00:46:02.685 --> 00:46:05.005
<00:46:02.685>I <00:46:02.884>have <00:46:03.085>to <00:46:03.285>always <00:46:03.485>suppose <00:46:03.685>that <00:46:03.884>there <00:46:04.085>needs

1037
00:46:05.005 --> 00:46:08.525
<00:46:05.005>to <00:46:05.180>be <00:46:05.355>a <00:46:05.530>server <00:46:05.705>side <00:46:05.880>counterpart <00:46:06.055>for <00:46:06.230>input <00:46:06.405>validation,

1038
00:46:08.525 --> 00:46:09.645
<00:46:08.525>but <00:46:08.861>it's <00:46:09.197>absolutely <00:46:09.533>okay.

1039
00:46:09.645 --> 00:46:12.525
<00:46:09.645>It's <00:46:09.800>even <00:46:09.956>advisable <00:46:10.111>to <00:46:10.267>have <00:46:10.422>something <00:46:10.578>equal <00:46:10.733>on <00:46:10.889>the <00:46:11.045>client

1040
00:46:12.555 --> 00:46:15.325
<00:46:12.555>side <00:46:12.710>to <00:46:12.866>save <00:46:13.021>you <00:46:13.177>from <00:46:13.332>round <00:46:13.488>trips <00:46:13.643>to <00:46:13.799>the <00:46:13.955>server.

1041
00:46:16.975 --> 00:46:21.105
<00:46:16.975>Alright, <00:46:17.130>so <00:46:17.286>let's <00:46:17.441>get <00:46:17.597>to <00:46:17.752>the <00:46:17.908>next <00:46:18.063>one <00:46:18.219>with, <00:46:18.375>uh,

1042
00:46:21.655 --> 00:46:23.945
<00:46:21.655>it's <00:46:21.888>not <00:46:22.121>handling <00:46:22.355>anymore, <00:46:22.588>it's <00:46:22.821>output <00:46:23.055>handling.

1043
00:46:23.965 --> 00:46:28.225
<00:46:23.965>Output <00:46:24.105>means <00:46:24.245>I <00:46:24.385>take <00:46:24.525>some <00:46:24.665>user <00:46:24.805>input <00:46:24.945>that's <00:46:25.085>not <00:46:25.225>trusted <00:46:25.365>so

1044
00:46:28.225 --> 00:46:31.185
<00:46:28.225>that <00:46:28.341>I <00:46:28.458>take <00:46:28.575>it <00:46:28.691>from <00:46:28.808>the <00:46:28.924>database <00:46:29.041>that <00:46:29.158>was <00:46:29.275>entered <00:46:29.391>by <00:46:29.508>a <00:46:29.625>user,

1045
00:46:31.605 --> 00:46:33.385
<00:46:31.605>or <00:46:31.780>I <00:46:31.955>take <00:46:32.130>it <00:46:32.305>from <00:46:32.480>an <00:46:32.655>HT <00:46:32.830>DB <00:46:33.005>request

1046
00:46:33.805 --> 00:46:37.545
<00:46:33.805>and <00:46:33.921>I <00:46:34.038>put <00:46:34.154>it <00:46:34.271>into <00:46:34.388>some <00:46:34.504>sort <00:46:34.621>of <00:46:34.738>data <00:46:34.855>structure <00:46:34.971>that <00:46:35.088>could <00:46:35.205>be,

1047
00:46:37.545 --> 00:46:39.225
<00:46:37.545>for <00:46:37.895>example, <00:46:38.245>an <00:46:38.595>HTML <00:46:38.945>document.

1048
00:46:39.665 --> 00:46:41.065
<00:46:39.665>I <00:46:39.875>could <00:46:40.085>be <00:46:40.295>showing <00:46:40.505>the <00:46:40.715>first <00:46:40.925>name

1049
00:46:41.065 --> 00:46:44.345
<00:46:41.065>and <00:46:41.220>last <00:46:41.376>name <00:46:41.531>on <00:46:41.687>the <00:46:41.842>user <00:46:41.998>interface <00:46:42.153>in <00:46:42.309>HTM <00:46:42.465>L.

1050
00:46:44.365 --> 00:46:46.265
<00:46:44.365>So <00:46:44.598>I <00:46:44.831>take <00:46:45.064>that <00:46:45.298>untrusted <00:46:45.531>user <00:46:45.765>input

1051
00:46:46.265 --> 00:46:47.545
<00:46:46.265>that <00:46:46.649>everybody <00:46:47.033>can <00:46:47.417>manipulate

1052
00:46:47.545 --> 00:46:49.585
<00:46:47.545>or <00:46:47.825>that <00:46:48.105>specific <00:46:48.385>person <00:46:48.665>can <00:46:48.945>manipulate,

1053
00:46:49.585 --> 00:46:50.865
<00:46:49.585>and <00:46:49.815>I <00:46:50.045>put <00:46:50.276>it <00:46:50.506>into <00:46:50.736>html.

1054
00:46:51.725 --> 00:46:55.065
<00:46:51.725>Um, <00:46:51.900>now <00:46:52.075>why <00:46:52.250>do <00:46:52.424>I <00:46:52.600>need <00:46:52.775>output <00:46:52.950>and <00:46:53.125>coding?

1055
00:46:55.415 --> 00:46:57.025
<00:46:55.415>Well, <00:46:55.695>that <00:46:55.975>user <00:46:56.255>could <00:46:56.535>go <00:46:56.815>ahead

1056
00:46:57.125 --> 00:47:00.785
<00:46:57.125>and <00:46:57.300>enter, <00:46:57.475>for <00:46:57.650>example, <00:46:57.825>uh, <00:46:58.000>new <00:46:58.175>HTML <00:46:58.350>tags <00:46:58.525>such

1057
00:47:00.785 --> 00:47:04.225
<00:47:00.785>as <00:47:00.912>a <00:47:01.039>script <00:47:01.166>tag <00:47:01.294>and <00:47:01.421>could, <00:47:01.548>you <00:47:01.675>know, <00:47:01.803>you <00:47:01.930>then <00:47:02.057>take <00:47:02.185>it

1058
00:47:04.225 --> 00:47:05.345
<00:47:04.225>and <00:47:04.426>put <00:47:04.628>it <00:47:04.829>into <00:47:05.031>HT <00:47:05.232>ML

1059
00:47:05.765 --> 00:47:09.545
<00:47:05.765>and <00:47:05.920>they <00:47:06.076>could, <00:47:06.231>um, <00:47:06.387>execute <00:47:06.542>arbitrary <00:47:06.698>JavaScript <00:47:06.853>in <00:47:07.009>the <00:47:07.165>name

1060
00:47:09.545 --> 00:47:11.865
<00:47:09.545>of <00:47:09.745>other <00:47:09.945>users <00:47:10.145>if <00:47:10.345>they <00:47:10.545>see <00:47:10.745>that <00:47:10.945>input.

1061
00:47:13.045 --> 00:47:16.105
<00:47:13.045>Now, <00:47:13.220>we <00:47:13.395>said <00:47:13.570>that <00:47:13.745>input <00:47:13.920>validation <00:47:14.095>is <00:47:14.270>not, <00:47:14.445>uh,

1062
00:47:16.365 --> 00:47:17.625
<00:47:16.365>the <00:47:16.743>countermeasure <00:47:17.121>against <00:47:17.499>this.

1063
00:47:17.935 --> 00:47:19.385
<00:47:17.935>It's <00:47:18.370>output <00:47:18.805>and <00:47:19.240>coding.

1064
00:47:20.295 --> 00:47:22.145
<00:47:20.295>It's <00:47:20.645>safely <00:47:20.995>embedding <00:47:21.345>user <00:47:21.695>input

1065
00:47:22.175 --> 00:47:23.345
<00:47:22.175>into <00:47:22.526>different <00:47:22.877>data <00:47:23.228>structures.

1066
00:47:23.385 --> 00:47:25.425
<00:47:23.385>A <00:47:23.585>data <00:47:23.785>structure <00:47:23.985>could <00:47:24.185>be <00:47:24.385>an <00:47:24.585>SQL <00:47:24.785>statement,

1067
00:47:25.485 --> 00:47:30.325
<00:47:25.485>it <00:47:25.612>could <00:47:25.739>be <00:47:25.866>an <00:47:25.994>HTM <00:47:26.121>document, <00:47:26.248>it <00:47:26.375>could <00:47:26.503>be <00:47:26.630>a <00:47:26.757>CSV <00:47:26.885>export,

1068
00:47:30.465 --> 00:47:34.285
<00:47:30.465>it <00:47:30.592>could <00:47:30.719>be <00:47:30.846>an <00:47:30.974>LDAP <00:47:31.101>query, <00:47:31.228>it <00:47:31.355>could <00:47:31.483>be <00:47:31.610>an <00:47:31.737>SNTP <00:47:31.865>command

1069
00:47:34.285 --> 00:47:35.485
<00:47:34.285>because <00:47:34.645>you're <00:47:35.005>sending <00:47:35.365>emails

1070
00:47:36.265 --> 00:47:37.765
<00:47:36.265>and <00:47:36.457>when <00:47:36.650>you <00:47:36.843>take <00:47:37.036>something <00:47:37.229>that's <00:47:37.422>not <00:47:37.615>trusted,

1071
00:47:37.825 --> 00:47:39.125
<00:47:37.825>the <00:47:38.058>user <00:47:38.292>can <00:47:38.527>manipulate <00:47:38.761>in <00:47:38.995>it.

1072
00:47:39.125 --> 00:47:40.965
<00:47:39.125>You <00:47:39.325>put <00:47:39.525>it <00:47:39.725>directly <00:47:39.925>into <00:47:40.125>the <00:47:40.325>data <00:47:40.525>structure.

1073
00:47:41.355 --> 00:47:44.125
<00:47:41.355>Then <00:47:41.555>the <00:47:41.755>user <00:47:41.955>can <00:47:42.155>also <00:47:42.355>add <00:47:42.555>other <00:47:42.755>commands

1074
00:47:44.305 --> 00:47:45.445
<00:47:44.305>to <00:47:44.647>that <00:47:44.989>data <00:47:45.331>structure.

1075
00:47:46.225 --> 00:47:48.405
<00:47:46.225>For <00:47:46.400>H <00:47:46.575>TM <00:47:46.750>L, <00:47:46.924>that <00:47:47.100>means <00:47:47.275>cross <00:47:47.450>side <00:47:47.625>scripting.

1076
00:47:48.405 --> 00:47:52.325
<00:47:48.405>They <00:47:48.560>can <00:47:48.716>add <00:47:48.871>script <00:47:49.027>code <00:47:49.182>to <00:47:49.338>that <00:47:49.493>input <00:47:49.649>for, <00:47:49.805>um,

1077
00:47:54.055 --> 00:47:55.535
<00:47:54.055>SQL, <00:47:54.388>that <00:47:54.721>means <00:47:55.053>SQL <00:47:55.386>injection

1078
00:47:55.535 --> 00:47:59.095
<00:47:55.535>because <00:47:55.734>they <00:47:55.935>can <00:47:56.134>extend <00:47:56.335>the <00:47:56.535>SQL <00:47:56.734>query <00:47:56.935>arbitrarily.

1079
00:47:59.515 --> 00:48:02.455
<00:47:59.515>If <00:47:59.654>I <00:47:59.795>don't <00:47:59.935>do <00:48:00.075>anything <00:48:00.214>with <00:48:00.355>this <00:48:00.495>input <00:48:00.634>to <00:48:00.775>be <00:48:00.915>safely

1080
00:48:03.215 --> 00:48:04.495
<00:48:03.215>embedded <00:48:03.503>into <00:48:03.791>the <00:48:04.079>target <00:48:04.366>structure,

1081
00:48:04.875 --> 00:48:07.175
<00:48:04.875>I'm <00:48:05.050>gonna <00:48:05.225>have <00:48:05.400>a <00:48:05.575>security <00:48:05.750>problem, <00:48:05.925>uh, <00:48:06.100>most <00:48:06.275>likely.

1082
00:48:07.875 --> 00:48:10.615
<00:48:07.875>So <00:48:07.991>what <00:48:08.108>are <00:48:08.225>common <00:48:08.341>situations <00:48:08.458>where <00:48:08.575>I <00:48:08.691>must <00:48:08.808>be <00:48:08.925>aware <00:48:09.041>of <00:48:09.158>the <00:48:09.275>s

1083
00:48:10.635 --> 00:48:12.295
<00:48:10.635>of <00:48:11.335>taking <00:48:12.035>inputs

1084
00:48:12.295 --> 00:48:14.695
<00:48:12.295>and <00:48:12.575>they're <00:48:12.855>just <00:48:13.135>concatenating <00:48:13.415>the <00:48:13.695>strings

1085
00:48:14.695 --> 00:48:16.175
<00:48:14.695>to <00:48:14.961>some <00:48:15.227>sort <00:48:15.494>of <00:48:15.760>data <00:48:16.027>structure?

1086
00:48:16.915 --> 00:48:18.695
<00:48:16.915>Um, <00:48:17.615>it's <00:48:18.315>HTML

1087
00:48:18.755 --> 00:48:20.735
<00:48:18.755>and <00:48:18.955>JavaScript <00:48:19.155>just <00:48:19.355>as, <00:48:19.555>as <00:48:19.755>I <00:48:19.955>just <00:48:20.155>said,

1088
00:48:20.735 --> 00:48:22.015
<00:48:20.735>cross <00:48:21.023>out <00:48:21.311>scripting <00:48:21.599>is <00:48:21.886>a

1089
00:48:22.015 --> 00:48:23.295
<00:48:22.015>vulnerability <00:48:22.303>that <00:48:22.591>arises <00:48:22.879>from <00:48:23.167>that.

1090
00:48:23.765 --> 00:48:27.455
<00:48:23.765>It's <00:48:23.881>XML <00:48:23.998>when <00:48:24.115>you <00:48:24.231>do <00:48:24.348>x <00:48:24.464>ml <00:48:24.581>injection, <00:48:24.698>so <00:48:24.815>you <00:48:24.931>take <00:48:25.048>user <00:48:25.165>input

1091
00:48:27.455 --> 00:48:30.055
<00:48:27.455>and <00:48:27.610>you <00:48:27.766>talk <00:48:27.921>to <00:48:28.077>a <00:48:28.232>soap <00:48:28.388>service <00:48:28.543>internally, <00:48:28.699>for <00:48:28.855>example,

1092
00:48:30.075 --> 00:48:32.095
<00:48:30.075>and <00:48:30.355>you <00:48:30.634>just <00:48:30.915>do <00:48:31.194>stream <00:48:31.475>conation.

1093
00:48:32.615 --> 00:48:36.415
<00:48:32.615>I <00:48:32.742>can <00:48:32.869>add <00:48:32.996>other <00:48:33.124>parts <00:48:33.251>to <00:48:33.378>that <00:48:33.505>soap <00:48:33.633>query, <00:48:33.760>for <00:48:33.887>example, <00:48:34.015>uh,

1094
00:48:36.615 --> 00:48:39.095
<00:48:36.615>CSV <00:48:36.814>exports, <00:48:37.015>l <00:48:37.214>up <00:48:37.415>queries <00:48:37.615>that <00:48:37.814>you <00:48:38.015>use

1095
00:48:39.095 --> 00:48:42.215
<00:48:39.095>for <00:48:39.250>looking <00:48:39.406>up <00:48:39.561>users <00:48:39.717>in, <00:48:39.872>in <00:48:40.028>an <00:48:40.183>L <00:48:40.339>up, <00:48:40.495>uh,

1096
00:48:42.215 --> 00:48:43.655
<00:48:42.215>server, <00:48:42.863>for <00:48:43.511>example.

1097
00:48:44.325 --> 00:48:45.935
<00:48:44.325>There's <00:48:44.791>this <00:48:45.258>filter <00:48:45.725>syntax

1098
00:48:45.935 --> 00:48:48.455
<00:48:45.935>that <00:48:46.110>you <00:48:46.285>can <00:48:46.460>also <00:48:46.634>escape <00:48:46.810>from <00:48:46.985>and <00:48:47.160>so <00:48:47.335>on.

1099
00:48:49.255 --> 00:48:50.615
<00:48:49.255>SQL <00:48:49.429>is <00:48:49.604>a <00:48:49.779>bit <00:48:49.954>of <00:48:50.129>a <00:48:50.304>special <00:48:50.479>case

1100
00:48:50.615 --> 00:48:53.055
<00:48:50.615>because <00:48:50.848>the <00:48:51.081>primary <00:48:51.314>protection <00:48:51.548>mess <00:48:51.781>mechanisms <00:48:52.015>here

1101
00:48:53.075 --> 00:48:54.295
<00:48:53.075>is <00:48:53.441>not <00:48:53.807>output <00:48:54.173>coding.

1102
00:48:54.845 --> 00:48:56.255
<00:48:54.845>It's <00:48:55.479>prepared <00:48:56.114>statements.

1103
00:48:56.815 --> 00:48:59.175
<00:48:56.815>A <00:48:57.095>prepared <00:48:57.375>statement <00:48:57.655>means <00:48:57.935>that, <00:48:58.215>uh,

1104
00:48:59.175 --> 00:49:00.455
<00:48:59.175>you're <00:48:59.559>constructing <00:48:59.943>the <00:49:00.327>query

1105
00:49:00.595 --> 00:49:03.015
<00:49:00.595>and <00:49:00.828>you <00:49:01.061>have <00:49:01.294>placeholders <00:49:01.528>that <00:49:01.761>are <00:49:01.995>sometimes,

1106
00:49:03.195 --> 00:49:04.455
<00:49:03.195>for <00:49:03.573>example, <00:49:03.951>question <00:49:04.328>marks.

1107
00:49:05.155 --> 00:49:08.095
<00:49:05.155>Um, <00:49:05.295>and <00:49:05.435>then <00:49:05.575>you <00:49:05.715>send <00:49:05.855>that <00:49:05.995>query <00:49:06.135>to <00:49:06.275>the <00:49:06.415>database <00:49:06.555>server,

1108
00:49:08.125 --> 00:49:09.815
<00:49:08.125>it's <00:49:08.358>gonna <00:49:08.591>parse <00:49:08.825>it <00:49:09.058>and <00:49:09.291>interpret <00:49:09.525>it.

1109
00:49:10.115 --> 00:49:12.335
<00:49:10.115>And <00:49:10.270>only <00:49:10.426>then <00:49:10.581>in <00:49:10.737>a <00:49:10.892>separate <00:49:11.048>step <00:49:11.203>you <00:49:11.359>send <00:49:11.515>the

1110
00:49:12.335 --> 00:49:13.655
<00:49:12.335>parameters <00:49:12.632>to <00:49:12.929>the <00:49:13.226>SQL <00:49:13.523>server.

1111
00:49:14.275 --> 00:49:16.415
<00:49:14.275>And <00:49:14.450>then <00:49:14.625>I <00:49:14.800>don't, <00:49:14.975>I <00:49:15.150>cannot <00:49:15.325>change <00:49:15.500>the <00:49:15.675>structure

1112
00:49:16.415 --> 00:49:18.535
<00:49:16.415>of <00:49:16.695>the <00:49:16.975>SQL <00:49:17.255>statement <00:49:17.535>itself <00:49:17.815>anymore

1113
00:49:18.535 --> 00:49:19.855
<00:49:18.535>because <00:49:18.772>that <00:49:19.010>was <00:49:19.247>a <00:49:19.485>separate <00:49:19.723>step.

1114
00:49:20.675 --> 00:49:24.055
<00:49:20.675>But <00:49:20.830>for <00:49:20.986>all <00:49:21.141>the <00:49:21.297>others, <00:49:21.452>output <00:49:21.608>and <00:49:21.763>coding <00:49:21.919>is <00:49:22.075>key.

1115
00:49:26.035 --> 00:49:27.535
<00:49:26.035>So <00:49:26.305>as <00:49:26.575>opposed <00:49:26.845>to <00:49:27.115>input <00:49:27.384>validation,

1116
00:49:27.535 --> 00:49:30.255
<00:49:27.535>this <00:49:27.768>is <00:49:28.001>usually <00:49:28.234>a <00:49:28.468>primary <00:49:28.701>protection <00:49:28.935>mechanism.

1117
00:49:30.785 --> 00:49:32.895
<00:49:30.785>Input <00:49:31.018>validation <00:49:31.251>lowers <00:49:31.484>the <00:49:31.718>attack <00:49:31.951>attack <00:49:32.185>surface.

1118
00:49:32.955 --> 00:49:34.015
<00:49:32.955>So <00:49:33.273>it's <00:49:33.591>very <00:49:33.908>effective.

1119
00:49:34.015 --> 00:49:35.415
<00:49:34.015>So <00:49:34.194>you <00:49:34.375>should, <00:49:34.555>you <00:49:34.735>should <00:49:34.915>still <00:49:35.095>do <00:49:35.275>it.

1120
00:49:35.915 --> 00:49:38.215
<00:49:35.915>Uh, <00:49:36.115>but <00:49:36.315>output <00:49:36.515>and <00:49:36.715>coding <00:49:36.915>protects <00:49:37.115>against <00:49:37.315>those

1121
00:49:38.735 --> 00:49:39.855
<00:49:38.735>specific <00:49:39.239>vulnerability <00:49:39.743>classes.

1122
00:49:42.135 --> 00:49:44.075
<00:49:42.135>Um, <00:49:42.368>there's <00:49:42.601>one <00:49:42.835>more <00:49:43.068>thing <00:49:43.301>that <00:49:43.535>relates

1123
00:49:44.375 --> 00:49:46.035
<00:49:44.375>to <00:49:44.841>handing <00:49:45.308>the <00:49:45.775>input.

1124
00:49:46.035 --> 00:49:47.435
<00:49:46.035>That's <00:49:46.665>called <00:49:47.295>sanitization.

1125
00:49:47.675 --> 00:49:50.795
<00:49:47.675>I <00:49:47.850>need <00:49:48.025>that <00:49:48.200>sometimes <00:49:48.375>because <00:49:48.550>I <00:49:48.725>might <00:49:48.900>have <00:49:49.075>code

1126
00:49:50.815 --> 00:49:52.715
<00:49:50.815>or <00:49:51.095>potential <00:49:51.375>code <00:49:51.655>as <00:49:51.935>an <00:49:52.215>input.

1127
00:49:52.945 --> 00:49:55.635
<00:49:52.945>Imagine <00:49:53.145>a <00:49:53.345>situation <00:49:53.545>where <00:49:53.745>you <00:49:53.945>have <00:49:54.145>formatted <00:49:54.345>code.

1128
00:49:55.735 --> 00:49:56.995
<00:49:55.735>So <00:49:55.897>you <00:49:56.059>have <00:49:56.221>this, <00:49:56.383>what <00:49:56.545>you <00:49:56.707>see <00:49:56.868>is

1129
00:49:56.995 --> 00:49:59.115
<00:49:56.995>what <00:49:57.150>you <00:49:57.306>get <00:49:57.461>editor <00:49:57.617>here <00:49:57.772>on <00:49:57.928>the <00:49:58.083>right <00:49:58.239>hand <00:49:58.395>side

1130
00:49:59.445 --> 00:50:02.155
<00:49:59.445>where <00:49:59.585>you <00:49:59.725>can <00:49:59.865>do <00:50:00.005>format, <00:50:00.145>like <00:50:00.285>you <00:50:00.425>can <00:50:00.565>make <00:50:00.705>something <00:50:00.845>bold

1131
00:50:02.215 --> 00:50:06.075
<00:50:02.215>or <00:50:02.370>italic <00:50:02.526>or <00:50:02.681>you <00:50:02.837>can, <00:50:02.992>uh, <00:50:03.148>maybe <00:50:03.303>do <00:50:03.459>unordered <00:50:03.615>lists

1132
00:50:06.135 --> 00:50:07.195
<00:50:06.135>and <00:50:06.373>and <00:50:06.612>stuff <00:50:06.850>like <00:50:07.089>that.

1133
00:50:08.015 --> 00:50:10.635
<00:50:08.015>And <00:50:08.214>that <00:50:08.415>often <00:50:08.615>results <00:50:08.815>in <00:50:09.015>HTML <00:50:09.214>code <00:50:09.415>being

1134
00:50:10.635 --> 00:50:11.755
<00:50:10.635>posted <00:50:10.971>to <00:50:11.307>your <00:50:11.643>server.

1135
00:50:12.135 --> 00:50:14.355
<00:50:12.135>So <00:50:12.275>I <00:50:12.415>cannot <00:50:12.555>just <00:50:12.695>encode <00:50:12.835>that <00:50:12.975>because <00:50:13.115>what <00:50:13.255>I'm <00:50:13.395>gonna <00:50:13.535>see

1136
00:50:14.535 --> 00:50:16.875
<00:50:14.535>and <00:50:14.710>get <00:50:14.884>back, <00:50:15.060>I'll <00:50:15.234>go <00:50:15.410>back <00:50:15.585>to <00:50:15.759>this <00:50:15.935>slide.

1137
00:50:17.385 --> 00:50:21.635
<00:50:17.385>I'll <00:50:17.585>be <00:50:17.785>seeing <00:50:17.985>literal <00:50:18.185>HTML <00:50:18.385>code <00:50:18.585>in <00:50:18.785>my,

1138
00:50:22.055 --> 00:50:23.675
<00:50:22.055>in <00:50:22.521>my <00:50:22.988>application, <00:50:23.455>right?

1139
00:50:24.425 --> 00:50:26.725
<00:50:24.425>But <00:50:24.600>it's <00:50:24.775>not <00:50:24.950>gonna <00:50:25.125>work. <00:50:25.300>But <00:50:25.475>I <00:50:25.650>still <00:50:25.825>want

1140
00:50:26.725 --> 00:50:27.805
<00:50:26.725>this <00:50:27.211>formatted <00:50:27.696>text.

1141
00:50:28.075 --> 00:50:32.925
<00:50:28.075>What <00:50:28.202>I <00:50:28.329>can <00:50:28.456>do <00:50:28.584>now <00:50:28.711>is <00:50:28.838>I <00:50:28.965>can <00:50:29.093>strip <00:50:29.220>out <00:50:29.347>everything <00:50:29.475>of

1142
00:50:32.925 --> 00:50:34.045
<00:50:32.925>that <00:50:33.429>HMLT <00:50:33.933>input

1143
00:50:34.515 --> 00:50:37.485
<00:50:34.515>that <00:50:34.795>can <00:50:35.075>contain <00:50:35.355>potentially <00:50:35.634>JavaScript <00:50:35.915>code,

1144
00:50:38.105 --> 00:50:39.485
<00:50:38.105>that's <00:50:38.726>script <00:50:39.347>text,

1145
00:50:39.905 --> 00:50:42.605
<00:50:39.905>that's <00:50:40.185>JavaScript <00:50:40.465>event <00:50:40.745>handle <00:50:41.025>handlers, <00:50:41.305>basically.

1146
00:50:43.785 --> 00:50:47.405
<00:50:43.785>Um, <00:50:43.912>so <00:50:44.039>I <00:50:44.166>have <00:50:44.294>to <00:50:44.421>get <00:50:44.548>rid <00:50:44.675>of <00:50:44.803>those <00:50:44.930>dangerous <00:50:45.057>parts, <00:50:45.185>uh,

1147
00:50:47.405 --> 00:50:49.525
<00:50:47.405>because <00:50:47.638>I <00:50:47.871>have <00:50:48.105>to <00:50:48.338>have, <00:50:48.571>you <00:50:48.805>know,

1148
00:50:49.685 --> 00:50:51.685
<00:50:49.685>h <00:50:49.840>TM <00:50:49.996>l <00:50:50.151>it's <00:50:50.307>not <00:50:50.462>possible <00:50:50.618>in <00:50:50.773>any <00:50:50.929>other <00:50:51.085>way.

1149
00:50:51.685 --> 00:50:52.925
<00:50:51.685>That's <00:50:52.243>called <00:50:52.801>sanitization

1150
00:50:52.925 --> 00:50:56.645
<00:50:52.925>because <00:50:53.125>I <00:50:53.325>sanitize <00:50:53.525>it <00:50:53.725>when <00:50:53.925>doing <00:50:54.125>input <00:50:54.325>validation

1151
00:50:56.705 --> 00:50:57.925
<00:50:56.705>and <00:50:56.924>the <00:50:57.144>input <00:50:57.363>is <00:50:57.583>not <00:50:57.803>valid.

1152
00:50:58.245 --> 00:50:59.885
<00:50:58.245>I <00:50:58.420>reject <00:50:58.595>it. <00:50:58.770>I <00:50:58.944>say <00:50:59.120>this <00:50:59.295>is <00:50:59.470>not <00:50:59.645>correct.

1153
00:51:00.755 --> 00:51:02.085
<00:51:00.755>When <00:51:01.154>I <00:51:01.553>do <00:51:01.952>sanitization,

1154
00:51:02.205 --> 00:51:03.685
<00:51:02.205>I <00:51:02.395>get <00:51:02.585>an <00:51:02.775>input <00:51:02.966>that <00:51:03.156>that's <00:51:03.346>not <00:51:03.537>valid.

1155
00:51:03.925 --> 00:51:06.165
<00:51:03.925>I <00:51:04.100>strip <00:51:04.275>out <00:51:04.450>the <00:51:04.625>parts <00:51:04.800>that <00:51:04.975>are <00:51:05.150>in <00:51:05.325>vetted,

1156
00:51:06.165 --> 00:51:07.285
<00:51:06.165>but <00:51:06.417>I <00:51:06.669>keep <00:51:06.921>the <00:51:07.173>input.

1157
00:51:07.305 --> 00:51:09.725
<00:51:07.305>That's <00:51:07.585>the <00:51:07.865>different <00:51:08.145>difference <00:51:08.424>between <00:51:08.705>input,

1158
00:51:09.725 --> 00:51:11.125
<00:51:09.725>validation <00:51:10.355>and <00:51:10.985>sanitization.

1159
00:51:12.585 --> 00:51:15.405
<00:51:12.585>Uh, <00:51:12.818>the <00:51:13.051>rules <00:51:13.285>about <00:51:13.518>sanitization <00:51:13.751>don't <00:51:13.985>roll

1160
00:51:15.435 --> 00:51:16.765
<00:51:15.435>your <00:51:16.033>own <00:51:16.632>sanitizer.

1161
00:51:16.935 --> 00:51:18.245
<00:51:16.935>There <00:51:17.229>are <00:51:17.524>libraries <00:51:17.819>out <00:51:18.114>there.

1162
00:51:18.585 --> 00:51:21.725
<00:51:18.585>Uh, <00:51:18.692>I <00:51:18.800>listed <00:51:18.908>a <00:51:19.015>few <00:51:19.123>here <00:51:19.231>in <00:51:19.338>the <00:51:19.446>slide, <00:51:19.554>uh, <00:51:19.661>that <00:51:19.769>you <00:51:19.877>can <00:51:19.985>use

1163
00:51:21.725 --> 00:51:23.165
<00:51:21.725>that <00:51:22.049>are <00:51:22.373>specialized <00:51:22.697>in <00:51:23.020>this.

1164
00:51:24.025 --> 00:51:26.205
<00:51:24.025>Um, <00:51:24.200>this <00:51:24.375>is <00:51:24.550>very, <00:51:24.725>very <00:51:24.900>hard <00:51:25.075>to <00:51:25.250>do, <00:51:25.425>right?

1165
00:51:26.465 --> 00:51:29.165
<00:51:26.465>So <00:51:26.581>don't <00:51:26.698>do <00:51:26.815>it <00:51:26.931>on <00:51:27.048>your <00:51:27.165>own. <00:51:27.281>Use <00:51:27.398>a <00:51:27.515>library <00:51:27.631>that <00:51:27.748>does <00:51:27.865>it.

1166
00:51:29.665 --> 00:51:32.605
<00:51:29.665>Uh, <00:51:29.840>for <00:51:30.015>example, <00:51:30.190>angular <00:51:30.365>comes <00:51:30.540>with <00:51:30.715>its <00:51:30.890>own <00:51:31.065>sanitizer.

1167
00:51:32.605 --> 00:51:33.925
<00:51:32.605>It's <00:51:32.902>built <00:51:33.199>into <00:51:33.496>the <00:51:33.793>framework.

1168
00:51:33.925 --> 00:51:37.885
<00:51:33.925>You <00:51:34.080>don't <00:51:34.236>have <00:51:34.391>to <00:51:34.547>load <00:51:34.702>the <00:51:34.858>library <00:51:35.013>for <00:51:35.169>it. <00:51:35.325>Okay?

1169
00:51:37.885 --> 00:51:42.325
<00:51:37.885>So <00:51:38.001>let's <00:51:38.118>get <00:51:38.235>back <00:51:38.351>to <00:51:38.468>the <00:51:38.585>big <00:51:38.701>picture. <00:51:38.818>Uh, <00:51:38.935>what <00:51:39.051>to <00:51:39.168>do <00:51:39.285>when.

1170
00:51:42.545 --> 00:51:43.885
<00:51:42.545>So <00:51:42.786>I <00:51:43.027>have <00:51:43.268>my <00:51:43.509>user <00:51:43.751>interface

1171
00:51:43.885 --> 00:51:46.805
<00:51:43.885>that <00:51:44.118>gives <00:51:44.351>me <00:51:44.585>untrusted <00:51:44.818>user <00:51:45.051>input, <00:51:45.285>right?

1172
00:51:46.965 --> 00:51:49.085
<00:51:46.965>I <00:51:47.120>don't <00:51:47.276>trust <00:51:47.431>what's <00:51:47.587>coming <00:51:47.742>from <00:51:47.898>the <00:51:48.053>browser, <00:51:48.209>for <00:51:48.365>example.

1173
00:51:50.025 --> 00:51:52.565
<00:51:50.025>And, <00:51:50.200>uh, <00:51:50.375>when <00:51:50.550>the <00:51:50.725>input <00:51:50.900>comes <00:51:51.075>into <00:51:51.250>my <00:51:51.425>application,

1174
00:51:52.805 --> 00:51:54.885
<00:51:52.805>I <00:51:53.154>optionally <00:51:53.504>do <00:51:53.855>a <00:51:54.205>canonization.

1175
00:51:54.905 --> 00:51:57.805
<00:51:54.905>So <00:51:55.032>for <00:51:55.159>example, <00:51:55.286>I <00:51:55.414>have <00:51:55.541>HTML <00:51:55.668>input <00:51:55.795>from <00:51:55.923>what <00:51:56.050>you <00:51:56.177>see <00:51:56.305>is

1176
00:51:57.805 --> 00:52:01.205
<00:51:57.805>what <00:51:57.960>you <00:51:58.116>get <00:51:58.271>formatted <00:51:58.427>editor, <00:51:58.582>I <00:51:58.738>have <00:51:58.893>to <00:51:59.049>get <00:51:59.205>rid

1177
00:52:01.205 --> 00:52:04.605
<00:52:01.205>of <00:52:01.360>what's <00:52:01.516>in <00:52:01.671>there, <00:52:01.827>uh, <00:52:01.982>in <00:52:02.138>terms <00:52:02.293>of <00:52:02.449>JavaScript <00:52:02.605>code

1178
00:52:04.605 --> 00:52:06.285
<00:52:04.605>because <00:52:04.780>I <00:52:04.955>don't <00:52:05.130>want <00:52:05.305>that, <00:52:05.480>uh, <00:52:05.655>to <00:52:05.830>be <00:52:06.005>part

1179
00:52:06.285 --> 00:52:07.405
<00:52:06.285>of <00:52:06.621>the <00:52:06.957>other <00:52:07.293>user's.

1180
00:52:07.665 --> 00:52:11.205
<00:52:07.665>Uh, <00:52:07.865>HTML. <00:52:08.065>Then <00:52:08.265>I <00:52:08.465>validate, <00:52:08.665>uh, <00:52:08.865>maximum <00:52:09.065>length

1181
00:52:11.385 --> 00:52:13.525
<00:52:11.385>and, <00:52:11.585>uh, <00:52:11.785>type <00:52:11.985>of <00:52:12.185>data <00:52:12.385>and <00:52:12.585>so <00:52:12.785>on.

1182
00:52:14.185 --> 00:52:18.185
<00:52:14.185>Um, <00:52:14.384>sorry, <00:52:14.585>uh, <00:52:14.785>I <00:52:14.985>just <00:52:15.185>swapped <00:52:15.384>those <00:52:15.585>two.

1183
00:52:18.205 --> 00:52:20.505
<00:52:18.205>The <00:52:18.404>first <00:52:18.605>thing <00:52:18.805>I <00:52:19.005>explained <00:52:19.205>was <00:52:19.404>sanitization <00:52:19.605>actually.

1184
00:52:20.505 --> 00:52:22.185
<00:52:20.505>So <00:52:20.855>sanitization <00:52:21.205>is <00:52:21.555>getting <00:52:21.905>rid

1185
00:52:22.185 --> 00:52:24.225
<00:52:22.185>of <00:52:22.418>the <00:52:22.651>dangerous <00:52:22.884>parts <00:52:23.118>of <00:52:23.351>the <00:52:23.585>input.

1186
00:52:24.625 --> 00:52:28.265
<00:52:24.625>Canonization <00:52:24.800>is <00:52:24.975>also <00:52:25.150>optionally <00:52:25.325>when <00:52:25.500>it's <00:52:25.675>an <00:52:25.850>email <00:52:26.025>address

1187
00:52:28.405 --> 00:52:32.745
<00:52:28.405>or <00:52:28.512>a <00:52:28.620>URL <00:52:28.728>or <00:52:28.835>an <00:52:28.943>IP <00:52:29.051>address, <00:52:29.158>I <00:52:29.266>bring <00:52:29.374>it <00:52:29.481>into <00:52:29.589>a <00:52:29.697>specific <00:52:29.805>format

1188
00:52:32.745 --> 00:52:34.625
<00:52:32.745>that's <00:52:33.025>comparable <00:52:33.305>to <00:52:33.585>other <00:52:33.865>fields <00:52:34.145>that,

1189
00:52:34.625 --> 00:52:36.105
<00:52:34.625>that <00:52:34.815>I <00:52:35.005>have <00:52:35.195>already <00:52:35.386>stored <00:52:35.576>in <00:52:35.766>my <00:52:35.957>database.

1190
00:52:36.105 --> 00:52:37.545
<00:52:36.105>Sorry, <00:52:36.429>I <00:52:36.753>confused <00:52:37.077>the <00:52:37.401>two.

1191
00:52:38.405 --> 00:52:41.545
<00:52:38.405>Uh, <00:52:38.580>then <00:52:38.755>I <00:52:38.930>store <00:52:39.105>it, <00:52:39.280>sorry, <00:52:39.455>I <00:52:39.630>store <00:52:39.805>it.

1192
00:52:42.045 --> 00:52:44.985
<00:52:42.045>Um, <00:52:42.185>and <00:52:42.325>when <00:52:42.465>I <00:52:42.605>store <00:52:42.745>it <00:52:42.885>in <00:52:43.025>a <00:52:43.165>database, <00:52:43.305>I <00:52:43.445>have

1193
00:52:44.985 --> 00:52:48.145
<00:52:44.985>to <00:52:45.160>keep <00:52:45.335>an <00:52:45.510>eye <00:52:45.685>on <00:52:45.860>SQL <00:52:46.035>objection <00:52:46.210>of <00:52:46.385>vulnerabilities.

1194
00:52:48.205 --> 00:52:49.785
<00:52:48.205>But <00:52:48.485>that's <00:52:48.765>done <00:52:49.045>with <00:52:49.325>prepared <00:52:49.605>statements.

1195
00:52:50.455 --> 00:52:52.105
<00:52:50.455>Then <00:52:50.654>when <00:52:50.855>I <00:52:51.055>read <00:52:51.255>it <00:52:51.455>from <00:52:51.654>the <00:52:51.855>storage

1196
00:52:52.125 --> 00:52:55.025
<00:52:52.125>and <00:52:52.265>I <00:52:52.405>put <00:52:52.545>it <00:52:52.685>into <00:52:52.825>some <00:52:52.965>target <00:52:53.105>data <00:52:53.245>format, <00:52:53.385>I <00:52:53.525>have

1197
00:52:55.025 --> 00:52:57.785
<00:52:55.025>to <00:52:55.258>do <00:52:55.491>context <00:52:55.725>sensitive <00:52:55.958>output <00:52:56.191>and <00:52:56.425>coding.

1198
00:52:57.855 --> 00:52:59.785
<00:52:57.855>That <00:52:58.135>is <00:52:58.415>key <00:52:58.695>to <00:52:58.975>protect <00:52:59.255>yourself

1199
00:52:59.785 --> 00:53:00.985
<00:52:59.785>against <00:53:00.325>certain <00:53:00.865>vulnerabilities.

1200
00:53:01.405 --> 00:53:04.545
<00:53:01.405>For <00:53:01.560>example, <00:53:01.716>when <00:53:01.871>you <00:53:02.027>out, <00:53:02.182>when <00:53:02.338>using <00:53:02.493>a <00:53:02.649>rest <00:53:02.805>API

1201
00:53:04.545 --> 00:53:06.705
<00:53:04.545>and <00:53:04.895>you <00:53:05.245>output <00:53:05.595>chason, <00:53:05.945>uh,

1202
00:53:06.895 --> 00:53:09.345
<00:53:06.895>your <00:53:07.245>framework <00:53:07.595>basically <00:53:07.945>automatically <00:53:08.295>does

1203
00:53:09.705 --> 00:53:10.825
<00:53:09.705>escaping <00:53:10.040>of <00:53:10.377>double <00:53:10.712>quotes.

1204
00:53:11.205 --> 00:53:13.305
<00:53:11.205>So <00:53:11.360>if <00:53:11.516>you <00:53:11.671>have <00:53:11.827>a <00:53:11.982>string <00:53:12.138>that's <00:53:12.293>in <00:53:12.449>double <00:53:12.605>quotes,

1205
00:53:13.405 --> 00:53:15.785
<00:53:13.405>if <00:53:13.638>a <00:53:13.871>value <00:53:14.105>in <00:53:14.338>your <00:53:14.571>chason <00:53:14.805>object

1206
00:53:16.645 --> 00:53:18.985
<00:53:16.645>and <00:53:16.820>that <00:53:16.995>value <00:53:17.170>itself <00:53:17.345>contains <00:53:17.520>double <00:53:17.695>quotes <00:53:17.870>as <00:53:18.045>well

1207
00:53:19.205 --> 00:53:22.425
<00:53:19.205>as <00:53:19.345>well <00:53:19.485>your <00:53:19.625>chason <00:53:19.765>co <00:53:19.904>encoder <00:53:20.045>is <00:53:20.185>gonna <00:53:20.325>do <00:53:20.465>backslash <00:53:20.605>double

1208
00:53:22.425 --> 00:53:25.165
<00:53:22.425>quote, <00:53:22.705>that's <00:53:22.985>context <00:53:23.265>sensitive <00:53:23.545>output <00:53:23.825>coding.

1209
00:53:25.595 --> 00:53:27.725
<00:53:25.595>Your <00:53:25.875>framework <00:53:26.154>probably <00:53:26.435>does <00:53:26.714>that <00:53:26.995>automatically,

1210
00:53:28.845 --> 00:53:30.145
<00:53:28.845>but <00:53:29.078>it <00:53:29.312>could <00:53:29.547>also <00:53:29.781>be <00:53:30.015>HTML.

1211
00:53:30.205 --> 00:53:34.105
<00:53:30.205>So <00:53:30.321>I <00:53:30.438>have <00:53:30.555>to <00:53:30.671>take <00:53:30.788>the <00:53:30.904>values <00:53:31.021>that, <00:53:31.138>uh, <00:53:31.255>stem <00:53:31.371>from <00:53:31.488>the <00:53:31.605>user

1212
00:53:34.525 --> 00:53:36.745
<00:53:34.525>and <00:53:34.758>do <00:53:34.991>HTML <00:53:35.225>encoding <00:53:35.458>in <00:53:35.691>that <00:53:35.925>case

1213
00:53:36.885 --> 00:53:39.625
<00:53:36.885>before <00:53:37.118>I <00:53:37.351>embed <00:53:37.585>it <00:53:37.818>into <00:53:38.051>my <00:53:38.285>HTML.

1214
00:53:41.115 --> 00:53:42.965
<00:53:41.115>Most <00:53:41.314>of <00:53:41.515>the <00:53:41.714>single <00:53:41.915>page <00:53:42.115>application <00:53:42.314>frameworks <00:53:42.515>do

1215
00:53:42.965 --> 00:53:45.405
<00:53:42.965>that <00:53:43.245>automatically <00:53:43.525>in <00:53:43.805>most <00:53:44.085>cases, <00:53:44.365>right?

1216
00:53:45.825 --> 00:53:49.205
<00:53:45.825>So <00:53:45.980>your <00:53:46.136>angular, <00:53:46.291>your <00:53:46.447>E <00:53:46.602>react, <00:53:46.758>your <00:53:46.913>VTS <00:53:47.069>application <00:53:47.225>does

1217
00:53:49.315 --> 00:53:52.485
<00:53:49.315>that <00:53:49.515>encoding <00:53:49.715>in <00:53:49.915>the <00:53:50.115>browser <00:53:50.315>for <00:53:50.515>you, <00:53:50.715>right?

1218
00:53:52.865 --> 00:53:55.325
<00:53:52.865>But <00:53:53.020>there <00:53:53.176>are <00:53:53.331>some <00:53:53.487>situations <00:53:53.642>in <00:53:53.798>React, <00:53:53.953>it's <00:53:54.109>dangers <00:53:54.265>is

1219
00:53:55.325 --> 00:53:57.045
<00:53:55.325>that <00:53:55.524>dangerously <00:53:55.725>set <00:53:55.924>in <00:53:56.125>your <00:53:56.325>H <00:53:56.524>TM <00:53:56.725>L

1220
00:53:57.255 --> 00:53:59.645
<00:53:57.255>where <00:53:57.430>in <00:53:57.605>VTS <00:53:57.780>it's <00:53:57.955>V <00:53:58.130>dash <00:53:58.305>H <00:53:58.480>TM <00:53:58.655>L

1221
00:53:59.775 --> 00:54:01.485
<00:53:59.775>where <00:53:59.975>it <00:54:00.175>does <00:54:00.375>not <00:54:00.575>encode <00:54:00.775>and <00:54:00.975>that's <00:54:01.175>dangerous.

1222
00:54:04.385 --> 00:54:07.755
<00:54:04.385>Alright, <00:54:04.618>um, <00:54:04.851>some <00:54:05.085>more <00:54:05.318>secure <00:54:05.551>coding <00:54:05.785>practices.

1223
00:54:07.935 --> 00:54:11.875
<00:54:07.935>So, <00:54:08.110>um, <00:54:08.285>pitfalls <00:54:08.460>in <00:54:08.634>lower <00:54:08.810>lang <00:54:08.985>lower <00:54:09.160>level <00:54:09.335>languages,

1224
00:54:11.975 --> 00:54:15.155
<00:54:11.975>that's <00:54:12.174>a, <00:54:12.375>that's <00:54:12.575>hard <00:54:12.775>to <00:54:12.975>say, <00:54:13.174>um, <00:54:13.375>is

1225
00:54:15.225 --> 00:54:17.835
<00:54:15.225>that <00:54:15.505>we <00:54:15.785>have <00:54:16.065>no <00:54:16.345>memory <00:54:16.625>safety.

1226
00:54:18.205 --> 00:54:19.795
<00:54:18.205>Those <00:54:18.671>languages <00:54:19.138>are <00:54:19.605>not,

1227
00:54:19.895 --> 00:54:23.555
<00:54:19.895>or <00:54:20.050>in <00:54:20.206>a <00:54:20.361>very <00:54:20.517>limited <00:54:20.672>way, <00:54:20.828>only <00:54:20.983>checking <00:54:21.139>whether, <00:54:21.295>um,

1228
00:54:24.025 --> 00:54:27.275
<00:54:24.025>what <00:54:24.200>I <00:54:24.375>do <00:54:24.550>is, <00:54:24.725>you <00:54:24.900>know, <00:54:25.075>they're <00:54:25.250>checking <00:54:25.425>that

1229
00:54:27.495 --> 00:54:30.835
<00:54:27.495>or <00:54:27.622>they <00:54:27.749>don't <00:54:27.876>even <00:54:28.004>give <00:54:28.131>it, <00:54:28.258>give <00:54:28.385>you <00:54:28.513>the <00:54:28.640>opportunity <00:54:28.767>to, <00:54:28.895>uh,

1230
00:54:31.355 --> 00:54:32.595
<00:54:31.355>mangle <00:54:31.634>with <00:54:31.913>pointers, <00:54:32.192>for <00:54:32.471>example.

1231
00:54:32.775 --> 00:54:35.075
<00:54:32.775>So <00:54:32.950>what <00:54:33.125>could <00:54:33.300>arise <00:54:33.475>from <00:54:33.650>this <00:54:33.825>is <00:54:34.000>buffer <00:54:34.175>overflows.

1232
00:54:35.075 --> 00:54:36.515
<00:54:35.075>They <00:54:35.290>don't <00:54:35.506>check <00:54:35.723>the <00:54:35.939>bounds <00:54:36.154>when <00:54:36.371>writing

1233
00:54:37.335 --> 00:54:39.235
<00:54:37.335>an <00:54:37.615>input <00:54:37.895>into <00:54:38.175>a <00:54:38.455>memory <00:54:38.735>structure.

1234
00:54:39.855 --> 00:54:42.315
<00:54:39.855>Uh, <00:54:40.135>heap <00:54:40.415>overflows <00:54:40.695>form <00:54:40.975>string <00:54:41.255>vulnerabilities.

1235
00:54:43.015 --> 00:54:45.475
<00:54:43.015>So <00:54:43.190>this <00:54:43.365>is <00:54:43.540>an <00:54:43.714>example <00:54:43.890>of <00:54:44.065>a <00:54:44.240>buffer <00:54:44.415>overflow.

1236
00:54:45.995 --> 00:54:48.635
<00:54:45.995>I <00:54:46.150>have <00:54:46.306>an <00:54:46.461>argument <00:54:46.617>here <00:54:46.772>that's, <00:54:46.928>um, <00:54:47.083>that <00:54:47.239>can <00:54:47.395>be

1237
00:54:48.635 --> 00:54:50.035
<00:54:48.635>of <00:54:49.055>arbitrary <00:54:49.475>length, <00:54:49.895>right?

1238
00:54:50.975 --> 00:54:54.875
<00:54:50.975>And, <00:54:51.115>um, <00:54:51.255>I <00:54:51.395>string <00:54:51.535>copy <00:54:51.674>this <00:54:51.815>into, <00:54:51.955>uh, <00:54:52.095>into <00:54:52.235>this <00:54:52.375>buffer

1239
00:54:54.945 --> 00:54:57.635
<00:54:54.945>that <00:54:55.225>is <00:54:55.505>10 <00:54:55.785>characters <00:54:56.065>in <00:54:56.345>length.

1240
00:54:58.215 --> 00:55:01.835
<00:54:58.215>But <00:54:58.355>as <00:54:58.495>this <00:54:58.635>part <00:54:58.775>can <00:54:58.915>be <00:54:59.055>longer, <00:54:59.195>uh, <00:54:59.335>I <00:54:59.475>could <00:54:59.615>potentially

1241
00:55:02.765 --> 00:55:04.835
<00:55:02.765>write <00:55:02.940>over <00:55:03.115>the <00:55:03.290>length <00:55:03.464>of, <00:55:03.640>of <00:55:03.815>the <00:55:03.990>buffer <00:55:04.165>buffer.

1242
00:55:05.375 --> 00:55:08.315
<00:55:05.375>So <00:55:05.530>the <00:55:05.686>programming <00:55:05.841>language <00:55:05.997>itself <00:55:06.152>is <00:55:06.308>not <00:55:06.463>gonna <00:55:06.619>protect <00:55:06.775>me

1243
00:55:08.315 --> 00:55:10.475
<00:55:08.315>against <00:55:08.665>this <00:55:09.015>problem <00:55:09.365>here, <00:55:09.715>right?

1244
00:55:10.655 --> 00:55:13.595
<00:55:10.655>The <00:55:10.795>same <00:55:10.935>in <00:55:11.075>c <00:55:11.215>plus <00:55:11.355>plus <00:55:11.495>could <00:55:11.635>also <00:55:11.775>happen <00:55:11.915>both <00:55:12.055>languages.

1245
00:55:14.255 --> 00:55:16.075
<00:55:14.255>Um, <00:55:14.605>don't <00:55:14.955>do <00:55:15.305>those <00:55:15.655>bounce,

1246
00:55:16.095 --> 00:55:17.795
<00:55:16.095>bounce <00:55:16.444>checks <00:55:16.794>with <00:55:17.145>those <00:55:17.495>functions.

1247
00:55:18.415 --> 00:55:20.395
<00:55:18.415>So <00:55:18.570>we <00:55:18.726>have <00:55:18.881>a <00:55:19.037>buffer <00:55:19.192>overflow. <00:55:19.348>What <00:55:19.503>does <00:55:19.659>it <00:55:19.815>mean?

1248
00:55:20.395 --> 00:55:23.555
<00:55:20.395>Buffer <00:55:20.595>overflow <00:55:20.795>means <00:55:20.995>that <00:55:21.195>I <00:55:21.395>keep <00:55:21.595>writing, <00:55:21.795>um,

1249
00:55:23.705 --> 00:55:26.515
<00:55:23.705>onto <00:55:23.860>the <00:55:24.016>buffer <00:55:24.171>and <00:55:24.327>when <00:55:24.482>I <00:55:24.638>write <00:55:24.793>over <00:55:24.949>the <00:55:25.105>buffer,

1250
00:55:26.995 --> 00:55:30.035
<00:55:26.995>I <00:55:27.275>can <00:55:27.555>potentially <00:55:27.835>overwrite <00:55:28.115>control <00:55:28.395>structures

1251
00:55:30.225 --> 00:55:31.755
<00:55:30.225>that <00:55:30.454>control <00:55:30.684>the <00:55:30.913>flow <00:55:31.143>of <00:55:31.372>my <00:55:31.602>code.

1252
00:55:32.335 --> 00:55:34.115
<00:55:32.335>And <00:55:32.568>thereby <00:55:32.801>I <00:55:33.035>can <00:55:33.268>also, <00:55:33.501>you <00:55:33.735>know,

1253
00:55:34.185 --> 00:55:36.475
<00:55:34.185>make <00:55:34.418>the <00:55:34.651>program <00:55:34.884>do <00:55:35.118>something <00:55:35.351>else, <00:55:35.585>right?

1254
00:55:36.675 --> 00:55:39.995
<00:55:36.675>I <00:55:36.850>can <00:55:37.025>control, <00:55:37.200>uh, <00:55:37.375>some <00:55:37.550>of <00:55:37.725>the <00:55:37.900>return <00:55:38.075>pointers

1255
00:55:39.995 --> 00:55:41.315
<00:55:39.995>and <00:55:40.192>point <00:55:40.391>to <00:55:40.589>a <00:55:40.787>different <00:55:40.985>function <00:55:41.183>and,

1256
00:55:41.375 --> 00:55:43.315
<00:55:41.375>and <00:55:41.608>suddenly <00:55:41.841>it's <00:55:42.075>gonna <00:55:42.308>execute <00:55:42.541>something <00:55:42.775>else.

1257
00:55:43.895 --> 00:55:46.715
<00:55:43.895>That's, <00:55:44.070>uh, <00:55:44.245>the, <00:55:44.420>an <00:55:44.595>anatomy <00:55:44.770>of <00:55:44.945>a <00:55:45.120>buffer <00:55:45.295>overflow.

1258
00:55:47.695 --> 00:55:50.675
<00:55:47.695>The <00:55:47.811>problem <00:55:47.928>is <00:55:48.045>that <00:55:48.161>we <00:55:48.278>have <00:55:48.395>a <00:55:48.511>structure, <00:55:48.628>uh, <00:55:48.745>a <00:55:48.861>mix <00:55:48.978>of <00:55:49.095>data

1259
00:55:50.775 --> 00:55:53.675
<00:55:50.775>and <00:55:51.055>code <00:55:51.335>in <00:55:51.615>our, <00:55:51.895>uh, <00:55:52.175>software.

1260
00:55:54.255 --> 00:55:56.755
<00:55:54.255>So <00:55:54.430>the <00:55:54.605>program <00:55:54.780>writes <00:55:54.955>be <00:55:55.130>beyond <00:55:55.305>the <00:55:55.480>memory <00:55:55.655>area

1261
00:55:57.255 --> 00:56:00.115
<00:55:57.255>and <00:55:57.488>we <00:55:57.721>can <00:55:57.955>override <00:55:58.188>con <00:55:58.421>control <00:55:58.655>structures.

1262
00:56:00.115 --> 00:56:02.195
<00:56:00.115>As <00:56:00.290>I <00:56:00.464>said, <00:56:00.640>what <00:56:00.814>can <00:56:00.990>we <00:56:01.165>do <00:56:01.339>about <00:56:01.515>this?

1263
00:56:02.935 --> 00:56:06.035
<00:56:02.935>Um, <00:56:03.168>do <00:56:03.401>bounce <00:56:03.634>checks <00:56:03.868>when <00:56:04.101>creating <00:56:04.335>software

1264
00:56:06.065 --> 00:56:08.675
<00:56:06.065>with <00:56:06.240>a <00:56:06.415>low <00:56:06.590>level <00:56:06.765>languages <00:56:06.940>like <00:56:07.115>CNC <00:56:07.290>plus <00:56:07.465>plus.

1265
00:56:09.295 --> 00:56:11.995
<00:56:09.295>Um, <00:56:09.575>do <00:56:09.855>the <00:56:10.135>bounce <00:56:10.415>check <00:56:10.695>so

1266
00:56:11.995 --> 00:56:13.995
<00:56:11.995>that <00:56:12.194>the <00:56:12.395>input <00:56:12.595>is <00:56:12.795>not <00:56:12.995>longer <00:56:13.194>than, <00:56:13.395>uh,

1267
00:56:14.095 --> 00:56:15.275
<00:56:14.095>the <00:56:14.307>buffer <00:56:14.519>that <00:56:14.732>I <00:56:14.944>can <00:56:15.157>use.

1268
00:56:15.975 --> 00:56:17.515
<00:56:15.975>Be <00:56:16.252>very <00:56:16.529>careful <00:56:16.806>with <00:56:17.083>user <00:56:17.361>input

1269
00:56:17.515 --> 00:56:22.075
<00:56:17.515>because <00:56:17.690>you <00:56:17.865>know, <00:56:18.040>that's, <00:56:18.214>uh, <00:56:18.390>some <00:56:18.565>generic <00:56:18.740>user <00:56:18.915>input.

1270
00:56:22.175 --> 00:56:24.365
<00:56:22.175>Uh, <00:56:22.375>validation <00:56:22.575>is <00:56:22.775>always <00:56:22.975>something <00:56:23.175>that <00:56:23.375>makes <00:56:23.575>sense.

1271
00:56:25.305 --> 00:56:26.525
<00:56:25.305>Um, <00:56:25.671>also <00:56:26.037>use <00:56:26.403>classes

1272
00:56:26.555 --> 00:56:28.805
<00:56:26.555>that <00:56:26.788>are <00:56:27.021>automatically <00:56:27.254>protected <00:56:27.488>against <00:56:27.721>those <00:56:27.955>problems,

1273
00:56:28.805 --> 00:56:30.805
<00:56:28.805>like <00:56:28.960>the <00:56:29.116>string <00:56:29.271>and <00:56:29.427>vector <00:56:29.582>classes <00:56:29.738>in <00:56:29.893>c <00:56:30.049>plus <00:56:30.205>plus.

1274
00:56:31.705 --> 00:56:33.965
<00:56:31.705>Uh, <00:56:31.845>don't <00:56:31.985>use <00:56:32.125>the <00:56:32.265>functions <00:56:32.404>like <00:56:32.545>the <00:56:32.685>one <00:56:32.825>that <00:56:32.965>I <00:56:33.105>used

1275
00:56:33.985 --> 00:56:35.325
<00:56:33.985>before, <00:56:34.387>the <00:56:34.788>string <00:56:35.191>copy.

1276
00:56:36.425 --> 00:56:39.165
<00:56:36.425>Uh, <00:56:36.658>and <00:56:36.891>there <00:56:37.125>are <00:56:37.358>also <00:56:37.591>some <00:56:37.825>interfaces

1277
00:56:39.165 --> 00:56:42.005
<00:56:39.165>or <00:56:39.305>some <00:56:39.445>functions <00:56:39.585>in <00:56:39.725>those, <00:56:39.865>uh, <00:56:40.005>languages <00:56:40.145>that <00:56:40.285>you <00:56:40.425>can <00:56:40.565>use

1278
00:56:42.115 --> 00:56:43.525
<00:56:42.115>that <00:56:42.326>do <00:56:42.538>the <00:56:42.749>bounce <00:56:42.961>checks <00:56:43.172>for <00:56:43.384>you.

1279
00:56:43.665 --> 00:56:45.685
<00:56:43.665>So <00:56:43.840>here's <00:56:44.015>the <00:56:44.190>reference <00:56:44.365>where <00:56:44.540>you <00:56:44.715>can <00:56:44.890>find <00:56:45.065>them.

1280
00:56:46.785 --> 00:56:50.005
<00:56:46.785>Um, <00:56:46.960>you <00:56:47.134>could <00:56:47.310>also <00:56:47.484>stay <00:56:47.660>so <00:56:47.835>when <00:56:48.009>using <00:56:48.185>Rust

1281
00:56:50.005 --> 00:56:53.645
<00:56:50.005>and <00:56:50.205>Go, <00:56:50.405>they <00:56:50.605>are <00:56:50.805>basically, <00:56:51.005>um, <00:56:51.205>close <00:56:51.405>to

1282
00:56:53.815 --> 00:56:56.005
<00:56:53.815>where <00:56:54.015>CC <00:56:54.215>plus <00:56:54.415>are <00:56:54.615>in <00:56:54.815>terms <00:56:55.015>of <00:56:55.215>performance.

1283
00:56:56.025 --> 00:56:57.365
<00:56:56.025>Not <00:56:56.266>really, <00:56:56.507>but <00:56:56.748>you <00:56:56.989>know, <00:56:57.231>closer,

1284
00:56:57.745 --> 00:56:59.765
<00:56:57.745>as <00:56:57.978>closer <00:56:58.211>than <00:56:58.444>Java <00:56:58.678>or <00:56:58.911>C <00:56:59.145>Shop.

1285
00:56:59.765 --> 00:57:01.885
<00:56:59.765>So <00:56:59.998>they're <00:57:00.231>a <00:57:00.464>bit <00:57:00.698>faster. <00:57:00.931>Uh, <00:57:01.165>and,

1286
00:57:01.905 --> 00:57:05.285
<00:57:01.905>but <00:57:02.045>they <00:57:02.185>offer <00:57:02.325>you <00:57:02.465>also <00:57:02.605>to <00:57:02.745>go <00:57:02.885>into <00:57:03.025>the <00:57:03.165>non-safe <00:57:03.305>world

1287
00:57:05.285 --> 00:57:08.165
<00:57:05.285>where <00:57:05.518>you <00:57:05.751>do <00:57:05.984>have <00:57:06.218>pointer, <00:57:06.451>arithmetics, <00:57:06.685>uh,

1288
00:57:08.385 --> 00:57:10.485
<00:57:08.385>and <00:57:08.560>in <00:57:08.735>order <00:57:08.910>to <00:57:09.085>avoid <00:57:09.260>this <00:57:09.435>problem <00:57:09.610>in <00:57:09.785>rust

1289
00:57:10.485 --> 00:57:12.965
<00:57:10.485>and <00:57:10.612>go <00:57:10.739>stay <00:57:10.866>in <00:57:10.994>a <00:57:11.121>safe <00:57:11.248>world <00:57:11.375>and <00:57:11.503>don't <00:57:11.630>use <00:57:11.757>those <00:57:11.885>features

1290
00:57:13.025 --> 00:57:15.405
<00:57:13.025>or <00:57:13.200>be <00:57:13.375>very <00:57:13.550>much <00:57:13.725>aware <00:57:13.900>of <00:57:14.075>what <00:57:14.250>you're <00:57:14.425>doing,

1291
00:57:15.475 --> 00:57:17.405
<00:57:15.475>otherwise <00:57:15.708>you <00:57:15.941>could <00:57:16.174>potentially <00:57:16.408>have <00:57:16.641>a <00:57:16.875>problem.

1292
00:57:19.625 --> 00:57:20.885
<00:57:19.625>All <00:57:19.908>right, <00:57:20.192>the <00:57:20.475>next <00:57:20.759>principle,

1293
00:57:20.885 --> 00:57:22.005
<00:57:20.885>secure <00:57:21.137>coding <00:57:21.389>principle <00:57:21.641>is <00:57:21.893>the

1294
00:57:22.005 --> 00:57:23.245
<00:57:22.005>principle <00:57:22.377>of <00:57:22.749>complete <00:57:23.121>mediation.

1295
00:57:23.245 --> 00:57:26.325
<00:57:23.245>What <00:57:23.384>does <00:57:23.525>that <00:57:23.665>mean? <00:57:23.805>It <00:57:23.944>means <00:57:24.085>exit <00:57:24.225>control <00:57:24.365>at <00:57:24.505>every <00:57:24.645>request.

1296
00:57:27.025 --> 00:57:30.445
<00:57:27.025>Uh, <00:57:27.152>one <00:57:27.279>classic, <00:57:27.406>uh, <00:57:27.534>thing <00:57:27.661>where <00:57:27.788>this <00:57:27.915>is <00:57:28.043>missing <00:57:28.170>is, <00:57:28.297>uh, <00:57:28.425>say

1297
00:57:30.445 --> 00:57:32.085
<00:57:30.445>for <00:57:30.678>example, <00:57:30.911>we <00:57:31.145>log <00:57:31.378>into <00:57:31.611>an <00:57:31.845>application

1298
00:57:32.105 --> 00:57:33.685
<00:57:32.105>and <00:57:32.385>we <00:57:32.665>have <00:57:32.945>a <00:57:33.225>multi-step <00:57:33.505>form

1299
00:57:33.715 --> 00:57:37.005
<00:57:33.715>that <00:57:33.915>only <00:57:34.115>certain <00:57:34.315>users <00:57:34.515>say <00:57:34.715>administrators <00:57:34.915>can <00:57:35.115>access,

1300
00:57:37.825 --> 00:57:40.085
<00:57:37.825>and <00:57:38.000>it's <00:57:38.174>maybe <00:57:38.350>a <00:57:38.524>form <00:57:38.700>that <00:57:38.875>creates <00:57:39.049>a <00:57:39.225>user,

1301
00:57:40.185 --> 00:57:42.205
<00:57:40.185>and <00:57:40.360>I <00:57:40.535>have <00:57:40.710>the <00:57:40.884>username, <00:57:41.060>I <00:57:41.235>have <00:57:41.410>their <00:57:41.585>role,

1302
00:57:42.345 --> 00:57:43.605
<00:57:42.345>and <00:57:42.571>I <00:57:42.798>have <00:57:43.025>some <00:57:43.252>additional <00:57:43.479>data

1303
00:57:43.605 --> 00:57:45.405
<00:57:43.605>that <00:57:43.838>I <00:57:44.071>can <00:57:44.305>enter <00:57:44.538>into <00:57:44.771>the <00:57:45.005>application.

1304
00:57:46.465 --> 00:57:49.055
<00:57:46.465>Uh, <00:57:46.745>an <00:57:47.025>old <00:57:47.305>classic <00:57:47.585>would <00:57:47.865>be

1305
00:57:49.055 --> 00:57:51.935
<00:57:49.055>to <00:57:49.171>do <00:57:49.288>the <00:57:49.404>access <00:57:49.521>control <00:57:49.638>only <00:57:49.754>at <00:57:49.871>the <00:57:49.988>first <00:57:50.105>step <00:57:50.221>of <00:57:50.338>the <00:57:50.455>form,

1306
00:57:51.955 --> 00:57:56.135
<00:57:51.955>but <00:57:52.095>I <00:57:52.235>can <00:57:52.375>manually <00:57:52.515>call <00:57:52.654>the <00:57:52.795>other <00:57:52.935>parts <00:57:53.075>of <00:57:53.215>the <00:57:53.355>form,

1307
00:57:56.395 --> 00:57:58.055
<00:57:56.395>and <00:57:56.550>I <00:57:56.706>don't <00:57:56.861>even <00:57:57.017>have <00:57:57.172>the <00:57:57.328>role <00:57:57.483>to <00:57:57.639>do <00:57:57.795>so.

1308
00:57:59.215 --> 00:58:00.715
<00:57:59.215>So, <00:57:59.485>almost <00:57:59.755>suppose <00:58:00.025>that <00:58:00.295>the <00:58:00.565>user

1309
00:58:00.815 --> 00:58:04.475
<00:58:00.815>or <00:58:00.990>the <00:58:01.165>potential <00:58:01.340>attacker <00:58:01.515>knows <00:58:01.690>all <00:58:01.865>URLs <00:58:02.040>and <00:58:02.215>parameters,

1310
00:58:05.055 --> 00:58:07.755
<00:58:05.055>and <00:58:05.210>even <00:58:05.366>though <00:58:05.521>you <00:58:05.677>would <00:58:05.832>open <00:58:05.988>source <00:58:06.143>your <00:58:06.299>applications <00:58:06.455>to,

1311
00:58:07.815 --> 00:58:09.035
<00:58:07.815>should <00:58:08.181>still <00:58:08.547>be <00:58:08.913>secure,

1312
00:58:10.665 --> 00:58:12.755
<00:58:10.665>have <00:58:10.898>a <00:58:11.131>very <00:58:11.365>well <00:58:11.598>structured <00:58:11.831>access <00:58:12.065>control.

1313
00:58:12.755 --> 00:58:14.675
<00:58:12.755>That's <00:58:13.221>basically <00:58:13.688>design <00:58:14.155>principle.

1314
00:58:15.295 --> 00:58:17.115
<00:58:15.295>Um, <00:58:15.470>so <00:58:15.645>that, <00:58:15.820>you <00:58:15.995>know, <00:58:16.170>you <00:58:16.345>have <00:58:16.520>one <00:58:16.695>place

1315
00:58:17.115 --> 00:58:19.515
<00:58:17.115>where <00:58:17.270>you <00:58:17.426>can <00:58:17.581>check <00:58:17.737>whether, <00:58:17.892>uh, <00:58:18.048>exit <00:58:18.203>control <00:58:18.359>is <00:58:18.515>correct,

1316
00:58:19.885 --> 00:58:22.595
<00:58:19.885>don't <00:58:20.118>spread <00:58:20.351>your <00:58:20.585>exit <00:58:20.818>control <00:58:21.051>over <00:58:21.285>centralized

1317
00:58:22.875 --> 00:58:25.475
<00:58:22.875>configuration <00:58:23.075>with <00:58:23.275>spring <00:58:23.475>security <00:58:23.675>plus <00:58:23.875>at <00:58:24.075>the <00:58:24.275>control

1318
00:58:25.585 --> 00:58:27.475
<00:58:25.585>control <00:58:25.818>level, <00:58:26.051>plus <00:58:26.285>at <00:58:26.518>the <00:58:26.751>code <00:58:26.985>level,

1319
00:58:27.505 --> 00:58:29.275
<00:58:27.505>plus <00:58:27.785>at <00:58:28.065>the <00:58:28.345>template <00:58:28.625>level, <00:58:28.905>right?

1320
00:58:29.275 --> 00:58:30.395
<00:58:29.275>Because <00:58:29.527>then <00:58:29.779>it's <00:58:30.031>very <00:58:30.283>hard

1321
00:58:30.395 --> 00:58:32.795
<00:58:30.395>to <00:58:30.550>check <00:58:30.706>whether <00:58:30.861>this <00:58:31.017>is <00:58:31.172>really <00:58:31.328>okay, <00:58:31.483>so <00:58:31.639>do <00:58:31.795>it

1322
00:58:32.895 --> 00:58:34.235
<00:58:32.895>as <00:58:33.297>centralized <00:58:33.699>as <00:58:34.101>possible.

1323
00:58:36.015 --> 00:58:39.795
<00:58:36.015>Um, <00:58:36.214>cryptography, <00:58:36.415>this <00:58:36.615>is <00:58:36.815>a <00:58:37.015>very <00:58:37.214>difficult <00:58:37.415>topic,

1324
00:58:40.135 --> 00:58:41.195
<00:58:40.135>uh, <00:58:40.453>on <00:58:40.771>its <00:58:41.089>own.

1325
00:58:41.895 --> 00:58:45.515
<00:58:41.895>Um, <00:58:42.022>also <00:58:42.149>just <00:58:42.276>in <00:58:42.404>terms <00:58:42.531>that <00:58:42.658>we <00:58:42.785>are, <00:58:42.913>you <00:58:43.040>know, <00:58:43.167>are <00:58:43.295>able

1326
00:58:45.515 --> 00:58:47.755
<00:58:45.515>to <00:58:45.714>communicate, <00:58:45.915>there <00:58:46.115>are <00:58:46.315>some <00:58:46.515>cryptographic <00:58:46.714>primi, <00:58:46.915>uh,

1327
00:58:47.755 --> 00:58:51.435
<00:58:47.755>primitives, <00:58:47.955>like <00:58:48.155>block <00:58:48.355>ciphers, <00:58:48.555>stream <00:58:48.755>CI <00:58:48.955>hash <00:58:49.155>functions,

1328
00:58:51.455 --> 00:58:53.635
<00:58:51.455>public <00:58:51.921>key <00:58:52.388>primitives, <00:58:52.855>uh,

1329
00:58:53.635 --> 00:58:55.715
<00:58:53.635>like <00:58:53.915>factoring <00:58:54.195>means <00:58:54.475>RSA, <00:58:54.755>for <00:58:55.035>example.

1330
00:58:56.415 --> 00:59:00.075
<00:58:56.415>Um, <00:58:56.590>there <00:58:56.765>are <00:58:56.940>schemes <00:58:57.115>that <00:58:57.290>are <00:58:57.465>basically <00:58:57.640>a <00:58:57.815>combination

1331
00:59:00.075 --> 00:59:01.155
<00:59:00.075>of <00:59:00.561>different <00:59:01.047>primitives,

1332
00:59:01.335 --> 00:59:04.235
<00:59:01.335>and <00:59:01.490>then <00:59:01.646>there <00:59:01.801>are <00:59:01.957>protocols <00:59:02.112>that <00:59:02.268>are <00:59:02.423>combination <00:59:02.579>of <00:59:02.735>schemes

1333
00:59:04.235 --> 00:59:05.315
<00:59:04.235>and <00:59:04.721>primitives, <00:59:05.207>right?

1334
00:59:05.695 --> 00:59:08.555
<00:59:05.695>So <00:59:05.870>for <00:59:06.045>example, <00:59:06.220>TLS <00:59:06.395>is <00:59:06.570>not <00:59:06.745>the <00:59:06.920>cryptographic <00:59:07.095>algorithm.

1335
00:59:08.655 --> 00:59:11.115
<00:59:08.655>It <00:59:08.888>is <00:59:09.121>a <00:59:09.355>cryptographic <00:59:09.588>protocol <00:59:09.821>that <00:59:10.055>uses

1336
00:59:11.705 --> 00:59:13.035
<00:59:11.705>asmatic <00:59:12.902>cryptography.

1337
00:59:13.035 --> 00:59:16.355
<00:59:13.035>It <00:59:13.210>uses <00:59:13.384>hash <00:59:13.560>function <00:59:13.734>functions, <00:59:13.910>it <00:59:14.085>uses <00:59:14.259>stream <00:59:14.435>ciphers

1338
00:59:16.375 --> 00:59:17.635
<00:59:16.375>and <00:59:16.658>all <00:59:16.942>those <00:59:17.225>things <00:59:17.509>combined.

1339
00:59:17.995 --> 00:59:20.715
<00:59:17.995>Combined. <00:59:18.194>So <00:59:18.395>just <00:59:18.595>to <00:59:18.795>give <00:59:18.995>you <00:59:19.194>an <00:59:19.395>overview

1340
00:59:20.715 --> 00:59:24.525
<00:59:20.715>of <00:59:20.831>this <00:59:20.948>is <00:59:21.065>what's <00:59:21.181>out <00:59:21.298>there <00:59:21.415>that <00:59:21.531>we <00:59:21.648>can't <00:59:21.765>use <00:59:21.881>to, <00:59:21.998>um, <00:59:22.115>to,

1341
00:59:24.745 --> 00:59:27.165
<00:59:24.745>you <00:59:24.920>know, <00:59:25.095>for <00:59:25.270>example, <00:59:25.444>encrypt <00:59:25.620>data <00:59:25.795>or <00:59:25.970>store <00:59:26.145>it

1342
00:59:27.165 --> 00:59:28.605
<00:59:27.165>or <00:59:27.381>transfer <00:59:27.596>it <00:59:27.813>in <00:59:28.029>a <00:59:28.245>secure <00:59:28.461>way.

1343
00:59:29.985 --> 00:59:34.805
<00:59:29.985>Uh, <00:59:30.101>I <00:59:30.218>tend <00:59:30.335>to <00:59:30.451>hear <00:59:30.568>in <00:59:30.685>the, <00:59:30.801>in <00:59:30.918>the, <00:59:31.035>in <00:59:31.151>the <00:59:31.268>last <00:59:31.385>months

1344
00:59:34.825 --> 00:59:36.725
<00:59:34.825>and <00:59:35.024>years <00:59:35.225>that <00:59:35.424>people <00:59:35.625>want <00:59:35.825>to <00:59:36.024>create <00:59:36.225>software

1345
00:59:36.725 --> 00:59:38.325
<00:59:36.725>that <00:59:37.191>has <00:59:37.658>end-to-end <00:59:38.125>encryption.

1346
00:59:38.325 --> 00:59:40.285
<00:59:38.325>Everybody <00:59:38.558>wants <00:59:38.791>to <00:59:39.024>have <00:59:39.258>the <00:59:39.491>security <00:59:39.725>poster

1347
00:59:40.425 --> 00:59:41.725
<00:59:40.425>of <00:59:40.815>doing <00:59:41.205>end-to-end <00:59:41.595>encryption.

1348
00:59:42.055 --> 00:59:44.005
<00:59:42.055>Shall <00:59:42.288>we <00:59:42.521>end-to-end <00:59:42.754>encrypt <00:59:42.988>all <00:59:43.221>the <00:59:43.455>things?

1349
00:59:44.555 --> 00:59:47.885
<00:59:44.555>Well, <00:59:44.682>I <00:59:44.809>really <00:59:44.936>suggest <00:59:45.064>to <00:59:45.191>think <00:59:45.318>about <00:59:45.445>it <00:59:45.573>before <00:59:45.700>you <00:59:45.827>do <00:59:45.955>it,

1350
00:59:47.885 --> 00:59:49.525
<00:59:47.885>because <00:59:48.060>there <00:59:48.235>are <00:59:48.410>many <00:59:48.585>things <00:59:48.760>that <00:59:48.935>could <00:59:49.110>go <00:59:49.285>wrong.

1351
00:59:50.105 --> 00:59:53.645
<00:59:50.105>So <00:59:50.221>on <00:59:50.338>a, <00:59:50.455>on <00:59:50.571>a <00:59:50.688>very <00:59:50.805>high <00:59:50.921>end <00:59:51.038>conceptual <00:59:51.155>level, <00:59:51.271>if <00:59:51.388>you <00:59:51.505>put

1352
00:59:54.365 --> 00:59:56.975
<00:59:54.365>this <00:59:54.520>on, <00:59:54.676>on, <00:59:54.831>on <00:59:54.987>this <00:59:55.142>lower <00:59:55.298>horizontal <00:59:55.453>line, <00:59:55.609>you <00:59:55.765>put

1353
00:59:57.875 --> 00:59:59.895
<00:59:57.875>the <00:59:58.575>encryptions <00:59:59.275>types

1354
00:59:59.895 --> 01:00:01.975
<00:59:59.895>of <01:00:00.175>encryption <01:00:00.455>data <01:00:00.735>on <01:00:01.015>different <01:00:01.295>levels.

1355
01:00:02.435 --> 01:00:04.975
<01:00:02.435>So <01:00:02.562>on <01:00:02.689>the <01:00:02.816>very <01:00:02.944>left <01:00:03.071>hand <01:00:03.198>side, <01:00:03.325>you <01:00:03.453>can <01:00:03.580>see <01:00:03.707>this <01:00:03.835>encryption.

1356
01:00:04.975 --> 01:00:07.295
<01:00:04.975>That's <01:00:05.150>something <01:00:05.325>that <01:00:05.500>you <01:00:05.674>can <01:00:05.850>just <01:00:06.025>turn <01:00:06.200>on, <01:00:06.375>uh,

1357
01:00:07.595 --> 01:00:09.135
<01:00:07.595>in <01:00:07.826>your <01:00:08.057>computer <01:00:08.288>or <01:00:08.519>on <01:00:08.750>the <01:00:08.981>server.

1358
01:00:09.235 --> 01:00:11.695
<01:00:09.235>That's <01:00:09.515>basically <01:00:09.795>quite <01:00:10.075>easy <01:00:10.355>to <01:00:10.635>configure.

1359
01:00:11.765 --> 01:00:12.935
<01:00:11.765>Then <01:00:11.975>there's <01:00:12.186>somewhere <01:00:12.396>in <01:00:12.607>the <01:00:12.817>middle,

1360
01:00:12.935 --> 01:00:14.295
<01:00:12.935>there's <01:00:13.343>app <01:00:13.751>level <01:00:14.159>encryption.

1361
01:00:14.295 --> 01:00:16.615
<01:00:14.295>So <01:00:14.495>you <01:00:14.695>have <01:00:14.895>encrypted <01:00:15.095>data <01:00:15.295>in <01:00:15.495>your <01:00:15.695>database

1362
01:00:16.655 --> 01:00:18.975
<01:00:16.655>that <01:00:16.855>you <01:00:17.055>only <01:00:17.255>decrypt <01:00:17.455>when <01:00:17.655>someone <01:00:17.855>accesses <01:00:18.055>it,

1363
01:00:19.355 --> 01:00:21.335
<01:00:19.355>and <01:00:19.588>then <01:00:19.821>you <01:00:20.055>have <01:00:20.288>the <01:00:20.521>highest <01:00:20.755>level

1364
01:00:21.335 --> 01:00:22.735
<01:00:21.335>that <01:00:21.650>is <01:00:21.965>end-to-end <01:00:22.280>encryption <01:00:22.595>so

1365
01:00:22.735 --> 01:00:25.535
<01:00:22.735>that <01:00:22.890>the <01:00:23.046>user <01:00:23.201>manages <01:00:23.357>their <01:00:23.512>own <01:00:23.668>keys <01:00:23.823>on <01:00:23.979>their <01:00:24.135>devices

1366
01:00:25.635 --> 01:00:26.815
<01:00:25.635>and <01:00:25.812>you <01:00:25.989>don't <01:00:26.166>know <01:00:26.343>anything <01:00:26.520>about <01:00:26.697>it.

1367
01:00:27.595 --> 01:00:30.695
<01:00:27.595>Um, <01:00:27.828>then <01:00:28.061>on <01:00:28.294>this, <01:00:28.528>um, <01:00:28.761>vertical <01:00:28.995>line,

1368
01:00:30.715 --> 01:00:32.175
<01:00:30.715>we <01:00:31.043>have <01:00:31.372>the <01:00:31.700>solution <01:00:32.029>complexity.

1369
01:00:32.175 --> 01:00:34.335
<01:00:32.175>So <01:00:32.375>how <01:00:32.575>complex <01:00:32.775>is <01:00:32.975>the <01:00:33.175>solution <01:00:33.375>getting <01:00:33.575>when

1370
01:00:34.345 --> 01:00:35.455
<01:00:34.345>doing <01:00:34.678>each <01:00:35.011>of <01:00:35.344>those?

1371
01:00:36.925 --> 01:00:39.135
<01:00:36.925>From <01:00:37.158>my <01:00:37.391>experience, <01:00:37.625>it's <01:00:37.858>something <01:00:38.091>like <01:00:38.325>this.

1372
01:00:40.355 --> 01:00:43.095
<01:00:40.355>So <01:00:40.510>when <01:00:40.666>doing <01:00:40.821>an <01:00:40.977>end-to-end <01:00:41.132>encryption, <01:00:41.288>you <01:00:41.443>need <01:00:41.599>to <01:00:41.755>really,

1373
01:00:43.095 --> 01:00:45.655
<01:00:43.095>really, <01:00:43.328>really, <01:00:43.561>really <01:00:43.794>know <01:00:44.028>what <01:00:44.261>you're <01:00:44.495>doing

1374
01:00:45.655 --> 01:00:47.815
<01:00:45.655>because <01:00:45.935>there <01:00:46.215>are <01:00:46.495>many, <01:00:46.775>many <01:00:47.055>disadvantages

1375
01:00:47.815 --> 01:00:49.815
<01:00:47.815>that <01:00:47.970>you <01:00:48.126>get <01:00:48.281>when <01:00:48.437>you <01:00:48.592>do <01:00:48.748>end-to-end <01:00:48.903>encryption, <01:00:49.059>for <01:00:49.215>example,

1376
01:00:50.675 --> 01:00:52.495
<01:00:50.675>you <01:00:50.850>have <01:00:51.025>to <01:00:51.200>have <01:00:51.375>some <01:00:51.550>sort <01:00:51.725>of <01:00:51.900>key <01:00:52.075>recovery.

1377
01:00:52.605 --> 01:00:55.615
<01:00:52.605>When <01:00:52.760>people <01:00:52.916>lose <01:00:53.071>their <01:00:53.227>devices, <01:00:53.382>they <01:00:53.538>have <01:00:53.693>to <01:00:53.849>be <01:00:54.005>able

1378
01:00:55.615 --> 01:00:56.615
<01:00:55.615>to <01:00:55.915>recover <01:00:56.214>that <01:00:56.515>data.

1379
01:00:57.475 --> 01:00:59.215
<01:00:57.475>Um, <01:00:57.674>you <01:00:57.875>can <01:00:58.075>see <01:00:58.275>how <01:00:58.475>hard <01:00:58.674>it <01:00:58.875>is.

1380
01:00:59.215 --> 01:01:02.455
<01:00:59.215>Those <01:00:59.355>of <01:00:59.495>you <01:00:59.635>who <01:00:59.775>are <01:00:59.915>using <01:01:00.055>signal <01:01:00.195>and <01:01:00.335>lose <01:01:00.475>their <01:01:00.615>device

1381
01:01:02.475 --> 01:01:05.855
<01:01:02.475>or <01:01:02.615>WhatsApp <01:01:02.755>or <01:01:02.895>anything, <01:01:03.035>you <01:01:03.174>have <01:01:03.315>to <01:01:03.455>have <01:01:03.595>a <01:01:03.735>backup <01:01:03.875>and,

1382
01:01:05.875 --> 01:01:07.135
<01:01:05.875>and <01:01:06.158>some <01:01:06.442>sort <01:01:06.725>of <01:01:07.009>key

1383
01:01:07.135 --> 01:01:08.455
<01:01:07.135>stored <01:01:07.304>in <01:01:07.474>the <01:01:07.644>password <01:01:07.813>manager <01:01:07.983>and <01:01:08.153>so <01:01:08.323>on.

1384
01:01:08.455 --> 01:01:10.495
<01:01:08.455>So <01:01:08.654>it's <01:01:08.855>really <01:01:09.055>complicated <01:01:09.255>to <01:01:09.455>have <01:01:09.654>key <01:01:09.855>recovery.

1385
01:01:11.155 --> 01:01:12.775
<01:01:11.155>How <01:01:11.388>am <01:01:11.621>I <01:01:11.855>gonna <01:01:12.088>do <01:01:12.321>backup <01:01:12.555>securely,

1386
01:01:12.775 --> 01:01:15.015
<01:01:12.775>because <01:01:12.902>that <01:01:13.029>one <01:01:13.156>needs <01:01:13.284>to <01:01:13.411>be <01:01:13.538>encrypted <01:01:13.665>as <01:01:13.793>well <01:01:13.920>with <01:01:14.047>my <01:01:14.175>keys.

1387
01:01:15.995 --> 01:01:18.455
<01:01:15.995>How <01:01:16.170>am <01:01:16.345>I <01:01:16.520>doing <01:01:16.694>multi-device? <01:01:16.870>That's <01:01:17.045>a <01:01:17.220>big <01:01:17.395>problem.

1388
01:01:18.475 --> 01:01:21.615
<01:01:18.475>That's <01:01:18.708>an <01:01:18.941>unsolved <01:01:19.174>problem <01:01:19.408>in <01:01:19.641>end-to-end <01:01:19.875>encryption.

1389
01:01:22.675 --> 01:01:25.295
<01:01:22.675>Uh, <01:01:22.850>I <01:01:23.025>cannot <01:01:23.200>index <01:01:23.375>data <01:01:23.550>on <01:01:23.725>the <01:01:23.900>database <01:01:24.075>level,

1390
01:01:25.395 --> 01:01:26.495
<01:01:25.395>so <01:01:25.642>I <01:01:25.890>cannot <01:01:26.137>search <01:01:26.384>it.

1391
01:01:26.575 --> 01:01:29.295
<01:01:26.575>I <01:01:26.774>cannot, <01:01:26.975>you <01:01:27.174>know, <01:01:27.375>it's <01:01:27.575>just <01:01:27.774>encrypted <01:01:27.975>stuff.

1392
01:01:29.915 --> 01:01:33.015
<01:01:29.915>So <01:01:30.070>I <01:01:30.226>need <01:01:30.381>to <01:01:30.537>really, <01:01:30.692>um, <01:01:30.848>have <01:01:31.003>a <01:01:31.159>look <01:01:31.315>at

1393
01:01:33.015 --> 01:01:34.495
<01:01:33.015>what <01:01:33.459>can <01:01:33.903>be <01:01:34.346>encrypted

1394
01:01:34.495 --> 01:01:36.535
<01:01:34.495>and <01:01:34.650>what <01:01:34.806>cannot <01:01:34.961>in <01:01:35.117>order <01:01:35.272>to, <01:01:35.428>to <01:01:35.583>still <01:01:35.739>be <01:01:35.895>able

1395
01:01:36.535 --> 01:01:37.655
<01:01:36.535>to <01:01:36.871>operate <01:01:37.207>the <01:01:37.543>software.

1396
01:01:38.085 --> 01:01:41.615
<01:01:38.085>There's <01:01:38.225>a, <01:01:38.365>um, <01:01:38.505>a <01:01:38.645>huge <01:01:38.785>pile <01:01:38.925>of <01:01:39.065>things <01:01:39.205>that <01:01:39.345>I <01:01:39.485>need

1397
01:01:41.615 --> 01:01:42.935
<01:01:41.615>to <01:01:41.852>consider <01:01:42.090>when <01:01:42.327>really <01:01:42.565>doing <01:01:42.803>this.

1398
01:01:44.485 --> 01:01:46.695
<01:01:44.485>Some <01:01:44.685>important <01:01:44.885>you <01:01:45.085>rules <01:01:45.285>when, <01:01:45.485>uh, <01:01:45.685>it <01:01:45.885>comes

1399
01:01:46.695 --> 01:01:47.815
<01:01:46.695>to <01:01:47.199>using <01:01:47.703>cryptography.

1400
01:01:48.265 --> 01:01:49.735
<01:01:48.265>Don't <01:01:48.595>roll <01:01:48.926>your <01:01:49.257>own <01:01:49.588>crypto.

1401
01:01:50.385 --> 01:01:53.895
<01:01:50.385>There <01:01:50.525>are, <01:01:50.665>uh, <01:01:50.805>certain <01:01:50.945>algorithms <01:01:51.085>out <01:01:51.225>there <01:01:51.365>that <01:01:51.505>you <01:01:51.645>can <01:01:51.785>use

1402
01:01:53.895 --> 01:01:55.015
<01:01:53.895>that <01:01:54.096>are <01:01:54.298>ready <01:01:54.499>to <01:01:54.701>be <01:01:54.903>used.

1403
01:01:55.395 --> 01:01:56.575
<01:01:55.395>Uh, <01:01:55.572>don't <01:01:55.749>do <01:01:55.926>this <01:01:56.103>on <01:01:56.279>your <01:01:56.457>own

1404
01:01:56.575 --> 01:01:57.775
<01:01:56.575>because <01:01:56.845>it's <01:01:57.115>really, <01:01:57.385>really <01:01:57.655>hard.

1405
01:01:58.955 --> 01:02:01.785
<01:01:58.955>Um, <01:01:59.188>don't <01:01:59.421>just <01:01:59.654>check <01:01:59.888>the <01:02:00.121>encryption <01:02:00.355>checkbox.

1406
01:02:01.905 --> 01:02:03.545
<01:02:01.905>I <01:02:02.185>often <01:02:02.465>see <01:02:02.745>in <01:02:03.025>security <01:02:03.305>requirements

1407
01:02:03.545 --> 01:02:05.065
<01:02:03.545>that <01:02:03.773>the <01:02:04.001>data <01:02:04.229>needs <01:02:04.457>to <01:02:04.685>be <01:02:04.913>encrypted.

1408
01:02:05.295 --> 01:02:07.625
<01:02:05.295>What <01:02:05.422>does <01:02:05.549>it <01:02:05.676>mean? <01:02:05.804>Is <01:02:05.931>it <01:02:06.058>enough <01:02:06.185>when <01:02:06.313>I <01:02:06.440>do <01:02:06.567>this <01:02:06.695>encryption

1409
01:02:07.965 --> 01:02:11.545
<01:02:07.965>or <01:02:08.245>whatever <01:02:08.525>other <01:02:08.805>means <01:02:09.085>of <01:02:09.365>encryption?

1410
01:02:12.005 --> 01:02:13.345
<01:02:12.005>Um, <01:02:12.246>don't <01:02:12.487>just <01:02:12.728>check <01:02:12.969>the <01:02:13.211>box,

1411
01:02:13.345 --> 01:02:16.545
<01:02:13.345>but <01:02:13.452>be <01:02:13.560>fully <01:02:13.668>aware <01:02:13.775>of <01:02:13.883>what <01:02:13.991>it <01:02:14.098>can <01:02:14.206>do <01:02:14.314>and <01:02:14.421>what <01:02:14.529>it <01:02:14.637>cannot <01:02:14.745>do.

1412
01:02:17.045 --> 01:02:19.725
<01:02:17.045>Uh, <01:02:17.220>there's <01:02:17.395>very, <01:02:17.570>very <01:02:17.745>few <01:02:17.920>people <01:02:18.095>from <01:02:18.270>my <01:02:18.445>perception

1413
01:02:19.725 --> 01:02:21.045
<01:02:19.725>that <01:02:20.121>really <01:02:20.517>understand <01:02:20.913>what,

1414
01:02:21.315 --> 01:02:23.685
<01:02:21.315>what <01:02:21.490>it's <01:02:21.665>gonna <01:02:21.840>get <01:02:22.015>you <01:02:22.190>in <01:02:22.365>terms <01:02:22.540>of <01:02:22.715>advantages,

1415
01:02:23.745 --> 01:02:27.325
<01:02:23.745>but <01:02:23.920>also <01:02:24.095>in <01:02:24.270>terms <01:02:24.444>of <01:02:24.620>disadvantages, <01:02:24.795>use <01:02:24.970>good <01:02:25.145>randomness.

1416
01:02:27.325 --> 01:02:30.085
<01:02:27.325>Because <01:02:27.464>if <01:02:27.605>the <01:02:27.745>random <01:02:27.884>numbers <01:02:28.024>that <01:02:28.165>you <01:02:28.305>use <01:02:28.444>for, <01:02:28.585>for <01:02:28.725>example,

1417
01:02:30.385 --> 01:02:31.605
<01:02:30.385>uh, <01:02:30.751>you <01:02:31.117>generate <01:02:31.483>keys

1418
01:02:31.605 --> 01:02:34.805
<01:02:31.605>or <01:02:31.760>you <01:02:31.916>generate <01:02:32.071>passwords, <01:02:32.227>when <01:02:32.382>that <01:02:32.538>is <01:02:32.693>not <01:02:32.849>good <01:02:33.005>randomness,

1419
01:02:34.805 --> 01:02:38.085
<01:02:34.805>everything <01:02:35.085>boils <01:02:35.365>down <01:02:35.645>to <01:02:35.924>something <01:02:36.205>predictable

1420
01:02:38.305 --> 01:02:39.325
<01:02:38.305>and <01:02:39.223>deterministic.

1421
01:02:39.585 --> 01:02:41.645
<01:02:39.585>So <01:02:39.785>good <01:02:39.985>randomness <01:02:40.185>is <01:02:40.385>the <01:02:40.585>base <01:02:40.785>for <01:02:40.985>everything

1422
01:02:43.095 --> 01:02:45.145
<01:02:43.095>when <01:02:43.561>doing <01:02:44.028>actual <01:02:44.495>encryption.

1423
01:02:45.145 --> 01:02:49.105
<01:02:45.145>So <01:02:45.300>symmetric <01:02:45.456>encryption, <01:02:45.611>for <01:02:45.767>example, <01:02:45.922>uh, <01:02:46.078>use <01:02:46.233>a <01:02:46.389>EAD <01:02:46.545>cipher.

1424
01:02:49.165 --> 01:02:51.705
<01:02:49.165>So, <01:02:49.398>uh, <01:02:49.631>authenticated <01:02:49.865>encryption <01:02:50.098>with <01:02:50.331>associated <01:02:50.565>data.

1425
01:02:52.085 --> 01:02:54.345
<01:02:52.085>That's <01:02:52.551>A-E-S-G-C-M, <01:02:53.018>for <01:02:53.485>example.

1426
01:02:54.365 --> 01:02:58.785
<01:02:54.365>So <01:02:54.492>a <01:02:54.619>ES <01:02:54.746>in <01:02:54.874>GCM <01:02:55.001>mode <01:02:55.128>or, <01:02:55.255>uh, <01:02:55.383>Chacha <01:02:55.510>20, <01:02:55.637>poly <01:02:55.765>1305.

1427
01:02:59.765 --> 01:03:01.985
<01:02:59.765>Wow, <01:03:00.115>that's <01:03:00.464>a <01:03:00.815>really <01:03:01.165>hard

1428
01:03:01.985 --> 01:03:03.865
<01:03:01.985>to <01:03:02.218>memorize <01:03:02.451>name <01:03:02.685>for <01:03:02.918>a <01:03:03.151>crypto <01:03:03.385>algorithm.

1429
01:03:04.645 --> 01:03:08.185
<01:03:04.645>Uh, <01:03:04.820>use <01:03:04.995>unique <01:03:05.170>initialization <01:03:05.345>vectors <01:03:05.520>per <01:03:05.695>clear <01:03:05.870>text <01:03:06.045>when

1430
01:03:08.185 --> 01:03:10.505
<01:03:08.185>you <01:03:08.360>use <01:03:08.535>the <01:03:08.710>same <01:03:08.884>key <01:03:09.060>for <01:03:09.235>encrypting <01:03:09.410>multiple <01:03:09.585>blocks

1431
01:03:10.505 --> 01:03:11.545
<01:03:10.505>of <01:03:10.739>data, <01:03:10.973>that's <01:03:11.207>very <01:03:11.441>important.

1432
01:03:11.695 --> 01:03:15.465
<01:03:11.695>Many <01:03:11.870>flaws <01:03:12.045>in <01:03:12.220>cryptographic <01:03:12.395>protocols <01:03:12.570>in <01:03:12.745>the <01:03:12.920>past <01:03:13.095>boiled

1433
01:03:15.465 --> 01:03:18.305
<01:03:15.465>down <01:03:15.640>to <01:03:15.815>not <01:03:15.990>managing <01:03:16.165>initialization <01:03:16.340>vectors <01:03:16.515>the <01:03:16.690>right <01:03:16.865>way,

1434
01:03:19.635 --> 01:03:23.705
<01:03:19.635>sorry, <01:03:19.775>and <01:03:19.915>use <01:03:20.055>expansive <01:03:20.195>key <01:03:20.335>derivation <01:03:20.475>when <01:03:20.615>the <01:03:20.755>key <01:03:20.895>base <01:03:21.035>is

1435
01:03:23.705 --> 01:03:24.865
<01:03:23.705>a <01:03:24.053>human <01:03:24.401>generated <01:03:24.749>password.

1436
01:03:24.865 --> 01:03:27.025
<01:03:24.865>So, <01:03:25.040>for <01:03:25.214>example, <01:03:25.390>you, <01:03:25.564>you're <01:03:25.740>coding <01:03:25.915>a <01:03:26.089>password <01:03:26.265>manager

1437
01:03:27.125 --> 01:03:29.025
<01:03:27.125>and <01:03:27.358>people <01:03:27.591>have <01:03:27.825>their <01:03:28.058>password <01:03:28.291>manager <01:03:28.525>password.

1438
01:03:29.845 --> 01:03:33.785
<01:03:29.845>Um, <01:03:30.000>don't <01:03:30.156>use <01:03:30.311>that <01:03:30.467>password <01:03:30.622>directly <01:03:30.778>to <01:03:30.933>do <01:03:31.089>encryption <01:03:31.245>stuff,

1439
01:03:33.925 --> 01:03:36.665
<01:03:33.925>but <01:03:34.080>derive <01:03:34.236>a <01:03:34.391>key <01:03:34.547>at <01:03:34.702>the <01:03:34.858>length <01:03:35.013>that <01:03:35.169>you <01:03:35.325>need

1440
01:03:36.665 --> 01:03:38.225
<01:03:36.665>and <01:03:37.015>use <01:03:37.365>expensive <01:03:37.715>key <01:03:38.065>derivation.

1441
01:03:38.225 --> 01:03:39.905
<01:03:38.225>Expensive <01:03:38.505>means <01:03:38.785>it <01:03:39.065>takes <01:03:39.345>a <01:03:39.625>while,

1442
01:03:39.965 --> 01:03:44.225
<01:03:39.965>but <01:03:40.092>also <01:03:40.219>attacks <01:03:40.346>on <01:03:40.474>the <01:03:40.601>password <01:03:40.728>are <01:03:40.855>gonna <01:03:40.983>be <01:03:41.110>slower <01:03:41.237>if, <01:03:41.365>uh,

1443
01:03:44.225 --> 01:03:45.585
<01:03:44.225>the <01:03:44.531>deriv <01:03:44.837>derivation <01:03:45.143>is <01:03:45.449>slow.

1444
01:03:46.065 --> 01:03:49.265
<01:03:46.065>Examples <01:03:46.240>for, <01:03:46.415>uh, <01:03:46.590>algorithms <01:03:46.765>are <01:03:46.940>argon <01:03:47.115>two, <01:03:47.290>for <01:03:47.465>example,

1445
01:03:49.365 --> 01:03:50.865
<01:03:49.365>or <01:03:50.040>P-P-K-D-F <01:03:50.714>two.

1446
01:03:52.415 --> 01:03:54.785
<01:03:52.415>Good <01:03:52.615>crypto <01:03:52.815>is <01:03:53.015>hard. <01:03:53.215>Get <01:03:53.415>help <01:03:53.615>if <01:03:53.815>necessary.

1447
01:03:54.885 --> 01:03:57.265
<01:03:54.885>So <01:03:55.025>if <01:03:55.165>you're <01:03:55.305>designing <01:03:55.445>a <01:03:55.585>crypto <01:03:55.725>system, <01:03:55.865>get <01:03:56.005>someone <01:03:56.145>on <01:03:56.285>board

1448
01:03:57.265 --> 01:03:58.425
<01:03:57.265>that <01:03:57.526>knows <01:03:57.787>what <01:03:58.048>they're <01:03:58.309>doing.

1449
01:03:59.055 --> 01:04:00.945
<01:03:59.055>This <01:03:59.254>is <01:03:59.455>really <01:03:59.654>important. <01:03:59.855>I've <01:04:00.055>seen <01:04:00.254>so <01:04:00.455>many

1450
01:04:01.525 --> 01:04:03.545
<01:04:01.525>flawed <01:04:01.991>crypto <01:04:02.458>designs, <01:04:02.925>uh,

1451
01:04:03.725 --> 01:04:05.185
<01:04:03.725>in <01:04:03.944>my <01:04:04.163>work <01:04:04.382>as <01:04:04.601>a <01:04:04.819>penetration <01:04:05.038>tester.

1452
01:04:05.185 --> 01:04:06.305
<01:04:05.185>I <01:04:05.353>just <01:04:05.520>don't <01:04:05.689>wanna <01:04:05.857>see <01:04:06.024>this <01:04:06.192>anymore.

1453
01:04:08.855 --> 01:04:12.905
<01:04:08.855>Alright, <01:04:09.055>um, <01:04:09.255>another <01:04:09.455>principle <01:04:09.655>is, <01:04:09.855>uh, <01:04:10.055>secure <01:04:10.255>coding.

1454
01:04:13.535 --> 01:04:15.785
<01:04:13.535>Also, <01:04:13.768>the <01:04:14.001>design <01:04:14.234>principle <01:04:14.468>is <01:04:14.701>session <01:04:14.935>management.

1455
01:04:16.285 --> 01:04:19.825
<01:04:16.285>So <01:04:16.424>as <01:04:16.565>soon <01:04:16.705>as <01:04:16.845>you <01:04:16.984>have <01:04:17.125>two <01:04:17.265>separate <01:04:17.404>systems <01:04:17.545>that <01:04:17.685>are,

1456
01:04:19.925 --> 01:04:22.185
<01:04:19.925>one <01:04:20.125>is <01:04:20.325>a <01:04:20.525>trusted <01:04:20.725>system <01:04:20.925>like <01:04:21.125>your <01:04:21.325>backend

1457
01:04:22.185 --> 01:04:24.105
<01:04:22.185>and <01:04:22.360>one <01:04:22.535>is <01:04:22.710>an <01:04:22.884>untrusted <01:04:23.060>system <01:04:23.235>like <01:04:23.410>a <01:04:23.585>browser

1458
01:04:24.845 --> 01:04:28.225
<01:04:24.845>and <01:04:25.020>the <01:04:25.195>browsers <01:04:25.370>sending <01:04:25.545>multiple <01:04:25.720>requests <01:04:25.895>to <01:04:26.070>your <01:04:26.245>system,

1459
01:04:28.415 --> 01:04:30.905
<01:04:28.415>then <01:04:28.615>you <01:04:28.815>need <01:04:29.015>some <01:04:29.215>sort <01:04:29.415>of, <01:04:29.615>uh, <01:04:29.815>session.

1460
01:04:31.045 --> 01:04:33.425
<01:04:31.045>So <01:04:31.325>establishing <01:04:31.605>connections <01:04:31.885>between <01:04:32.165>those <01:04:32.445>requests,

1461
01:04:33.425 --> 01:04:35.905
<01:04:33.425>they're <01:04:33.580>belonging <01:04:33.736>to <01:04:33.891>the <01:04:34.047>same <01:04:34.202>session <01:04:34.358>to <01:04:34.513>the <01:04:34.669>same <01:04:34.825>user.

1462
01:04:36.965 --> 01:04:39.585
<01:04:36.965>Um, <01:04:37.198>so <01:04:37.431>this <01:04:37.665>usually <01:04:37.898>works <01:04:38.131>this <01:04:38.365>way.

1463
01:04:39.605 --> 01:04:42.145
<01:04:39.605>So <01:04:39.745>we <01:04:39.885>have <01:04:40.025>a <01:04:40.165>login <01:04:40.305>and <01:04:40.445>we <01:04:40.585>have <01:04:40.725>the <01:04:40.865>session <01:04:41.005>created

1464
01:04:42.165 --> 01:04:43.185
<01:04:42.165>and <01:04:42.348>sent <01:04:42.532>back <01:04:42.715>to <01:04:42.899>the <01:04:43.083>user.

1465
01:04:43.205 --> 01:04:44.625
<01:04:43.205>So <01:04:43.524>that's <01:04:43.844>a <01:04:44.163>random <01:04:44.483>session.

1466
01:04:44.845 --> 01:04:46.465
<01:04:44.845>You <01:04:45.195>usually, <01:04:45.545>that's <01:04:45.895>non <01:04:46.245>guessable,

1467
01:04:46.465 --> 01:04:49.945
<01:04:46.465>should <01:04:46.665>be <01:04:46.865>at <01:04:47.065>least <01:04:47.265>128 <01:04:47.465>bits <01:04:47.665>of <01:04:47.865>entropy,

1468
01:04:50.085 --> 01:04:51.585
<01:04:50.085>of <01:04:50.422>randomness <01:04:50.760>if <01:04:51.097>you <01:04:51.435>want.

1469
01:04:52.445 --> 01:04:56.585
<01:04:52.445>Um, <01:04:52.645>and <01:04:52.845>then <01:04:53.045>for <01:04:53.245>each <01:04:53.445>subsequent <01:04:53.645>request, <01:04:53.845>uh,

1470
01:04:56.585 --> 01:04:58.265
<01:04:56.585>the <01:04:56.865>browser's <01:04:57.145>gonna <01:04:57.425>send <01:04:57.705>that, <01:04:57.985>uh,

1471
01:04:58.265 --> 01:04:59.625
<01:04:58.265>session <01:04:58.571>to <01:04:58.877>the <01:04:59.183>application <01:04:59.489>server.

1472
01:04:59.685 --> 01:05:01.265
<01:04:59.685>So <01:04:59.884>the <01:05:00.085>application <01:05:00.285>server <01:05:00.485>can <01:05:00.685>tell <01:05:00.884>it's <01:05:01.085>the

1473
01:05:01.265 --> 01:05:02.305
<01:05:01.265>same <01:05:01.452>user <01:05:01.639>with <01:05:01.826>the <01:05:02.013>same <01:05:02.201>session.

1474
01:05:02.485 --> 01:05:06.145
<01:05:02.485>So <01:05:02.660>that's <01:05:02.835>the <01:05:03.010>basic <01:05:03.185>principle <01:05:03.360>here. <01:05:03.535>Some <01:05:03.710>important <01:05:03.885>rules.

1475
01:05:06.605 --> 01:05:11.025
<01:05:06.605>Now <01:05:06.780>your <01:05:06.955>framework <01:05:07.130>is <01:05:07.305>probably <01:05:07.480>gonna <01:05:07.655>give <01:05:07.830>you <01:05:08.005>most

1476
01:05:11.025 --> 01:05:12.385
<01:05:11.025>of <01:05:11.433>those <01:05:11.841>things <01:05:12.249>automatically,

1477
01:05:12.845 --> 01:05:14.425
<01:05:12.845>but <01:05:13.125>maybe <01:05:13.405>you <01:05:13.685>check <01:05:13.965>the <01:05:14.245>documentation

1478
01:05:14.425 --> 01:05:15.625
<01:05:14.425>of <01:05:14.605>your <01:05:14.785>framework <01:05:14.965>if <01:05:15.145>it <01:05:15.325>really <01:05:15.505>does.

1479
01:05:16.325 --> 01:05:19.445
<01:05:16.325>So, <01:05:16.480>if <01:05:16.636>it, <01:05:16.791>if <01:05:16.947>your <01:05:17.102>framework <01:05:17.258>offers <01:05:17.413>session <01:05:17.569>management, <01:05:17.725>use

1480
01:05:19.445 --> 01:05:21.005
<01:05:19.445>that <01:05:19.725>session <01:05:20.005>management <01:05:20.285>because <01:05:20.565>it's <01:05:20.845>usually,

1481
01:05:21.315 --> 01:05:24.125
<01:05:21.315>hopefully <01:05:21.595>tested <01:05:21.875>and, <01:05:22.155>uh, <01:05:22.435>well <01:05:22.715>done.

1482
01:05:24.915 --> 01:05:26.045
<01:05:24.915>They <01:05:25.169>should <01:05:25.423>be <01:05:25.677>non <01:05:25.932>guessable

1483
01:05:26.045 --> 01:05:28.965
<01:05:26.045>because <01:05:26.245>the <01:05:26.445>security <01:05:26.645>of <01:05:26.845>our <01:05:27.045>system <01:05:27.245>relies <01:05:27.445>100%

1484
01:05:28.965 --> 01:05:30.925
<01:05:28.965>of <01:05:29.198>the <01:05:29.431>nons <01:05:29.665>ability <01:05:29.898>of <01:05:30.131>that <01:05:30.365>token.

1485
01:05:30.945 --> 01:05:32.325
<01:05:30.945>So <01:05:31.100>it <01:05:31.255>needs <01:05:31.410>to <01:05:31.566>be <01:05:31.721>long <01:05:31.876>enough <01:05:32.031>and <01:05:32.187>random.

1486
01:05:33.705 --> 01:05:36.285
<01:05:33.705>Um, <01:05:33.904>use <01:05:34.105>the <01:05:34.305>session <01:05:34.505>as <01:05:34.705>the <01:05:34.904>only <01:05:35.105>source

1487
01:05:36.285 --> 01:05:37.765
<01:05:36.285>of <01:05:36.618>information <01:05:36.951>for <01:05:37.283>security <01:05:37.616>decisions.

1488
01:05:37.765 --> 01:05:39.485
<01:05:37.765>So <01:05:38.045>for <01:05:38.325>example, <01:05:38.605>whether <01:05:38.884>that <01:05:39.165>user's,

1489
01:05:39.485 --> 01:05:41.405
<01:05:39.485>administrator <01:05:39.835>don't <01:05:40.185>trust <01:05:40.535>any <01:05:40.885>parameter

1490
01:05:41.405 --> 01:05:43.605
<01:05:41.404>that <01:05:41.560>comes <01:05:41.716>from <01:05:41.871>the <01:05:42.027>client <01:05:42.182>that <01:05:42.338>they <01:05:42.493>could <01:05:42.649>be <01:05:42.805>manipulated,

1491
01:05:44.465 --> 01:05:47.405
<01:05:44.465>uh, <01:05:44.592>put <01:05:44.719>the <01:05:44.846>fact <01:05:44.974>that <01:05:45.101>this <01:05:45.228>user <01:05:45.355>is <01:05:45.483>an <01:05:45.610>administrator <01:05:45.737>into <01:05:45.865>the

1492
01:05:47.405 --> 01:05:49.365
<01:05:47.404>session, <01:05:47.754>and <01:05:48.104>then <01:05:48.455>decide <01:05:48.805>whether

1493
01:05:49.365 --> 01:05:52.245
<01:05:49.365>or <01:05:49.540>not, <01:05:49.714>uh, <01:05:49.890>they <01:05:50.064>can <01:05:50.240>access <01:05:50.415>that <01:05:50.589>specific <01:05:50.765>functionality.

1494
01:05:54.265 --> 01:05:58.085
<01:05:54.265>Uh, <01:05:54.404>make <01:05:54.545>sure <01:05:54.685>the <01:05:54.825>session <01:05:54.964>is, <01:05:55.105>is, <01:05:55.245>uh, <01:05:55.384>changes <01:05:55.525>upon <01:05:55.665>login.

1495
01:05:58.345 --> 01:06:00.165
<01:05:58.345>So <01:05:58.695>that's, <01:05:59.045>uh, <01:05:59.395>the <01:05:59.745>vulnerability

1496
01:06:00.165 --> 01:06:01.325
<01:06:00.165>behind <01:06:00.426>this <01:06:00.687>is <01:06:00.948>called <01:06:01.209>session

1497
01:06:01.445 --> 01:06:02.965
<01:06:01.445>fixation, <01:06:01.673>if <01:06:01.901>you <01:06:02.129>want <01:06:02.357>to <01:06:02.585>Google <01:06:02.813>it.

1498
01:06:03.705 --> 01:06:06.285
<01:06:03.705>Um, <01:06:03.938>so <01:06:04.171>when <01:06:04.404>you <01:06:04.638>log <01:06:04.871>in <01:06:05.105>successfully,

1499
01:06:06.585 --> 01:06:07.965
<01:06:06.585>the <01:06:06.895>session <01:06:07.206>ID <01:06:07.516>should <01:06:07.827>change

1500
01:06:07.965 --> 01:06:09.005
<01:06:07.965>because <01:06:08.199>often <01:06:08.433>you <01:06:08.667>have <01:06:08.901>an,

1501
01:06:09.065 --> 01:06:10.565
<01:06:09.065>an <01:06:09.335>anonymous <01:06:09.605>session <01:06:09.875>at <01:06:10.145>the <01:06:10.415>beginning,

1502
01:06:10.665 --> 01:06:14.445
<01:06:10.665>and <01:06:10.820>when <01:06:10.976>you're <01:06:11.131>not <01:06:11.287>logged <01:06:11.442>in, <01:06:11.598>when <01:06:11.753>changing <01:06:11.909>the <01:06:12.065>role

1503
01:06:14.465 --> 01:06:18.525
<01:06:14.465>or <01:06:14.605>changing <01:06:14.745>the <01:06:14.885>logged <01:06:15.025>in <01:06:15.165>state, <01:06:15.305>uh, <01:06:15.445>that <01:06:15.585>Id <01:06:15.725>should <01:06:15.865>renew,

1504
01:06:19.665 --> 01:06:22.325
<01:06:19.665>uh, <01:06:19.865>and <01:06:20.065>also <01:06:20.265>have <01:06:20.465>inactivity <01:06:20.665>timeouts <01:06:20.865>implemented <01:06:21.065>so

1505
01:06:22.325 --> 01:06:26.885
<01:06:22.325>that <01:06:22.480>sessions <01:06:22.636>are <01:06:22.791>not, <01:06:22.947>um, <01:06:23.102>you <01:06:23.258>know, <01:06:23.413>valid <01:06:23.569>to <01:06:23.725>infinity,

1506
01:06:26.885 --> 01:06:29.085
<01:06:26.885>but <01:06:27.235>have <01:06:27.585>some <01:06:27.935>inactivity <01:06:28.285>timeout.

1507
01:06:30.345 --> 01:06:33.045
<01:06:30.345>How <01:06:30.500>long <01:06:30.656>the <01:06:30.811>timeouts <01:06:30.967>gonna <01:06:31.122>be <01:06:31.278>really <01:06:31.433>depends <01:06:31.589>on <01:06:31.745>the

1508
01:06:33.045 --> 01:06:35.285
<01:06:33.045>confidentiality <01:06:33.325>integrity <01:06:33.605>requirements <01:06:33.885>of <01:06:34.165>your <01:06:34.445>software.

1509
01:06:35.305 --> 01:06:37.325
<01:06:35.305>So <01:06:35.480>for <01:06:35.654>example, <01:06:35.830>if <01:06:36.004>you're <01:06:36.180>doing <01:06:36.355>an <01:06:36.529>e-banking <01:06:36.705>application,

1510
01:06:37.325 --> 01:06:39.765
<01:06:37.325>it's <01:06:37.480>probably <01:06:37.636>gonna <01:06:37.791>be <01:06:37.947>shorter <01:06:38.102>if <01:06:38.258>you're <01:06:38.413>doing <01:06:38.569>a <01:06:38.725>recipe

1511
01:06:39.765 --> 01:06:42.725
<01:06:39.765>collection <01:06:39.964>app, <01:06:40.165>then <01:06:40.365>it <01:06:40.565>could <01:06:40.765>be <01:06:40.964>longer <01:06:41.165>probably

1512
01:06:42.725 --> 01:06:44.005
<01:06:42.725>because <01:06:42.955>it's <01:06:43.185>not <01:06:43.416>so <01:06:43.646>sensitive <01:06:43.877>for

1513
01:06:44.005 --> 01:06:45.125
<01:06:44.005>what <01:06:44.206>we <01:06:44.408>are <01:06:44.609>processing <01:06:44.811>in <01:06:45.013>there.

1514
01:06:47.675 --> 01:06:50.685
<01:06:47.675>Okay? <01:06:48.025>Um, <01:06:48.375>just <01:06:48.725>to, <01:06:49.075>uh,

1515
01:06:50.915 --> 01:06:54.405
<01:06:50.915>also <01:06:51.090>understand <01:06:51.265>three <01:06:51.440>terms <01:06:51.615>that <01:06:51.790>are <01:06:51.965>important <01:06:52.140>when, <01:06:52.315>uh,

1516
01:06:54.405 --> 01:06:56.765
<01:06:54.404>doing <01:06:54.638>some, <01:06:54.871>some <01:06:55.104>sort <01:06:55.338>of, <01:06:55.571>uh, <01:06:55.805>concurrency

1517
01:06:56.825 --> 01:06:58.085
<01:06:56.825>or <01:06:57.392>parallel <01:06:57.959>computing.

1518
01:06:58.625 --> 01:07:00.085
<01:06:58.625>Uh, <01:06:58.887>if <01:06:59.150>you <01:06:59.413>do <01:06:59.676>something <01:06:59.939>sequential,

1519
01:07:00.085 --> 01:07:01.525
<01:07:00.085>it's <01:07:00.301>just <01:07:00.517>one <01:07:00.733>step <01:07:00.949>after <01:07:01.165>the <01:07:01.381>other.

1520
01:07:01.545 --> 01:07:03.045
<01:07:01.545>If <01:07:01.770>you <01:07:01.995>do <01:07:02.220>it <01:07:02.445>concurrent, <01:07:02.670>it <01:07:02.895>means

1521
01:07:03.045 --> 01:07:04.685
<01:07:03.045>that <01:07:03.395>if <01:07:03.745>two <01:07:04.095>processes <01:07:04.445>running,

1522
01:07:04.685 --> 01:07:06.325
<01:07:04.685>they <01:07:04.860>can <01:07:05.035>even <01:07:05.210>be <01:07:05.384>running <01:07:05.560>on <01:07:05.735>the <01:07:05.910>same <01:07:06.085>core

1523
01:07:06.325 --> 01:07:10.445
<01:07:06.325>and <01:07:06.452>the <01:07:06.579>same <01:07:06.706>CPU, <01:07:06.834>there <01:07:06.961>might <01:07:07.088>be <01:07:07.215>one <01:07:07.343>chart, <01:07:07.470>chunk <01:07:07.597>of, <01:07:07.725>uh,

1524
01:07:10.965 --> 01:07:14.205
<01:07:10.965>instructions <01:07:11.140>be <01:07:11.315>processed <01:07:11.490>and <01:07:11.665>then <01:07:11.840>of <01:07:12.015>the <01:07:12.190>other <01:07:12.365>process.

1525
01:07:14.235 --> 01:07:15.685
<01:07:14.235>Then <01:07:14.496>the <01:07:14.757>first <01:07:15.018>process, <01:07:15.279>second <01:07:15.540>one.

1526
01:07:15.985 --> 01:07:19.285
<01:07:15.985>So <01:07:16.160>these <01:07:16.335>are <01:07:16.510>concurrent <01:07:16.685>doesn't <01:07:16.860>necessarily <01:07:17.035>mean <01:07:17.210>that <01:07:17.385>they

1527
01:07:20.125 --> 01:07:21.565
<01:07:20.125>actually <01:07:20.384>running <01:07:20.643>at <01:07:20.902>the <01:07:21.161>same <01:07:21.421>time,

1528
01:07:22.025 --> 01:07:24.805
<01:07:22.025>but <01:07:22.225>maybe <01:07:22.425>they're, <01:07:22.625>uh, <01:07:22.825>put <01:07:23.025>into <01:07:23.225>smaller <01:07:23.425>chunks.

1529
01:07:24.825 --> 01:07:28.645
<01:07:24.825>And <01:07:25.000>then, <01:07:25.174>um, <01:07:25.350>you <01:07:25.524>know, <01:07:25.700>first <01:07:25.875>part, <01:07:26.049>first <01:07:26.225>process,

1530
01:07:28.975 --> 01:07:31.005
<01:07:28.975>first <01:07:29.208>part, <01:07:29.441>second <01:07:29.674>process, <01:07:29.908>and <01:07:30.141>so <01:07:30.375>on.

1531
01:07:31.705 --> 01:07:34.365
<01:07:31.705>And <01:07:31.880>then <01:07:32.055>we <01:07:32.230>have <01:07:32.404>actual <01:07:32.580>parallel <01:07:32.755>computing <01:07:32.930>that, <01:07:33.105>uh,

1532
01:07:34.455 --> 01:07:35.725
<01:07:34.455>could <01:07:34.740>mean, <01:07:35.026>or <01:07:35.312>that <01:07:35.598>means

1533
01:07:35.725 --> 01:07:39.405
<01:07:35.725>that <01:07:35.880>things <01:07:36.036>are <01:07:36.191>actually <01:07:36.347>happening <01:07:36.502>at <01:07:36.658>the <01:07:36.813>same <01:07:36.969>time, <01:07:37.125>uh,

1534
01:07:39.705 --> 01:07:41.005
<01:07:39.705>in <01:07:40.290>separate <01:07:40.875>sequences.

1535
01:07:43.145 --> 01:07:45.045
<01:07:43.145>Um, <01:07:43.845>for <01:07:44.545>coding

1536
01:07:45.465 --> 01:07:47.485
<01:07:45.465>and <01:07:45.698>secure <01:07:45.931>coding, <01:07:46.165>there <01:07:46.398>are <01:07:46.631>two <01:07:46.865>situations

1537
01:07:47.485 --> 01:07:48.805
<01:07:47.485>that, <01:07:47.881>uh, <01:07:48.277>are <01:07:48.673>relevant.

1538
01:07:49.585 --> 01:07:51.445
<01:07:49.585>For <01:07:49.760>example, <01:07:49.935>two <01:07:50.110>users <01:07:50.285>check <01:07:50.460>out <01:07:50.635>the <01:07:50.810>same <01:07:50.985>version

1539
01:07:51.445 --> 01:07:53.005
<01:07:51.445>of <01:07:51.678>an <01:07:51.911>object <01:07:52.145>in <01:07:52.378>a <01:07:52.611>web <01:07:52.845>application.

1540
01:07:53.035 --> 01:07:54.405
<01:07:53.035>They <01:07:53.240>edit <01:07:53.446>it <01:07:53.651>and <01:07:53.857>they <01:07:54.062>save <01:07:54.267>it.

1541
01:07:54.865 --> 01:07:57.725
<01:07:54.865>If <01:07:55.004>two <01:07:55.145>users <01:07:55.285>do <01:07:55.424>that <01:07:55.564>at <01:07:55.705>the <01:07:55.845>same <01:07:55.984>time, <01:07:56.125>the <01:07:56.265>one

1542
01:07:57.725 --> 01:07:59.885
<01:07:57.725>that <01:07:58.005>comes <01:07:58.285>later, <01:07:58.565>uh, <01:07:58.845>takes <01:07:59.125>precedents

1543
01:07:59.885 --> 01:08:01.885
<01:07:59.885>and <01:08:00.085>the <01:08:00.285>first <01:08:00.485>one <01:08:00.685>maybe <01:08:00.885>doesn't <01:08:01.085>even <01:08:01.285>notice

1544
01:08:01.885 --> 01:08:03.525
<01:08:01.885>that <01:08:02.165>there <01:08:02.445>are <01:08:02.725>changes <01:08:03.005>were <01:08:03.285>overwritten.

1545
01:08:05.025 --> 01:08:07.365
<01:08:05.025>Uh, <01:08:05.305>the <01:08:05.585>second, <01:08:05.865>uh, <01:08:06.145>situation <01:08:06.425>is

1546
01:08:07.965 --> 01:08:09.845
<01:08:07.965>a <01:08:08.315>transaction <01:08:08.665>may <01:08:09.015>happen <01:08:09.365>simultaneously.

1547
01:08:10.785 --> 01:08:13.845
<01:08:10.785>It <01:08:10.912>reads <01:08:11.039>the <01:08:11.166>value <01:08:11.294>and <01:08:11.421>writes <01:08:11.548>it <01:08:11.675>back <01:08:11.803>to <01:08:11.930>a <01:08:12.057>database, <01:08:12.185>uh,

1548
01:08:14.065 --> 01:08:15.445
<01:08:14.065>and <01:08:14.313>changes <01:08:14.561>it <01:08:14.810>in <01:08:15.058>the <01:08:15.307>meantime.

1549
01:08:15.865 --> 01:08:17.845
<01:08:15.865>And <01:08:16.064>that <01:08:16.264>could <01:08:16.465>lead <01:08:16.665>to <01:08:16.865>an <01:08:17.064>integrity <01:08:17.264>problem.

1550
01:08:18.025 --> 01:08:20.725
<01:08:18.024>Let <01:08:18.152>me <01:08:18.279>show <01:08:18.406>this <01:08:18.534>to <01:08:18.661>you <01:08:18.788>with, <01:08:18.915>um, <01:08:19.043>uh, <01:08:19.170>with <01:08:19.297>an <01:08:19.424>example.

1551
01:08:20.945 --> 01:08:24.925
<01:08:20.944>So <01:08:21.085>we <01:08:21.224>have <01:08:21.365>two <01:08:21.505>threats <01:08:21.644>that <01:08:21.785>access <01:08:21.924>the <01:08:22.064>same <01:08:22.205>data, <01:08:22.344>um,

1552
01:08:25.145 --> 01:08:26.165
<01:08:25.145>and <01:08:25.374>do <01:08:25.604>something <01:08:25.833>with <01:08:26.063>it.

1553
01:08:26.545 --> 01:08:29.405
<01:08:26.545>We <01:08:26.745>have <01:08:26.944>to <01:08:27.145>withdraw <01:08:27.345>function <01:08:27.545>that <01:08:27.745>says, <01:08:27.944>uh,

1554
01:08:29.605 --> 01:08:31.085
<01:08:29.604>withdraw <01:08:29.938>$10 <01:08:30.270>from <01:08:30.604>that <01:08:30.937>account.

1555
01:08:31.585 --> 01:08:33.525
<01:08:31.585>So <01:08:31.785>it <01:08:31.984>gets <01:08:32.185>the <01:08:32.385>balance <01:08:32.585>from <01:08:32.785>the <01:08:32.984>account

1556
01:08:34.345 --> 01:08:37.845
<01:08:34.345>and, <01:08:34.545>um, <01:08:34.745>it <01:08:34.945>just <01:08:35.145>re <01:08:35.345>uh, <01:08:35.545>you <01:08:35.745>know,

1557
01:08:38.145 --> 01:08:40.125
<01:08:38.145>it <01:08:38.425>reduces <01:08:38.705>the <01:08:38.985>amount <01:08:39.265>by <01:08:39.545>$10.

1558
01:08:40.185 --> 01:08:42.885
<01:08:40.184>In <01:08:40.359>this <01:08:40.535>case, <01:08:40.709>it's <01:08:40.884>gonna <01:08:41.059>do <01:08:41.234>balance <01:08:41.410>minus <01:08:41.584>amount.

1559
01:08:44.195 --> 01:08:46.455
<01:08:44.194>And <01:08:44.335>then <01:08:44.474>at <01:08:44.615>the <01:08:44.755>same <01:08:44.894>time, <01:08:45.035>so <01:08:45.174>now <01:08:45.314>it's, <01:08:45.455>it's <01:08:45.594>interrupted

1560
01:08:46.455 --> 01:08:48.255
<01:08:46.455>because <01:08:46.610>these <01:08:46.766>two <01:08:46.921>thread <01:08:47.077>are <01:08:47.232>running <01:08:47.388>on <01:08:47.543>the <01:08:47.699>same <01:08:47.854>core,

1561
01:08:48.255 --> 01:08:52.215
<01:08:48.255>it's <01:08:48.488>interrupted, <01:08:48.721>and <01:08:48.955>these <01:08:49.188>instruction, <01:08:49.421>um, <01:08:49.654>instructions

1562
01:08:52.215 --> 01:08:54.135
<01:08:52.215>of <01:08:52.448>the <01:08:52.681>same <01:08:52.915>function <01:08:53.148>are <01:08:53.381>gonna <01:08:53.615>be

1563
01:08:54.135 --> 01:08:55.455
<01:08:54.135>called <01:08:54.531>from <01:08:54.926>another <01:08:55.323>threat.

1564
01:08:55.555 --> 01:08:56.575
<01:08:55.555>So <01:08:55.738>it <01:08:55.922>does <01:08:56.105>the <01:08:56.289>same <01:08:56.473>thing.

1565
01:08:56.795 --> 01:09:00.895
<01:08:56.795>It <01:08:56.970>says <01:08:57.145>with <01:08:57.319>drought <01:08:57.495>withdraw <01:08:57.670>$10, <01:08:57.845>it's <01:08:58.020>gonna <01:08:58.194>read

1566
01:09:01.635 --> 01:09:03.895
<01:09:01.635>the <01:09:01.835>actual, <01:09:02.035>the <01:09:02.235>current <01:09:02.435>balance <01:09:02.635>from <01:09:02.835>the <01:09:03.035>database.

1567
01:09:04.075 --> 01:09:05.535
<01:09:04.075>It <01:09:04.337>is <01:09:04.600>still <01:09:04.863>gonna <01:09:05.126>be <01:09:05.389>10,000

1568
01:09:05.535 --> 01:09:07.335
<01:09:05.535>because <01:09:05.734>this <01:09:05.934>one <01:09:06.135>did <01:09:06.335>not <01:09:06.535>write <01:09:06.734>its <01:09:06.934>changes

1569
01:09:07.515 --> 01:09:08.775
<01:09:07.515>yet <01:09:07.798>to <01:09:08.082>the <01:09:08.365>data <01:09:08.648>store.

1570
01:09:09.315 --> 01:09:11.855
<01:09:09.315>So <01:09:09.490>it's <01:09:09.665>gonna, <01:09:09.840>you <01:09:10.015>know, <01:09:10.190>reduce <01:09:10.365>it <01:09:10.540>by <01:09:10.715>$10.

1571
01:09:11.915 --> 01:09:14.975
<01:09:11.915>So <01:09:12.055>we <01:09:12.194>have, <01:09:12.335>in <01:09:12.475>memory, <01:09:12.615>we <01:09:12.755>have <01:09:12.894>the <01:09:13.035>state <01:09:13.175>of <01:09:13.314>9,900,

1572
01:09:15.595 --> 01:09:19.215
<01:09:15.595>and <01:09:15.722>then <01:09:15.849>this <01:09:15.976>one's <01:09:16.104>gonna <01:09:16.231>write <01:09:16.358>it <01:09:16.485>to <01:09:16.613>the <01:09:16.740>data <01:09:16.867>store, <01:09:16.995>9,990,

1573
01:09:19.315 --> 01:09:21.295
<01:09:19.315>and <01:09:19.595>this <01:09:19.875>one <01:09:20.155>as <01:09:20.435>well, <01:09:20.715>9,990.

1574
01:09:21.635 --> 01:09:25.775
<01:09:21.635>So <01:09:21.751>in <01:09:21.868>the, <01:09:21.985>in <01:09:22.101>the <01:09:22.218>end <01:09:22.335>we <01:09:22.451>called <01:09:22.568>the <01:09:22.685>reduced <01:09:22.801>by <01:09:22.918>10 <01:09:23.035>twice,

1575
01:09:26.555 --> 01:09:28.015
<01:09:26.555>but <01:09:26.817>it <01:09:27.080>only <01:09:27.343>got <01:09:27.606>reduced <01:09:27.869>once

1576
01:09:28.165 --> 01:09:31.335
<01:09:28.165>because <01:09:28.340>it's <01:09:28.515>time <01:09:28.689>of <01:09:28.865>check, <01:09:29.040>time <01:09:29.215>of <01:09:29.390>use <01:09:29.564>problem.

1577
01:09:32.115 --> 01:09:34.815
<01:09:32.115>We <01:09:32.270>check <01:09:32.426>the <01:09:32.581>balance, <01:09:32.737>it's <01:09:32.892>10,000, <01:09:33.048>we <01:09:33.203>check <01:09:33.359>the <01:09:33.514>balance,

1578
01:09:34.845 --> 01:09:38.135
<01:09:34.845>it's <01:09:35.125>10,000, <01:09:35.405>we <01:09:35.685>write <01:09:35.965>it, <01:09:36.245>9,990,

1579
01:09:38.235 --> 01:09:40.255
<01:09:38.234>we <01:09:38.410>write <01:09:38.585>it <01:09:38.759>ten <01:09:38.934>nine <01:09:39.109>thousand <01:09:39.285>nine <01:09:39.460>hundred <01:09:39.634>ninety.

1580
01:09:40.435 --> 01:09:41.855
<01:09:40.434>If <01:09:40.690>it <01:09:40.946>would've <01:09:41.201>happened <01:09:41.457>this <01:09:41.712>way,

1581
01:09:41.855 --> 01:09:42.975
<01:09:41.854>everything <01:09:42.107>would <01:09:42.359>be <01:09:42.611>all <01:09:42.863>right.

1582
01:09:43.195 --> 01:09:45.615
<01:09:43.194>If <01:09:43.350>it <01:09:43.506>happens <01:09:43.661>this <01:09:43.817>way, <01:09:43.972>we <01:09:44.128>have <01:09:44.283>an <01:09:44.439>integrity <01:09:44.594>problem

1583
01:09:45.615 --> 01:09:47.735
<01:09:45.615>because, <01:09:45.894>uh, <01:09:46.175>it's <01:09:46.455>not <01:09:46.734>correct <01:09:47.014>anymore.

1584
01:09:49.315 --> 01:09:53.095
<01:09:49.315>Uh, <01:09:49.455>the <01:09:49.595>same <01:09:49.735>thing <01:09:49.875>in, <01:09:50.015>in <01:09:50.155>the <01:09:50.295>form <01:09:50.435>of <01:09:50.575>a <01:09:50.715>t-shirt.

1585
01:09:53.455 --> 01:09:56.455
<01:09:53.455>I <01:09:53.582>think <01:09:53.709>I'm, <01:09:53.836>I <01:09:53.964>have <01:09:54.091>to <01:09:54.218>get <01:09:54.345>this <01:09:54.473>T-shirt. <01:09:54.600>I <01:09:54.727>like <01:09:54.855>it.

1586
01:09:56.615 --> 01:09:59.455
<01:09:56.615>A <01:09:56.790>race <01:09:56.965>condition <01:09:57.139>on <01:09:57.315>t-shirt, <01:09:57.490>don't <01:09:57.665>be <01:09:57.840>happy, <01:09:58.014>worry.

1587
01:10:01.235 --> 01:10:05.295
<01:10:01.235>So <01:10:01.410>solution <01:10:01.585>approaches, <01:10:01.759>uh, <01:10:01.934>ask <01:10:02.110>yourself, <01:10:02.285>is <01:10:02.460>this <01:10:02.634>situation,

1588
01:10:05.295 --> 01:10:07.735
<01:10:05.295>is <01:10:05.411>it <01:10:05.528>gonna <01:10:05.645>be <01:10:05.761>an <01:10:05.878>exception <01:10:05.995>or <01:10:06.111>is <01:10:06.228>it <01:10:06.345>gonna <01:10:06.461>be <01:10:06.578>the <01:10:06.695>rule?

1589
01:10:08.425 --> 01:10:10.655
<01:10:08.425>There <01:10:08.580>are <01:10:08.736>two <01:10:08.891>different <01:10:09.047>types <01:10:09.202>of <01:10:09.358>things <01:10:09.513>you <01:10:09.669>can <01:10:09.825>do.

1590
01:10:10.675 --> 01:10:12.215
<01:10:10.675>You <01:10:11.021>can <01:10:11.368>do <01:10:11.714>optimistic <01:10:12.061>measures

1591
01:10:12.215 --> 01:10:13.735
<01:10:12.215>or <01:10:12.488>you <01:10:12.762>can <01:10:13.035>do <01:10:13.309>pessimistic <01:10:13.583>measures.

1592
01:10:14.795 --> 01:10:18.375
<01:10:14.795>The, <01:10:15.028>um, <01:10:15.261>possible <01:10:15.495>solutions <01:10:15.728>are, <01:10:15.961>for <01:10:16.195>example,

1593
01:10:18.395 --> 01:10:19.615
<01:10:18.395>you <01:10:18.761>do <01:10:19.127>entity <01:10:19.492>versioning.

1594
01:10:20.235 --> 01:10:22.375
<01:10:20.235>You <01:10:20.434>have <01:10:20.634>two <01:10:20.835>people <01:10:21.035>that <01:10:21.235>check <01:10:21.434>out <01:10:21.634>the

1595
01:10:22.375 --> 01:10:23.455
<01:10:22.375>same <01:10:22.618>version <01:10:22.861>of <01:10:23.104>an <01:10:23.347>object.

1596
01:10:24.275 --> 01:10:26.055
<01:10:24.275>Uh, <01:10:24.508>they <01:10:24.741>both <01:10:24.974>check <01:10:25.208>out <01:10:25.441>version <01:10:25.674>one.

1597
01:10:26.645 --> 01:10:29.455
<01:10:26.645>That <01:10:26.820>first <01:10:26.995>person <01:10:27.170>writes <01:10:27.345>version <01:10:27.520>two <01:10:27.695>to <01:10:27.870>the <01:10:28.045>database.

1598
01:10:29.715 --> 01:10:31.615
<01:10:29.715>And <01:10:29.890>when <01:10:30.065>that <01:10:30.240>second <01:10:30.415>person <01:10:30.590>do <01:10:30.765>the <01:10:30.940>same <01:10:31.115>thing

1599
01:10:31.615 --> 01:10:33.655
<01:10:31.615>and <01:10:31.770>writes <01:10:31.926>it <01:10:32.081>to <01:10:32.237>the <01:10:32.392>database, <01:10:32.548>the <01:10:32.703>application's <01:10:32.859>gonna <01:10:33.014>say,

1600
01:10:33.655 --> 01:10:35.055
<01:10:33.655>look, <01:10:33.970>you <01:10:34.285>had <01:10:34.600>version <01:10:34.915>one,

1601
01:10:35.475 --> 01:10:36.975
<01:10:35.475>but <01:10:35.700>in <01:10:35.925>the <01:10:36.150>meantime <01:10:36.375>it <01:10:36.600>was <01:10:36.825>updated

1602
01:10:37.035 --> 01:10:38.695
<01:10:37.035>and <01:10:37.268>it's <01:10:37.501>gonna <01:10:37.735>throw <01:10:37.968>an <01:10:38.201>exception <01:10:38.434>so

1603
01:10:38.695 --> 01:10:40.695
<01:10:38.695>that <01:10:38.870>at <01:10:39.045>least <01:10:39.219>we <01:10:39.394>don't <01:10:39.570>have <01:10:39.745>an <01:10:39.920>integrity <01:10:40.094>problem.

1604
01:10:40.875 --> 01:10:42.375
<01:10:40.875>So <01:10:41.067>at <01:10:41.260>least <01:10:41.453>they <01:10:41.646>get <01:10:41.839>an <01:10:42.032>error <01:10:42.225>message

1605
01:10:42.515 --> 01:10:44.655
<01:10:42.515>and <01:10:42.670>it <01:10:42.826>tells <01:10:42.981>them, <01:10:43.137>look, <01:10:43.292>you <01:10:43.448>have <01:10:43.603>to <01:10:43.759>start <01:10:43.915>over.

1606
01:10:45.315 --> 01:10:47.895
<01:10:45.315>If <01:10:45.470>that's <01:10:45.626>not <01:10:45.781>gonna <01:10:45.937>happen, <01:10:46.092>often <01:10:46.248>you <01:10:46.403>can <01:10:46.559>do <01:10:46.715>that

1607
01:10:47.925 --> 01:10:50.455
<01:10:47.925>because <01:10:48.158>then <01:10:48.391>it <01:10:48.625>happens <01:10:48.858>once <01:10:49.091>a <01:10:49.325>year

1608
01:10:50.455 --> 01:10:51.975
<01:10:50.455>that <01:10:50.683>somebody <01:10:50.911>needs <01:10:51.139>to <01:10:51.367>read <01:10:51.595>their <01:10:51.823>work.

1609
01:10:51.975 --> 01:10:53.295
<01:10:51.975>But <01:10:52.272>it's <01:10:52.569>a <01:10:52.866>simple <01:10:53.163>solution.

1610
01:10:54.835 --> 01:10:56.695
<01:10:54.835>Um, <01:10:55.068>you <01:10:55.301>could <01:10:55.535>also <01:10:55.768>do <01:10:56.001>atomic <01:10:56.235>operations.

1611
01:10:56.875 --> 01:10:58.855
<01:10:56.875>So <01:10:57.030>going <01:10:57.186>back <01:10:57.341>to <01:10:57.497>this <01:10:57.652>one, <01:10:57.808>it <01:10:57.963>would <01:10:58.119>mean <01:10:58.275>that

1612
01:10:59.365 --> 01:11:01.735
<01:10:59.365>this <01:10:59.644>function <01:10:59.925>cannot <01:11:00.205>be <01:11:00.485>called, <01:11:00.764>uh,

1613
01:11:02.195 --> 01:11:03.935
<01:11:02.195>two <01:11:02.545>times <01:11:02.894>on <01:11:03.245>one <01:11:03.594>computer.

1614
01:11:04.115 --> 01:11:08.055
<01:11:04.115>It <01:11:04.270>can <01:11:04.426>only <01:11:04.581>be <01:11:04.737>called, <01:11:04.892>um, <01:11:05.048>one <01:11:05.203>after <01:11:05.359>the <01:11:05.514>other.

1615
01:11:09.315 --> 01:11:11.175
<01:11:09.315>Uh, <01:11:09.548>you <01:11:09.781>can <01:11:10.015>also <01:11:10.248>do <01:11:10.481>mutual <01:11:10.715>exclusion.

1616
01:11:11.175 --> 01:11:15.005
<01:11:11.175>That's <01:11:11.350>file <01:11:11.525>logs <01:11:11.700>or <01:11:11.875>database <01:11:12.050>level, <01:11:12.225>role <01:11:12.400>level <01:11:12.575>locks

1617
01:11:15.005 --> 01:11:16.165
<01:11:15.005>or <01:11:15.527>table <01:11:16.049>locks.

1618
01:11:17.425 --> 01:11:19.485
<01:11:17.425>Uh, <01:11:17.625>or <01:11:17.825>you <01:11:18.025>can <01:11:18.225>also <01:11:18.425>do <01:11:18.625>message <01:11:18.825>passing.

1619
01:11:19.865 --> 01:11:21.725
<01:11:19.865>That's <01:11:20.215>an <01:11:20.565>advanced, <01:11:20.915>advanced, <01:11:21.264>uh,

1620
01:11:21.725 --> 01:11:25.815
<01:11:21.725>measure <01:11:22.075>against <01:11:22.425>this <01:11:22.775>problem <01:11:23.125>all.

1621
01:11:26.155 --> 01:11:28.535
<01:11:26.155>So <01:11:26.355>that's <01:11:26.554>about <01:11:26.755>it. <01:11:26.955>For <01:11:27.155>secure <01:11:27.355>coding <01:11:27.554>practices,

1622
01:11:28.635 --> 01:11:30.535
<01:11:28.635>we <01:11:28.985>talked <01:11:29.335>about <01:11:29.685>input <01:11:30.035>handing.

1623
01:11:30.715 --> 01:11:34.695
<01:11:30.715>So <01:11:30.890>input <01:11:31.065>handing <01:11:31.240>has <01:11:31.415>a <01:11:31.590>few <01:11:31.765>different, <01:11:31.940>um, <01:11:32.115>activities

1624
01:11:35.315 --> 01:11:37.255
<01:11:35.315>That's <01:11:36.015>canonical <01:11:36.715>sessions

1625
01:11:37.255 --> 01:11:39.255
<01:11:37.255>of <01:11:37.430>bringing <01:11:37.605>it <01:11:37.780>into <01:11:37.955>the <01:11:38.130>same <01:11:38.305>formats <01:11:38.480>of <01:11:38.655>that.

1626
01:11:39.255 --> 01:11:40.415
<01:11:39.255>The <01:11:39.603>values <01:11:39.951>are <01:11:40.299>comparable.

1627
01:11:40.455 --> 01:11:42.415
<01:11:40.455>I <01:11:40.630>think <01:11:40.805>email <01:11:40.980>addresses <01:11:41.155>and <01:11:41.330>upper <01:11:41.505>and <01:11:41.680>lower <01:11:41.855>case.

1628
01:11:42.955 --> 01:11:44.295
<01:11:42.955>Uh, <01:11:43.256>we <01:11:43.558>had <01:11:43.859>input <01:11:44.161>validation.

1629
01:11:44.645 --> 01:11:46.695
<01:11:44.645>It's <01:11:44.995>not <01:11:45.345>against <01:11:45.695>specific <01:11:46.045>bilities,

1630
01:11:46.695 --> 01:11:48.735
<01:11:46.695>but <01:11:46.870>it's <01:11:47.045>gonna <01:11:47.219>help <01:11:47.394>you <01:11:47.570>lower <01:11:47.745>the <01:11:47.920>attack <01:11:48.094>surface,

1631
01:11:48.735 --> 01:11:51.255
<01:11:48.735>which <01:11:48.890>makes <01:11:49.046>sense <01:11:49.201>in <01:11:49.357>which <01:11:49.512>we <01:11:49.668>want <01:11:49.823>to <01:11:49.979>do <01:11:50.134>right.

1632
01:11:51.715 --> 01:11:55.975
<01:11:51.715>And <01:11:51.855>then <01:11:51.995>we <01:11:52.135>have, <01:11:52.275>uh, <01:11:52.415>sanitization, <01:11:52.555>which <01:11:52.695>is, <01:11:52.835>I <01:11:52.975>have <01:11:53.115>code

1633
01:11:55.995 --> 01:11:58.775
<01:11:55.995>as <01:11:56.228>an <01:11:56.461>input, <01:11:56.695>like <01:11:56.928>HTML <01:11:57.161>formatted <01:11:57.394>code,

1634
01:11:59.195 --> 01:12:01.255
<01:11:59.195>and <01:11:59.350>I <01:11:59.506>don't <01:11:59.661>want <01:11:59.817>any <01:11:59.972>JavaScript <01:12:00.128>to <01:12:00.283>be <01:12:00.439>in <01:12:00.594>there.

1635
01:12:01.365 --> 01:12:04.415
<01:12:01.365>Then <01:12:01.565>I <01:12:01.764>have <01:12:01.965>to <01:12:02.165>use <01:12:02.365>sanitization, <01:12:02.565>use <01:12:02.764>all

1636
01:12:04.415 --> 01:12:05.695
<01:12:04.415>of <01:12:04.607>the <01:12:04.799>three <01:12:04.991>whenever <01:12:05.183>they <01:12:05.375>make <01:12:05.567>sense.

1637
01:12:05.705 --> 01:12:07.375
<01:12:05.705>Input <01:12:05.985>validation <01:12:06.265>is <01:12:06.545>not <01:12:06.825>really <01:12:07.105>optional,

1638
01:12:07.395 --> 01:12:09.695
<01:12:07.395>but <01:12:07.550>the <01:12:07.706>other <01:12:07.861>two <01:12:08.017>are <01:12:08.172>optional, <01:12:08.328>depending <01:12:08.483>on <01:12:08.639>the <01:12:08.795>context.

1639
01:12:10.685 --> 01:12:13.575
<01:12:10.684>Then <01:12:10.884>in <01:12:11.084>order <01:12:11.285>to <01:12:11.485>protect <01:12:11.684>against <01:12:11.884>specific <01:12:12.084>mobilities,

1640
01:12:13.595 --> 01:12:14.655
<01:12:13.595>we <01:12:13.913>have <01:12:14.231>output <01:12:14.549>handling.

1641
01:12:14.675 --> 01:12:18.495
<01:12:14.675>So <01:12:14.850>context <01:12:15.025>specific <01:12:15.200>output <01:12:15.375>and <01:12:15.550>coding <01:12:15.725>is <01:12:15.900>key <01:12:16.075>here.

1642
01:12:18.635 --> 01:12:22.455
<01:12:18.635>So <01:12:18.762>that <01:12:18.889>I <01:12:19.016>don't, <01:12:19.144>uh, <01:12:19.271>have <01:12:19.398>put <01:12:19.525>any <01:12:19.653>input <01:12:19.780>into <01:12:19.907>data <01:12:20.035>structures

1643
01:12:22.675 --> 01:12:23.695
<01:12:22.675>and <01:12:23.134>the <01:12:23.593>attacker,

1644
01:12:23.695 --> 01:12:26.935
<01:12:23.695>the <01:12:23.870>potential <01:12:24.045>attacker <01:12:24.219>can <01:12:24.394>change <01:12:24.570>the <01:12:24.745>structure, <01:12:24.920>you <01:12:25.094>know,

1645
01:12:27.355 --> 01:12:28.575
<01:12:27.355>around <01:12:27.904>the <01:12:28.452>input.

1646
01:12:28.695 --> 01:12:31.975
<01:12:28.695>I <01:12:28.835>don't <01:12:28.974>want <01:12:29.115>this. <01:12:29.255>We <01:12:29.394>have <01:12:29.535>pitfalls <01:12:29.674>in <01:12:29.815>low <01:12:29.955>level <01:12:30.094>languages.

1647
01:12:32.715 --> 01:12:35.855
<01:12:32.715>Um, <01:12:32.915>and <01:12:33.115>that's <01:12:33.315>buffer <01:12:33.515>workflows <01:12:33.715>and <01:12:33.915>t <01:12:34.115>overflows

1648
01:12:35.855 --> 01:12:37.055
<01:12:35.855>and <01:12:36.215>format <01:12:36.575>strong <01:12:36.935>vulnerabilities.

1649
01:12:37.435 --> 01:12:39.975
<01:12:37.434>If <01:12:37.668>you <01:12:37.901>are, <01:12:38.134>um, <01:12:38.368>programmer <01:12:38.601>in <01:12:38.834>C

1650
01:12:39.975 --> 01:12:42.495
<01:12:39.975>or <01:12:40.130>c <01:12:40.286>plus <01:12:40.441>plus, <01:12:40.597>which <01:12:40.752>out <01:12:40.908>for <01:12:41.063>bounce <01:12:41.219>checks, <01:12:41.375>use,

1651
01:12:43.115 --> 01:12:44.495
<01:12:43.115>uh, <01:12:43.736>say <01:12:44.357>functions.

1652
01:12:46.515 --> 01:12:49.575
<01:12:46.515>And <01:12:46.631>if <01:12:46.748>you're <01:12:46.865>using <01:12:46.981>go <01:12:47.098>or <01:12:47.215>rust, <01:12:47.331>just <01:12:47.448>stay <01:12:47.565>in <01:12:47.681>the <01:12:47.798>safe <01:12:47.915>world

1653
01:12:49.575 --> 01:12:51.375
<01:12:49.575>and <01:12:49.925>don't <01:12:50.275>use <01:12:50.625>pointer <01:12:50.974>arithmetics,

1654
01:12:51.655 --> 01:12:54.095
<01:12:51.655>although <01:12:51.810>those <01:12:51.966>languages <01:12:52.121>give <01:12:52.277>you <01:12:52.432>the <01:12:52.588>opportunity <01:12:52.743>to <01:12:52.899>do <01:12:53.054>so.

1655
01:12:54.475 --> 01:12:56.695
<01:12:54.475>If <01:12:54.602>you <01:12:54.729>do <01:12:54.856>so, <01:12:54.984>you <01:12:55.111>have <01:12:55.238>to <01:12:55.365>really <01:12:55.493>know <01:12:55.620>what <01:12:55.747>you're <01:12:55.875>doing.

1656
01:12:57.235 --> 01:12:59.015
<01:12:57.235>The <01:12:57.585>principle <01:12:57.934>of <01:12:58.285>complete <01:12:58.634>mediation,

1657
01:12:59.435 --> 01:13:00.975
<01:12:59.434>do <01:12:59.712>access <01:12:59.989>control <01:13:00.266>at <01:13:00.543>every <01:13:00.821>request,

1658
01:13:00.975 --> 01:13:02.215
<01:13:00.975>not <01:13:01.198>just <01:13:01.421>the <01:13:01.644>first <01:13:01.867>form <01:13:02.091>step,

1659
01:13:02.215 --> 01:13:03.615
<01:13:02.215>but <01:13:02.425>also <01:13:02.635>the <01:13:02.845>second <01:13:03.055>and <01:13:03.264>third <01:13:03.474>one.

1660
01:13:03.705 --> 01:13:05.615
<01:13:03.705>Every <01:13:03.985>request <01:13:04.265>needs <01:13:04.545>to <01:13:04.825>be <01:13:05.105>authorized.

1661
01:13:06.495 --> 01:13:08.655
<01:13:06.495>Cryptography <01:13:06.775>is <01:13:07.055>a <01:13:07.335>very <01:13:07.615>broad <01:13:07.894>topic.

1662
01:13:09.275 --> 01:13:11.415
<01:13:09.275>Uh, <01:13:09.474>also <01:13:09.674>important <01:13:09.875>to <01:13:10.075>know <01:13:10.275>what <01:13:10.474>you're <01:13:10.674>doing.

1663
01:13:11.725 --> 01:13:13.655
<01:13:11.725>Dive <01:13:12.075>deeper <01:13:12.425>into <01:13:12.775>applied <01:13:13.125>cryptography

1664
01:13:13.655 --> 01:13:15.295
<01:13:13.655>before <01:13:14.005>you <01:13:14.355>start <01:13:14.705>encrypting <01:13:15.054>things,

1665
01:13:15.295 --> 01:13:17.775
<01:13:15.295>because <01:13:15.450>once <01:13:15.606>they're <01:13:15.761>encrypted, <01:13:15.917>uh, <01:13:16.072>it's <01:13:16.228>hard <01:13:16.383>to <01:13:16.539>roll <01:13:16.695>back.

1666
01:13:18.435 --> 01:13:21.935
<01:13:18.434>Uh, <01:13:18.562>so <01:13:18.689>watch <01:13:18.816>out <01:13:18.944>for <01:13:19.071>correct <01:13:19.198>design, <01:13:19.325>uh, <01:13:19.453>get <01:13:19.580>people <01:13:19.707>on <01:13:19.834>board

1667
01:13:21.935 --> 01:13:22.975
<01:13:21.934>to <01:13:22.169>know <01:13:22.403>what <01:13:22.637>they're <01:13:22.871>doing.

1668
01:13:23.595 --> 01:13:26.775
<01:13:23.595>Um, <01:13:23.875>and <01:13:24.155>yeah, <01:13:24.435>that's <01:13:24.715>basically <01:13:24.995>it.

1669
01:13:26.955 --> 01:13:29.055
<01:13:26.955>Use <01:13:27.155>the <01:13:27.355>correct <01:13:27.555>algorithms, <01:13:27.755>not <01:13:27.955>just <01:13:28.155>the <01:13:28.355>algorithm.

1670
01:13:29.165 --> 01:13:31.055
<01:13:29.165>Also, <01:13:29.445>the <01:13:29.725>mode <01:13:30.005>is <01:13:30.285>always <01:13:30.565>important.

1671
01:13:31.195 --> 01:13:34.375
<01:13:31.195>So <01:13:31.350>a <01:13:31.506>ES <01:13:31.661>can <01:13:31.817>be <01:13:31.972>used <01:13:32.128>in, <01:13:32.283>uh, <01:13:32.439>ECB <01:13:32.594>mode,

1672
01:13:34.375 --> 01:13:36.535
<01:13:34.375>which <01:13:34.608>is <01:13:34.841>not <01:13:35.075>good <01:13:35.308>for <01:13:35.541>most <01:13:35.775>situations.

1673
01:13:36.555 --> 01:13:39.495
<01:13:36.555>You <01:13:36.730>can <01:13:36.905>use <01:13:37.080>A <01:13:37.255>GCM <01:13:37.430>mode <01:13:37.605>guidewire <01:13:37.780>counter <01:13:37.955>mode,

1674
01:13:39.495 --> 01:13:41.575
<01:13:39.495>which <01:13:39.695>is <01:13:39.894>better <01:13:40.095>because <01:13:40.295>it, <01:13:40.495>uh, <01:13:40.695>it <01:13:40.894>has

1675
01:13:41.575 --> 01:13:43.015
<01:13:41.575>that <01:13:41.899>authentication <01:13:42.223>part <01:13:42.547>in <01:13:42.871>it.

1676
01:13:43.955 --> 01:13:46.175
<01:13:43.955>Um, <01:13:44.421>yes, <01:13:44.888>session <01:13:45.355>management

1677
01:13:47.165 --> 01:13:49.015
<01:13:47.165>rely <01:13:47.445>on <01:13:47.725>your <01:13:48.005>framework, <01:13:48.285>if <01:13:48.565>possible.

1678
01:13:49.355 --> 01:13:51.575
<01:13:49.355>If <01:13:49.471>you <01:13:49.588>do <01:13:49.705>session <01:13:49.821>management, <01:13:49.938>you <01:13:50.054>have <01:13:50.171>to <01:13:50.288>do <01:13:50.405>it <01:13:50.521>on <01:13:50.638>your <01:13:50.754>own.

1679
01:13:51.995 --> 01:13:54.615
<01:13:51.995>Uh, <01:13:52.150>make <01:13:52.306>sure <01:13:52.461>that <01:13:52.617>the <01:13:52.772>session <01:13:52.928>ID <01:13:53.083>is <01:13:53.239>non <01:13:53.394>guessable,

1680
01:13:54.615 --> 01:13:57.375
<01:13:54.615>so <01:13:54.790>it <01:13:54.965>has <01:13:55.139>good <01:13:55.315>randomness, <01:13:55.490>is <01:13:55.665>long <01:13:55.840>enough, <01:13:56.014>um,

1681
01:13:57.395 --> 01:14:00.735
<01:13:57.395>and <01:13:57.595>make <01:13:57.795>security <01:13:57.995>decisions <01:13:58.195>only <01:13:58.395>on <01:13:58.595>the <01:13:58.795>session.

1682
01:14:00.865 --> 01:14:02.935
<01:14:00.865>Never <01:14:01.144>directly <01:14:01.425>from <01:14:01.705>parameters <01:14:01.985>that <01:14:02.264>coming

1683
01:14:02.965 --> 01:14:05.015
<01:14:02.965>that <01:14:03.198>are <01:14:03.431>coming <01:14:03.665>from <01:14:03.898>the <01:14:04.131>client <01:14:04.365>except

1684
01:14:05.015 --> 01:14:07.415
<01:14:05.015>for <01:14:05.365>the <01:14:05.715>session <01:14:06.065>token <01:14:06.415>concurrency.

1685
01:14:07.795 --> 01:14:11.925
<01:14:07.795>Um, <01:14:07.970>we <01:14:08.145>had, <01:14:08.320>uh, <01:14:08.495>you <01:14:08.670>know, <01:14:08.845>two <01:14:09.020>situations, <01:14:09.195>one

1686
01:14:11.925 --> 01:14:13.725
<01:14:11.925>where <01:14:12.158>I <01:14:12.391>don't <01:14:12.625>think <01:14:12.858>it's <01:14:13.091>gonna <01:14:13.325>happen,

1687
01:14:13.785 --> 01:14:15.925
<01:14:13.785>but <01:14:13.985>I <01:14:14.184>still <01:14:14.385>have <01:14:14.585>to, <01:14:14.785>uh, <01:14:14.985>you <01:14:15.184>know,

1688
01:14:16.495 --> 01:14:19.205
<01:14:16.495>think <01:14:16.670>about <01:14:16.845>this <01:14:17.019>like <01:14:17.195>two <01:14:17.370>users <01:14:17.545>or <01:14:17.720>using <01:14:17.894>this

1689
01:14:19.205 --> 01:14:20.365
<01:14:19.205>or <01:14:19.466>editing <01:14:19.727>the <01:14:19.987>same <01:14:20.249>object.

1690
01:14:20.985 --> 01:14:24.645
<01:14:20.985>And <01:14:21.140>I <01:14:21.296>have <01:14:21.451>situations <01:14:21.607>where <01:14:21.762>it <01:14:21.918>will <01:14:22.073>happen, <01:14:22.229>uh, <01:14:22.384>frequently,

1691
01:14:24.745 --> 01:14:26.645
<01:14:24.745>and <01:14:24.945>I <01:14:25.144>have <01:14:25.345>to <01:14:25.545>think <01:14:25.745>about <01:14:25.945>this <01:14:26.144>separately.

1692
01:14:27.145 --> 01:14:29.965
<01:14:27.145>And <01:14:27.320>there <01:14:27.495>are <01:14:27.670>other, <01:14:27.845>uh, <01:14:28.020>solutions <01:14:28.195>like <01:14:28.370>for <01:14:28.545>example,

1693
01:14:30.265 --> 01:14:31.605
<01:14:30.265>uh, <01:14:30.868>resource <01:14:31.471>locking.

1694
01:14:31.685 --> 01:14:34.285
<01:14:31.684>I <01:14:31.792>can <01:14:31.900>do <01:14:32.008>role <01:14:32.115>level <01:14:32.223>locks. <01:14:32.331>I <01:14:32.438>can <01:14:32.546>do <01:14:32.654>file <01:14:32.761>locks <01:14:32.869>and <01:14:32.977>so <01:14:33.084>on.

1695
01:14:35.835 --> 01:14:38.295
<01:14:35.835>Um, <01:14:36.010>I <01:14:36.185>recently <01:14:36.360>coded, <01:14:36.535>for <01:14:36.710>example, <01:14:36.885>an <01:14:37.060>application <01:14:37.235>where

1696
01:14:39.005 --> 01:14:41.215
<01:14:39.005>file <01:14:39.205>chunks <01:14:39.405>could <01:14:39.605>be <01:14:39.805>uploaded <01:14:40.005>via <01:14:40.205>web <01:14:40.405>browser,

1697
01:14:41.395 --> 01:14:43.055
<01:14:41.395>and <01:14:41.628>they <01:14:41.861>could <01:14:42.095>come <01:14:42.328>out <01:14:42.561>of <01:14:42.795>order

1698
01:14:43.115 --> 01:14:45.535
<01:14:43.115>and <01:14:43.255>they <01:14:43.394>could <01:14:43.535>come <01:14:43.675>at <01:14:43.815>the <01:14:43.955>same <01:14:44.094>time <01:14:44.235>and <01:14:44.375>so <01:14:44.514>on.

1699
01:14:45.915 --> 01:14:47.335
<01:14:45.915>So <01:14:46.234>I <01:14:46.554>used <01:14:46.873>file <01:14:47.193>locking

1700
01:14:47.595 --> 01:14:50.335
<01:14:47.595>to <01:14:47.722>block <01:14:47.849>the <01:14:47.976>resource <01:14:48.104>while <01:14:48.231>I'm <01:14:48.358>writing <01:14:48.485>to <01:14:48.613>the <01:14:48.740>file <01:14:48.867>so <01:14:48.995>that,

1701
01:14:50.555 --> 01:14:52.695
<01:14:50.555>uh, <01:14:50.835>the <01:14:51.115>integrity <01:14:51.395>is <01:14:51.675>still <01:14:51.955>assured.

1702
01:14:52.715 --> 01:14:55.695
<01:14:52.715>So <01:14:52.855>that's <01:14:52.995>an <01:14:53.135>example <01:14:53.275>of <01:14:53.415>how <01:14:53.555>to <01:14:53.695>solve <01:14:53.835>a <01:14:53.975>concurrency <01:14:54.115>problem.

1703
01:14:58.255 --> 01:15:00.995
<01:14:58.255>All <01:14:58.721>right, <01:14:59.188>let's <01:14:59.655>breathe.

1704
01:15:02.485 --> 01:15:05.715
<01:15:02.485>Stand <01:15:02.718>up <01:15:02.951>and <01:15:03.184>move <01:15:03.418>a <01:15:03.651>little <01:15:03.884>bit

1705
01:15:05.855 --> 01:15:08.235
<01:15:05.855>and, <01:15:06.205>uh, <01:15:06.554>shake <01:15:06.905>your <01:15:07.254>arms

1706
01:15:08.335 --> 01:15:10.315
<01:15:08.335>and <01:15:08.535>your <01:15:08.735>legs <01:15:08.935>so <01:15:09.135>that <01:15:09.335>you <01:15:09.535>get <01:15:09.735>fresh.

1707
01:15:10.365 --> 01:15:12.435
<01:15:10.365>Again, <01:15:10.565>that <01:15:10.764>was <01:15:10.965>a <01:15:11.165>lot <01:15:11.365>of <01:15:11.565>contents <01:15:11.764>already.

1708
01:15:12.575 --> 01:15:17.195
<01:15:12.575>I'm <01:15:12.775>gonna <01:15:12.974>do <01:15:13.175>the <01:15:13.375>same. <01:15:13.575>Um, <01:15:13.775>so <01:15:13.974>one

1709
01:15:17.195 --> 01:15:20.035
<01:15:17.195>of <01:15:17.322>the <01:15:17.449>last <01:15:17.576>chapters <01:15:17.704>that <01:15:17.831>we're <01:15:17.958>gonna <01:15:18.085>go <01:15:18.213>into, <01:15:18.340>we <01:15:18.467>have <01:15:18.594>about

1710
01:15:20.655 --> 01:15:21.875
<01:15:20.655>25 <01:15:21.204>more <01:15:21.753>minutes,

1711
01:15:22.055 --> 01:15:24.075
<01:15:22.055>and <01:15:22.288>then, <01:15:22.521>uh, <01:15:22.755>I'm <01:15:22.988>ready <01:15:23.221>to <01:15:23.455>do,

1712
01:15:24.215 --> 01:15:27.315
<01:15:24.215>to <01:15:24.415>answer <01:15:24.615>questions <01:15:24.815>if <01:15:25.015>you <01:15:25.215>have <01:15:25.415>any, <01:15:25.615>um,

1713
01:15:27.735 --> 01:15:29.035
<01:15:27.735>common <01:15:28.320>vulnerability <01:15:28.905>classes.

1714
01:15:30.445 --> 01:15:32.065
<01:15:30.445>So <01:15:30.724>when <01:15:31.005>we <01:15:31.285>do <01:15:31.565>secure <01:15:31.844>coding

1715
01:15:32.205 --> 01:15:34.385
<01:15:32.205>and <01:15:32.438>you <01:15:32.671>apply <01:15:32.905>those <01:15:33.138>secure <01:15:33.371>coding <01:15:33.605>practices

1716
01:15:34.385 --> 01:15:36.545
<01:15:34.385>that <01:15:34.665>I <01:15:34.945>just <01:15:35.225>showed <01:15:35.505>you, <01:15:35.785>um,

1717
01:15:36.725 --> 01:15:39.305
<01:15:36.725>you're <01:15:36.958>gonna <01:15:37.191>be <01:15:37.425>writing <01:15:37.658>more <01:15:37.891>robust <01:15:38.125>code,

1718
01:15:39.405 --> 01:15:41.065
<01:15:39.405>but <01:15:39.605>there <01:15:39.804>are <01:15:40.005>gonna <01:15:40.205>be <01:15:40.405>some <01:15:40.605>vulnerability <01:15:40.804>classes

1719
01:15:41.065 --> 01:15:42.625
<01:15:41.065>that <01:15:41.345>you <01:15:41.625>have <01:15:41.905>to <01:15:42.185>understand <01:15:42.465>so

1720
01:15:42.625 --> 01:15:44.505
<01:15:42.625>that <01:15:42.905>you <01:15:43.185>can <01:15:43.465>avoid <01:15:43.745>them, <01:15:44.025>right?

1721
01:15:45.325 --> 01:15:47.265
<01:15:45.325>I'm <01:15:45.558>gonna <01:15:45.791>show <01:15:46.025>you <01:15:46.258>three <01:15:46.491>different <01:15:46.724>lists

1722
01:15:47.285 --> 01:15:49.945
<01:15:47.285>of <01:15:47.485>top <01:15:47.684>vulnerabilities <01:15:47.885>that <01:15:48.085>you <01:15:48.285>can <01:15:48.485>use <01:15:48.684>to,

1723
01:15:49.945 --> 01:15:51.025
<01:15:49.945>to <01:15:50.188>dive <01:15:50.431>into <01:15:50.674>this <01:15:50.916>topic.

1724
01:15:51.885 --> 01:15:55.865
<01:15:51.885>The, <01:15:51.992>the <01:15:52.100>best <01:15:52.208>known <01:15:52.315>one <01:15:52.423>is <01:15:52.531>the <01:15:52.638>OAS <01:15:52.746>Top <01:15:52.854>10 <01:15:52.961>OAS <01:15:53.069>being <01:15:53.177>the <01:15:53.285>Open

1725
01:15:55.885 --> 01:15:57.345
<01:15:55.885>Web <01:15:56.323>Application <01:15:56.761>Security <01:15:57.199>project.

1726
01:15:58.205 --> 01:16:01.345
<01:15:58.205>Um, <01:15:58.360>that's <01:15:58.516>an <01:15:58.671>open <01:15:58.827>source <01:15:58.982>project <01:15:59.138>with <01:15:59.293>lots <01:15:59.449>of <01:15:59.605>resources

1727
01:16:01.345 --> 01:16:03.105
<01:16:01.345>with <01:16:01.695>regards <01:16:02.045>to <01:16:02.395>application <01:16:02.745>security.

1728
01:16:03.805 --> 01:16:04.825
<01:16:03.805>It <01:16:04.034>has <01:16:04.264>the <01:16:04.493>top <01:16:04.723>10,

1729
01:16:04.825 --> 01:16:06.865
<01:16:04.825>which <01:16:05.058>is <01:16:05.291>the <01:16:05.525>most <01:16:05.758>used <01:16:05.991>resource, <01:16:06.224>probably.

1730
01:16:07.045 --> 01:16:09.865
<01:16:07.045>It <01:16:07.200>has <01:16:07.356>also <01:16:07.511>other <01:16:07.667>cool <01:16:07.822>things <01:16:07.978>like <01:16:08.133>the <01:16:08.289>application <01:16:08.445>security

1731
01:16:09.905 --> 01:16:14.745
<01:16:09.905>verification <01:16:10.080>standard, <01:16:10.255>A <01:16:10.429>SVS, <01:16:10.605>um, <01:16:10.780>that <01:16:10.955>can <01:16:11.130>be <01:16:11.304>used

1732
01:16:14.885 --> 01:16:16.905
<01:16:14.885>to <01:16:15.351>also <01:16:15.818>take <01:16:16.285>requirements

1733
01:16:16.905 --> 01:16:18.945
<01:16:16.905>and <01:16:17.184>do, <01:16:17.465>uh, <01:16:17.745>security <01:16:18.025>requirements <01:16:18.304>engineering.

1734
01:16:21.595 --> 01:16:24.975
<01:16:21.595>Um, <01:16:21.750>this <01:16:21.906>is <01:16:22.061>the <01:16:22.217>most <01:16:22.372>used <01:16:22.528>product <01:16:22.683>of <01:16:22.839>oas <01:16:22.995>probably.

1735
01:16:25.315 --> 01:16:28.335
<01:16:25.315>Um, <01:16:25.470>the <01:16:25.626>current <01:16:25.781>version <01:16:25.937>is <01:16:26.092>the <01:16:26.248>OAS <01:16:26.403>top <01:16:26.559>10, <01:16:26.715>2017.

1736
01:16:29.125 --> 01:16:30.295
<01:16:29.125>It's <01:16:29.476>the <01:16:29.827>most <01:16:30.178>widespread

1737
01:16:30.795 --> 01:16:33.815
<01:16:30.795>and <01:16:31.028>most <01:16:31.261>severe <01:16:31.495>vulnerabilities <01:16:31.728>in <01:16:31.961>web <01:16:32.195>applications.

1738
01:16:34.795 --> 01:16:37.575
<01:16:34.795>Um, <01:16:34.935>I <01:16:35.075>told <01:16:35.215>you <01:16:35.355>before <01:16:35.495>that <01:16:35.635>one <01:16:35.775>important <01:16:35.915>thing <01:16:36.055>is <01:16:36.195>injection

1739
01:16:37.715 --> 01:16:40.375
<01:16:37.715>and <01:16:37.855>I, <01:16:37.995>we <01:16:38.135>need <01:16:38.275>to <01:16:38.415>be <01:16:38.555>to <01:16:38.695>do <01:16:38.835>context <01:16:38.975>sensitive <01:16:39.115>output

1740
01:16:40.375 --> 01:16:42.175
<01:16:40.375>and <01:16:40.655>coding <01:16:40.935>or <01:16:41.215>prepared <01:16:41.495>statements <01:16:41.775>in

1741
01:16:42.175 --> 01:16:43.215
<01:16:42.175>order <01:16:42.409>to <01:16:42.643>avoid <01:16:42.877>this <01:16:43.111>problem.

1742
01:16:43.715 --> 01:16:45.295
<01:16:43.715>It <01:16:43.995>is <01:16:44.275>still <01:16:44.555>number <01:16:44.835>one <01:16:45.115>even

1743
01:16:45.295 --> 01:16:47.495
<01:16:45.295>after <01:16:45.470>so <01:16:45.645>many <01:16:45.820>years, <01:16:45.995>so <01:16:46.170>it's <01:16:46.345>still <01:16:46.520>a <01:16:46.695>very

1744
01:16:47.495 --> 01:16:48.895
<01:16:47.495>widespread <01:16:47.915>and <01:16:48.335>common <01:16:48.755>problem.

1745
01:16:49.995 --> 01:16:52.295
<01:16:49.995>Um, <01:16:50.195>one <01:16:50.394>important <01:16:50.595>thing <01:16:50.795>to <01:16:50.995>notice <01:16:51.195>here <01:16:51.394>is

1746
01:16:52.295 --> 01:16:54.735
<01:16:52.295>that <01:16:52.470>it's <01:16:52.645>not <01:16:52.820>a <01:16:52.995>flat <01:16:53.170>list <01:16:53.345>like <01:16:53.520>it <01:16:53.695>looks.

1747
01:16:54.845 --> 01:16:57.375
<01:16:54.845>It's <01:16:55.000>not <01:16:55.156>something <01:16:55.311>that <01:16:55.467>you <01:16:55.622>can <01:16:55.778>just <01:16:55.933>buy <01:16:56.089>a <01:16:56.245>tool

1748
01:16:57.395 --> 01:16:59.495
<01:16:57.395>and <01:16:57.535>throw <01:16:57.675>the <01:16:57.815>tool <01:16:57.955>on <01:16:58.095>it, <01:16:58.235>and <01:16:58.375>it's <01:16:58.515>gonna <01:16:58.655>scan <01:16:58.795>it

1749
01:16:59.495 --> 01:17:00.735
<01:16:59.495>and <01:16:59.681>it's <01:16:59.867>gonna <01:17:00.053>find <01:17:00.239>all <01:17:00.425>those <01:17:00.611>things.

1750
01:17:01.275 --> 01:17:02.775
<01:17:01.275>Uh, <01:17:01.467>we're <01:17:01.660>gonna <01:17:01.853>go <01:17:02.046>back <01:17:02.239>to <01:17:02.432>this <01:17:02.625>later.

1751
01:17:03.315 --> 01:17:04.735
<01:17:03.315>So <01:17:03.528>some <01:17:03.741>of <01:17:03.954>these <01:17:04.167>things, <01:17:04.380>for <01:17:04.593>example,

1752
01:17:04.795 --> 01:17:07.015
<01:17:04.795>broken <01:17:05.028>authentication <01:17:05.261>is <01:17:05.495>a <01:17:05.728>very <01:17:05.961>broad <01:17:06.195>topic.

1753
01:17:07.585 --> 01:17:09.290
<01:17:07.585>There <01:17:07.760>are <01:17:07.935>many, <01:17:08.110>many <01:17:08.285>things <01:17:08.460>that <01:17:08.635>can <01:17:08.810>go <01:17:08.985>wrong.

1754
01:17:09.985 --> 01:17:13.965
<01:17:09.985>Um, <01:17:10.160>can <01:17:10.335>have <01:17:10.509>an <01:17:10.684>application <01:17:10.860>that <01:17:11.035>permits <01:17:11.210>password <01:17:11.384>guessing.

1755
01:17:14.025 --> 01:17:17.685
<01:17:14.025>You <01:17:14.165>can <01:17:14.304>have <01:17:14.445>user <01:17:14.585>lockout, <01:17:14.724>uh, <01:17:14.865>you <01:17:15.004>can <01:17:15.144>have <01:17:15.285>user <01:17:15.424>ation,

1756
01:17:17.865 --> 01:17:20.125
<01:17:17.865>you <01:17:18.098>can <01:17:18.331>have <01:17:18.565>a <01:17:18.798>weak <01:17:19.031>password <01:17:19.264>policy.

1757
01:17:20.345 --> 01:17:23.605
<01:17:20.345>All <01:17:20.520>those <01:17:20.695>things <01:17:20.870>fall <01:17:21.045>into <01:17:21.220>this <01:17:21.395>category <01:17:21.570>here, <01:17:21.745>right?

1758
01:17:24.145 --> 01:17:26.645
<01:17:24.145>So <01:17:24.611>they <01:17:25.078>are <01:17:25.545>different.

1759
01:17:26.975 --> 01:17:29.365
<01:17:26.975>These <01:17:27.208>vulnerabilities <01:17:27.441>are, <01:17:27.675>some <01:17:27.908>are <01:17:28.141>very <01:17:28.375>specific

1760
01:17:29.425 --> 01:17:30.565
<01:17:29.425>to <01:17:29.938>one <01:17:30.451>technology,

1761
01:17:30.865 --> 01:17:32.325
<01:17:30.865>and <01:17:31.052>you <01:17:31.240>can <01:17:31.428>find <01:17:31.615>them <01:17:31.803>easily <01:17:31.991>in <01:17:32.179>an

1762
01:17:32.325 --> 01:17:33.365
<01:17:32.325>automated <01:17:32.637>way, <01:17:32.949>others <01:17:33.260>not.

1763
01:17:34.545 --> 01:17:37.725
<01:17:34.545>Now, <01:17:34.672>besides <01:17:34.799>the <01:17:34.926>OS <01:17:35.054>top <01:17:35.181>10, <01:17:35.308>which <01:17:35.435>are <01:17:35.563>very <01:17:35.690>well <01:17:35.817>known, <01:17:35.945>um,

1764
01:17:38.495 --> 01:17:41.805
<01:17:38.495>there <01:17:38.650>are, <01:17:38.806>there's <01:17:38.961>a <01:17:39.117>new <01:17:39.272>list <01:17:39.428>for <01:17:39.583>specifically <01:17:39.739>for <01:17:39.894>APIs.

1765
01:17:41.805 --> 01:17:44.005
<01:17:41.805>It's <01:17:42.005>called <01:17:42.205>the <01:17:42.405>OAS <01:17:42.605>API <01:17:42.805>security <01:17:43.005>top <01:17:43.205>10.

1766
01:17:44.985 --> 01:17:48.125
<01:17:44.985>And <01:17:45.140>yeah, <01:17:45.296>you <01:17:45.451>might <01:17:45.607>say, <01:17:45.762>well, <01:17:45.918>another <01:17:46.073>top <01:17:46.229>10 <01:17:46.384>list.

1767
01:17:48.195 --> 01:17:50.285
<01:17:48.195>Well, <01:17:48.350>I <01:17:48.506>think <01:17:48.661>the <01:17:48.817>good <01:17:48.972>thing <01:17:49.128>about <01:17:49.283>this <01:17:49.439>one <01:17:49.594>is

1768
01:17:50.285 --> 01:17:52.285
<01:17:50.285>that <01:17:50.565>it's <01:17:50.845>really <01:17:51.125>specific <01:17:51.405>to <01:17:51.684>APIs.

1769
01:17:52.285 --> 01:17:54.485
<01:17:52.285>There <01:17:52.425>are <01:17:52.565>things <01:17:52.705>in <01:17:52.845>there <01:17:52.985>that <01:17:53.125>are <01:17:53.264>relevant <01:17:53.405>for <01:17:53.545>APIs <01:17:53.684>only,

1770
01:17:54.505 --> 01:17:56.845
<01:17:54.505>and <01:17:54.645>that <01:17:54.785>there <01:17:54.925>are <01:17:55.065>things <01:17:55.205>in <01:17:55.345>there <01:17:55.485>that <01:17:55.625>are <01:17:55.765>not <01:17:55.905>relevant.

1771
01:17:57.585 --> 01:18:00.085
<01:17:57.585>Uh, <01:17:57.760>they <01:17:57.935>took <01:17:58.110>them <01:17:58.285>out <01:17:58.460>of <01:17:58.635>the <01:17:58.810>top <01:17:58.985>10.

1772
01:18:00.355 --> 01:18:02.925
<01:18:00.355>What <01:18:00.588>one <01:18:00.821>example <01:18:01.054>is <01:18:01.288>cross <01:18:01.521>side <01:18:01.754>scripting.

1773
01:18:03.185 --> 01:18:06.125
<01:18:03.184>We <01:18:03.360>have <01:18:03.535>here, <01:18:03.709>A <01:18:03.884>seven <01:18:04.059>is <01:18:04.235>not <01:18:04.410>in <01:18:04.584>here

1774
01:18:06.125 --> 01:18:09.325
<01:18:06.125>because <01:18:06.300>the <01:18:06.475>API <01:18:06.650>is <01:18:06.825>not <01:18:07.000>responsible <01:18:07.175>for <01:18:07.350>rendering <01:18:07.525>HML.

1775
01:18:09.325 --> 01:18:13.805
<01:18:09.325>Usually <01:18:09.558>it's, <01:18:09.791>uh, <01:18:10.025>responsible <01:18:10.258>for <01:18:10.491>taking <01:18:10.724>input

1776
01:18:13.945 --> 01:18:15.405
<01:18:13.945>and <01:18:14.383>giving <01:18:14.821>out <01:18:15.259>data.

1777
01:18:16.465 --> 01:18:19.205
<01:18:16.465>Uh, <01:18:16.605>there <01:18:16.745>are <01:18:16.885>a <01:18:17.025>few, <01:18:17.165>uh, <01:18:17.305>very <01:18:17.445>cool <01:18:17.585>things <01:18:17.725>in <01:18:17.865>there

1778
01:18:19.205 --> 01:18:21.685
<01:18:19.205>that <01:18:19.405>are <01:18:19.605>really <01:18:19.805>common <01:18:20.005>also <01:18:20.205>in <01:18:20.405>API <01:18:20.605>security.

1779
01:18:21.805 --> 01:18:24.805
<01:18:21.805>I <01:18:21.960>know <01:18:22.116>it <01:18:22.271>because <01:18:22.427>I'm <01:18:22.582>pentest <01:18:22.738>those <01:18:22.893>APIs <01:18:23.049>many <01:18:23.205>times

1780
01:18:24.985 --> 01:18:26.325
<01:18:24.985>and <01:18:25.286>I <01:18:25.588>see <01:18:25.889>those <01:18:26.191>vulnerabilities.

1781
01:18:26.325 --> 01:18:30.045
<01:18:26.325>Really <01:18:26.441>excessive <01:18:26.558>data <01:18:26.675>exposure <01:18:26.791>is <01:18:26.908>a <01:18:27.025>new <01:18:27.141>one <01:18:27.258>on <01:18:27.375>a <01:18:27.491>new <01:18:27.608>kit <01:18:27.724>on

1782
01:18:30.045 --> 01:18:33.415
<01:18:30.045>the <01:18:30.172>block <01:18:30.299>that <01:18:30.426>says <01:18:30.554>that <01:18:30.681>if <01:18:30.808>you <01:18:30.935>return <01:18:31.063>a <01:18:31.190>chase <01:18:31.317>in <01:18:31.445>response,

1783
01:18:33.415 --> 01:18:35.255
<01:18:33.415>for <01:18:33.695>example, <01:18:33.975>you're <01:18:34.255>getting, <01:18:34.535>you're <01:18:34.815>searching

1784
01:18:35.255 --> 01:18:37.935
<01:18:35.255>for <01:18:35.455>other <01:18:35.655>users <01:18:35.855>in <01:18:36.055>the <01:18:36.255>system <01:18:36.455>and, <01:18:36.655>uh,

1785
01:18:37.935 --> 01:18:39.175
<01:18:37.934>because <01:18:38.094>you <01:18:38.253>want <01:18:38.413>to <01:18:38.572>send <01:18:38.732>them <01:18:38.891>a <01:18:39.051>message

1786
01:18:39.875 --> 01:18:43.235
<01:18:39.875>and <01:18:40.050>you <01:18:40.225>don't <01:18:40.400>just <01:18:40.575>go <01:18:40.750>get <01:18:40.925>back <01:18:41.100>their <01:18:41.275>name

1787
01:18:43.235 --> 01:18:45.235
<01:18:43.235>and <01:18:43.390>email <01:18:43.546>address, <01:18:43.701>which <01:18:43.857>is <01:18:44.012>all <01:18:44.168>you <01:18:44.323>need <01:18:44.479>to <01:18:44.634>know,

1788
01:18:45.615 --> 01:18:47.475
<01:18:45.615>but <01:18:45.815>you're <01:18:46.014>also <01:18:46.215>getting <01:18:46.415>back <01:18:46.615>their <01:18:46.815>password <01:18:47.014>hash,

1789
01:18:47.495 --> 01:18:49.755
<01:18:47.495>for <01:18:47.775>example, <01:18:48.055>because <01:18:48.335>the <01:18:48.615>database <01:18:48.894>table

1790
01:18:49.895 --> 01:18:52.795
<01:18:49.895>or <01:18:50.022>the <01:18:50.149>all <01:18:50.276>the <01:18:50.404>columns <01:18:50.531>are <01:18:50.658>just <01:18:50.785>taken <01:18:50.913>all, <01:18:51.040>all <01:18:51.167>of <01:18:51.295>them,

1791
01:18:53.615 --> 01:18:54.795
<01:18:53.615>you <01:18:53.827>render <01:18:54.039>them <01:18:54.252>as <01:18:54.464>chase <01:18:54.677>'em,

1792
01:18:54.795 --> 01:18:55.875
<01:18:54.795>and <01:18:54.933>you <01:18:55.072>put <01:18:55.211>them <01:18:55.350>out <01:18:55.489>of <01:18:55.628>the <01:18:55.767>API.

1793
01:18:56.615 --> 01:18:59.555
<01:18:56.615>Um, <01:18:56.731>so, <01:18:56.848>uh, <01:18:56.965>if <01:18:57.081>you <01:18:57.198>think <01:18:57.315>you <01:18:57.431>have <01:18:57.548>that <01:18:57.665>in <01:18:57.781>your <01:18:57.898>code <01:18:58.014>base,

1794
01:18:59.735 --> 01:19:00.995
<01:18:59.735>uh, <01:18:59.924>go <01:19:00.112>and <01:19:00.302>look <01:19:00.491>for <01:19:00.679>it <01:19:00.869>now

1795
01:19:01.015 --> 01:19:02.675
<01:19:01.015>and <01:19:01.365>use <01:19:01.715>data <01:19:02.065>transfer <01:19:02.415>objects

1796
01:19:02.695 --> 01:19:04.195
<01:19:02.695>to <01:19:02.965>save <01:19:03.235>yourself <01:19:03.505>against <01:19:03.775>this <01:19:04.045>problem.

1797
01:19:04.735 --> 01:19:06.675
<01:19:04.735>The <01:19:04.934>same, <01:19:05.134>uh, <01:19:05.335>goes <01:19:05.535>for <01:19:05.735>the <01:19:05.934>other <01:19:06.134>way.

1798
01:19:06.735 --> 01:19:10.875
<01:19:06.735>So <01:19:06.890>I <01:19:07.046>had <01:19:07.201>registration <01:19:07.357>forms <01:19:07.512>that <01:19:07.668>took <01:19:07.823>a <01:19:07.979>role <01:19:08.134>parameter,

1799
01:19:10.875 --> 01:19:12.515
<01:19:10.875>and <01:19:11.108>I <01:19:11.341>could <01:19:11.575>just <01:19:11.808>say <01:19:12.041>role <01:19:12.275>admin,

1800
01:19:12.515 --> 01:19:14.715
<01:19:12.515>and <01:19:12.715>I <01:19:12.915>was <01:19:13.115>admin <01:19:13.315>administrator <01:19:13.515>in <01:19:13.715>that <01:19:13.915>application.

1801
01:19:15.615 --> 01:19:16.955
<01:19:15.615>Uh, <01:19:15.816>so <01:19:16.017>that's <01:19:16.218>a <01:19:16.419>very <01:19:16.620>common <01:19:16.821>problem,

1802
01:19:17.095 --> 01:19:18.315
<01:19:17.095>and <01:19:17.369>it's <01:19:17.644>called <01:19:17.918>mass <01:19:18.193>assignment.

1803
01:19:20.055 --> 01:19:23.475
<01:19:20.055>Um, <01:19:20.210>so <01:19:20.366>I <01:19:20.521>really <01:19:20.677>suggest <01:19:20.832>if <01:19:20.988>you're <01:19:21.143>an <01:19:21.299>API <01:19:21.455>developer

1804
01:19:23.775 --> 01:19:25.235
<01:19:23.775>to <01:19:23.994>look <01:19:24.213>into <01:19:24.432>this <01:19:24.651>list <01:19:24.870>as <01:19:25.089>well,

1805
01:19:25.235 --> 01:19:28.235
<01:19:25.235>because <01:19:25.390>the, <01:19:25.546>the <01:19:25.701>ones <01:19:25.857>in <01:19:26.012>bold <01:19:26.168>here <01:19:26.323>are <01:19:26.479>the <01:19:26.634>ones

1806
01:19:28.235 --> 01:19:29.675
<01:19:28.235>that <01:19:28.451>are <01:19:28.666>not <01:19:28.883>in <01:19:29.099>the <01:19:29.315>classic <01:19:29.531>OS

1807
01:19:29.675 --> 01:19:30.795
<01:19:29.675>top <01:19:29.876>10, <01:19:30.078>but <01:19:30.279>are <01:19:30.481>very <01:19:30.683>frequent.

1808
01:19:30.945 --> 01:19:34.875
<01:19:30.945>Also, <01:19:31.120>this <01:19:31.295>is, <01:19:31.469>this <01:19:31.644>the <01:19:31.820>sounds <01:19:31.995>CW <01:19:32.170>top <01:19:32.344>25.

1809
01:19:35.065 --> 01:19:39.795
<01:19:35.065>It's <01:19:35.265>a, <01:19:35.465>uh, <01:19:35.665>also <01:19:35.865>the <01:19:36.065>25 <01:19:36.265>most <01:19:36.465>widespread

1810
01:19:39.795 --> 01:19:42.195
<01:19:39.795>and <01:19:40.145>severe <01:19:40.495>software <01:19:40.845>security <01:19:41.195>vulnerabilities,

1811
01:19:42.295 --> 01:19:45.995
<01:19:42.295>but <01:19:42.450>not <01:19:42.606>just <01:19:42.761>web <01:19:42.917>applications, <01:19:43.072>but <01:19:43.228>all <01:19:43.383>types <01:19:43.539>of <01:19:43.695>software.

1812
01:19:46.775 --> 01:19:49.595
<01:19:46.775>Um, <01:19:46.974>they <01:19:47.174>have <01:19:47.375>an <01:19:47.575>evidence-based <01:19:47.775>list, <01:19:47.974>you <01:19:48.174>know,

1813
01:19:49.655 --> 01:19:52.195
<01:19:49.655>all <01:19:49.855>the <01:19:50.054>CVEs, <01:19:50.255>all <01:19:50.455>the <01:19:50.655>publicly <01:19:50.855>known <01:19:51.054>vulnerabilities.

1814
01:19:52.225 --> 01:19:55.435
<01:19:52.225>They, <01:19:52.352>they <01:19:52.479>take <01:19:52.606>them <01:19:52.734>out <01:19:52.861>of <01:19:52.988>a <01:19:53.115>database, <01:19:53.243>they <01:19:53.370>give <01:19:53.497>it, <01:19:53.625>uh,

1815
01:19:55.505 --> 01:19:57.755
<01:19:55.505>give <01:19:55.785>each <01:19:56.065>vulnerability <01:19:56.345>type <01:19:56.625>of <01:19:56.905>score,

1816
01:19:57.975 --> 01:20:00.475
<01:19:57.975>and <01:19:58.150>they, <01:19:58.325>it <01:19:58.500>sums <01:19:58.675>up <01:19:58.850>how <01:19:59.025>often <01:19:59.200>it <01:19:59.375>occurred

1817
01:20:01.015 --> 01:20:02.675
<01:20:01.015>and <01:20:01.295>the <01:20:01.575>severity <01:20:01.855>level <01:20:02.135>it <01:20:02.415>had.

1818
01:20:03.475 --> 01:20:05.655
<01:20:03.475>So <01:20:03.708>if <01:20:03.941>you <01:20:04.175>are <01:20:04.408>not <01:20:04.641>a <01:20:04.875>replication

1819
01:20:05.655 --> 01:20:07.445
<01:20:05.655>developer, <01:20:05.934>this <01:20:06.215>might <01:20:06.495>be <01:20:06.775>a <01:20:07.054>list.

1820
01:20:07.685 --> 01:20:09.245
<01:20:07.684>Although <01:20:07.964>there <01:20:08.245>are <01:20:08.525>web <01:20:08.804>application <01:20:09.084>specific

1821
01:20:09.245 --> 01:20:10.405
<01:20:09.245>things <01:20:09.593>also <01:20:09.941>in <01:20:10.289>here.

1822
01:20:11.945 --> 01:20:14.245
<01:20:11.945>Now, <01:20:12.100>I <01:20:12.256>combine <01:20:12.411>the <01:20:12.567>list <01:20:12.722>of <01:20:12.878>the <01:20:13.033>OS <01:20:13.189>top <01:20:13.344>10

1823
01:20:14.245 --> 01:20:16.005
<01:20:14.245>and <01:20:14.478>the <01:20:14.711>OS <01:20:14.945>VPI <01:20:15.178>security <01:20:15.411>top <01:20:15.644>10.

1824
01:20:16.385 --> 01:20:20.165
<01:20:16.385>And <01:20:16.501>if <01:20:16.618>you <01:20:16.735>look <01:20:16.851>at <01:20:16.968>how <01:20:17.085>well <01:20:17.201>they <01:20:17.318>can <01:20:17.435>be <01:20:17.551>tested <01:20:17.668>in <01:20:17.785>a

1825
01:20:20.165 --> 01:20:23.685
<01:20:20.165>completely <01:20:20.398>ultimate <01:20:20.631>way, <01:20:20.865>uh, <01:20:21.098>it's <01:20:21.331>only <01:20:21.565>those

1826
01:20:23.685 --> 01:20:25.925
<01:20:23.684>that <01:20:23.884>are <01:20:24.084>green, <01:20:24.285>and <01:20:24.485>it's <01:20:24.684>not <01:20:24.884>a <01:20:25.084>lot.

1827
01:20:26.865 --> 01:20:30.805
<01:20:26.865>So <01:20:26.981>if <01:20:27.098>a <01:20:27.215>vendor <01:20:27.331>tells <01:20:27.448>you <01:20:27.565>that <01:20:27.681>we <01:20:27.798>covered <01:20:27.915>the <01:20:28.031>OS <01:20:28.148>top <01:20:28.264>10,

1828
01:20:31.195 --> 01:20:33.165
<01:20:31.195>they <01:20:31.545>are <01:20:31.894>either <01:20:32.245>intentionally <01:20:32.594>lying

1829
01:20:33.705 --> 01:20:35.005
<01:20:33.705>or <01:20:33.900>they <01:20:34.095>don't <01:20:34.290>know <01:20:34.485>their <01:20:34.680>own <01:20:34.875>product,

1830
01:20:35.185 --> 01:20:37.365
<01:20:35.184>or <01:20:35.360>they <01:20:35.535>just <01:20:35.709>have <01:20:35.884>no <01:20:36.059>idea <01:20:36.235>about, <01:20:36.410>you <01:20:36.584>know,

1831
01:20:37.365 --> 01:20:38.565
<01:20:37.365>it's <01:20:37.725>just <01:20:38.085>salespeople <01:20:38.445>maybe.

1832
01:20:39.145 --> 01:20:41.045
<01:20:39.145>Um, <01:20:39.378>so <01:20:39.611>they're <01:20:39.845>probably <01:20:40.078>not <01:20:40.311>covering <01:20:40.545>them

1833
01:20:41.045 --> 01:20:43.005
<01:20:41.045>because <01:20:41.278>they're <01:20:41.511>so <01:20:41.745>different <01:20:41.978>in <01:20:42.211>their <01:20:42.445>nature

1834
01:20:43.555 --> 01:20:46.325
<01:20:43.555>that <01:20:43.710>they're <01:20:43.866>probably <01:20:44.021>not <01:20:44.177>be <01:20:44.332>able <01:20:44.488>to, <01:20:44.643>to <01:20:44.799>cover <01:20:44.955>everything.

1835
01:20:46.865 --> 01:20:49.045
<01:20:46.865>So <01:20:47.065>maybe <01:20:47.264>specific <01:20:47.465>aspects <01:20:47.665>of <01:20:47.865>each <01:20:48.065>of <01:20:48.264>those.

1836
01:20:49.425 --> 01:20:54.285
<01:20:49.425>That's <01:20:49.600>my <01:20:49.775>daughter, <01:20:49.950>I'm <01:20:50.125>sorry, <01:20:50.300>um, <01:20:50.475>maybe <01:20:50.650>specific <01:20:50.825>aspects

1837
01:20:54.305 --> 01:20:57.405
<01:20:54.305>of <01:20:54.460>each <01:20:54.616>of <01:20:54.771>those, <01:20:54.927>but <01:20:55.082>even <01:20:55.238>that <01:20:55.393>is <01:20:55.549>very <01:20:55.705>optimistic.

1838
01:20:57.545 --> 01:21:00.405
<01:20:57.545>So <01:20:57.700>be <01:20:57.856>aware <01:20:58.011>of <01:20:58.167>that <01:20:58.322>potential <01:20:58.478>false <01:20:58.633>sense <01:20:58.789>of <01:20:58.945>security

1839
01:21:00.435 --> 01:21:01.525
<01:21:00.434>that <01:21:00.762>this <01:21:01.089>gives <01:21:01.415>you.

1840
01:21:02.265 --> 01:21:05.405
<01:21:02.265>You <01:21:02.392>will <01:21:02.519>not <01:21:02.646>be <01:21:02.774>able <01:21:02.901>to <01:21:03.028>just <01:21:03.155>take <01:21:03.283>a, <01:21:03.410>an <01:21:03.537>expensive <01:21:03.665>piece

1841
01:21:05.405 --> 01:21:08.485
<01:21:05.405>of <01:21:05.545>software, <01:21:05.684>be <01:21:05.825>it <01:21:05.965>the <01:21:06.105>best <01:21:06.245>vendor <01:21:06.384>in <01:21:06.525>the, <01:21:06.665>you <01:21:06.804>know,

1842
01:21:08.485 --> 01:21:11.405
<01:21:08.485>the <01:21:08.718>Gartner <01:21:08.951>thing <01:21:09.184>on <01:21:09.418>the <01:21:09.651>top <01:21:09.884>right.

1843
01:21:12.215 --> 01:21:13.965
<01:21:12.215>Throw <01:21:12.448>a <01:21:12.681>hundred <01:21:12.915>thousand <01:21:13.148>dollars <01:21:13.381>at <01:21:13.615>them

1844
01:21:13.965 --> 01:21:15.845
<01:21:13.965>and <01:21:14.105>then <01:21:14.245>take <01:21:14.385>the <01:21:14.525>tool <01:21:14.665>and <01:21:14.805>you, <01:21:14.945>you <01:21:15.085>will <01:21:15.225>be <01:21:15.365>secure.

1845
01:21:15.845 --> 01:21:17.005
<01:21:15.845>That's <01:21:16.053>not <01:21:16.262>gonna <01:21:16.471>work <01:21:16.680>that <01:21:16.889>way.

1846
01:21:17.445 --> 01:21:19.925
<01:21:17.445>I, <01:21:17.585>I <01:21:17.724>can <01:21:17.865>tell <01:21:18.005>you <01:21:18.144>out <01:21:18.285>of <01:21:18.424>experience, <01:21:18.565>it <01:21:18.705>is <01:21:18.844>not.

1847
01:21:22.385 --> 01:21:24.605
<01:21:22.385>Um, <01:21:22.618>so <01:21:22.851>steps <01:21:23.085>towards <01:21:23.318>more <01:21:23.551>targeted <01:21:23.785>protection.

1848
01:21:24.605 --> 01:21:26.685
<01:21:24.605>So <01:21:24.760>if <01:21:24.916>you <01:21:25.071>want <01:21:25.227>to <01:21:25.382>be <01:21:25.538>aware <01:21:25.693>of <01:21:25.849>those <01:21:26.004>things

1849
01:21:26.825 --> 01:21:27.925
<01:21:26.825>and <01:21:27.155>say, <01:21:27.485>I'm <01:21:27.815>gonna,

1850
01:21:28.155 --> 01:21:30.205
<01:21:28.155>what <01:21:28.355>am <01:21:28.554>I <01:21:28.755>gonna <01:21:28.955>do <01:21:29.155>against <01:21:29.355>these <01:21:29.554>vulnerabilities?

1851
01:21:30.345 --> 01:21:31.805
<01:21:30.345>Are <01:21:30.607>those <01:21:30.870>even <01:21:31.133>relevant <01:21:31.396>for <01:21:31.659>me?

1852
01:21:32.585 --> 01:21:35.405
<01:21:32.585>Um, <01:21:32.740>for <01:21:32.896>each <01:21:33.051>vulnerability <01:21:33.207>class, <01:21:33.362>take <01:21:33.518>a <01:21:33.673>top <01:21:33.829>10 <01:21:33.985>list

1853
01:21:35.405 --> 01:21:39.125
<01:21:35.405>or <01:21:35.684>take <01:21:35.965>whatever, <01:21:36.245>um, <01:21:36.525>assess <01:21:36.804>how,

1854
01:21:39.125 --> 01:21:41.405
<01:21:39.125>if <01:21:39.265>at <01:21:39.405>all <01:21:39.545>the <01:21:39.685>technology <01:21:39.825>is <01:21:39.965>gonna <01:21:40.105>help <01:21:40.245>me <01:21:40.385>against <01:21:40.525>them.

1855
01:21:42.065 --> 01:21:44.685
<01:21:42.065>If <01:21:42.240>you <01:21:42.415>take <01:21:42.590>cross <01:21:42.765>scripting <01:21:42.940>as <01:21:43.115>an <01:21:43.290>example, <01:21:43.465>um,

1856
01:21:45.205 --> 01:21:47.245
<01:21:45.205>angular <01:21:45.438>has <01:21:45.671>very <01:21:45.905>good <01:21:46.138>pro <01:21:46.371>automatic <01:21:46.605>protection.

1857
01:21:47.355 --> 01:21:50.285
<01:21:47.355>Also <01:21:47.482>react <01:21:47.609>most <01:21:47.736>of <01:21:47.864>the <01:21:47.991>time <01:21:48.118>also <01:21:48.245>UJS <01:21:48.373>most <01:21:48.500>of <01:21:48.627>the <01:21:48.754>time.

1858
01:21:50.345 --> 01:21:52.645
<01:21:50.345>But <01:21:50.500>there <01:21:50.656>are <01:21:50.811>ways <01:21:50.967>you <01:21:51.122>can <01:21:51.278>screw <01:21:51.433>up, <01:21:51.589>for <01:21:51.745>example,

1859
01:21:52.655 --> 01:21:55.605
<01:21:52.655>using <01:21:52.888>in <01:21:53.121>React <01:21:53.355>dangerously <01:21:53.588>set <01:21:53.821>in <01:21:54.054>HML

1860
01:21:55.605 --> 01:21:58.245
<01:21:55.605>or <01:21:55.838>in <01:21:56.071>angular <01:21:56.304>bypass <01:21:56.538>security <01:21:56.771>trust, <01:21:57.004>HML,

1861
01:21:58.585 --> 01:21:59.685
<01:21:58.585>that's <01:21:58.783>where <01:21:58.981>it <01:21:59.179>could <01:21:59.376>go <01:21:59.575>wrong.

1862
01:21:59.825 --> 01:22:03.925
<01:21:59.825>So <01:21:59.980>how, <01:22:00.136>if <01:22:00.291>at <01:22:00.447>all, <01:22:00.602>it <01:22:00.758>could <01:22:00.913>go <01:22:01.069>wrong, <01:22:01.224>um,

1863
01:22:04.375 --> 01:22:05.965
<01:22:04.375>which <01:22:04.608>is <01:22:04.841>the <01:22:05.075>best <01:22:05.308>place <01:22:05.541>of <01:22:05.775>mitigation?

1864
01:22:06.065 --> 01:22:08.485
<01:22:06.065>It <01:22:06.205>could <01:22:06.345>be <01:22:06.485>a <01:22:06.625>linter, <01:22:06.765>it <01:22:06.905>could <01:22:07.045>be <01:22:07.185>a <01:22:07.325>scan <01:22:07.465>tool,

1865
01:22:08.545 --> 01:22:11.565
<01:22:08.545>it <01:22:08.720>could <01:22:08.895>be <01:22:09.070>coding <01:22:09.245>guidelines, <01:22:09.420>it <01:22:09.595>could <01:22:09.770>be, <01:22:09.945>uh,

1866
01:22:11.565 --> 01:22:12.645
<01:22:11.565>something <01:22:11.808>on <01:22:12.051>the <01:22:12.294>process <01:22:12.537>level.

1867
01:22:12.645 --> 01:22:13.845
<01:22:12.645>It <01:22:12.861>could <01:22:13.077>be <01:22:13.293>anything, <01:22:13.509>but <01:22:13.725>it,

1868
01:22:13.845 --> 01:22:15.685
<01:22:13.845>it's <01:22:14.125>not <01:22:14.405>always <01:22:14.685>the <01:22:14.965>same <01:22:15.245>layer.

1869
01:22:15.835 --> 01:22:19.365
<01:22:15.835>It's <01:22:15.990>not <01:22:16.146>because <01:22:16.301>something <01:22:16.457>is <01:22:16.612>in, <01:22:16.768>it <01:22:16.923>could <01:22:17.079>be, <01:22:17.235>uh,

1870
01:22:19.365 --> 01:22:22.165
<01:22:19.365>threat <01:22:19.520>modeling <01:22:19.676>and <01:22:19.831>then <01:22:19.987>changing <01:22:20.142>something <01:22:20.298>in <01:22:20.453>a <01:22:20.609>design, <01:22:20.764>uh,

1871
01:22:22.405 --> 01:22:23.405
<01:22:22.405>documentation <01:22:22.705>of <01:22:23.005>my <01:22:23.304>software.

1872
01:22:23.865 --> 01:22:25.245
<01:22:23.865>So <01:22:24.175>it's <01:22:24.486>not <01:22:24.796>always <01:22:25.107>code.

1873
01:22:26.025 --> 01:22:28.125
<01:22:26.025>If <01:22:26.258>I <01:22:26.491>think, <01:22:26.724>uh, <01:22:26.958>about <01:22:27.191>the, <01:22:27.424>um,

1874
01:22:28.425 --> 01:22:31.085
<01:22:28.425>broken <01:22:28.625>authentication <01:22:28.825>vulnerability <01:22:29.025>in <01:22:29.225>the <01:22:29.425>top <01:22:29.625>10 <01:22:29.825>list,

1875
01:22:32.065 --> 01:22:35.565
<01:22:32.065>it <01:22:32.240>could <01:22:32.415>be, <01:22:32.590>you <01:22:32.765>know, <01:22:32.940>missing <01:22:33.115>protection <01:22:33.290>against <01:22:33.465>password,

1876
01:22:35.685 --> 01:22:37.005
<01:22:35.684>guessing <01:22:35.883>that's <01:22:36.081>not <01:22:36.279>on <01:22:36.477>the <01:22:36.675>coding <01:22:36.873>level.

1877
01:22:37.005 --> 01:22:39.725
<01:22:37.005>That's, <01:22:37.160>I <01:22:37.316>I <01:22:37.471>have <01:22:37.627>to <01:22:37.782>design <01:22:37.938>that <01:22:38.093>into <01:22:38.249>my <01:22:38.405>application.

1878
01:22:39.725 --> 01:22:43.845
<01:22:39.725>So <01:22:39.880>that's <01:22:40.036>design <01:22:40.191>level, <01:22:40.347>um, <01:22:40.502>which <01:22:40.658>is <01:22:40.813>the <01:22:40.969>best <01:22:41.125>place

1879
01:22:43.865 --> 01:22:44.965
<01:22:43.865>for <01:22:44.360>quality <01:22:44.855>assurance.

1880
01:22:45.145 --> 01:22:46.645
<01:22:45.145>So <01:22:45.482>maybe <01:22:45.820>some <01:22:46.157>automated <01:22:46.495>tool

1881
01:22:46.645 --> 01:22:48.125
<01:22:46.645>that <01:22:46.835>checks <01:22:47.025>whether <01:22:47.215>that <01:22:47.406>is <01:22:47.596>really <01:22:47.786>the <01:22:47.977>case.

1882
01:22:48.785 --> 01:22:51.445
<01:22:48.785>Um, <01:22:48.985>in <01:22:49.184>the <01:22:49.385>case <01:22:49.585>of, <01:22:49.785>uh, <01:22:49.985>cross <01:22:50.184>scripting

1883
01:22:51.445 --> 01:22:54.045
<01:22:51.445>and <01:22:51.620>react, <01:22:51.795>that <01:22:51.969>could <01:22:52.144>be <01:22:52.320>searching <01:22:52.495>the <01:22:52.670>code <01:22:52.844>base

1884
01:22:54.045 --> 01:22:55.565
<01:22:54.045>for <01:22:54.273>dangerously <01:22:54.501>said <01:22:54.729>in <01:22:54.957>your <01:22:55.185>HTM <01:22:55.413>L

1885
01:22:55.565 --> 01:22:57.285
<01:22:55.565>and <01:22:55.798>then <01:22:56.031>flagging <01:22:56.265>that <01:22:56.498>if <01:22:56.731>that <01:22:56.965>happens.

1886
01:22:58.345 --> 01:23:00.725
<01:22:58.345>Um, <01:22:58.545>what <01:22:58.745>defense <01:22:58.945>in <01:22:59.145>depth <01:22:59.345>is <01:22:59.545>available <01:22:59.745>in

1887
01:23:00.745 --> 01:23:02.005
<01:23:00.745>use <01:23:01.123>for <01:23:01.501>cross <01:23:01.879>encrypting.

1888
01:23:02.005 --> 01:23:04.005
<01:23:02.005>That <01:23:02.180>could <01:23:02.355>be <01:23:02.530>a <01:23:02.705>content <01:23:02.880>security <01:23:03.055>policy, <01:23:03.230>for <01:23:03.405>example.

1889
01:23:04.705 --> 01:23:06.365
<01:23:04.705>Uh, <01:23:04.985>what <01:23:05.265>residual <01:23:05.545>risk <01:23:05.825>is <01:23:06.105>there?

1890
01:23:06.395 --> 01:23:09.245
<01:23:06.395>Well, <01:23:06.570>people <01:23:06.745>could <01:23:06.920>just, <01:23:07.095>you <01:23:07.270>know, <01:23:07.445>uh, <01:23:07.620>make <01:23:07.795>exceptions

1891
01:23:09.245 --> 01:23:10.365
<01:23:09.245>with <01:23:09.446>the <01:23:09.648>tools <01:23:09.849>and <01:23:10.051>the <01:23:10.253>code

1892
01:23:10.365 --> 01:23:11.965
<01:23:10.365>and <01:23:10.598>say, <01:23:10.831>this <01:23:11.065>is <01:23:11.298>not <01:23:11.531>relevant <01:23:11.764>finding,

1893
01:23:12.765 --> 01:23:14.885
<01:23:12.765>although <01:23:12.940>it <01:23:13.115>actually <01:23:13.290>is <01:23:13.465>a <01:23:13.640>relevant <01:23:13.815>finding <01:23:13.990>that <01:23:14.165>this,

1894
01:23:14.885 --> 01:23:16.205
<01:23:14.885>there's <01:23:15.281>a <01:23:15.677>residual <01:23:16.073>risk.

1895
01:23:17.225 --> 01:23:19.565
<01:23:17.225>And <01:23:17.425>also <01:23:17.625>how <01:23:17.825>that <01:23:18.025>vulnerability <01:23:18.225>class <01:23:18.425>relates <01:23:18.625>to

1896
01:23:20.125 --> 01:23:22.845
<01:23:20.125>documentation, <01:23:20.475>standards, <01:23:20.825>guidelines, <01:23:21.175>requirements, <01:23:21.525>anything

1897
01:23:22.845 --> 01:23:25.085
<01:23:22.845>that's, <01:23:23.045>you <01:23:23.245>know, <01:23:23.445>inside <01:23:23.645>the <01:23:23.845>company <01:23:24.045>or <01:23:24.245>outside.

1898
01:23:25.665 --> 01:23:27.325
<01:23:25.665>If <01:23:25.840>you <01:23:26.015>do <01:23:26.190>that <01:23:26.365>for <01:23:26.540>each, <01:23:26.715>for <01:23:26.890>OB <01:23:27.065>class,

1899
01:23:27.325 --> 01:23:29.165
<01:23:27.325>it's <01:23:27.525>gonna <01:23:27.724>take <01:23:27.925>some <01:23:28.125>time, <01:23:28.325>but <01:23:28.525>you'll <01:23:28.724>have

1900
01:23:29.165 --> 01:23:30.325
<01:23:29.165>more <01:23:29.687>target <01:23:30.209>protection.

1901
01:23:31.105 --> 01:23:32.245
<01:23:31.105>You <01:23:31.310>don't <01:23:31.515>just <01:23:31.720>take <01:23:31.925>any <01:23:32.130>tool

1902
01:23:32.245 --> 01:23:34.205
<01:23:32.245>and <01:23:32.385>hope <01:23:32.525>that <01:23:32.665>it's <01:23:32.805>gonna <01:23:32.945>find <01:23:33.085>all <01:23:33.224>those <01:23:33.365>things <01:23:33.505>in <01:23:33.644>your

1903
01:23:34.445 --> 01:23:36.885
<01:23:34.445>software, <01:23:34.644>but <01:23:34.844>you <01:23:35.045>know <01:23:35.245>exactly <01:23:35.445>what <01:23:35.644>to <01:23:35.844>look

1904
01:23:36.885 --> 01:23:37.965
<01:23:36.885>for <01:23:37.047>and <01:23:37.209>where <01:23:37.371>to <01:23:37.533>look <01:23:37.695>for <01:23:37.857>it.

1905
01:23:39.705 --> 01:23:41.605
<01:23:39.705>I'm <01:23:39.905>gonna <01:23:40.105>give <01:23:40.305>you <01:23:40.505>an <01:23:40.705>example. <01:23:40.905>Uh, <01:23:41.105>that's,

1906
01:23:41.605 --> 01:23:43.885
<01:23:41.605>that <01:23:41.838>example <01:23:42.071>is <01:23:42.304>angular <01:23:42.538>and <01:23:42.771>cross <01:23:43.004>scripting.

1907
01:23:43.945 --> 01:23:46.405
<01:23:43.945>So <01:23:44.178>single <01:23:44.411>page <01:23:44.644>applications <01:23:44.878>like, <01:23:45.111>like <01:23:45.344>Angular

1908
01:23:46.405 --> 01:23:48.685
<01:23:46.405>and <01:23:46.580>others <01:23:46.755>give <01:23:46.929>a <01:23:47.105>very <01:23:47.280>good <01:23:47.455>separation <01:23:47.630>of <01:23:47.804>concerns,

1909
01:23:48.685 --> 01:23:51.125
<01:23:48.684>and <01:23:48.964>that's <01:23:49.245>good <01:23:49.525>for <01:23:49.804>security, <01:23:50.084>uh,

1910
01:23:51.125 --> 01:23:54.445
<01:23:51.125>because <01:23:51.325>they <01:23:51.525>are <01:23:51.725>responsible <01:23:51.925>for <01:23:52.125>presenting <01:23:52.325>the <01:23:52.525>data

1911
01:23:54.905 --> 01:23:58.005
<01:23:54.905>and <01:23:55.060>the <01:23:55.216>APIs <01:23:55.371>responsible <01:23:55.527>for, <01:23:55.682>you <01:23:55.838>know, <01:23:55.993>managing <01:23:56.149>the <01:23:56.304>data.

1912
01:23:58.665 --> 01:24:01.285
<01:23:58.665>So <01:23:58.865>only <01:23:59.065>a <01:23:59.265>small <01:23:59.465>set <01:23:59.665>of <01:23:59.865>vulnerabilities <01:24:00.065>relevant,

1913
01:24:01.285 --> 01:24:02.525
<01:24:01.285>even <01:24:01.563>in <01:24:01.843>single <01:24:02.121>page <01:24:02.401>applications.

1914
01:24:02.665 --> 01:24:04.525
<01:24:02.665>In <01:24:02.945>short, <01:24:03.225>it's <01:24:03.505>cross <01:24:03.785>scripting <01:24:04.065>mostly.

1915
01:24:04.575 --> 01:24:07.605
<01:24:04.575>There <01:24:04.775>are <01:24:04.974>other <01:24:05.175>things <01:24:05.375>like <01:24:05.575>RegX, <01:24:05.775>Doss <01:24:05.974>and,

1916
01:24:07.705 --> 01:24:10.365
<01:24:07.705>but <01:24:07.905>crosses <01:24:08.105>scripting <01:24:08.305>is <01:24:08.505>the <01:24:08.705>most <01:24:08.905>important <01:24:09.105>one.

1917
01:24:11.295 --> 01:24:12.965
<01:24:11.295>There <01:24:11.495>are <01:24:11.695>a <01:24:11.895>few <01:24:12.095>ways <01:24:12.295>to <01:24:12.495>screw <01:24:12.695>up

1918
01:24:13.225 --> 01:24:14.645
<01:24:13.225>that's <01:24:13.651>bypass <01:24:14.077>security <01:24:14.503>trust,

1919
01:24:15.065 --> 01:24:18.525
<01:24:15.065>and <01:24:15.265>the <01:24:15.465>direct <01:24:15.665>use <01:24:15.865>of <01:24:16.065>unsafe <01:24:16.265>thumb <01:24:16.465>APIs.

1920
01:24:19.385 --> 01:24:22.405
<01:24:19.385>Um, <01:24:19.560>so <01:24:19.735>angular <01:24:19.910>and <01:24:20.085>cross <01:24:20.260>scripting <01:24:20.435>in <01:24:20.610>a <01:24:20.785>nutshell.

1921
01:24:22.405 --> 01:24:25.205
<01:24:22.405>Let's, <01:24:22.532>let's <01:24:22.659>dive <01:24:22.786>a <01:24:22.914>bit <01:24:23.041>deeper <01:24:23.168>into <01:24:23.295>this <01:24:23.423>to <01:24:23.550>analyze <01:24:23.677>what <01:24:23.804>is,

1922
01:24:25.205 --> 01:24:27.405
<01:24:25.205>how <01:24:25.345>can <01:24:25.485>it <01:24:25.625>happen, <01:24:25.765>what <01:24:25.905>could <01:24:26.045>go <01:24:26.184>wrong <01:24:26.325>and <01:24:26.465>how <01:24:26.605>exactly?

1923
01:24:28.425 --> 01:24:29.845
<01:24:28.425>Uh, <01:24:28.680>so <01:24:28.936>we <01:24:29.191>have <01:24:29.447>two <01:24:29.703>inputs.

1924
01:24:29.845 --> 01:24:33.565
<01:24:29.845>We <01:24:30.000>have <01:24:30.156>the <01:24:30.311>HTML <01:24:30.467>that <01:24:30.622>is, <01:24:30.778>you <01:24:30.933>know, <01:24:31.089>potentially <01:24:31.245>unsafe.

1925
01:24:33.565 --> 01:24:35.725
<01:24:33.565>So <01:24:33.720>this <01:24:33.876>is <01:24:34.031>not <01:24:34.187>a <01:24:34.342>constant <01:24:34.498>in <01:24:34.653>the <01:24:34.809>real <01:24:34.965>world,

1926
01:24:35.725 --> 01:24:38.165
<01:24:35.725>it's <01:24:35.925>user <01:24:36.125>input, <01:24:36.325>say <01:24:36.525>for <01:24:36.725>example, <01:24:36.925>their <01:24:37.125>name

1927
01:24:38.585 --> 01:24:40.965
<01:24:38.585>or <01:24:38.818>their <01:24:39.051>job <01:24:39.285>description <01:24:39.518>or <01:24:39.751>whatever, <01:24:39.985>right?

1928
01:24:41.585 --> 01:24:44.605
<01:24:41.585>So <01:24:41.760>that's, <01:24:41.935>we, <01:24:42.110>we <01:24:42.285>consider <01:24:42.460>that <01:24:42.635>untrusted <01:24:42.810>user <01:24:42.985>input

1929
01:24:44.605 --> 01:24:46.485
<01:24:44.605>that <01:24:44.884>could <01:24:45.165>potentially <01:24:45.445>be <01:24:45.724>script <01:24:46.004>code.

1930
01:24:47.305 --> 01:24:49.245
<01:24:47.305>So <01:24:47.538>when <01:24:47.771>you, <01:24:48.005>do <01:24:48.238>you <01:24:48.471>want <01:24:48.705>to,

1931
01:24:49.265 --> 01:24:51.565
<01:24:49.265>to <01:24:49.440>output <01:24:49.615>this <01:24:49.790>in <01:24:49.965>a <01:24:50.140>formatted <01:24:50.315>way, <01:24:50.490>think <01:24:50.665>that

1932
01:24:51.565 --> 01:24:53.325
<01:24:51.565>what <01:24:51.720>you <01:24:51.876>see <01:24:52.031>is <01:24:52.187>what <01:24:52.342>you <01:24:52.498>get <01:24:52.653>editor, <01:24:52.809>that's <01:24:52.965>exactly

1933
01:24:53.325 --> 01:24:55.645
<01:24:53.325>what <01:24:53.465>would <01:24:53.605>you, <01:24:53.745>what <01:24:53.885>you <01:24:54.025>would <01:24:54.165>do <01:24:54.304>in <01:24:54.445>an <01:24:54.585>angle <01:24:54.724>application.

1934
01:24:56.425 --> 01:24:59.525
<01:24:56.425>And <01:24:56.600>you <01:24:56.775>do <01:24:56.950>square <01:24:57.125>brackets <01:24:57.300>in <01:24:57.475>HTML <01:24:57.650>equals <01:24:57.825>this.

1935
01:25:00.345 --> 01:25:03.325
<01:25:00.345>So <01:25:00.545>what's <01:25:00.745>gonna <01:25:00.945>happen <01:25:01.145>is <01:25:01.345>angular <01:25:01.545>sanitizes <01:25:01.745>this,

1936
01:25:03.545 --> 01:25:06.085
<01:25:03.545>so <01:25:03.745>it's <01:25:03.945>gonna <01:25:04.145>put <01:25:04.345>out <01:25:04.545>everything <01:25:04.745>that's <01:25:04.945>dangerous

1937
01:25:06.145 --> 01:25:07.925
<01:25:06.145>or <01:25:06.495>could <01:25:06.845>contain <01:25:07.195>JavaScript <01:25:07.545>code.

1938
01:25:08.225 --> 01:25:09.565
<01:25:08.225>So <01:25:08.466>what's <01:25:08.707>left <01:25:08.948>in <01:25:09.189>your <01:25:09.431>do,

1939
01:25:10.475 --> 01:25:14.085
<01:25:10.475>this <01:25:10.650>is <01:25:10.825>really <01:25:11.000>great <01:25:11.175>angular <01:25:11.350>developers, <01:25:11.525>uh, <01:25:11.700>it <01:25:11.875>only

1940
01:25:14.945 --> 01:25:18.405
<01:25:14.945>leaves <01:25:15.100>the <01:25:15.256>image <01:25:15.411>tag <01:25:15.567>and <01:25:15.722>it <01:25:15.878>leaves <01:25:16.033>the <01:25:16.189>source <01:25:16.344>attribute.

1941
01:25:18.505 --> 01:25:20.765
<01:25:18.505>But <01:25:18.785>the <01:25:19.065>on <01:25:19.345>error <01:25:19.625>event <01:25:19.905>handler

1942
01:25:20.765 --> 01:25:22.725
<01:25:20.765>that <01:25:20.998>can <01:25:21.231>contain <01:25:21.465>JavaScript <01:25:21.698>is <01:25:21.931>just <01:25:22.165>gone.

1943
01:25:23.505 --> 01:25:25.925
<01:25:23.505>The <01:25:23.785>angular <01:25:24.065>single <01:25:24.345>page <01:25:24.625>application <01:25:24.905>framework

1944
01:25:25.925 --> 01:25:27.085
<01:25:25.925>comes <01:25:26.273>with <01:25:26.621>a <01:25:26.969>sanitizer.

1945
01:25:27.085 --> 01:25:31.965
<01:25:27.085>That's <01:25:27.240>awesome. <01:25:27.396>Now, <01:25:27.551>the <01:25:27.707>other <01:25:27.862>way <01:25:28.018>to <01:25:28.173>basically <01:25:28.329>screw <01:25:28.485>up,

1946
01:25:31.965 --> 01:25:34.445
<01:25:31.965>or <01:25:32.140>one <01:25:32.315>other <01:25:32.490>way <01:25:32.665>is <01:25:32.840>you <01:25:33.015>have <01:25:33.190>a <01:25:33.365>link,

1947
01:25:35.245 --> 01:25:36.925
<01:25:35.245>a <01:25:35.711>dynamic <01:25:36.178>hre <01:25:36.644>attribute,

1948
01:25:37.385 --> 01:25:39.125
<01:25:37.385>and <01:25:37.585>that <01:25:37.785>can <01:25:37.985>contain <01:25:38.185>JavaScript <01:25:38.385>in <01:25:38.585>the <01:25:38.785>form

1949
01:25:39.125 --> 01:25:41.605
<01:25:39.125>of <01:25:39.358>JavaScript <01:25:39.591>column <01:25:39.825>alert <01:25:40.058>one <01:25:40.291>for <01:25:40.525>example.

1950
01:25:43.055 --> 01:25:44.965
<01:25:43.055>Again, <01:25:43.521>angular <01:25:43.988>sanitizes <01:25:44.455>this,

1951
01:25:45.505 --> 01:25:48.205
<01:25:45.505>so <01:25:45.738>it <01:25:45.971>says <01:25:46.205>unsafe <01:25:46.438>JavaScript <01:25:46.671>alert <01:25:46.905>one,

1952
01:25:48.745 --> 01:25:51.285
<01:25:48.745>and <01:25:48.920>the <01:25:49.095>browser <01:25:49.269>is <01:25:49.445>not <01:25:49.620>gonna, <01:25:49.795>uh, <01:25:49.970>interpret <01:25:50.144>this

1953
01:25:51.285 --> 01:25:53.765
<01:25:51.285>as <01:25:51.485>JavaScript <01:25:51.684>anymore <01:25:51.885>because <01:25:52.085>it <01:25:52.285>starts <01:25:52.485>with <01:25:52.684>unsafe.

1954
01:25:53.765 --> 01:25:54.765
<01:25:53.765>It <01:25:53.990>doesn't <01:25:54.215>make <01:25:54.440>any <01:25:54.665>sense,

1955
01:25:54.905 --> 01:25:57.245
<01:25:54.905>but <01:25:55.060>you <01:25:55.216>know, <01:25:55.371>it's <01:25:55.527>safe <01:25:55.682>against <01:25:55.838>the <01:25:55.993>attack <01:25:56.149>at <01:25:56.304>least.

1956
01:25:58.865 --> 01:26:02.965
<01:25:58.865>So, <01:25:58.992>um, <01:25:59.119>let's <01:25:59.246>take <01:25:59.374>the, <01:25:59.501>the, <01:25:59.628>the <01:25:59.755>list <01:25:59.883>that <01:26:00.010>we <01:26:00.137>had <01:26:00.264>before

1957
01:26:03.385 --> 01:26:06.285
<01:26:03.385>and, <01:26:03.618>uh, <01:26:03.851>make <01:26:04.085>a <01:26:04.318>mitigation <01:26:04.551>tracking <01:26:04.785>list.

1958
01:26:06.865 --> 01:26:09.125
<01:26:06.865>So <01:26:07.040>we <01:26:07.215>have <01:26:07.389>cross <01:26:07.565>scripting <01:26:07.740>as <01:26:07.915>a <01:26:08.090>vulnerability <01:26:08.264>type.

1959
01:26:09.985 --> 01:26:12.725
<01:26:09.985>Uh, <01:26:10.184>it's <01:26:10.384>confidentiality <01:26:10.585>integrity, <01:26:10.785>so <01:26:10.985>I <01:26:11.184>can <01:26:11.384>read

1960
01:26:12.725 --> 01:26:13.965
<01:26:12.725>and <01:26:13.004>manipulate <01:26:13.283>data <01:26:13.562>with <01:26:13.841>it.

1961
01:26:14.945 --> 01:26:18.005
<01:26:14.945>Uh, <01:26:15.072>let's <01:26:15.199>say <01:26:15.326>it's <01:26:15.454>high <01:26:15.581>in <01:26:15.708>terms <01:26:15.835>of <01:26:15.963>severity, <01:26:16.090>whatever <01:26:16.217>it <01:26:16.344>is

1962
01:26:18.005 --> 01:26:19.685
<01:26:18.005>for <01:26:18.285>you <01:26:18.565>depends <01:26:18.845>on <01:26:19.125>your <01:26:19.405>environment.

1963
01:26:20.705 --> 01:26:21.845
<01:26:20.705>How <01:26:21.047>does <01:26:21.389>technology <01:26:21.731>help?

1964
01:26:21.955 --> 01:26:24.285
<01:26:21.955>Well, <01:26:22.235>it <01:26:22.515>has <01:26:22.795>an <01:26:23.075>automatic <01:26:23.355>sanitizer,

1965
01:26:24.425 --> 01:26:26.885
<01:26:24.425>and <01:26:24.580>so <01:26:24.736>these <01:26:24.891>things <01:26:25.047>are <01:26:25.202>safe <01:26:25.358>from, <01:26:25.513>from <01:26:25.669>a <01:26:25.825>tech.

1966
01:26:26.885 --> 01:26:30.205
<01:26:26.885>When <01:26:27.012>I <01:26:27.139>just <01:26:27.266>use <01:26:27.394>it <01:26:27.521>like <01:26:27.648>it <01:26:27.775>is, <01:26:27.903>what <01:26:28.030>could <01:26:28.157>go <01:26:28.285>wrong?

1967
01:26:30.485 --> 01:26:32.125
<01:26:30.485>I <01:26:30.764>could <01:26:31.045>use <01:26:31.325>bypass <01:26:31.605>security <01:26:31.884>trust.

1968
01:26:33.385 --> 01:26:35.725
<01:26:33.385>Um, <01:26:33.665>and <01:26:33.945>that <01:26:34.225>disables <01:26:34.505>the <01:26:34.785>sanitizer.

1969
01:26:35.985 --> 01:26:37.645
<01:26:35.985>So <01:26:36.335>search <01:26:36.684>your <01:26:37.035>code <01:26:37.384>base.

1970
01:26:38.145 --> 01:26:41.045
<01:26:38.145>If <01:26:38.320>you're <01:26:38.495>an <01:26:38.670>Angular <01:26:38.845>developer <01:26:39.020>for <01:26:39.195>bypass <01:26:39.370>security <01:26:39.545>trust,

1971
01:26:41.505 --> 01:26:45.405
<01:26:41.505>if <01:26:41.705>there's <01:26:41.905>any <01:26:42.105>untrusted <01:26:42.305>input <01:26:42.505>going <01:26:42.705>into, <01:26:42.905>uh,

1972
01:26:45.435 --> 01:26:46.565
<01:26:45.434>this <01:26:45.773>bypass <01:26:46.113>security <01:26:46.452>trust,

1973
01:26:46.565 --> 01:26:48.485
<01:26:46.565>you're <01:26:46.798>gonna <01:26:47.031>be <01:26:47.265>susceptible <01:26:47.498>to <01:26:47.731>cross <01:26:47.965>scripting.

1974
01:26:49.065 --> 01:26:50.485
<01:26:49.065>What's <01:26:49.320>the <01:26:49.576>best <01:26:49.831>place <01:26:50.087>for <01:26:50.343>assurance?

1975
01:26:50.745 --> 01:26:53.365
<01:26:50.745>You <01:26:50.885>could <01:26:51.025>use <01:26:51.165>a <01:26:51.305>static <01:26:51.445>analysis <01:26:51.585>tool <01:26:51.724>to <01:26:51.865>search <01:26:52.005>for <01:26:52.144>this,

1976
01:26:54.025 --> 01:26:57.825
<01:26:54.025>or <01:26:54.165>you <01:26:54.304>could <01:26:54.445>lose <01:26:54.585>a, <01:26:54.724>use <01:26:54.865>a <01:26:55.004>link <01:26:55.144>to <01:26:55.285>disallow, <01:26:55.424>uh,

1977
01:26:57.895 --> 01:26:58.985
<01:26:57.895>long <01:26:58.385>access <01:26:58.876>syncs.

1978
01:26:59.025 --> 01:27:01.025
<01:26:59.025>So <01:26:59.258>you <01:26:59.491>could <01:26:59.724>also <01:26:59.958>use, <01:27:00.191>not <01:27:00.424>angular,

1979
01:27:01.045 --> 01:27:03.785
<01:27:01.045>but <01:27:01.245>have <01:27:01.445>direct <01:27:01.645>access <01:27:01.845>to <01:27:02.045>DOM <01:27:02.245>elements, <01:27:02.445>right?

1980
01:27:03.785 --> 01:27:05.465
<01:27:03.785>That's <01:27:03.985>also <01:27:04.184>a <01:27:04.385>way <01:27:04.585>to <01:27:04.785>do <01:27:04.985>cross <01:27:05.184>scripting.

1981
01:27:06.165 --> 01:27:08.265
<01:27:06.165>What's <01:27:06.445>defense <01:27:06.725>in <01:27:07.005>depth <01:27:07.285>using <01:27:07.565>a

1982
01:27:08.265 --> 01:27:09.505
<01:27:08.265>strong <01:27:08.637>content <01:27:09.009>security <01:27:09.381>policy?

1983
01:27:10.765 --> 01:27:11.985
<01:27:10.765>Uh, <01:27:11.039>there's <01:27:11.314>some <01:27:11.588>risk <01:27:11.862>left

1984
01:27:11.985 --> 01:27:13.825
<01:27:11.985>because <01:27:12.218>people <01:27:12.451>could <01:27:12.684>still <01:27:12.918>use <01:27:13.151>DOM <01:27:13.384>APIs

1985
01:27:13.825 --> 01:27:17.265
<01:27:13.825>and <01:27:13.941>they <01:27:14.058>could <01:27:14.175>not <01:27:14.291>be <01:27:14.408>caught, <01:27:14.525>uh, <01:27:14.641>by, <01:27:14.758>by <01:27:14.875>this, <01:27:14.991>by <01:27:15.108>the <01:27:15.224>linter

1986
01:27:17.325 --> 01:27:18.505
<01:27:17.325>or <01:27:17.590>a <01:27:17.856>static <01:27:18.121>analysis <01:27:18.387>tool.

1987
01:27:18.925 --> 01:27:21.345
<01:27:18.925>And <01:27:19.100>then <01:27:19.275>some <01:27:19.450>links <01:27:19.625>and <01:27:19.800>references <01:27:19.975>to <01:27:20.150>coding <01:27:20.325>guidelines,

1988
01:27:21.345 --> 01:27:23.345
<01:27:21.345>maybe <01:27:21.625>also <01:27:21.905>requirements <01:27:22.185>and <01:27:22.465>so <01:27:22.745>on.

1989
01:27:24.245 --> 01:27:27.225
<01:27:24.245>So <01:27:24.385>now <01:27:24.525>we <01:27:24.665>are <01:27:24.805>way <01:27:24.945>more <01:27:25.085>specific <01:27:25.224>than <01:27:25.365>just, <01:27:25.505>uh, <01:27:25.644>saying,

1990
01:27:27.385 --> 01:27:29.065
<01:27:27.385>I <01:27:27.618>don't <01:27:27.851>want <01:27:28.085>cross <01:27:28.318>scripting <01:27:28.551>in <01:27:28.785>my,

1991
01:27:29.085 --> 01:27:31.025
<01:27:29.085>or, <01:27:29.240>I <01:27:29.396>don't <01:27:29.551>want <01:27:29.707>the <01:27:29.862>top <01:27:30.018>10 <01:27:30.173>in <01:27:30.329>my <01:27:30.485>application.

1992
01:27:31.495 --> 01:27:33.465
<01:27:31.495>Well, <01:27:31.650>now <01:27:31.806>for <01:27:31.961>the <01:27:32.117>front <01:27:32.272>end <01:27:32.428>code, <01:27:32.583>we <01:27:32.739>know <01:27:32.894>exactly

1993
01:27:33.465 --> 01:27:35.625
<01:27:33.465>what <01:27:33.592>could <01:27:33.719>go <01:27:33.846>wrong <01:27:33.974>and <01:27:34.101>what <01:27:34.228>we <01:27:34.355>need <01:27:34.483>to <01:27:34.610>do <01:27:34.737>about <01:27:34.865>this.

1994
01:27:38.345 --> 01:27:42.325
<01:27:38.345>All <01:27:38.485>right? <01:27:38.625>Um, <01:27:38.765>which <01:27:38.905>brings <01:27:39.045>me <01:27:39.185>to <01:27:39.325>the <01:27:39.465>next <01:27:39.605>thing, <01:27:39.745>uh,

1995
01:27:42.425 --> 01:27:43.845
<01:27:42.425>one <01:27:42.744>residual <01:27:43.064>risk <01:27:43.383>and <01:27:43.703>something

1996
01:27:43.845 --> 01:27:45.165
<01:27:43.845>that <01:27:44.043>could <01:27:44.241>go <01:27:44.439>wrong <01:27:44.637>when <01:27:44.835>it <01:27:45.033>comes

1997
01:27:45.165 --> 01:27:47.725
<01:27:45.165>to <01:27:45.365>cross <01:27:45.565>scripting <01:27:45.765>in <01:27:45.965>single <01:27:46.165>page <01:27:46.365>applications <01:27:46.565>is,

1998
01:27:48.025 --> 01:27:51.805
<01:27:48.025>and <01:27:48.224>generally <01:27:48.424>in <01:27:48.625>software, <01:27:48.825>is <01:27:49.025>I <01:27:49.224>have <01:27:49.424>dependencies

1999
01:27:51.805 --> 01:27:53.205
<01:27:51.805>that <01:27:52.057>have <01:27:52.309>a <01:27:52.561>vulnerability <01:27:52.813>in <01:27:53.065>them,

2000
01:27:53.465 --> 01:27:54.765
<01:27:53.465>and <01:27:53.699>that's <01:27:53.933>not <01:27:54.167>my <01:27:54.401>own <01:27:54.635>code.

2001
01:27:54.965 --> 01:27:56.525
<01:27:54.965>I <01:27:55.165>can <01:27:55.365>maybe <01:27:55.565>not <01:27:55.765>even <01:27:55.965>change <01:27:56.165>it <01:27:56.365>easily.

2002
01:27:57.425 --> 01:27:59.365
<01:27:57.425>So <01:27:57.625>how <01:27:57.825>do <01:27:58.025>I <01:27:58.225>deal <01:27:58.425>with <01:27:58.625>external <01:27:58.825>code?

2003
01:27:59.985 --> 01:28:01.325
<01:27:59.985>So <01:28:00.286>what <01:28:00.588>is <01:28:00.889>external <01:28:01.191>code?

2004
01:28:01.985 --> 01:28:04.685
<01:28:01.985>If <01:28:02.184>you <01:28:02.384>are <01:28:02.585>a <01:28:02.785>travel <01:28:02.985>developer, <01:28:03.184>it's <01:28:03.384>something

2005
01:28:04.685 --> 01:28:07.405
<01:28:04.684>that's <01:28:04.884>on <01:28:05.084>the <01:28:05.285>Aven <01:28:05.485>repository <01:28:05.684>when <01:28:05.884>doing <01:28:06.084>C

2006
01:28:07.585 --> 01:28:11.525
<01:28:07.585>and <01:28:07.785>dotnet <01:28:07.985>related <01:28:08.185>things, <01:28:08.385>it's, <01:28:08.585>uh, <01:28:08.785>repository <01:28:08.985>Python,

2007
01:28:11.635 --> 01:28:14.525
<01:28:11.635>it's <01:28:11.868>pi <01:28:12.101>p <01:28:12.335>and <01:28:12.568>PHP, <01:28:12.801>it's <01:28:13.035>packages

2008
01:28:14.545 --> 01:28:18.725
<01:28:14.545>or <01:28:14.685>composer <01:28:14.825>is <01:28:14.965>the <01:28:15.105>client <01:28:15.245>basically <01:28:15.385>to <01:28:15.525>it <01:28:15.665>when <01:28:15.805>using <01:28:15.945>Ruby,

2009
01:28:18.835 --> 01:28:20.445
<01:28:18.835>it's <01:28:19.115>Ruby <01:28:19.395>games <01:28:19.675>and <01:28:19.955>so <01:28:20.235>on.

2010
01:28:20.825 --> 01:28:23.125
<01:28:20.825>So <01:28:21.175>foreign <01:28:21.525>code <01:28:21.875>usually <01:28:22.224>prevails.

2011
01:28:23.125 --> 01:28:26.125
<01:28:23.125>So <01:28:23.252>it <01:28:23.379>makes <01:28:23.506>up <01:28:23.634>for <01:28:23.761>more <01:28:23.888>than <01:28:24.015>50% <01:28:24.143>of <01:28:24.270>the <01:28:24.397>running <01:28:24.525>code.

2012
01:28:27.105 --> 01:28:29.285
<01:28:27.105>We <01:28:27.260>cannot <01:28:27.416>go <01:28:27.571>and <01:28:27.727>check <01:28:27.882>every <01:28:28.038>line <01:28:28.193>of <01:28:28.349>code <01:28:28.504>there,

2013
01:28:29.825 --> 01:28:31.925
<01:28:29.825>but <01:28:29.980>what <01:28:30.136>we <01:28:30.291>can <01:28:30.447>do <01:28:30.602>is <01:28:30.758>we <01:28:30.913>can <01:28:31.069>check <01:28:31.224>it

2014
01:28:31.925 --> 01:28:35.685
<01:28:31.925>for <01:28:32.158>known <01:28:32.391>weaknesses <01:28:32.625>for <01:28:32.858>that <01:28:33.091>to <01:28:33.325>work.

2015
01:28:35.745 --> 01:28:38.725
<01:28:35.745>So <01:28:35.900>that <01:28:36.056>in <01:28:36.211>order <01:28:36.367>to <01:28:36.522>have <01:28:36.678>a, <01:28:36.833>um, <01:28:36.989>a <01:28:37.144>process

2016
01:28:38.725 --> 01:28:41.245
<01:28:38.725>that <01:28:38.958>does <01:28:39.191>automatic <01:28:39.425>checking <01:28:39.658>for <01:28:39.891>known <01:28:40.125>vulnerabilities,

2017
01:28:41.835 --> 01:28:44.485
<01:28:41.835>they <01:28:42.010>must <01:28:42.185>be <01:28:42.360>declared <01:28:42.535>in <01:28:42.710>the <01:28:42.885>machine <01:28:43.060>readable <01:28:43.235>way.

2018
01:28:44.715 --> 01:28:47.325
<01:28:44.715>Machine <01:28:44.948>readable <01:28:45.181>means <01:28:45.415>a <01:28:45.648>list <01:28:45.881>of <01:28:46.115>dependencies

2019
01:28:47.325 --> 01:28:49.765
<01:28:47.325>that <01:28:47.525>can <01:28:47.724>be <01:28:47.925>parsed <01:28:48.125>by, <01:28:48.325>by <01:28:48.525>a <01:28:48.724>process,

2020
01:28:49.945 --> 01:28:50.965
<01:28:49.945>by <01:28:50.174>a <01:28:50.404>script, <01:28:50.633>for <01:28:50.863>example.

2021
01:28:52.665 --> 01:28:56.205
<01:28:52.665>So, <01:28:52.805>um, <01:28:52.945>if <01:28:53.085>you <01:28:53.225>take <01:28:53.365>ular <01:28:53.505>again, <01:28:53.644>um, <01:28:53.785>I <01:28:53.925>hope <01:28:54.065>many

2022
01:28:56.205 --> 01:28:57.325
<01:28:56.205>of <01:28:56.457>you <01:28:56.709>are <01:28:56.961>annual <01:28:57.213>developers,

2023
01:28:57.325 --> 01:29:00.445
<01:28:57.325>because <01:28:57.480>then <01:28:57.636>you <01:28:57.791>can <01:28:57.947>take <01:28:58.102>something, <01:28:58.258>uh, <01:28:58.413>away <01:28:58.569>very, <01:28:58.724>uh,

2024
01:29:00.475 --> 01:29:02.725
<01:29:00.475>exactly <01:29:00.755>from <01:29:01.035>this, <01:29:01.315>from <01:29:01.595>this <01:29:01.875>training.

2025
01:29:03.425 --> 01:29:07.125
<01:29:03.425>Um, <01:29:03.580>when <01:29:03.736>doing <01:29:03.891>a <01:29:04.047>Hello <01:29:04.202>World <01:29:04.358>project <01:29:04.513>that <01:29:04.669>does <01:29:04.825>nothing,

2026
01:29:07.395 --> 01:29:09.725
<01:29:07.395>just, <01:29:07.570>you <01:29:07.745>know, <01:29:07.920>showing <01:29:08.095>a <01:29:08.270>page <01:29:08.445>that <01:29:08.620>says <01:29:08.795>hello

2027
01:29:09.985 --> 01:29:13.285
<01:29:09.985>and <01:29:10.160>some <01:29:10.335>information <01:29:10.509>about <01:29:10.684>angle <01:29:10.860>on <01:29:11.035>it, <01:29:11.210>we <01:29:11.384>have

2028
01:29:14.745 --> 01:29:16.305
<01:29:14.745>altogether, <01:29:15.095>when <01:29:15.445>you <01:29:15.795>count <01:29:16.144>JavaScript

2029
01:29:16.305 --> 01:29:18.945
<01:29:16.305>and <01:29:16.480>TypeScript <01:29:16.655>code <01:29:16.830>for <01:29:17.005>this <01:29:17.180>application, <01:29:17.355>we <01:29:17.530>have <01:29:17.705>about

2030
01:29:19.055 --> 01:29:24.025
<01:29:19.055>through <01:29:19.195>3.2 <01:29:19.335>million <01:29:19.475>lines <01:29:19.615>of <01:29:19.755>code <01:29:19.895>in <01:29:20.035>our <01:29:20.175>node <01:29:20.315>models <01:29:20.455>folder.

2031
01:29:24.285 --> 01:29:27.545
<01:29:24.285>You <01:29:24.425>know, <01:29:24.565>my <01:29:24.705>laptop <01:29:24.845>is <01:29:24.985>one <01:29:25.125>and <01:29:25.264>a <01:29:25.405>half <01:29:25.545>kilos <01:29:25.684>heavier

2032
01:29:27.835 --> 01:29:31.145
<01:29:27.835>after <01:29:28.010>doing <01:29:28.185>an <01:29:28.360>NPN <01:29:28.535>install <01:29:28.710>on <01:29:28.885>this, <01:29:29.060>uh, <01:29:29.235>project.

2033
01:29:31.605 --> 01:29:32.625
<01:29:31.605>So <01:29:31.788>that's <01:29:31.972>a <01:29:32.155>lot <01:29:32.339>of <01:29:32.523>code

2034
01:29:32.625 --> 01:29:34.025
<01:29:32.625>where <01:29:32.876>we <01:29:33.129>could <01:29:33.380>have <01:29:33.633>weaknesses <01:29:33.884>inside.

2035
01:29:35.935 --> 01:29:38.315
<01:29:35.934>We <01:29:36.110>have <01:29:36.285>libraries <01:29:36.459>with <01:29:36.634>frameworks, <01:29:36.809>we <01:29:36.985>have <01:29:37.160>the <01:29:37.334>runtime,

2036
01:29:39.095 --> 01:29:40.355
<01:29:39.095>the <01:29:39.378>quality <01:29:39.662>is <01:29:39.945>really <01:29:40.228>different.

2037
01:29:40.415 --> 01:29:43.395
<01:29:40.415>If <01:29:40.590>you <01:29:40.765>look <01:29:40.940>at, <01:29:41.115>um, <01:29:41.290>JavaScript <01:29:41.465>libraries <01:29:41.640>out <01:29:41.815>there

2038
01:29:43.495 --> 01:29:45.515
<01:29:43.495>and <01:29:43.650>you <01:29:43.806>look <01:29:43.961>into <01:29:44.117>the <01:29:44.272>code, <01:29:44.428>you, <01:29:44.583>we <01:29:44.739>will <01:29:44.894>see

2039
01:29:45.515 --> 01:29:46.835
<01:29:45.515>that <01:29:45.752>the <01:29:45.990>quality <01:29:46.227>is <01:29:46.465>really <01:29:46.703>different.

2040
01:29:46.835 --> 01:29:48.555
<01:29:46.835>Some <01:29:47.068>of <01:29:47.301>them <01:29:47.535>have <01:29:47.768>even <01:29:48.001>automated <01:29:48.235>checks

2041
01:29:48.555 --> 01:29:50.195
<01:29:48.555>with <01:29:48.788>good <01:29:49.021>code <01:29:49.255>coverage <01:29:49.488>and <01:29:49.721>so <01:29:49.955>on.

2042
01:29:50.415 --> 01:29:52.275
<01:29:50.415>Others <01:29:50.695>have <01:29:50.975>none <01:29:51.255>of <01:29:51.535>these, <01:29:51.815>right?

2043
01:29:53.775 --> 01:29:56.275
<01:29:53.775>So <01:29:54.241>automate <01:29:54.708>dependency <01:29:55.174>checks,

2044
01:29:56.415 --> 01:29:58.835
<01:29:56.415>that's <01:29:56.615>the <01:29:56.815>most <01:29:57.015>important <01:29:57.215>thing <01:29:57.415>on <01:29:57.615>every <01:29:57.815>push.

2045
01:29:59.135 --> 01:30:02.115
<01:29:59.135>So <01:29:59.310>when <01:29:59.485>something <01:29:59.660>is <01:29:59.835>pushed <01:30:00.010>to <01:30:00.185>your <01:30:00.360>repository, <01:30:00.535>uh,

2046
01:30:02.255 --> 01:30:04.035
<01:30:02.255>and <01:30:02.535>we <01:30:02.815>have <01:30:03.095>a <01:30:03.375>known <01:30:03.655>vulnerability,

2047
01:30:04.035 --> 01:30:06.595
<01:30:04.035>it's <01:30:04.175>not <01:30:04.315>about <01:30:04.455>the <01:30:04.595>unknown <01:30:04.735>ones, <01:30:04.875>it's <01:30:05.014>about <01:30:05.155>the <01:30:05.295>known <01:30:05.434>ones,

2048
01:30:06.595 --> 01:30:09.395
<01:30:06.595>so <01:30:06.770>that <01:30:06.945>the <01:30:07.120>vulnerabilities <01:30:07.295>that <01:30:07.470>we <01:30:07.645>know, <01:30:07.820>this <01:30:07.995>library

2049
01:30:09.495 --> 01:30:12.675
<01:30:09.495>and <01:30:09.650>that <01:30:09.806>version <01:30:09.961>has <01:30:10.117>that <01:30:10.272>weakness, <01:30:10.428>um, <01:30:10.583>if <01:30:10.739>that <01:30:10.894>happens

2050
01:30:12.845 --> 01:30:15.155
<01:30:12.845>above <01:30:13.045>a <01:30:13.245>certain <01:30:13.445>severity <01:30:13.645>level, <01:30:13.845>fail <01:30:14.045>to <01:30:14.245>build.

2051
01:30:16.535 --> 01:30:19.315
<01:30:16.535>Um, <01:30:16.642>one <01:30:16.750>thing <01:30:16.858>that <01:30:16.965>I <01:30:17.073>also <01:30:17.181>have <01:30:17.288>to <01:30:17.396>note, <01:30:17.504>if <01:30:17.611>you <01:30:17.719>have <01:30:17.827>a <01:30:17.934>piece

2052
01:30:19.315 --> 01:30:21.595
<01:30:19.315>of <01:30:19.490>software <01:30:19.665>that <01:30:19.840>you <01:30:20.015>don't <01:30:20.190>update <01:30:20.365>regularly, <01:30:20.540>for <01:30:20.715>example,

2053
01:30:21.655 --> 01:30:24.555
<01:30:21.655>you <01:30:21.810>have <01:30:21.966>a <01:30:22.121>library, <01:30:22.277>um, <01:30:22.432>that <01:30:22.588>has <01:30:22.743>dependencies <01:30:22.899>to <01:30:23.054>others

2054
01:30:24.745 --> 01:30:26.195
<01:30:24.745>that <01:30:24.962>you <01:30:25.180>use <01:30:25.397>internally <01:30:25.615>in <01:30:25.832>your <01:30:26.049>company,

2055
01:30:26.655 --> 01:30:29.915
<01:30:26.655>and <01:30:26.795>maybe <01:30:26.934>every <01:30:27.075>two <01:30:27.215>weeks <01:30:27.355>a <01:30:27.495>commit <01:30:27.634>is <01:30:27.775>gonna <01:30:27.915>happen, <01:30:28.054>right?

2056
01:30:30.065 --> 01:30:31.955
<01:30:30.065>It's <01:30:30.298>not <01:30:30.531>something <01:30:30.765>that <01:30:30.998>changes <01:30:31.231>too <01:30:31.465>frequently.

2057
01:30:32.585 --> 01:30:35.355
<01:30:32.585>Then <01:30:32.740>do <01:30:32.896>that <01:30:33.051>regularly <01:30:33.207>if <01:30:33.362>even <01:30:33.518>if <01:30:33.673>no <01:30:33.829>pushes <01:30:33.985>happen,

2058
01:30:35.355 --> 01:30:38.675
<01:30:35.355>because <01:30:35.510>there <01:30:35.666>might <01:30:35.821>be <01:30:35.977>a <01:30:36.132>known <01:30:36.288>weakness <01:30:36.443>coming <01:30:36.599>up <01:30:36.754>in

2059
01:30:38.675 --> 01:30:39.795
<01:30:38.675>the <01:30:39.179>meantime, <01:30:39.683>right?

2060
01:30:39.935 --> 01:30:43.995
<01:30:39.934>So <01:30:40.075>do <01:30:40.214>it <01:30:40.355>on <01:30:40.495>each <01:30:40.634>push <01:30:40.775>plus <01:30:40.914>on <01:30:41.054>a <01:30:41.195>regular <01:30:41.334>basis.

2061
01:30:45.775 --> 01:30:47.075
<01:30:45.775>Um, <01:30:45.942>I <01:30:46.109>not <01:30:46.276>gonna <01:30:46.443>go <01:30:46.610>through <01:30:46.777>the <01:30:46.945>list,

2062
01:30:47.075 --> 01:30:48.915
<01:30:47.075>but <01:30:47.250>here <01:30:47.425>are <01:30:47.599>some <01:30:47.775>tools <01:30:47.950>that <01:30:48.125>you <01:30:48.300>can <01:30:48.474>use

2063
01:30:48.915 --> 01:30:50.595
<01:30:48.915>to <01:30:49.265>do <01:30:49.615>automated <01:30:49.965>dependency <01:30:50.315>checks.

2064
01:30:51.045 --> 01:30:53.635
<01:30:51.045>Maybe <01:30:51.245>do <01:30:51.445>a <01:30:51.645>quick <01:30:51.845>scan <01:30:52.045>for <01:30:52.245>your <01:30:52.445>technology.

2065
01:30:54.045 --> 01:30:58.155
<01:30:54.045>There <01:30:54.220>are <01:30:54.395>even <01:30:54.570>some <01:30:54.745>integrated <01:30:54.920>into, <01:30:55.095>um, <01:30:55.270>you <01:30:55.445>know,

2066
01:30:58.325 --> 01:31:02.675
<01:30:58.325>well-known <01:30:58.605>repository <01:30:58.885>software, <01:30:59.165>uh, <01:30:59.445>like <01:30:59.724>GitLab

2067
01:31:02.675 --> 01:31:04.315
<01:31:02.675>or <01:31:02.955>GitHub <01:31:03.235>that <01:31:03.515>you <01:31:03.795>can <01:31:04.075>use.

2068
01:31:04.545 --> 01:31:06.315
<01:31:04.545>Some <01:31:04.778>commercial <01:31:05.011>ones <01:31:05.245>here <01:31:05.478>on <01:31:05.711>the <01:31:05.945>bottom

2069
01:31:06.575 --> 01:31:08.395
<01:31:06.575>and <01:31:06.750>some <01:31:06.925>open <01:31:07.099>source <01:31:07.275>ones <01:31:07.450>here <01:31:07.625>at <01:31:07.800>the <01:31:07.974>top.

2070
01:31:10.815 --> 01:31:12.595
<01:31:10.815>All <01:31:11.165>right, <01:31:11.515>developers, <01:31:11.865>checklist, <01:31:12.215>dependencies.

2071
01:31:12.615 --> 01:31:13.595
<01:31:12.615>How <01:31:12.791>are <01:31:12.967>you <01:31:13.144>gonna <01:31:13.320>deal <01:31:13.497>with

2072
01:31:13.595 --> 01:31:14.875
<01:31:13.595>dependencies <01:31:13.883>in <01:31:14.171>terms <01:31:14.459>of <01:31:14.747>security?

2073
01:31:15.125 --> 01:31:18.195
<01:31:15.125>First, <01:31:15.280>choose <01:31:15.436>them <01:31:15.591>wisely. <01:31:15.747>Don't <01:31:15.902>just <01:31:16.058>pull <01:31:16.213>in <01:31:16.369>a <01:31:16.525>library.

2074
01:31:18.455 --> 01:31:20.915
<01:31:18.455>That's <01:31:18.735>actually <01:31:19.015>just <01:31:19.295>a <01:31:19.575>function, <01:31:19.855>right?

2075
01:31:21.105 --> 01:31:24.435
<01:31:21.105>It's <01:31:21.260>gonna <01:31:21.416>open <01:31:21.571>yourself <01:31:21.727>up <01:31:21.882>to, <01:31:22.038>uh, <01:31:22.193>you <01:31:22.349>know, <01:31:22.504>it,

2076
01:31:24.455 --> 01:31:26.555
<01:31:24.455>it <01:31:24.630>makes <01:31:24.805>the, <01:31:24.980>the, <01:31:25.155>the <01:31:25.330>attack <01:31:25.505>surface <01:31:25.680>way <01:31:25.855>bigger

2077
01:31:26.585 --> 01:31:27.755
<01:31:26.585>than <01:31:26.848>it <01:31:27.111>has <01:31:27.374>to <01:31:27.638>be.

2078
01:31:29.015 --> 01:31:31.315
<01:31:29.015>Um, <01:31:29.295>so <01:31:29.575>have <01:31:29.855>a <01:31:30.135>declarative <01:31:30.415>machine

2079
01:31:31.315 --> 01:31:32.635
<01:31:31.315>readable <01:31:31.711>list <01:31:32.107>of <01:31:32.503>dependencies.

2080
01:31:34.095 --> 01:31:36.755
<01:31:34.095>Uh, <01:31:34.250>that's <01:31:34.406>so <01:31:34.561>that <01:31:34.717>an <01:31:34.872>automated <01:31:35.028>tool <01:31:35.183>can <01:31:35.339>get <01:31:35.495>it

2081
01:31:36.775 --> 01:31:38.955
<01:31:36.775>and <01:31:36.930>can, <01:31:37.086>you <01:31:37.241>know, <01:31:37.397>can <01:31:37.552>check <01:31:37.708>it <01:31:37.863>for <01:31:38.019>normal <01:31:38.174>bilities

2082
01:31:39.845 --> 01:31:41.875
<01:31:39.845>check <01:31:40.125>dependencies <01:31:40.405>in <01:31:40.685>an <01:31:40.965>automated <01:31:41.245>way.

2083
01:31:41.875 --> 01:31:44.395
<01:31:41.875>It's, <01:31:42.030>it, <01:31:42.186>it <01:31:42.341>just <01:31:42.497>doesn't <01:31:42.652>work <01:31:42.808>With <01:31:42.963>a <01:31:43.119>manual <01:31:43.275>process.

2084
01:31:45.465 --> 01:31:47.995
<01:31:45.465>Fail <01:31:45.640>build, <01:31:45.815>if <01:31:45.990>there <01:31:46.165>are <01:31:46.340>severe <01:31:46.515>vulnerabilities <01:31:46.690>in <01:31:46.865>there,

2085
01:31:49.055 --> 01:31:50.155
<01:31:49.055>uh, <01:31:50.045>rebuild

2086
01:31:50.335 --> 01:31:54.235
<01:31:50.335>and, <01:31:50.475>uh, <01:31:50.615>run <01:31:50.755>the <01:31:50.895>text <01:31:51.035>regularly <01:31:51.175>if <01:31:51.315>there's <01:31:51.455>no <01:31:51.595>push <01:31:51.735>so

2087
01:31:54.235 --> 01:31:55.995
<01:31:54.235>that <01:31:54.410>you <01:31:54.585>can <01:31:54.759>get <01:31:54.934>to <01:31:55.110>the <01:31:55.285>most <01:31:55.460>current <01:31:55.634>version

2088
01:31:55.995 --> 01:31:57.435
<01:31:55.995>of <01:31:56.427>your <01:31:56.858>library, <01:31:57.290>right?

2089
01:31:58.495 --> 01:32:00.605
<01:31:58.495>The <01:31:58.670>advanced <01:31:58.845>thing, <01:31:59.019>think <01:31:59.195>back, <01:31:59.370>back <01:31:59.545>of <01:31:59.720>the <01:31:59.894>image

2090
01:32:00.605 --> 01:32:03.165
<01:32:00.605>with <01:32:00.760>the <01:32:00.916>wave, <01:32:01.071>with <01:32:01.227>the <01:32:01.382>surfer <01:32:01.538>in <01:32:01.693>front <01:32:01.849>of <01:32:02.004>it.

2091
01:32:03.595 --> 01:32:05.125
<01:32:03.595>When <01:32:03.870>you <01:32:04.145>have <01:32:04.421>good <01:32:04.696>test <01:32:04.972>coverage

2092
01:32:05.425 --> 01:32:07.805
<01:32:05.425>and <01:32:05.600>you <01:32:05.775>have <01:32:05.950>about <01:32:06.125>submit <01:32:06.300>pull <01:32:06.475>requests <01:32:06.650>with <01:32:06.825>updates

2093
01:32:07.805 --> 01:32:10.325
<01:32:07.805>to <01:32:08.005>your <01:32:08.205>libraries, <01:32:08.405>and <01:32:08.605>they <01:32:08.805>are <01:32:09.005>automatically <01:32:09.205>merged.

2094
01:32:10.325 --> 01:32:14.085
<01:32:10.325>When <01:32:10.452>the <01:32:10.579>tests <01:32:10.706>are <01:32:10.834>green, <01:32:10.961>you <01:32:11.088>will <01:32:11.215>let <01:32:11.343>the <01:32:11.470>wave <01:32:11.597>push <01:32:11.724>you,

2095
01:32:14.385 --> 01:32:16.205
<01:32:14.385>and <01:32:14.665>sometimes <01:32:14.945>you <01:32:15.225>will <01:32:15.505>fall <01:32:15.785>down

2096
01:32:16.305 --> 01:32:17.925
<01:32:16.305>and <01:32:16.505>you <01:32:16.705>will <01:32:16.905>be <01:32:17.105>sucked <01:32:17.305>below <01:32:17.505>the <01:32:17.705>wave,

2097
01:32:18.545 --> 01:32:21.565
<01:32:18.545>but <01:32:18.720>in <01:32:18.895>maybe <01:32:19.070>70, <01:32:19.245>80% <01:32:19.420>of <01:32:19.595>the <01:32:19.770>times <01:32:19.945>it's,

2098
01:32:21.565 --> 01:32:23.845
<01:32:21.565>the <01:32:21.798>updates <01:32:22.031>are <01:32:22.265>just <01:32:22.498>going <01:32:22.731>completely <01:32:22.965>automatically.

2099
01:32:23.845 --> 01:32:25.085
<01:32:23.845>So <01:32:24.217>that's <01:32:24.589>advanced <01:32:24.961>thing

2100
01:32:25.085 --> 01:32:27.285
<01:32:25.085>that <01:32:25.318>will <01:32:25.551>cost <01:32:25.785>you <01:32:26.018>some <01:32:26.251>initial <01:32:26.485>velocity

2101
01:32:27.285 --> 01:32:29.605
<01:32:27.285>because <01:32:27.565>you'll <01:32:27.845>have <01:32:28.125>to <01:32:28.405>code <01:32:28.684>that.

2102
01:32:29.625 --> 01:32:31.245
<01:32:29.625>You <01:32:29.858>will, <01:32:30.091>you <01:32:30.325>will <01:32:30.558>have <01:32:30.791>to, <01:32:31.025>uh,

2103
01:32:31.245 --> 01:32:32.485
<01:32:31.245>write <01:32:31.404>the <01:32:31.563>test <01:32:31.723>for <01:32:31.882>it <01:32:32.042>and <01:32:32.201>so <01:32:32.361>on.

2104
01:32:33.345 --> 01:32:35.285
<01:32:33.345>But <01:32:33.578>it <01:32:33.811>will <01:32:34.045>give <01:32:34.278>you <01:32:34.511>sustained <01:32:34.745>velocity

2105
01:32:35.285 --> 01:32:37.565
<01:32:35.285>because <01:32:35.565>you <01:32:35.845>don't <01:32:36.125>have <01:32:36.405>to, <01:32:36.684>uh,

2106
01:32:37.585 --> 01:32:39.805
<01:32:37.585>do <01:32:37.785>the <01:32:37.985>dependency <01:32:38.185>updates <01:32:38.385>over <01:32:38.585>and <01:32:38.785>over <01:32:38.985>again.

2107
01:32:42.425 --> 01:32:47.205
<01:32:42.425>All <01:32:42.600>right, <01:32:42.775>we <01:32:42.950>are <01:32:43.125>slowly <01:32:43.300>getting <01:32:43.475>towards <01:32:43.650>the <01:32:43.825>end

2108
01:32:48.225 --> 01:32:51.005
<01:32:48.225>of <01:32:48.458>this <01:32:48.691>workshop, <01:32:48.925>about <01:32:49.158>10 <01:32:49.391>minutes <01:32:49.625>left,

2109
01:32:51.005 --> 01:32:53.645
<01:32:51.005>and <01:32:51.145>then <01:32:51.285>we <01:32:51.425>have, <01:32:51.565>uh, <01:32:51.705>a <01:32:51.845>few <01:32:51.985>more <01:32:52.125>minutes <01:32:52.265>to <01:32:52.405>do,

2110
01:32:54.985 --> 01:32:56.405
<01:32:54.985>um, <01:32:55.411>questions <01:32:55.837>and <01:32:56.263>answers.

2111
01:32:57.745 --> 01:33:01.125
<01:32:57.745>Um, <01:32:58.025>we <01:32:58.305>talked <01:32:58.585>about <01:32:58.865>secure <01:32:59.144>coding.

2112
01:33:01.385 --> 01:33:03.645
<01:33:01.385>Now <01:33:01.665>the <01:33:01.945>principles <01:33:02.225>of <01:33:02.505>secure <01:33:02.785>coding

2113
01:33:03.785 --> 01:33:04.805
<01:33:03.785>and <01:33:04.014>some <01:33:04.244>things <01:33:04.473>around <01:33:04.703>it.

2114
01:33:05.345 --> 01:33:06.605
<01:33:05.345>Um, <01:33:05.723>I <01:33:06.101>also <01:33:06.478>want

2115
01:33:06.605 --> 01:33:09.005
<01:33:06.605>to <01:33:06.760>go <01:33:06.916>a <01:33:07.071>little <01:33:07.227>bit <01:33:07.382>into <01:33:07.538>a <01:33:07.693>secure <01:33:07.849>development <01:33:08.004>lifecycle.

2116
01:33:09.425 --> 01:33:12.765
<01:33:09.425>So, <01:33:09.580>you <01:33:09.736>know, <01:33:09.891>sometimes <01:33:10.047>when <01:33:10.202>developers <01:33:10.358>hear <01:33:10.513>a <01:33:10.669>word <01:33:10.825>process

2117
01:33:13.225 --> 01:33:15.525
<01:33:13.225>or, <01:33:13.425>or <01:33:13.625>something <01:33:13.825>like <01:33:14.025>they <01:33:14.225>just, <01:33:14.425>they <01:33:14.625>turn,

2118
01:33:15.835 --> 01:33:17.005
<01:33:15.835>turn <01:33:16.098>around <01:33:16.361>and <01:33:16.624>run <01:33:16.888>away.

2119
01:33:17.465 --> 01:33:19.245
<01:33:17.465>Um, <01:33:17.745>but <01:33:18.025>I <01:33:18.305>don't <01:33:18.585>think, <01:33:18.865>um,

2120
01:33:20.245 --> 01:33:22.165
<01:33:20.245>I <01:33:20.420>think <01:33:20.595>it's <01:33:20.769>worth <01:33:20.945>looking <01:33:21.120>at <01:33:21.295>other <01:33:21.470>things <01:33:21.644>than

2121
01:33:22.195 --> 01:33:23.365
<01:33:22.195>just <01:33:22.721>coding, <01:33:23.248>right?

2122
01:33:24.225 --> 01:33:26.725
<01:33:24.225>Um, <01:33:24.400>you <01:33:24.575>might <01:33:24.750>have <01:33:24.925>heard <01:33:25.100>the <01:33:25.275>term <01:33:25.450>shifting <01:33:25.625>left,

2123
01:33:26.945 --> 01:33:29.005
<01:33:26.945>and <01:33:27.085>we <01:33:27.224>need <01:33:27.365>to <01:33:27.505>shift <01:33:27.644>left <01:33:27.785>in <01:33:27.924>terms <01:33:28.065>of <01:33:28.205>security <01:33:28.344>shifting.

2124
01:33:29.005 --> 01:33:31.245
<01:33:29.005>Left <01:33:29.205>just <01:33:29.405>means <01:33:29.605>when <01:33:29.805>you <01:33:30.005>have <01:33:30.205>a <01:33:30.405>timeline,

2125
01:33:31.345 --> 01:33:32.845
<01:33:31.345>you <01:33:31.795>start <01:33:32.245>with <01:33:32.695>requirements.

2126
01:33:32.845 --> 01:33:36.725
<01:33:32.845>You <01:33:32.985>do <01:33:33.125>design, <01:33:33.265>um, <01:33:33.405>you <01:33:33.545>do <01:33:33.685>technology <01:33:33.825>choices <01:33:33.965>and <01:33:34.105>so <01:33:34.245>on,

2127
01:33:36.725 --> 01:33:38.725
<01:33:36.725>and <01:33:36.852>then <01:33:36.979>you <01:33:37.106>do <01:33:37.234>the <01:33:37.361>coding, <01:33:37.488>and <01:33:37.615>then <01:33:37.743>you <01:33:37.870>do <01:33:37.997>the <01:33:38.125>testing.

2128
01:33:39.385 --> 01:33:41.805
<01:33:39.385>Um, <01:33:39.585>if <01:33:39.785>that <01:33:39.985>goes <01:33:40.185>from <01:33:40.385>left <01:33:40.585>to <01:33:40.785>right,

2129
01:33:42.325 --> 01:33:45.285
<01:33:42.325>shifting <01:33:42.525>left <01:33:42.724>means <01:33:42.925>just <01:33:43.125>considering <01:33:43.325>security <01:33:43.525>earlier <01:33:43.724>in

2130
01:33:45.285 --> 01:33:48.245
<01:33:45.285>that <01:33:45.460>process <01:33:45.635>also, <01:33:45.809>or <01:33:45.985>already <01:33:46.160>in <01:33:46.335>the <01:33:46.510>requirements <01:33:46.684>analysis,

2131
01:33:48.265 --> 01:33:51.715
<01:33:48.265>for <01:33:48.545>example, <01:33:48.825>um, <01:33:49.105>there's <01:33:49.385>one <01:33:49.665>model

2132
01:33:51.985 --> 01:33:53.715
<01:33:51.985>that <01:33:52.335>is <01:33:52.684>called <01:33:53.035>Oasp <01:33:53.384>sam,

2133
01:33:53.715 --> 01:33:56.035
<01:33:53.715>that's <01:33:53.995>a <01:33:54.275>software <01:33:54.555>assurance <01:33:54.835>maturity <01:33:55.115>model.

2134
01:33:56.215 --> 01:33:57.795
<01:33:56.215>That's <01:33:56.495>a, <01:33:56.775>a <01:33:57.055>really <01:33:57.335>good <01:33:57.615>tool.

2135
01:33:57.855 --> 01:34:01.795
<01:33:57.855>That's <01:33:57.995>one <01:33:58.134>of <01:33:58.275>the <01:33:58.415>more <01:33:58.554>major <01:33:58.695>projects <01:33:58.834>of <01:33:58.974>the <01:33:59.115>Oass <01:33:59.254>project.

2136
01:34:02.735 --> 01:34:05.475
<01:34:02.735>Um, <01:34:02.890>and <01:34:03.046>that <01:34:03.201>you <01:34:03.357>can <01:34:03.512>use <01:34:03.668>to <01:34:03.823>assess <01:34:03.979>the <01:34:04.134>security

2137
01:34:05.475 --> 01:34:06.875
<01:34:05.475>of <01:34:05.790>your <01:34:06.105>software <01:34:06.420>development <01:34:06.735>lifecycle.

2138
01:34:06.895 --> 01:34:08.235
<01:34:06.895>You <01:34:07.029>can <01:34:07.163>do <01:34:07.297>it <01:34:07.431>on <01:34:07.565>your <01:34:07.699>own, <01:34:07.833>you <01:34:07.967>can <01:34:08.101>do

2139
01:34:08.235 --> 01:34:09.515
<01:34:08.235>it <01:34:08.619>for <01:34:09.003>yourself, <01:34:09.387>basically.

2140
01:34:10.135 --> 01:34:12.795
<01:34:10.135>Um, <01:34:10.310>I <01:34:10.485>do <01:34:10.660>that <01:34:10.835>also <01:34:11.010>with <01:34:11.185>customers <01:34:11.360>of <01:34:11.535>ours.

2141
01:34:12.895 --> 01:34:15.475
<01:34:12.895>So, <01:34:13.050>um, <01:34:13.206>you <01:34:13.361>know, <01:34:13.517>we <01:34:13.672>sit <01:34:13.828>together <01:34:13.983>for <01:34:14.139>a <01:34:14.295>day

2142
01:34:15.735 --> 01:34:18.355
<01:34:15.735>and <01:34:15.968>that's, <01:34:16.201>there's <01:34:16.435>an <01:34:16.668>interview <01:34:16.901>Excel <01:34:17.135>sheet

2143
01:34:18.355 --> 01:34:20.795
<01:34:18.355>that <01:34:18.530>you <01:34:18.705>could <01:34:18.879>use <01:34:19.054>and <01:34:19.230>to <01:34:19.405>answer <01:34:19.580>some <01:34:19.754>questions,

2144
01:34:20.795 --> 01:34:22.275
<01:34:20.795>and <01:34:20.985>it's <01:34:21.175>gonna <01:34:21.365>give <01:34:21.556>you <01:34:21.746>a <01:34:21.936>score <01:34:22.126>in

2145
01:34:22.275 --> 01:34:23.355
<01:34:22.275>each <01:34:22.437>of <01:34:22.598>each <01:34:22.760>one <01:34:22.923>of <01:34:23.084>those <01:34:23.246>areas.

2146
01:34:24.295 --> 01:34:26.475
<01:34:24.295>Um, <01:34:24.575>so <01:34:24.855>we <01:34:25.135>covered <01:34:25.415>some <01:34:25.695>parts

2147
01:34:26.495 --> 01:34:28.315
<01:34:26.495>or <01:34:26.728>some <01:34:26.961>aspects <01:34:27.195>of <01:34:27.428>the <01:34:27.661>implementation <01:34:27.894>part,

2148
01:34:28.335 --> 01:34:30.355
<01:34:28.335>but <01:34:28.510>there's <01:34:28.685>way <01:34:28.860>more <01:34:29.035>that <01:34:29.210>you <01:34:29.385>can <01:34:29.560>do <01:34:29.735>to

2149
01:34:30.985 --> 01:34:32.515
<01:34:30.985>have <01:34:31.444>software <01:34:31.903>security <01:34:32.361>assurance.

2150
01:34:33.335 --> 01:34:37.035
<01:34:33.335>Um, <01:34:33.510>one <01:34:33.685>very <01:34:33.860>important <01:34:34.035>part <01:34:34.210>is <01:34:34.385>training <01:34:34.560>and <01:34:34.735>awareness.

2151
01:34:37.415 --> 01:34:40.835
<01:34:37.415>So, <01:34:37.881>um, <01:34:38.348>basically <01:34:38.815>exactly

2152
01:34:40.835 --> 01:34:43.065
<01:34:40.835>what <01:34:41.068>we <01:34:41.301>are <01:34:41.535>doing <01:34:41.768>right <01:34:42.001>now, <01:34:42.235>right?

2153
01:34:43.365 --> 01:34:44.705
<01:34:43.365>Uh, <01:34:43.606>you <01:34:43.847>are <01:34:44.088>in <01:34:44.329>a <01:34:44.571>training

2154
01:34:44.765 --> 01:34:47.225
<01:34:44.764>to <01:34:44.964>give <01:34:45.164>you <01:34:45.365>more <01:34:45.565>awareness <01:34:45.764>about <01:34:45.964>security <01:34:46.164>problems,

2155
01:34:47.645 --> 01:34:49.425
<01:34:47.645>and <01:34:47.925>that's <01:34:48.205>also <01:34:48.485>an <01:34:48.765>essential <01:34:49.045>part

2156
01:34:49.425 --> 01:34:50.945
<01:34:49.425>of <01:34:49.767>a <01:34:50.109>software <01:34:50.451>development <01:34:50.793>lifecycle.

2157
01:34:51.735 --> 01:34:53.665
<01:34:51.735>Give <01:34:52.015>your <01:34:52.295>people <01:34:52.575>trainings <01:34:52.855>and <01:34:53.135>awareness

2158
01:34:53.725 --> 01:34:55.465
<01:34:53.725>and <01:34:53.958>give <01:34:54.191>them <01:34:54.425>the <01:34:54.658>opportunity <01:34:54.891>to <01:34:55.125>learn,

2159
01:34:56.205 --> 01:34:59.765
<01:34:56.205>or, <01:34:56.345>for <01:34:56.485>example, <01:34:56.625>having <01:34:56.765>an <01:34:56.905>overview <01:34:57.045>of <01:34:57.184>what <01:34:57.325>is <01:34:57.465>relevant, <01:34:57.605>uh,

2160
01:34:59.865 --> 01:35:02.245
<01:34:59.865>for <01:35:00.065>us <01:35:00.264>in <01:35:00.465>terms <01:35:00.665>of <01:35:00.865>laws <01:35:01.065>and <01:35:01.264>regulations,

2161
01:35:03.185 --> 01:35:05.405
<01:35:03.184>or <01:35:03.464>have <01:35:03.745>a <01:35:04.025>security <01:35:04.304>testing <01:35:04.584>pipeline.

2162
01:35:05.425 --> 01:35:08.725
<01:35:05.425>So <01:35:05.600>for <01:35:05.775>example, <01:35:05.950>having <01:35:06.125>an <01:35:06.300>automated <01:35:06.475>tool <01:35:06.650>do <01:35:06.825>automated

2163
01:35:08.915 --> 01:35:10.405
<01:35:08.915>automated <01:35:09.585>security <01:35:10.256>checks.

2164
01:35:10.655 --> 01:35:13.925
<01:35:10.655>Every <01:35:10.830>time <01:35:11.005>I <01:35:11.180>push <01:35:11.355>something <01:35:11.530>to <01:35:11.705>the <01:35:11.880>repository, <01:35:12.055>uh,

2165
01:35:14.005 --> 01:35:17.925
<01:35:14.005>I <01:35:14.145>think <01:35:14.285>it's <01:35:14.425>one <01:35:14.565>very <01:35:14.705>valuable, <01:35:14.845>uh, <01:35:14.985>dis <01:35:15.125>distinction <01:35:15.265>in <01:35:15.405>this,

2166
01:35:18.105 --> 01:35:20.005
<01:35:18.105>um, <01:35:18.338>or <01:35:18.571>summit <01:35:18.804>is <01:35:19.038>that <01:35:19.271>they <01:35:19.504>distinguish

2167
01:35:20.005 --> 01:35:22.685
<01:35:20.005>between <01:35:20.238>the <01:35:20.471>scalable <01:35:20.705>baseline <01:35:20.938>and <01:35:21.171>deep <01:35:21.405>understanding.

2168
01:35:23.305 --> 01:35:25.125
<01:35:23.305>And <01:35:23.505>that's <01:35:23.705>exactly <01:35:23.905>what <01:35:24.105>I <01:35:24.305>told <01:35:24.505>you <01:35:24.705>before.

2169
01:35:25.575 --> 01:35:27.525
<01:35:25.575>There <01:35:25.750>might <01:35:25.925>be <01:35:26.099>some <01:35:26.275>things <01:35:26.450>that, <01:35:26.625>uh, <01:35:26.800>you <01:35:26.974>know,

2170
01:35:28.025 --> 01:35:30.485
<01:35:28.025>the <01:35:28.258>wrong <01:35:28.491>usage <01:35:28.724>of <01:35:28.958>a <01:35:29.191>cryptographic <01:35:29.424>algorithm

2171
01:35:30.665 --> 01:35:34.765
<01:35:30.665>or, <01:35:30.840>um, <01:35:31.015>I <01:35:31.190>don't <01:35:31.365>know, <01:35:31.540>omitting <01:35:31.715>the <01:35:31.890>initialization <01:35:32.065>vector.

2172
01:35:34.795 --> 01:35:36.445
<01:35:34.795>When <01:35:35.145>you <01:35:35.495>think <01:35:35.845>using <01:35:36.195>cryptography

2173
01:35:36.445 --> 01:35:38.725
<01:35:36.445>or <01:35:36.620>doing <01:35:36.795>an <01:35:36.969>SQL <01:35:37.144>injection, <01:35:37.320>that's <01:35:37.495>something <01:35:37.670>that <01:35:37.844>is

2174
01:35:39.505 --> 01:35:41.125
<01:35:39.505>almost <01:35:39.971>certainly <01:35:40.438>not <01:35:40.905>desirable,

2175
01:35:41.305 --> 01:35:43.005
<01:35:41.305>and <01:35:41.538>some <01:35:41.771>tools <01:35:42.005>can <01:35:42.238>find <01:35:42.471>it, <01:35:42.705>right?

2176
01:35:43.405 --> 01:35:45.045
<01:35:43.405>I <01:35:43.580>can <01:35:43.755>do <01:35:43.930>that <01:35:44.105>at <01:35:44.280>scale <01:35:44.455>because <01:35:44.630>it's <01:35:44.805>something

2177
01:35:45.085 --> 01:35:46.205
<01:35:45.085>I <01:35:45.337>definitely <01:35:45.589>do <01:35:45.841>not <01:35:46.093>want.

2178
01:35:46.305 --> 01:35:49.165
<01:35:46.305>And <01:35:46.480>that <01:35:46.655>applies <01:35:46.830>to <01:35:47.005>everything <01:35:47.180>that's <01:35:47.355>a <01:35:47.530>scalable <01:35:47.705>baseline.

2179
01:35:49.165 --> 01:35:52.205
<01:35:49.165>That's <01:35:49.281>a <01:35:49.398>few <01:35:49.515>things <01:35:49.631>that <01:35:49.748>I <01:35:49.865>can <01:35:49.981>pick <01:35:50.098>out <01:35:50.215>that <01:35:50.331>I <01:35:50.448>can <01:35:50.565>scan

2180
01:35:52.385 --> 01:35:55.085
<01:35:52.385>for <01:35:52.540>very <01:35:52.696>easily, <01:35:52.851>that <01:35:53.007>are <01:35:53.162>easily <01:35:53.318>detected <01:35:53.473>and <01:35:53.629>so <01:35:53.785>on.

2181
01:35:55.385 --> 01:35:57.445
<01:35:55.385>But <01:35:55.560>in <01:35:55.735>order <01:35:55.910>to <01:35:56.085>make <01:35:56.260>my <01:35:56.435>software <01:35:56.610>really <01:35:56.785>solid

2182
01:35:57.465 --> 01:36:00.325
<01:35:57.465>and <01:35:57.640>secure, <01:35:57.815>I <01:35:57.990>need <01:35:58.165>deep <01:35:58.340>understanding <01:35:58.515>for <01:35:58.690>those <01:35:58.865>problems.

2183
01:36:00.345 --> 01:36:02.365
<01:36:00.344>That's <01:36:00.544>just <01:36:00.744>what <01:36:00.945>we <01:36:01.144>did <01:36:01.344>with <01:36:01.544>the <01:36:01.744>angular

2184
01:36:02.365 --> 01:36:03.845
<01:36:02.365>and <01:36:02.697>cross <01:36:03.031>scripting <01:36:03.364>problem <01:36:03.696>before.

2185
01:36:04.545 --> 01:36:07.285
<01:36:04.545>So <01:36:04.685>you're <01:36:04.825>not <01:36:04.965>gonna <01:36:05.105>be <01:36:05.245>able <01:36:05.385>to <01:36:05.525>just <01:36:05.665>automate <01:36:05.805>a <01:36:05.945>way,

2186
01:36:07.285 --> 01:36:08.845
<01:36:07.285>everything, <01:36:07.635>it's <01:36:07.985>not <01:36:08.335>gonna <01:36:08.684>work.

2187
01:36:09.065 --> 01:36:11.365
<01:36:09.065>You <01:36:09.265>need <01:36:09.465>a <01:36:09.665>baseline <01:36:09.865>that <01:36:10.065>can <01:36:10.265>be <01:36:10.465>scaled.

2188
01:36:11.825 --> 01:36:14.005
<01:36:11.825>You <01:36:12.058>need <01:36:12.291>deep <01:36:12.525>understanding <01:36:12.758>for <01:36:12.991>certain <01:36:13.224>problems.

2189
01:36:15.505 --> 01:36:18.805
<01:36:15.505>Uh, <01:36:15.705>also, <01:36:15.905>uh, <01:36:16.105>it <01:36:16.305>has <01:36:16.505>some <01:36:16.705>assurance, <01:36:16.905>uh,

2190
01:36:18.805 --> 01:36:20.325
<01:36:18.805>activities <01:36:19.147>on <01:36:19.489>the <01:36:19.831>operations <01:36:20.173>level.

2191
01:36:20.425 --> 01:36:23.965
<01:36:20.425>So <01:36:20.705>logging, <01:36:20.985>monitoring, <01:36:21.265>incident <01:36:21.545>response, <01:36:21.825>um,

2192
01:36:24.265 --> 01:36:27.285
<01:36:24.264>and <01:36:24.420>altogether <01:36:24.576>it <01:36:24.731>is <01:36:24.887>a <01:36:25.042>prescriptive <01:36:25.198>model <01:36:25.353>that, <01:36:25.509>you <01:36:25.664>know,

2193
01:36:27.655 --> 01:36:31.005
<01:36:27.655>gives <01:36:28.005>suggestions, <01:36:28.355>suggestions, <01:36:28.705>uh, <01:36:29.055>of

2194
01:36:31.005 --> 01:36:32.165
<01:36:31.005>what <01:36:31.266>exactly <01:36:31.527>you <01:36:31.788>can <01:36:32.049>do

2195
01:36:32.625 --> 01:36:34.645
<01:36:32.625>to <01:36:32.825>make <01:36:33.025>your <01:36:33.225>software <01:36:33.425>development <01:36:33.625>process <01:36:33.825>more <01:36:34.025>secure.

2196
01:36:35.275 --> 01:36:37.325
<01:36:35.275>Also, <01:36:35.450>very <01:36:35.625>important <01:36:35.799>part <01:36:35.974>from <01:36:36.150>my <01:36:36.325>point <01:36:36.500>of <01:36:36.674>view,

2197
01:36:37.425 --> 01:36:41.485
<01:36:37.425>the <01:36:37.600>most <01:36:37.775>underrepresented <01:36:37.950>one <01:36:38.125>probably <01:36:38.300>is <01:36:38.475>the <01:36:38.650>design <01:36:38.825>part.

2198
01:36:41.985 --> 01:36:43.885
<01:36:41.985>So, <01:36:42.335>for <01:36:42.685>example, <01:36:43.035>threat <01:36:43.385>modeling.

2199
01:36:45.925 --> 01:36:48.205
<01:36:45.925>Remember <01:36:46.065>back, <01:36:46.205>uh, <01:36:46.345>in <01:36:46.485>the, <01:36:46.625>in <01:36:46.765>one <01:36:46.905>of <01:36:47.045>the <01:36:47.185>first <01:36:47.325>slides,

2200
01:36:48.265 --> 01:36:50.845
<01:36:48.264>we <01:36:48.464>made <01:36:48.664>a <01:36:48.865>distinction <01:36:49.065>between <01:36:49.264>bugs <01:36:49.464>and <01:36:49.664>flaws.

2201
01:36:50.915 --> 01:36:52.605
<01:36:50.915>Bugs <01:36:51.265>are <01:36:51.615>related <01:36:51.965>to <01:36:52.315>implementation.

2202
01:36:52.935 --> 01:36:54.965
<01:36:52.934>Flaws <01:36:53.168>are <01:36:53.401>related <01:36:53.634>to <01:36:53.868>architecture <01:36:54.101>and <01:36:54.334>design.

2203
01:36:55.465 --> 01:36:59.125
<01:36:55.465>In <01:36:55.620>order <01:36:55.776>to <01:36:55.931>find <01:36:56.087>bugs, <01:36:56.242>I <01:36:56.398>can <01:36:56.553>do <01:36:56.709>code <01:36:56.865>reviews

2204
01:36:59.145 --> 01:37:01.085
<01:36:59.145>and <01:36:59.611>automation, <01:37:00.078>static <01:37:00.545>analysis,

2205
01:37:01.085 --> 01:37:03.805
<01:37:01.085>and <01:37:01.260>on, <01:37:01.435>in <01:37:01.610>order <01:37:01.785>to <01:37:01.960>find <01:37:02.135>flaws <01:37:02.310>on <01:37:02.485>the

2206
01:37:03.805 --> 01:37:04.845
<01:37:03.805>design <01:37:04.117>and <01:37:04.429>architecture <01:37:04.740>level.

2207
01:37:04.905 --> 01:37:07.725
<01:37:04.905>That's <01:37:05.021>not <01:37:05.138>gonna <01:37:05.255>be <01:37:05.371>able, <01:37:05.488>we <01:37:05.605>are <01:37:05.721>not <01:37:05.838>gonna <01:37:05.955>be <01:37:06.071>able <01:37:06.188>to <01:37:06.305>do

2208
01:37:07.725 --> 01:37:10.405
<01:37:07.725>that, <01:37:07.958>uh, <01:37:08.191>with <01:37:08.425>a <01:37:08.658>completed <01:37:08.891>automated <01:37:09.125>tool.

2209
01:37:10.745 --> 01:37:12.325
<01:37:10.745>That's <01:37:11.211>where <01:37:11.678>threat <01:37:12.144>assessments

2210
01:37:12.325 --> 01:37:14.485
<01:37:12.325>or <01:37:12.605>threat <01:37:12.885>modeling, <01:37:13.165>uh, <01:37:13.445>kicks <01:37:13.724>in.

2211
01:37:14.585 --> 01:37:16.405
<01:37:14.585>So <01:37:14.785>we <01:37:14.985>also <01:37:15.185>do <01:37:15.385>that <01:37:15.585>with <01:37:15.785>our <01:37:15.985>customers.

2212
01:37:16.785 --> 01:37:18.165
<01:37:16.785>We <01:37:17.095>threat <01:37:17.406>model <01:37:17.716>their <01:37:18.027>software,

2213
01:37:18.225 --> 01:37:20.725
<01:37:18.225>and <01:37:18.505>then <01:37:18.785>we <01:37:19.065>hopefully <01:37:19.345>find <01:37:19.625>problems,

2214
01:37:20.905 --> 01:37:24.285
<01:37:20.905>or <01:37:21.060>hopefully <01:37:21.216>not, <01:37:21.371>depending <01:37:21.527>on <01:37:21.682>how <01:37:21.838>you <01:37:21.993>see <01:37:22.149>it, <01:37:22.305>uh,

2215
01:37:24.355 --> 01:37:25.965
<01:37:24.355>find <01:37:24.634>problems <01:37:24.915>on <01:37:25.195>a <01:37:25.474>design <01:37:25.754>level.

2216
01:37:26.865 --> 01:37:28.565
<01:37:26.865>If <01:37:27.020>you <01:37:27.176>do <01:37:27.331>that <01:37:27.487>early <01:37:27.642>on, <01:37:27.798>you <01:37:27.953>can <01:37:28.109>even <01:37:28.264>do

2217
01:37:28.565 --> 01:37:31.565
<01:37:28.565>that <01:37:28.798>when <01:37:29.031>there's <01:37:29.265>no <01:37:29.498>code <01:37:29.731>available <01:37:29.965>yet.

2218
01:37:32.265 --> 01:37:35.165
<01:37:32.264>And <01:37:32.420>just, <01:37:32.576>uh, <01:37:32.731>the <01:37:32.887>rough <01:37:33.042>the <01:37:33.198>technology <01:37:33.353>choices <01:37:33.509>are <01:37:33.664>there,

2219
01:37:35.225 --> 01:37:38.245
<01:37:35.225>the <01:37:35.365>components <01:37:35.505>that <01:37:35.645>are, <01:37:35.785>uh, <01:37:35.925>you <01:37:36.065>know, <01:37:36.205>the, <01:37:36.345>the <01:37:36.485>rough <01:37:36.625>design

2220
01:37:38.345 --> 01:37:39.485
<01:37:38.344>and <01:37:38.687>architecture <01:37:39.029>is <01:37:39.371>ready.

2221
01:37:40.025 --> 01:37:42.125
<01:37:40.025>So <01:37:40.258>that's <01:37:40.491>happening <01:37:40.724>before <01:37:40.958>the <01:37:41.191>implementation <01:37:41.424>phase.

2222
01:37:42.675 --> 01:37:45.805
<01:37:42.675>There's <01:37:42.830>a <01:37:42.986>very <01:37:43.141>cool <01:37:43.297>introduction <01:37:43.452>video <01:37:43.608>on <01:37:43.763>the <01:37:43.919>OWA <01:37:44.075>sum

2223
01:37:45.805 --> 01:37:48.005
<01:37:45.805>that <01:37:46.005>was <01:37:46.205>done <01:37:46.405>at <01:37:46.605>the <01:37:46.805>SBA <01:37:47.005>Life <01:37:47.205>Academy.

2224
01:37:48.155 --> 01:37:50.845
<01:37:48.155>That <01:37:48.330>was, <01:37:48.505>uh, <01:37:48.680>last <01:37:48.855>year <01:37:49.030>when <01:37:49.205>the <01:37:49.380>pandemic <01:37:49.555>started.

2225
01:37:51.385 --> 01:37:52.805
<01:37:51.385>Uh, <01:37:51.598>we <01:37:51.811>had <01:37:52.024>a <01:37:52.237>series <01:37:52.450>of <01:37:52.663>talks

2226
01:37:52.805 --> 01:37:55.805
<01:37:52.805>and <01:37:52.980>we, <01:37:53.155>uh, <01:37:53.330>this <01:37:53.505>is, <01:37:53.680>uh, <01:37:53.855>Sebastian <01:37:54.030>Dele <01:37:54.205>Schneider.

2227
01:37:56.065 --> 01:37:57.085
<01:37:56.065>He <01:37:56.371>is <01:37:56.677>from <01:37:56.983>Belgium.

2228
01:37:57.085 --> 01:37:59.405
<01:37:57.085>He's <01:37:57.260>one <01:37:57.435>of <01:37:57.610>the <01:37:57.785>project <01:37:57.960>leads <01:37:58.135>of <01:37:58.310>Owas <01:37:58.485>Sum.

2229
01:38:00.105 --> 01:38:02.645
<01:38:00.105>Um, <01:38:00.384>and <01:38:00.665>yeah, <01:38:00.945>there's <01:38:01.224>a <01:38:01.504>video

2230
01:38:02.645 --> 01:38:04.405
<01:38:02.645>where <01:38:02.878>he <01:38:03.111>explains <01:38:03.345>what <01:38:03.578>it's <01:38:03.811>all <01:38:04.045>about.

2231
01:38:04.765 --> 01:38:07.725
<01:38:04.764>I, <01:38:04.964>uh, <01:38:05.164>recommend <01:38:05.365>to <01:38:05.565>scan <01:38:05.764>the <01:38:05.964>QR <01:38:06.164>code

2232
01:38:07.745 --> 01:38:09.645
<01:38:07.745>or <01:38:08.095>just, <01:38:08.445>uh, <01:38:08.795>look <01:38:09.144>for

2233
01:38:10.245 --> 01:38:13.005
<01:38:10.245>SBA <01:38:10.478>Life <01:38:10.711>Academy <01:38:10.945>Oasp <01:38:11.178>Sum <01:38:11.411>on <01:38:11.644>YouTube,

2234
01:38:13.105 --> 01:38:14.365
<01:38:13.105>and <01:38:13.331>you <01:38:13.558>will <01:38:13.785>find <01:38:14.012>that <01:38:14.239>video.

2235
01:38:15.385 --> 01:38:18.045
<01:38:15.385>I'm, <01:38:15.560>I'm <01:38:15.735>moderating <01:38:15.910>this. <01:38:16.085>You <01:38:16.260>can <01:38:16.435>see <01:38:16.610>me <01:38:16.785>here.

2236
01:38:20.285 --> 01:38:24.065
<01:38:20.285>Um, <01:38:20.425>so <01:38:20.565>what <01:38:20.705>you <01:38:20.845>get <01:38:20.985>from <01:38:21.125>OAM <01:38:21.264>is <01:38:21.405>a <01:38:21.545>scored <01:38:21.684>result

2237
01:38:24.085 --> 01:38:25.665
<01:38:24.085>for <01:38:24.551>each <01:38:25.018>function, <01:38:25.485>right?

2238
01:38:25.965 --> 01:38:26.985
<01:38:25.965>So <01:38:26.148>it <01:38:26.332>looks <01:38:26.515>something <01:38:26.699>like <01:38:26.883>this.

2239
01:38:26.985 --> 01:38:28.305
<01:38:26.985>This <01:38:27.154>is <01:38:27.324>a <01:38:27.494>real <01:38:27.663>project, <01:38:27.833>by <01:38:28.003>the <01:38:28.173>way.

2240
01:38:28.305 --> 01:38:30.785
<01:38:28.305>It's <01:38:28.505>not <01:38:28.705>made <01:38:28.905>up <01:38:29.105>numbers, <01:38:29.305>it's <01:38:29.505>just <01:38:29.705>anonymized.

2241
01:38:31.765 --> 01:38:34.185
<01:38:31.764>And <01:38:31.892>you <01:38:32.019>can <01:38:32.146>see, <01:38:32.274>you <01:38:32.401>can <01:38:32.528>reach <01:38:32.655>a <01:38:32.783>maturity <01:38:32.910>level <01:38:33.037>of <01:38:33.164>something

2242
01:38:34.185 --> 01:38:36.105
<01:38:34.184>between <01:38:34.384>zero <01:38:34.584>and <01:38:34.785>three <01:38:34.985>for <01:38:35.184>each <01:38:35.384>of <01:38:35.584>those,

2243
01:38:36.525 --> 01:38:37.865
<01:38:36.525>uh, <01:38:36.927>functions <01:38:37.329>in <01:38:37.731>here.

2244
01:38:38.525 --> 01:38:41.345
<01:38:38.525>And <01:38:38.680>usually <01:38:38.836>when <01:38:38.991>you're <01:38:39.147>starting <01:38:39.302>out, <01:38:39.458>you're <01:38:39.613>not <01:38:39.769>gonna <01:38:39.924>reach

2245
01:38:41.885 --> 01:38:43.565
<01:38:41.885>one <01:38:42.351>as <01:38:42.818>a <01:38:43.285>level.

2246
01:38:44.425 --> 01:38:47.285
<01:38:44.425>Um, <01:38:44.625>so <01:38:44.825>that's <01:38:45.025>totally <01:38:45.225>normal. <01:38:45.425>That's <01:38:45.625>totally <01:38:45.825>okay.

2247
01:38:47.355 --> 01:38:50.645
<01:38:47.355>It's <01:38:47.510>also <01:38:47.666>not <01:38:47.821>the, <01:38:47.977>the <01:38:48.132>target <01:38:48.288>to <01:38:48.443>have <01:38:48.599>three <01:38:48.754>everywhere.

2248
01:38:51.025 --> 01:38:53.285
<01:38:51.025>You're <01:38:51.224>probably <01:38:51.424>gonna <01:38:51.625>waste <01:38:51.825>be <01:38:52.025>wasting <01:38:52.224>your <01:38:52.424>time

2249
01:38:53.285 --> 01:38:54.805
<01:38:53.285>and <01:38:53.558>energy <01:38:53.832>if <01:38:54.105>you <01:38:54.379>do <01:38:54.653>that.

2250
01:38:55.105 --> 01:38:58.165
<01:38:55.105>So <01:38:55.245>just <01:38:55.384>take <01:38:55.525>that <01:38:55.665>as <01:38:55.804>a <01:38:55.945>means <01:38:56.084>to <01:38:56.224>finding <01:38:56.365>blind <01:38:56.504>spots

2251
01:38:58.185 --> 01:39:01.085
<01:38:58.184>and <01:38:58.360>to <01:38:58.535>get <01:38:58.709>a <01:38:58.884>bigger <01:38:59.059>picture <01:38:59.235>of <01:38:59.410>what's <01:38:59.584>there.

2252
01:39:01.155 --> 01:39:03.045
<01:39:01.155>What <01:39:01.330>do <01:39:01.505>we <01:39:01.680>do <01:39:01.855>already? <01:39:02.030>What <01:39:02.205>would <01:39:02.380>make <01:39:02.555>sense?

2253
01:39:03.045 --> 01:39:04.565
<01:39:03.045>What <01:39:03.318>would <01:39:03.592>be <01:39:03.865>good <01:39:04.139>next <01:39:04.413>steps

2254
01:39:05.025 --> 01:39:06.645
<01:39:05.025>to <01:39:05.304>reach <01:39:05.585>a <01:39:05.865>higher <01:39:06.144>maturity <01:39:06.424>level?

2255
01:39:06.905 --> 01:39:09.085
<01:39:06.905>So <01:39:07.138>each <01:39:07.371>activity <01:39:07.605>has <01:39:07.838>the <01:39:08.071>same <01:39:08.305>weight,

2256
01:39:10.185 --> 01:39:12.325
<01:39:10.184>no <01:39:10.360>matter <01:39:10.535>whether <01:39:10.709>it's <01:39:10.884>maturity <01:39:11.059>level <01:39:11.235>1, <01:39:11.410>2, <01:39:11.584>3.

2257
01:39:13.105 --> 01:39:15.445
<01:39:13.105>Um, <01:39:13.304>the <01:39:13.504>score <01:39:13.705>is <01:39:13.905>not <01:39:14.105>the <01:39:14.304>ultimate <01:39:14.504>goal.

2258
01:39:15.505 --> 01:39:17.365
<01:39:15.505>So <01:39:15.785>rather <01:39:16.065>to <01:39:16.345>roadmap <01:39:16.625>the <01:39:16.905>process

2259
01:39:17.665 --> 01:39:20.165
<01:39:17.665>of <01:39:17.840>detecting <01:39:18.015>the <01:39:18.190>blind <01:39:18.365>spots <01:39:18.540>and <01:39:18.715>working <01:39:18.890>with <01:39:19.065>them.

2260
01:39:21.945 --> 01:39:23.725
<01:39:21.945>All <01:39:22.178>right, <01:39:22.411>that <01:39:22.644>brings <01:39:22.878>me <01:39:23.111>to, <01:39:23.344>wow,

2261
01:39:23.725 --> 01:39:28.125
<01:39:23.725>that's <01:39:23.865>gonna <01:39:24.005>be <01:39:24.145>exactly <01:39:24.285>one <01:39:24.425>hour, <01:39:24.565>45 <01:39:24.705>minutes, <01:39:24.845>I <01:39:24.985>think, <01:39:25.125>um,

2262
01:39:28.505 --> 01:39:29.685
<01:39:28.505>to <01:39:28.859>the <01:39:29.213>learning <01:39:29.566>resources.

2263
01:39:29.685 --> 01:39:30.725
<01:39:29.684>So <01:39:29.872>where <01:39:30.059>to <01:39:30.246>learn <01:39:30.433>more <01:39:30.621>about

2264
01:39:30.965 --> 01:39:32.125
<01:39:30.965>software <01:39:31.226>security <01:39:31.487>and <01:39:31.748>security <01:39:32.009>development.

2265
01:39:32.125 --> 01:39:33.405
<01:39:32.125>It's <01:39:32.355>not <01:39:32.585>just <01:39:32.816>the <01:39:33.046>coding <01:39:33.277>part.

2266
01:39:33.425 --> 01:39:35.325
<01:39:33.425>We <01:39:33.625>focused <01:39:33.825>mostly <01:39:34.025>on <01:39:34.225>the <01:39:34.425>coding <01:39:34.625>part <01:39:34.825>today,

2267
01:39:35.325 --> 01:39:38.525
<01:39:35.325>but <01:39:35.500>there's <01:39:35.675>way <01:39:35.849>more, <01:39:36.025>uh, <01:39:36.200>to <01:39:36.375>learn <01:39:36.550>around <01:39:36.724>that.

2268
01:39:39.185 --> 01:39:41.805
<01:39:39.184>Um, <01:39:39.651>understanding <01:39:40.118>is <01:39:40.584>key.

2269
01:39:42.055 --> 01:39:44.365
<01:39:42.055>Again, <01:39:42.255>we <01:39:42.455>have <01:39:42.655>some <01:39:42.855>things <01:39:43.055>that <01:39:43.255>are <01:39:43.455>scalable.

2270
01:39:44.545 --> 01:39:47.965
<01:39:44.545>We <01:39:44.720>have <01:39:44.895>some <01:39:45.070>baseline, <01:39:45.245>uh, <01:39:45.420>security <01:39:45.595>problems <01:39:45.770>that <01:39:45.945>need

2271
01:39:47.965 --> 01:39:49.005
<01:39:47.965>to <01:39:48.199>be <01:39:48.433>found <01:39:48.667>on <01:39:48.901>a,

2272
01:39:49.005 --> 01:39:51.725
<01:39:49.005>in <01:39:49.180>a <01:39:49.355>scalable <01:39:49.530>way <01:39:49.705>in <01:39:49.880>your <01:39:50.055>maybe <01:39:50.230>whole <01:39:50.405>organization.

2273
01:39:52.505 --> 01:39:55.525
<01:39:52.505>But <01:39:52.632>if <01:39:52.759>you <01:39:52.886>want <01:39:53.014>to <01:39:53.141>get <01:39:53.268>to <01:39:53.395>the <01:39:53.523>choosy <01:39:53.650>stuff, <01:39:53.777>you <01:39:53.905>need

2274
01:39:55.525 --> 01:39:57.565
<01:39:55.525>to <01:39:55.758>understand <01:39:55.991>how <01:39:56.224>things <01:39:56.458>are <01:39:56.691>are <01:39:56.924>going.

2275
01:39:58.225 --> 01:40:00.325
<01:39:58.225>So <01:39:58.458>cultivate <01:39:58.691>the <01:39:58.925>culture <01:39:59.158>of <01:39:59.391>continuous <01:39:59.625>learning.

2276
01:40:00.355 --> 01:40:02.685
<01:40:00.355>It's <01:40:00.510>not <01:40:00.666>gonna <01:40:00.821>be, <01:40:00.977>security <01:40:01.132>is <01:40:01.288>not <01:40:01.443>something <01:40:01.599>that <01:40:01.754>works,

2277
01:40:02.715 --> 01:40:04.605
<01:40:02.715>putting <01:40:02.948>it <01:40:03.181>on <01:40:03.415>top <01:40:03.648>of <01:40:03.881>everything <01:40:04.115>else.

2278
01:40:05.345 --> 01:40:07.245
<01:40:05.344>It <01:40:05.544>has <01:40:05.744>to <01:40:05.945>be <01:40:06.144>integrated <01:40:06.344>into <01:40:06.544>every <01:40:06.744>process.

2279
01:40:07.755 --> 01:40:10.645
<01:40:07.755>That <01:40:07.895>means, <01:40:08.035>for <01:40:08.175>example, <01:40:08.315>if <01:40:08.455>when <01:40:08.595>you <01:40:08.735>have <01:40:08.875>an <01:40:09.015>issue <01:40:09.155>tracker

2280
01:40:10.955 --> 01:40:13.765
<01:40:10.955>that <01:40:11.130>security <01:40:11.305>problems <01:40:11.480>are <01:40:11.655>not <01:40:11.830>managed <01:40:12.005>on <01:40:12.180>a <01:40:12.355>separate

2281
01:40:13.775 --> 01:40:15.045
<01:40:13.775>board, <01:40:14.003>they <01:40:14.232>need <01:40:14.460>to <01:40:14.689>be <01:40:14.918>there.

2282
01:40:15.155 --> 01:40:17.845
<01:40:15.155>They <01:40:15.295>need <01:40:15.435>to <01:40:15.575>be <01:40:15.715>sitting <01:40:15.855>on <01:40:15.995>a <01:40:16.135>big <01:40:16.275>kid's <01:40:16.415>table <01:40:16.555>so

2283
01:40:17.845 --> 01:40:20.205
<01:40:17.844>that <01:40:18.044>security <01:40:18.244>can <01:40:18.445>actually <01:40:18.644>be <01:40:18.844>integrated <01:40:19.044>into <01:40:19.244>developing.

2284
01:40:21.345 --> 01:40:24.365
<01:40:21.344>Um, <01:40:21.811>assessing <01:40:22.278>the <01:40:22.744>security

2285
01:40:24.385 --> 01:40:26.565
<01:40:24.385>of <01:40:24.585>a <01:40:24.785>software <01:40:24.985>product <01:40:25.185>means <01:40:25.385>understanding <01:40:25.585>your <01:40:25.785>language,

2286
01:40:26.565 --> 01:40:28.685
<01:40:26.565>your <01:40:26.740>runtime, <01:40:26.915>your <01:40:27.090>platform, <01:40:27.265>your <01:40:27.440>IDE, <01:40:27.615>your <01:40:27.790>build <01:40:27.965>tools,

2287
01:40:28.685 --> 01:40:30.685
<01:40:28.684>your <01:40:29.035>CICD <01:40:29.384>pipeline, <01:40:29.735>your <01:40:30.084>whatever,

2288
01:40:30.685 --> 01:40:31.805
<01:40:30.684>everything <01:40:31.021>that <01:40:31.357>is <01:40:31.693>involved.

2289
01:40:32.445 --> 01:40:34.245
<01:40:32.445>Security <01:40:32.724>problems <01:40:33.005>can <01:40:33.285>arise <01:40:33.565>from <01:40:33.844>everything.

2290
01:40:34.315 --> 01:40:37.725
<01:40:34.315>It's <01:40:34.442>not <01:40:34.569>just <01:40:34.696>the <01:40:34.824>code <01:40:34.951>you <01:40:35.078>write, <01:40:35.205>it <01:40:35.333>can <01:40:35.460>be <01:40:35.587>your <01:40:35.715>container,

2291
01:40:37.725 --> 01:40:40.205
<01:40:37.725>it <01:40:37.865>can <01:40:38.005>be <01:40:38.145>the <01:40:38.285>configuration, <01:40:38.425>it <01:40:38.565>can <01:40:38.705>be <01:40:38.845>your <01:40:38.985>CICD <01:40:39.125>pipeline.

2292
01:40:40.205 --> 01:40:42.885
<01:40:40.205>It <01:40:40.485>can <01:40:40.765>be <01:40:41.045>the <01:40:41.325>cloud <01:40:41.605>environment.

2293
01:40:43.105 --> 01:40:45.325
<01:40:43.105>Um, <01:40:43.280>so <01:40:43.455>many <01:40:43.629>things <01:40:43.804>where <01:40:43.980>stuff <01:40:44.155>can <01:40:44.330>go <01:40:44.504>wrong.

2294
01:40:45.985 --> 01:40:47.165
<01:40:45.985>The <01:40:46.250>best <01:40:46.516>people <01:40:46.781>I've <01:40:47.047>met

2295
01:40:47.235 --> 01:40:50.325
<01:40:47.235>that <01:40:47.410>are <01:40:47.585>best <01:40:47.760>in <01:40:47.935>security <01:40:48.110>are <01:40:48.285>just <01:40:48.460>good <01:40:48.635>engineers.

2296
01:40:50.675 --> 01:40:52.925
<01:40:50.675>They're <01:40:50.908>not <01:40:51.141>security <01:40:51.375>wizard <01:40:51.608>and <01:40:51.841>nothing <01:40:52.075>else.

2297
01:40:53.315 --> 01:40:57.175
<01:40:53.315>It's <01:40:53.515>just <01:40:53.715>knowing <01:40:53.915>the <01:40:54.115>environment <01:40:54.315>is <01:40:54.515>basically <01:40:54.715>key

2298
01:40:57.275 --> 01:40:58.455
<01:40:57.275>to <01:40:57.540>being <01:40:57.806>good <01:40:58.071>at <01:40:58.337>security.

2299
01:40:58.755 --> 01:41:02.975
<01:40:58.755>Um, <01:40:58.988>as <01:40:59.221>well <01:40:59.455>also, <01:40:59.688>uh, <01:40:59.921>be <01:41:00.155>aware

2300
01:41:02.975 --> 01:41:05.455
<01:41:02.975>that <01:41:03.255>not <01:41:03.535>everything <01:41:03.815>is <01:41:04.095>implementation <01:41:04.375>developed

2301
01:41:05.455 --> 01:41:06.735
<01:41:05.455>by <01:41:06.031>design <01:41:06.607>countermeasure.

2302
01:41:06.795 --> 01:41:08.495
<01:41:06.795>So <01:41:07.028>for <01:41:07.261>example, <01:41:07.495>having <01:41:07.728>a <01:41:07.961>template <01:41:08.195>engine

2303
01:41:08.495 --> 01:41:10.055
<01:41:08.495>that <01:41:08.845>automatically <01:41:09.195>encodes <01:41:09.545>stuff <01:41:09.894>so

2304
01:41:10.055 --> 01:41:11.295
<01:41:10.055>that <01:41:10.278>we <01:41:10.501>don't <01:41:10.724>have <01:41:10.947>cross <01:41:11.171>scripting.

2305
01:41:11.295 --> 01:41:13.495
<01:41:11.295>That's <01:41:11.645>design, <01:41:11.995>that's <01:41:12.345>technology <01:41:12.695>choice.

2306
01:41:14.975 --> 01:41:16.775
<01:41:14.975>Simplify <01:41:15.255>and <01:41:15.535>reduce <01:41:15.815>is <01:41:16.095>always <01:41:16.375>good

2307
01:41:16.775 --> 01:41:19.335
<01:41:16.775>because <01:41:16.950>the <01:41:17.125>simpler, <01:41:17.299>the <01:41:17.474>easier <01:41:17.650>to <01:41:17.825>understand, <01:41:18.000>the <01:41:18.174>easier

2308
01:41:19.395 --> 01:41:20.655
<01:41:19.395>to <01:41:19.773>see <01:41:20.151>security <01:41:20.529>problems.

2309
01:41:21.035 --> 01:41:23.415
<01:41:21.035>As <01:41:21.268>I <01:41:21.501>said, <01:41:21.735>the <01:41:21.968>um, <01:41:22.201>that's, <01:41:22.434>um,

2310
01:41:23.925 --> 01:41:25.735
<01:41:23.925>keeping <01:41:24.158>stuff <01:41:24.391>simple <01:41:24.625>is <01:41:24.858>very, <01:41:25.091>very <01:41:25.325>important.

2311
01:41:26.635 --> 01:41:27.855
<01:41:26.635>Uh, <01:41:26.909>testing <01:41:27.184>your <01:41:27.458>own <01:41:27.732>software

2312
01:41:28.075 --> 01:41:31.175
<01:41:28.075>for <01:41:28.230>security <01:41:28.386>problems <01:41:28.541>can <01:41:28.697>be <01:41:28.852>very <01:41:29.008>fun <01:41:29.163>and <01:41:29.319>very <01:41:29.474>rewarding.

2313
01:41:31.475 --> 01:41:34.695
<01:41:31.475>The <01:41:31.630>SEC <01:41:31.786>for <01:41:31.941>dev <01:41:32.097>conference <01:41:32.252>is <01:41:32.408>one <01:41:32.563>possibility <01:41:32.719>to <01:41:32.875>learn,

2314
01:41:35.035 --> 01:41:36.095
<01:41:35.035>uh, <01:41:35.512>software <01:41:35.989>security.

2315
01:41:36.485 --> 01:41:38.015
<01:41:36.485>There's <01:41:36.714>also <01:41:36.944>a <01:41:37.173>meetup <01:41:37.403>that <01:41:37.632>we <01:41:37.861>do.

2316
01:41:38.435 --> 01:41:42.735
<01:41:38.434>Um, <01:41:38.610>there's <01:41:38.785>one <01:41:38.959>today, <01:41:39.134>yeah, <01:41:39.309>at <01:41:39.485>six <01:41:39.660>o'clock <01:41:39.834>right

2317
01:41:42.735 --> 01:41:46.775
<01:41:42.735>after <01:41:42.935>this, <01:41:43.135>um, <01:41:43.335>about <01:41:43.535>end-to-end <01:41:43.735>encrypting, <01:41:43.935>uh, <01:41:44.135>notes,

2318
01:41:46.985 --> 01:41:48.055
<01:41:46.985>notes <01:41:47.948>application.

2319
01:41:48.115 --> 01:41:50.095
<01:41:48.115>So <01:41:48.348>getting <01:41:48.581>back <01:41:48.815>to <01:41:49.048>end <01:41:49.281>to <01:41:49.514>encryption

2320
01:41:51.235 --> 01:41:54.775
<01:41:51.235>and, <01:41:51.435>um, <01:41:51.635>working <01:41:51.835>can <01:41:52.035>learn <01:41:52.235>software <01:41:52.435>security <01:41:52.635>actively.

2321
01:41:55.245 --> 01:41:57.015
<01:41:55.245>Also <01:41:55.525>breaking <01:41:55.805>things <01:41:56.085>and <01:41:56.365>hacking <01:41:56.644>things.

2322
01:41:57.015 --> 01:41:59.695
<01:41:57.014>There's <01:41:57.248>a <01:41:57.481>very, <01:41:57.714>very, <01:41:57.948>very <01:41:58.181>good <01:41:58.414>application

2323
01:41:59.695 --> 01:42:01.935
<01:41:59.695>that <01:41:59.928>intentionally <01:42:00.161>has <01:42:00.394>lots <01:42:00.628>of <01:42:00.861>security <01:42:01.094>problems.

2324
01:42:01.935 --> 01:42:03.175
<01:42:01.934>It's <01:42:02.158>called <01:42:02.381>the <01:42:02.604>OAS <01:42:02.827>two <01:42:03.051>shop

2325
01:42:03.745 --> 01:42:07.215
<01:42:03.745>comes <01:42:03.885>from <01:42:04.025>the <01:42:04.165>German <01:42:04.305>word <01:42:04.445>Soft <01:42:04.585>la, <01:42:04.724>which <01:42:04.865>is <01:42:05.005>basically <01:42:05.144>a,

2326
01:42:07.615 --> 01:42:09.815
<01:42:07.615>a <01:42:07.965>shop <01:42:08.315>that's <01:42:08.665>not <01:42:09.014>good.

2327
01:42:10.835 --> 01:42:11.855
<01:42:10.835>Um, <01:42:11.294>so <01:42:11.753>yeah,

2328
01:42:12.195 --> 01:42:14.615
<01:42:12.195>the <01:42:12.394>German <01:42:12.594>speaking <01:42:12.795>people <01:42:12.995>will <01:42:13.195>understand <01:42:13.394>the <01:42:13.594>joke.

2329
01:42:15.355 --> 01:42:17.055
<01:42:15.355>That's <01:42:15.588>also <01:42:15.821>the <01:42:16.054>Port <01:42:16.288>Speaker <01:42:16.521>Web <01:42:16.754>Academy.

2330
01:42:17.155 --> 01:42:20.295
<01:42:17.155>That's <01:42:17.330>the <01:42:17.505>port <01:42:17.680>speaker <01:42:17.855>is, <01:42:18.030>is <01:42:18.205>a <01:42:18.380>tool <01:42:18.555>vendor

2331
01:42:20.295 --> 01:42:23.055
<01:42:20.295>that <01:42:20.495>they <01:42:20.695>make <01:42:20.895>dynamic <01:42:21.095>application <01:42:21.295>security <01:42:21.495>testing <01:42:21.695>tools.

2332
01:42:23.255 --> 01:42:24.655
<01:42:23.255>I <01:42:23.465>use <01:42:23.675>it <01:42:23.885>in <01:42:24.095>my <01:42:24.305>penetration <01:42:24.515>testing

2333
01:42:25.655 --> 01:42:26.735
<01:42:25.655>activity <01:42:25.979>for <01:42:26.303>web <01:42:26.627>applications.

2334
01:42:26.735 --> 01:42:28.015
<01:42:26.735>They <01:42:26.965>have <01:42:27.195>a <01:42:27.426>free <01:42:27.656>web <01:42:27.887>academy.

2335
01:42:28.595 --> 01:42:29.695
<01:42:28.594>You <01:42:28.842>only <01:42:29.089>have <01:42:29.337>to <01:42:29.585>register

2336
01:42:29.715 --> 01:42:31.695
<01:42:29.715>and <01:42:29.948>you <01:42:30.181>can, <01:42:30.415>uh, <01:42:30.648>use <01:42:30.881>their <01:42:31.115>labs

2337
01:42:31.795 --> 01:42:33.495
<01:42:31.795>to <01:42:32.261>practice <01:42:32.728>hacking <01:42:33.195>applications.

2338
01:42:33.715 --> 01:42:36.415
<01:42:33.715>Really <01:42:33.915>well <01:42:34.115>done. <01:42:34.315>Really <01:42:34.515>smart <01:42:34.715>people <01:42:34.915>behind <01:42:35.115>this.

2339
01:42:37.315 --> 01:42:39.015
<01:42:37.315>Uh, <01:42:37.665>generally <01:42:38.015>the <01:42:38.365>OAS <01:42:38.715>resources.

2340
01:42:39.235 --> 01:42:41.175
<01:42:39.235>So <01:42:39.435>having <01:42:39.635>a <01:42:39.835>look <01:42:40.035>at <01:42:40.235>the <01:42:40.435>OAS <01:42:40.635>website

2341
01:42:41.395 --> 01:42:43.175
<01:42:41.395>for <01:42:41.675>application <01:42:41.955>security <01:42:42.235>is <01:42:42.515>really <01:42:42.795>good.

2342
01:42:43.755 --> 01:42:46.575
<01:42:43.755>One <01:42:43.988>major <01:42:44.221>project <01:42:44.455>is <01:42:44.688>the, <01:42:44.921>uh, <01:42:45.155>security,

2343
01:42:46.875 --> 01:42:48.975
<01:42:46.875>the <01:42:47.225>application <01:42:47.575>security <01:42:47.925>verification <01:42:48.275>standard,

2344
01:42:49.165 --> 01:42:51.495
<01:42:49.165>also <01:42:49.365>called <01:42:49.565>A <01:42:49.765>SVS <01:42:49.965>that <01:42:50.165>has <01:42:50.365>a <01:42:50.565>list

2345
01:42:51.495 --> 01:42:53.735
<01:42:51.495>of <01:42:51.695>design <01:42:51.894>security <01:42:52.095>principles <01:42:52.295>that <01:42:52.495>you <01:42:52.695>can <01:42:52.894>take

2346
01:42:53.995 --> 01:42:55.015
<01:42:53.995>to <01:42:54.300>check <01:42:54.607>your <01:42:54.913>application

2347
01:42:55.015 --> 01:42:56.615
<01:42:55.014>or <01:42:55.294>to <01:42:55.575>write <01:42:55.855>requirements, <01:42:56.134>for <01:42:56.414>example,

2348
01:42:56.965 --> 01:42:58.775
<01:42:56.965>take <01:42:57.245>out <01:42:57.525>those <01:42:57.805>that <01:42:58.085>are <01:42:58.365>relevant.

2349
01:42:59.725 --> 01:43:03.055
<01:42:59.725>Alright, <01:42:59.880>that <01:43:00.036>gets <01:43:00.191>me <01:43:00.347>to <01:43:00.502>the, <01:43:00.658>to <01:43:00.813>the <01:43:00.969>wrap <01:43:01.125>up

2350
01:43:03.095 --> 01:43:06.825
<01:43:03.094>and <01:43:03.250>to <01:43:03.406>the <01:43:03.561>key <01:43:03.717>takeaways <01:43:03.872>of <01:43:04.028>this <01:43:04.183>talk <01:43:04.339>or <01:43:04.494>workshop.

2351
01:43:07.325 --> 01:43:09.305
<01:43:07.325>So, <01:43:07.605>most <01:43:07.885>companies <01:43:08.165>are <01:43:08.445>software <01:43:08.724>companies

2352
01:43:10.005 --> 01:43:11.625
<01:43:10.005>and <01:43:10.205>some <01:43:10.405>of <01:43:10.605>them <01:43:10.805>realize <01:43:11.005>that <01:43:11.205>they <01:43:11.405>are.

2353
01:43:11.625 --> 01:43:13.705
<01:43:11.625>Others <01:43:11.800>do <01:43:11.975>not <01:43:12.150>realize <01:43:12.325>that <01:43:12.500>they <01:43:12.675>are <01:43:12.850>software <01:43:13.025>companies.

2354
01:43:14.885 --> 01:43:16.265
<01:43:14.885>Um, <01:43:15.505>initial <01:43:16.126>velocity.

2355
01:43:16.525 --> 01:43:19.585
<01:43:16.525>So <01:43:16.724>prototyping <01:43:16.924>something <01:43:17.125>prototype <01:43:17.325>gets <01:43:17.525>the <01:43:17.724>actual <01:43:17.924>product.

2356
01:43:19.675 --> 01:43:21.145
<01:43:19.675>We're <01:43:19.939>pushing <01:43:20.204>it <01:43:20.468>out <01:43:20.733>to <01:43:20.998>production.

2357
01:43:21.725 --> 01:43:22.985
<01:43:21.725>Uh, <01:43:22.103>that's <01:43:22.481>initial <01:43:22.859>velocity.

2358
01:43:23.085 --> 01:43:24.345
<01:43:23.085>We <01:43:23.274>need <01:43:23.463>to <01:43:23.652>be <01:43:23.840>fast, <01:43:24.030>we <01:43:24.218>need

2359
01:43:24.345 --> 01:43:25.465
<01:43:24.344>to <01:43:24.489>be <01:43:24.633>the <01:43:24.777>first <01:43:24.920>ones <01:43:25.065>on <01:43:25.209>the <01:43:25.353>market.

2360
01:43:25.775 --> 01:43:28.345
<01:43:25.775>That <01:43:25.930>often <01:43:26.086>goes <01:43:26.241>to <01:43:26.397>the <01:43:26.552>cost <01:43:26.708>of <01:43:26.863>sustained <01:43:27.019>velocity. <01:43:27.174>Velocity.

2361
01:43:28.565 --> 01:43:32.705
<01:43:28.565>So <01:43:28.692>manage <01:43:28.819>your <01:43:28.946>technical <01:43:29.074>debt <01:43:29.201>so <01:43:29.328>that <01:43:29.455>you <01:43:29.583>can <01:43:29.710>also <01:43:29.837>stay <01:43:29.965>fast

2362
01:43:32.705 --> 01:43:33.865
<01:43:32.705>and <01:43:32.966>not <01:43:33.227>just <01:43:33.487>begin <01:43:33.749>fast.

2363
01:43:35.095 --> 01:43:36.995
<01:43:35.094>Secure <01:43:35.294>software <01:43:35.494>can <01:43:35.695>be <01:43:35.894>created <01:43:36.094>with <01:43:36.294>any <01:43:36.494>language.

2364
01:43:38.215 --> 01:43:41.075
<01:43:38.215>Uh, <01:43:38.390>knowing <01:43:38.565>the <01:43:38.740>security <01:43:38.915>properties <01:43:39.090>still <01:43:39.265>can <01:43:39.440>help <01:43:39.615>you

2365
01:43:41.075 --> 01:43:42.115
<01:43:41.075>make <01:43:41.543>better <01:43:42.010>decisions.

2366
01:43:42.855 --> 01:43:45.555
<01:43:42.855>But <01:43:42.995>again, <01:43:43.134>it <01:43:43.275>doesn't <01:43:43.415>depend <01:43:43.554>so <01:43:43.695>much <01:43:43.834>on <01:43:43.974>the <01:43:44.115>language <01:43:44.254>itself,

2367
01:43:45.555 --> 01:43:48.275
<01:43:45.555>but <01:43:45.730>it <01:43:45.905>depends <01:43:46.080>on <01:43:46.255>whether <01:43:46.430>you <01:43:46.605>master <01:43:46.780>its <01:43:46.955>features

2368
01:43:48.415 --> 01:43:50.715
<01:43:48.415>and, <01:43:48.695>uh, <01:43:48.975>it's, <01:43:49.255>its <01:43:49.535>its <01:43:49.815>principles.

2369
01:43:52.185 --> 01:43:53.765
<01:43:52.184>The <01:43:52.651>secure <01:43:53.118>coding <01:43:53.584>practices

2370
01:43:53.765 --> 01:43:55.965
<01:43:53.764>that <01:43:54.115>we <01:43:54.464>discussed, <01:43:54.815>internalize <01:43:55.164>them.

2371
01:43:56.785 --> 01:44:00.085
<01:43:56.785>And <01:43:56.925>that's <01:43:57.065>the <01:43:57.205>base, <01:43:57.345>that's <01:43:57.485>the <01:43:57.625>base <01:43:57.764>of <01:43:57.905>writing <01:43:58.045>secure <01:43:58.184>code.

2372
01:44:01.955 --> 01:44:05.215
<01:44:01.955>Um, <01:44:02.110>be <01:44:02.266>aware <01:44:02.421>of <01:44:02.577>the <01:44:02.732>vulnerability <01:44:02.888>classes <01:44:03.043>that <01:44:03.199>are <01:44:03.355>relevant

2373
01:44:05.215 --> 01:44:06.695
<01:44:05.215>for <01:44:05.548>your <01:44:05.881>environment <01:44:06.214>and <01:44:06.547>strive

2374
01:44:06.695 --> 01:44:08.055
<01:44:06.695>for <01:44:07.103>more <01:44:07.511>targeted <01:44:07.919>protection.

2375
01:44:08.145 --> 01:44:11.415
<01:44:08.145>Don't <01:44:08.272>be <01:44:08.399>the <01:44:08.526>one <01:44:08.654>that <01:44:08.781>just <01:44:08.908>wants <01:44:09.035>to <01:44:09.163>buy <01:44:09.290>an <01:44:09.417>expensive <01:44:09.545>tool,

2376
01:44:11.435 --> 01:44:12.975
<01:44:11.434>and <01:44:11.665>that's, <01:44:11.897>that <01:44:12.128>tool's <01:44:12.359>gonna <01:44:12.590>fix <01:44:12.821>it.

2377
01:44:12.975 --> 01:44:14.015
<01:44:12.975>That <01:44:13.209>tool's <01:44:13.443>gonna <01:44:13.677>find <01:44:13.910>it,

2378
01:44:14.605 --> 01:44:16.095
<01:44:14.605>it's <01:44:14.828>probably <01:44:15.052>not <01:44:15.275>gonna <01:44:15.499>be <01:44:15.722>that <01:44:15.945>way.

2379
01:44:16.345 --> 01:44:17.495
<01:44:16.344>These <01:44:16.690>tools <01:44:17.035>can <01:44:17.380>help.

2380
01:44:18.315 --> 01:44:21.455
<01:44:18.315>But, <01:44:18.490>um, <01:44:18.665>in <01:44:18.840>order <01:44:19.015>for <01:44:19.190>you <01:44:19.365>to <01:44:19.540>be <01:44:19.715>able

2381
01:44:21.455 --> 01:44:24.215
<01:44:21.455>to <01:44:21.595>test <01:44:21.735>whether <01:44:21.875>it <01:44:22.015>does <01:44:22.155>find <01:44:22.295>the <01:44:22.434>juicy <01:44:22.575>problems, <01:44:22.715>you <01:44:22.855>have

2382
01:44:24.215 --> 01:44:25.255
<01:44:24.215>to <01:44:24.402>know <01:44:24.589>which <01:44:24.776>ones <01:44:24.963>they <01:44:25.151>are.

2383
01:44:25.355 --> 01:44:26.655
<01:44:25.355>So <01:44:25.647>which <01:44:25.940>ones <01:44:26.232>are <01:44:26.525>the,

2384
01:44:26.955 --> 01:44:28.855
<01:44:26.955>the <01:44:27.155>weakness <01:44:27.355>classes <01:44:27.555>that <01:44:27.755>you <01:44:27.955>need <01:44:28.155>to <01:44:28.355>find?

2385
01:44:29.935 --> 01:44:32.545
<01:44:29.934>When <01:44:30.134>you <01:44:30.334>want <01:44:30.535>to <01:44:30.735>start <01:44:30.934>with <01:44:31.134>automation, <01:44:31.334>uh,

2386
01:44:32.545 --> 01:44:34.065
<01:44:32.545>dependency <01:44:32.773>checks <01:44:33.001>are <01:44:33.229>a <01:44:33.457>good <01:44:33.685>first <01:44:33.913>step

2387
01:44:34.065 --> 01:44:36.745
<01:44:34.065>because <01:44:34.345>they're <01:44:34.625>comparably <01:44:34.905>easy <01:44:35.185>to <01:44:35.465>integrate,

2388
01:44:37.045 --> 01:44:38.585
<01:44:37.045>and <01:44:37.218>they're <01:44:37.391>gonna <01:44:37.564>give <01:44:37.738>you <01:44:37.911>a <01:44:38.084>lot <01:44:38.257>of <01:44:38.431>value

2389
01:44:38.585 --> 01:44:41.385
<01:44:38.585>because <01:44:38.760>most <01:44:38.935>of <01:44:39.110>your <01:44:39.285>code <01:44:39.460>usually <01:44:39.635>is <01:44:39.810>external <01:44:39.985>code.

2390
01:44:42.965 --> 01:44:46.265
<01:44:42.965>Use <01:44:43.105>the <01:44:43.245>oasp <01:44:43.385>sum <01:44:43.525>to <01:44:43.665>widen <01:44:43.805>your <01:44:43.945>view <01:44:44.085>on <01:44:44.225>security <01:44:44.365>development.

2391
01:44:46.295 --> 01:44:49.545
<01:44:46.295>It's <01:44:46.435>not <01:44:46.575>just <01:44:46.715>coding, <01:44:46.855>it's <01:44:46.995>not <01:44:47.135>just <01:44:47.275>writing <01:44:47.415>lines <01:44:47.555>of <01:44:47.695>code.

2392
01:44:49.545 --> 01:44:51.945
<01:44:49.545>It's <01:44:49.745>not <01:44:49.945>just <01:44:50.145>configuration. <01:44:50.345>It's <01:44:50.545>more <01:44:50.745>than <01:44:50.945>that.

2393
01:44:52.135 --> 01:44:54.625
<01:44:52.135>It's <01:44:52.415>design, <01:44:52.695>it's <01:44:52.975>architecture, <01:44:53.255>it's <01:44:53.535>requirements,

2394
01:44:54.775 --> 01:44:58.585
<01:44:54.775>it's <01:44:55.054>education, <01:44:55.335>it's <01:44:55.615>verification, <01:44:55.894>it's <01:44:56.174>operation,

2395
01:44:58.585 --> 01:45:00.465
<01:44:58.585>it's <01:44:58.818>s <01:44:59.051>logging, <01:44:59.285>it's <01:44:59.518>monitoring, <01:44:59.751>it's <01:44:59.985>alerting.

2396
01:45:00.465 --> 01:45:01.625
<01:45:00.465>So <01:45:00.614>there <01:45:00.763>are <01:45:00.912>so <01:45:01.061>many <01:45:01.210>things <01:45:01.359>that <01:45:01.509>are

2397
01:45:01.625 --> 01:45:02.985
<01:45:01.625>important <01:45:02.033>in <01:45:02.441>software <01:45:02.849>security.

2398
01:45:03.565 --> 01:45:05.985
<01:45:03.565>Um, <01:45:03.705>I, <01:45:03.845>I <01:45:03.985>suggest <01:45:04.125>you <01:45:04.265>take <01:45:04.405>a <01:45:04.545>look <01:45:04.685>at <01:45:04.825>O <01:45:04.965>plm,

2399
01:45:05.985 --> 01:45:08.385
<01:45:05.985>which <01:45:06.160>is <01:45:06.335>a <01:45:06.510>really <01:45:06.685>great <01:45:06.860>project <01:45:07.035>that <01:45:07.210>has <01:45:07.385>descriptions

2400
01:45:08.385 --> 01:45:09.905
<01:45:08.385>of <01:45:08.580>all <01:45:08.775>those <01:45:08.971>activities, <01:45:09.166>and <01:45:09.362>you <01:45:09.557>can <01:45:09.753>measure

2401
01:45:10.225 --> 01:45:11.345
<01:45:10.225>yourself <01:45:10.561>where <01:45:10.897>you <01:45:11.232>are.

2402
01:45:12.525 --> 01:45:14.025
<01:45:12.525>The <01:45:12.795>deep <01:45:13.065>understanding <01:45:13.335>of <01:45:13.605>the <01:45:13.875>software,

2403
01:45:14.325 --> 01:45:15.425
<01:45:14.325>of <01:45:14.655>the <01:45:14.985>weakness <01:45:15.315>classes

2404
01:45:15.645 --> 01:45:18.785
<01:45:15.645>and <01:45:15.800>the <01:45:15.956>threats <01:45:16.111>is <01:45:16.267>key <01:45:16.422>to <01:45:16.578>also <01:45:16.733>securing <01:45:16.889>your <01:45:17.045>software.

2405
01:45:19.405 --> 01:45:21.545
<01:45:19.405>Uh, <01:45:19.638>that's, <01:45:19.871>that's <01:45:20.105>really <01:45:20.338>important. <01:45:20.571>Also <01:45:20.805>takeaway.

2406
01:45:22.615 --> 01:45:24.265
<01:45:22.615>Yeah, <01:45:22.894>I'm <01:45:23.175>working <01:45:23.455>for <01:45:23.735>this <01:45:24.014>company.

2407
01:45:24.935 --> 01:45:25.945
<01:45:24.934>Told <01:45:25.116>you <01:45:25.298>already <01:45:25.480>in <01:45:25.662>the <01:45:25.844>beginning,

2408
01:45:26.525 --> 01:45:30.665
<01:45:26.525>and <01:45:26.652>now <01:45:26.779>I'm <01:45:26.906>happy <01:45:27.034>to <01:45:27.161>take <01:45:27.288>any <01:45:27.415>questions <01:45:27.543>if <01:45:27.670>there <01:45:27.797>are <01:45:27.924>any.

2409
01:45:34.905 --> 01:45:37.235
<01:45:34.905>Okay. <01:45:35.185>Thomas, <01:45:35.465>thank <01:45:35.745>you <01:45:36.025>very <01:45:36.305>much

2410
01:45:37.495 --> 01:45:39.515
<01:45:37.495>for <01:45:37.961>this <01:45:38.428>amazing <01:45:38.894>presentation.

2411
01:45:39.675 --> 01:45:41.035
<01:45:39.675>I <01:45:39.919>think <01:45:40.164>people <01:45:40.409>have <01:45:40.654>enjoyed <01:45:40.898>it.

2412
01:45:41.475 --> 01:45:43.595
<01:45:41.475>I <01:45:41.650>would <01:45:41.825>say <01:45:42.000>let's <01:45:42.175>go <01:45:42.350>quickly <01:45:42.525>through <01:45:42.700>the <01:45:42.875>questions

2413
01:45:43.695 --> 01:45:47.435
<01:45:43.695>so <01:45:43.870>you <01:45:44.045>can <01:45:44.219>take <01:45:44.394>care <01:45:44.570>of <01:45:44.745>your <01:45:44.920>daughter. <01:45:45.094>Um,

2414
01:45:47.885 --> 01:45:48.885
<01:45:47.885>Sorry <01:45:48.335>for <01:45:48.785>that.

2415
01:45:49.395 --> 01:45:51.035
<01:45:49.395>I <01:45:49.628>was <01:45:49.861>thinking <01:45:50.095>about <01:45:50.328>taking <01:45:50.561>the <01:45:50.795>headphones,

2416
01:45:51.055 --> 01:45:52.555
<01:45:51.055>but <01:45:51.325>I <01:45:51.595>thought <01:45:51.865>it's <01:45:52.135>more <01:45:52.405>comfort,

2417
01:45:52.555 --> 01:45:54.155
<01:45:52.555>comfortable <01:45:52.905>with <01:45:53.255>others, <01:45:53.605>but <01:45:53.955>yeah.

2418
01:45:55.065 --> 01:45:57.995
<01:45:55.065>Okay. <01:45:55.220>Um, <01:45:55.376>yeah, <01:45:55.531>there <01:45:55.687>is <01:45:55.842>quite <01:45:55.998>a <01:45:56.153>lot <01:45:56.309>of <01:45:56.465>questions.

2419
01:45:57.995 --> 01:45:59.715
<01:45:57.995>So <01:45:58.228>let's, <01:45:58.461>let's <01:45:58.695>start <01:45:58.928>with <01:45:59.161>this <01:45:59.394>one.

2420
01:46:00.335 --> 01:46:03.675
<01:46:00.335>SOA <01:46:00.490>is <01:46:00.646>asking <01:46:00.801>like, <01:46:00.957>how, <01:46:01.112>how, <01:46:01.268>how <01:46:01.423>could <01:46:01.579>you, <01:46:01.735>um,

2421
01:46:03.745 --> 01:46:07.515
<01:46:03.745>develop <01:46:03.978>such <01:46:04.211>a, <01:46:04.445>a <01:46:04.678>broad <01:46:04.911>understanding <01:46:05.144>of

2422
01:46:07.695 --> 01:46:10.635
<01:46:07.695>so <01:46:07.870>much <01:46:08.045>different <01:46:08.219>topics <01:46:08.394>and <01:46:08.570>security <01:46:08.745>topics <01:46:08.920>as <01:46:09.094>well?

2423
01:46:10.895 --> 01:46:12.955
<01:46:10.895>So <01:46:11.070>did <01:46:11.245>you <01:46:11.420>have, <01:46:11.595>did <01:46:11.770>you <01:46:11.945>do <01:46:12.120>some <01:46:12.295>courses

2424
01:46:13.495 --> 01:46:15.235
<01:46:13.495>or <01:46:13.775>what <01:46:14.055>school <01:46:14.335>you <01:46:14.615>have <01:46:14.894>visited

2425
01:46:15.575 --> 01:46:18.315
<01:46:15.575>or <01:46:15.750>how, <01:46:15.925>how <01:46:16.099>did <01:46:16.275>you <01:46:16.450>develop <01:46:16.625>this <01:46:16.800>broad <01:46:16.974>understanding?

2426
01:46:19.415 --> 01:46:24.075
<01:46:19.415>Um, <01:46:19.590>well, <01:46:19.765>um, <01:46:19.940>I, <01:46:20.115>it's <01:46:20.290>basically <01:46:20.465>a <01:46:20.640>bit <01:46:20.815>in,

2427
01:46:24.295 --> 01:46:27.195
<01:46:24.295>you <01:46:24.450>know, <01:46:24.606>it's <01:46:24.761>in <01:46:24.917>my <01:46:25.072>job <01:46:25.228>as <01:46:25.383>a <01:46:25.539>penetration <01:46:25.695>tester,

2428
01:46:27.235 --> 01:46:28.755
<01:46:27.235>I <01:46:27.463>just <01:46:27.691>see <01:46:27.919>different <01:46:28.147>types <01:46:28.375>of <01:46:28.603>software

2429
01:46:28.755 --> 01:46:30.435
<01:46:28.755>and <01:46:29.105>applications <01:46:29.455>assessing <01:46:29.805>their <01:46:30.155>security.

2430
01:46:31.055 --> 01:46:32.995
<01:46:31.055>And <01:46:31.230>then <01:46:31.405>you, <01:46:31.580>you're <01:46:31.755>in <01:46:31.930>front <01:46:32.105>of <01:46:32.280>a <01:46:32.455>problem.

2431
01:46:33.015 --> 01:46:34.995
<01:46:33.014>You <01:46:33.155>need <01:46:33.294>to <01:46:33.434>solve <01:46:33.575>it. <01:46:33.714>You <01:46:33.855>need <01:46:33.994>to <01:46:34.134>hack <01:46:34.275>this <01:46:34.414>application,

2432
01:46:35.095 --> 01:46:36.635
<01:46:35.094>and <01:46:35.293>then <01:46:35.491>you <01:46:35.688>go <01:46:35.887>and <01:46:36.085>do <01:46:36.283>your <01:46:36.481>research.

2433
01:46:36.705 --> 01:46:39.715
<01:46:36.705>It's <01:46:36.821>basically <01:46:36.938>part <01:46:37.055>of <01:46:37.171>the <01:46:37.288>job. <01:46:37.405>So <01:46:37.521>I <01:46:37.638>learned <01:46:37.755>it <01:46:37.871>on <01:46:37.988>a <01:46:38.105>job.

2434
01:46:39.855 --> 01:46:42.115
<01:46:39.855>And <01:46:40.054>with <01:46:40.254>the <01:46:40.455>different <01:46:40.655>customers <01:46:40.855>that <01:46:41.054>we <01:46:41.254>have,

2435
01:46:42.115 --> 01:46:43.755
<01:46:42.115>they <01:46:42.465>use <01:46:42.815>different, <01:46:43.165>different <01:46:43.514>technology.

2436
01:46:43.855 --> 01:46:46.195
<01:46:43.855>So <01:46:44.054>you <01:46:44.254>basically, <01:46:44.455>there's <01:46:44.655>no <01:46:44.855>other <01:46:45.054>option <01:46:45.254>than,

2437
01:46:46.195 --> 01:46:48.595
<01:46:46.195>than <01:46:46.428>learning <01:46:46.661>a <01:46:46.894>broad <01:46:47.128>knowledge <01:46:47.361>about <01:46:47.594>security.

2438
01:46:48.855 --> 01:46:50.165
<01:46:48.855>On <01:46:49.023>the <01:46:49.191>other <01:46:49.360>hand, <01:46:49.528>I'm <01:46:49.697>not <01:46:49.865>very <01:46:50.034>deep,

2439
01:46:50.185 --> 01:46:51.965
<01:46:50.184>so <01:46:50.464>I'm <01:46:50.745>not <01:46:51.025>a <01:46:51.304>React <01:46:51.584>developer.

2440
01:46:52.145 --> 01:46:54.165
<01:46:52.145>If <01:46:52.300>you <01:46:52.456>give <01:46:52.611>me <01:46:52.767>an <01:46:52.922>IDE <01:46:53.078>with <01:46:53.233>a <01:46:53.389>React <01:46:53.545>application,

2441
01:46:54.165 --> 01:46:55.525
<01:46:54.165>I'm <01:46:54.318>not <01:46:54.471>gonna <01:46:54.624>be <01:46:54.777>able <01:46:54.929>to <01:46:55.083>really <01:46:55.236>do <01:46:55.388>that.

2442
01:46:55.905 --> 01:46:58.085
<01:46:55.905>You <01:46:56.032>all <01:46:56.159>are <01:46:56.286>better <01:46:56.414>at <01:46:56.541>that. <01:46:56.668>So <01:46:56.795>I <01:46:56.923>have <01:46:57.050>a <01:46:57.177>broad <01:46:57.305>knowledge.

2443
01:46:58.625 --> 01:47:01.205
<01:46:58.625>If <01:46:58.780>you <01:46:58.936>wanna <01:46:59.091>go <01:46:59.247>in <01:46:59.402>that <01:46:59.558>direction, <01:46:59.713>say <01:46:59.869>you <01:47:00.025>want

2444
01:47:01.205 --> 01:47:03.525
<01:47:01.205>to <01:47:01.405>develop <01:47:01.605>a <01:47:01.805>broad <01:47:02.005>knowledge <01:47:02.205>about <01:47:02.405>those <01:47:02.605>security

2445
01:47:03.525 --> 01:47:05.645
<01:47:03.525>principles, <01:47:03.758>I <01:47:03.991>really <01:47:04.224>suggest <01:47:04.458>you <01:47:04.691>to <01:47:04.924>go

2446
01:47:05.645 --> 01:47:06.805
<01:47:05.645>to <01:47:05.853>the <01:47:06.062>active <01:47:06.271>side <01:47:06.480>of <01:47:06.689>it.

2447
01:47:07.145 --> 01:47:08.685
<01:47:07.145>So <01:47:07.491>taking <01:47:07.838>Robot <01:47:08.184>two <01:47:08.531>shop,

2448
01:47:08.685 --> 01:47:10.845
<01:47:08.684>you <01:47:08.825>can <01:47:08.964>just <01:47:09.105>spin <01:47:09.245>up <01:47:09.384>your <01:47:09.525>own <01:47:09.664>instance <01:47:09.804>on <01:47:09.945>the <01:47:10.084>internet.

2449
01:47:10.845 --> 01:47:12.205
<01:47:10.844>You <01:47:11.089>don't <01:47:11.334>even <01:47:11.579>need <01:47:11.824>any <01:47:12.068>infrastructure.

2450
01:47:12.865 --> 01:47:15.365
<01:47:12.865>And <01:47:13.040>there's <01:47:13.215>a <01:47:13.389>handbook <01:47:13.565>where <01:47:13.740>you <01:47:13.915>can <01:47:14.090>start <01:47:14.264>hacking.

2451
01:47:15.365 --> 01:47:16.685
<01:47:15.365>There <01:47:15.602>are <01:47:15.840>certain <01:47:16.077>vulnerabilities <01:47:16.315>in <01:47:16.553>there

2452
01:47:16.685 --> 01:47:18.005
<01:47:16.684>and <01:47:16.982>you <01:47:17.279>start <01:47:17.576>exploiting <01:47:17.873>them.

2453
01:47:18.425 --> 01:47:19.605
<01:47:18.425>So <01:47:18.690>if <01:47:18.956>you're <01:47:19.221>a <01:47:19.486>developer

2454
01:47:19.605 --> 01:47:22.565
<01:47:19.605>and <01:47:19.780>on <01:47:19.955>the <01:47:20.129>creating <01:47:20.304>side, <01:47:20.480>uh, <01:47:20.655>change <01:47:20.830>a <01:47:21.004>bit

2455
01:47:22.565 --> 01:47:24.525
<01:47:22.565>to <01:47:22.915>the <01:47:23.265>destruction, <01:47:23.615>destruction <01:47:23.965>side

2456
01:47:24.625 --> 01:47:27.605
<01:47:24.625>and <01:47:24.858>try <01:47:25.091>hacking, <01:47:25.325>um, <01:47:25.558>these <01:47:25.791>sample <01:47:26.025>applications,

2457
01:47:27.745 --> 01:47:29.205
<01:47:27.745>the <01:47:28.007>you <01:47:28.270>will <01:47:28.533>learn <01:47:28.796>a <01:47:29.059>lot.

2458
01:47:29.305 --> 01:47:31.685
<01:47:29.305>So <01:47:29.432>if <01:47:29.559>you <01:47:29.686>do <01:47:29.814>all <01:47:29.941>those <01:47:30.068>challenges <01:47:30.195>that <01:47:30.323>are <01:47:30.450>always <01:47:30.577>true <01:47:30.705>shop,

2459
01:47:32.185 --> 01:47:34.405
<01:47:32.184>you're <01:47:32.360>gonna <01:47:32.535>be <01:47:32.709>close <01:47:32.884>to <01:47:33.059>being <01:47:33.235>a <01:47:33.410>security <01:47:33.584>pro.

2460
01:47:34.605 --> 01:47:37.685
<01:47:34.605>I, <01:47:34.838>I <01:47:35.071>swear, <01:47:35.304>take <01:47:35.538>some <01:47:35.771>time, <01:47:36.004>however.

2461
01:47:37.865 --> 01:47:38.965
<01:47:37.865>Mm-hmm. <01:47:38.855>Okay.

2462
01:47:38.965 --> 01:47:41.325
<01:47:38.965>So <01:47:39.120>it's <01:47:39.276>a <01:47:39.431>lot <01:47:39.587>of, <01:47:39.742>uh, <01:47:39.898>learning <01:47:40.053>by <01:47:40.209>doing, <01:47:40.365>right?

2463
01:47:41.825 --> 01:47:43.205
<01:47:41.825>Yes, <01:47:42.446>absolutely. <01:47:43.067>Yes.

2464
01:47:44.515 --> 01:47:49.125
<01:47:44.514>Okay. <01:47:44.670>Stephanie <01:47:44.826>is <01:47:44.981>asking, <01:47:45.137>are <01:47:45.292>there <01:47:45.448>any <01:47:45.603>low <01:47:45.759>handed <01:47:45.914>fruits

2465
01:47:49.195 --> 01:47:52.165
<01:47:49.195>that <01:47:49.474>one <01:47:49.755>can <01:47:50.035>fix, <01:47:50.315>avoid <01:47:50.594>easily?

2466
01:47:52.685 --> 01:47:54.885
<01:47:52.684>I <01:47:52.860>mean, <01:47:53.035>that's <01:47:53.209>a <01:47:53.384>very <01:47:53.559>general <01:47:53.735>question <01:47:53.910>right <01:47:54.084>now,

2467
01:47:55.305 --> 01:47:57.765
<01:47:55.305>but <01:47:55.480>maybe <01:47:55.655>could <01:47:55.830>you <01:47:56.005>like <01:47:56.180>make <01:47:56.355>a <01:47:56.530>top <01:47:56.705>three

2468
01:47:57.985 --> 01:48:01.085
<01:47:57.985>of <01:47:58.185>your <01:47:58.385>suggestions, <01:47:58.585>like <01:47:58.785>what <01:47:58.985>you <01:47:59.185>should <01:47:59.385>do?

2469
01:48:03.195 --> 01:48:06.885
<01:48:03.195>Yeah, <01:48:03.350>so, <01:48:03.506>um, <01:48:03.661>I <01:48:03.817>think <01:48:03.972>the, <01:48:04.128>the <01:48:04.283>top <01:48:04.439>most, <01:48:04.594>uh,

2470
01:48:08.115 --> 01:48:11.285
<01:48:08.115>idea <01:48:08.270>that <01:48:08.426>the <01:48:08.581>top <01:48:08.737>most <01:48:08.892>problem, <01:48:09.048>generic <01:48:09.203>problem <01:48:09.359>that <01:48:09.514>leads

2471
01:48:11.305 --> 01:48:14.685
<01:48:11.305>to <01:48:11.480>security <01:48:11.655>problems <01:48:11.830>is <01:48:12.005>that <01:48:12.180>I <01:48:12.355>take <01:48:12.530>untrusted <01:48:12.705>data,

2472
01:48:14.685 --> 01:48:17.725
<01:48:14.684>like <01:48:14.812>user <01:48:14.939>input <01:48:15.066>and <01:48:15.194>I <01:48:15.321>embed <01:48:15.448>it <01:48:15.575>in <01:48:15.703>some <01:48:15.830>sort <01:48:15.957>of <01:48:16.084>structure.

2473
01:48:17.905 --> 01:48:21.205
<01:48:17.905>For <01:48:18.060>example, <01:48:18.216>I <01:48:18.371>take <01:48:18.527>a <01:48:18.682>name <01:48:18.838>from <01:48:18.993>an <01:48:19.149>HDV <01:48:19.305>request

2474
01:48:21.205 --> 01:48:22.685
<01:48:21.205>and <01:48:21.427>I <01:48:21.648>put <01:48:21.871>it <01:48:22.093>into <01:48:22.315>a <01:48:22.536>database,

2475
01:48:22.705 --> 01:48:25.165
<01:48:22.705>or <01:48:22.860>I <01:48:23.016>put <01:48:23.171>it <01:48:23.327>into <01:48:23.482>an <01:48:23.638>H <01:48:23.793>TM <01:48:23.949>L <01:48:24.105>template,

2476
01:48:25.225 --> 01:48:27.005
<01:48:25.225>or <01:48:25.425>I <01:48:25.625>put <01:48:25.825>it <01:48:26.025>in, <01:48:26.225>into <01:48:26.425>another <01:48:26.625>query

2477
01:48:27.005 --> 01:48:28.365
<01:48:27.005>that <01:48:27.311>goes <01:48:27.617>to <01:48:27.923>another <01:48:28.228>microservice.

2478
01:48:29.145 --> 01:48:31.285
<01:48:29.145>So <01:48:29.345>whenever <01:48:29.545>I <01:48:29.745>take <01:48:29.945>something <01:48:30.145>that <01:48:30.345>is <01:48:30.545>untrusted

2479
01:48:31.865 --> 01:48:34.085
<01:48:31.865>and <01:48:31.992>put <01:48:32.119>it <01:48:32.246>into <01:48:32.374>a <01:48:32.501>data <01:48:32.628>structure, <01:48:32.755>this <01:48:32.883>is <01:48:33.010>where <01:48:33.137>I <01:48:33.264>need

2480
01:48:34.085 --> 01:48:36.005
<01:48:34.085>to <01:48:34.285>do <01:48:34.485>this <01:48:34.685>context <01:48:34.885>sensitive <01:48:35.085>output <01:48:35.285>and <01:48:35.485>coding.

2481
01:48:36.005 --> 01:48:38.165
<01:48:36.005>And <01:48:36.205>that <01:48:36.405>comes <01:48:36.605>in <01:48:36.805>different <01:48:37.005>shapes, <01:48:37.205>you <01:48:37.405>know,

2482
01:48:38.165 --> 01:48:39.645
<01:48:38.165>depending <01:48:38.498>on <01:48:38.831>the <01:48:39.164>output <01:48:39.497>format,

2483
01:48:40.185 --> 01:48:43.525
<01:48:40.184>but <01:48:40.360>I <01:48:40.535>think <01:48:40.709>that's <01:48:40.884>something <01:48:41.059>that's <01:48:41.235>a <01:48:41.410>basic <01:48:41.584>problem

2484
01:48:43.525 --> 01:48:45.125
<01:48:43.525>that <01:48:43.804>is <01:48:44.085>very <01:48:44.365>generic <01:48:44.644>that <01:48:44.924>leads

2485
01:48:45.145 --> 01:48:46.725
<01:48:45.145>to <01:48:45.611>specific <01:48:46.078>security <01:48:46.545>problems.

2486
01:48:46.725 --> 01:48:48.485
<01:48:46.725>So <01:48:46.958>whenever <01:48:47.191>you <01:48:47.425>take <01:48:47.658>interested <01:48:47.891>data <01:48:48.125>and,

2487
01:48:48.485 --> 01:48:51.165
<01:48:48.485>and <01:48:48.660>put <01:48:48.835>it <01:48:49.010>into <01:48:49.185>another <01:48:49.360>data <01:48:49.535>structure, <01:48:49.710>watch <01:48:49.885>out

2488
01:48:51.165 --> 01:48:52.285
<01:48:51.165>for <01:48:51.669>injection <01:48:52.173>attacks.

2489
01:48:52.865 --> 01:48:54.765
<01:48:52.865>And <01:48:53.098>that's <01:48:53.331>basically, <01:48:53.565>that's <01:48:53.798>top <01:48:54.031>number <01:48:54.264>one.

2490
01:48:55.115 --> 01:48:57.005
<01:48:55.115>When <01:48:55.394>doing <01:48:55.675>web <01:48:55.955>applications, <01:48:56.235>watch <01:48:56.514>out

2491
01:48:57.025 --> 01:48:58.285
<01:48:57.025>for <01:48:57.402>cross <01:48:57.781>site <01:48:58.159>scripting,

2492
01:48:58.285 --> 01:49:01.165
<01:48:58.285>that's <01:48:58.485>executing <01:48:58.684>script <01:48:58.885>code <01:48:59.085>in <01:48:59.285>other <01:48:59.485>users' <01:48:59.684>browsers.

2493
01:49:01.785 --> 01:49:03.165
<01:49:01.785>Uh, <01:49:01.992>have <01:49:02.199>a <01:49:02.406>look <01:49:02.613>at <01:49:02.820>your <01:49:03.027>framework,

2494
01:49:03.165 --> 01:49:04.645
<01:49:03.165>which <01:49:03.431>really <01:49:03.697>protects <01:49:03.964>you <01:49:04.230>against <01:49:04.497>this.

2495
01:49:05.665 --> 01:49:09.485
<01:49:05.665>Uh, <01:49:05.792>and <01:49:05.919>well, <01:49:06.046>uh, <01:49:06.174>other <01:49:06.301>than <01:49:06.428>that, <01:49:06.555>just <01:49:06.683>look <01:49:06.810>at, <01:49:06.937>you <01:49:07.065>know,

2496
01:49:09.665 --> 01:49:11.765
<01:49:09.665>at <01:49:09.840>those <01:49:10.015>top <01:49:10.190>list <01:49:10.365>and <01:49:10.540>try <01:49:10.715>to <01:49:10.890>understand, <01:49:11.065>uh,

2497
01:49:11.765 --> 01:49:13.125
<01:49:11.764>what <01:49:11.968>is <01:49:12.173>relevant <01:49:12.376>for <01:49:12.581>you <01:49:12.785>because <01:49:12.989>not

2498
01:49:13.125 --> 01:49:14.365
<01:49:13.125>everything <01:49:13.497>will <01:49:13.869>be <01:49:14.241>relevant.

2499
01:49:15.515 --> 01:49:18.005
<01:49:15.514>Okay. <01:49:15.714>And <01:49:15.914>then <01:49:16.115>again, <01:49:16.315>another <01:49:16.514>question <01:49:16.714>from <01:49:16.914>Stephanie.

2500
01:49:18.065 --> 01:49:21.045
<01:49:18.065>She <01:49:18.205>was <01:49:18.345>very, <01:49:18.485>uh, <01:49:18.625>engaged <01:49:18.765>in <01:49:18.905>the <01:49:19.045>discussion <01:49:19.185>as <01:49:19.325>well. <01:49:19.465>Mm-hmm.

2501
01:49:21.125 --> 01:49:24.205
<01:49:21.125>Thank <01:49:21.280>you <01:49:21.436>for <01:49:21.591>that, <01:49:21.747>Stephanie. <01:49:21.902>Um, <01:49:22.058>what <01:49:22.213>tools <01:49:22.369>to <01:49:22.525>check

2502
01:49:24.205 --> 01:49:27.005
<01:49:24.205>for <01:49:24.380>security <01:49:24.555>issues <01:49:24.730>in <01:49:24.905>an <01:49:25.080>app <01:49:25.255>would <01:49:25.430>you <01:49:25.605>recommend?

2503
01:49:28.265 --> 01:49:29.365
<01:49:28.264>Say <01:49:28.463>it <01:49:28.660>again, <01:49:28.858>I <01:49:29.057>didn't <01:49:29.255>understand

2504
01:49:29.365 --> 01:49:30.725
<01:49:29.365>this <01:49:29.568>first <01:49:29.773>part <01:49:29.977>of <01:49:30.181>your <01:49:30.385>question. <01:49:30.589>What

2505
01:49:30.725 --> 01:49:32.525
<01:49:30.725>Tools <01:49:31.075>would <01:49:31.425>you <01:49:31.775>recommend <01:49:32.125>for

2506
01:49:33.125 --> 01:49:35.285
<01:49:33.125>checking <01:49:33.405>security <01:49:33.685>issues <01:49:33.965>in <01:49:34.245>an <01:49:34.525>app?

2507
01:49:36.025 --> 01:49:37.885
<01:49:36.025>Um, <01:49:36.304>what <01:49:36.585>tool <01:49:36.865>will <01:49:37.144>I <01:49:37.424>recommend?

2508
01:49:37.985 --> 01:49:41.525
<01:49:37.985>So, <01:49:38.451>um, <01:49:38.918>in <01:49:39.385>general,

2509
01:49:41.925 --> 01:49:44.965
<01:49:41.925>I <01:49:42.125>would <01:49:42.325>check <01:49:42.525>dependencies <01:49:42.725>first <01:49:42.925>for <01:49:43.125>known <01:49:43.325>problems.

2510
01:49:45.025 --> 01:49:46.765
<01:49:45.025>So <01:49:45.304>when <01:49:45.585>starting <01:49:45.865>out <01:49:46.144>with <01:49:46.424>automation

2511
01:49:46.765 --> 01:49:49.845
<01:49:46.764>and <01:49:46.964>tools, <01:49:47.164>check <01:49:47.365>your <01:49:47.565>dependencies <01:49:47.764>for <01:49:47.964>known <01:49:48.164>problems,

2512
01:49:49.985 --> 01:49:51.565
<01:49:49.985>and <01:49:50.218>there <01:49:50.451>was <01:49:50.685>a <01:49:50.918>listing <01:49:51.151>the <01:49:51.385>presentation

2513
01:49:51.635 --> 01:49:53.045
<01:49:51.635>that <01:49:51.816>you <01:49:51.997>can <01:49:52.178>take <01:49:52.360>as <01:49:52.541>a <01:49:52.722>base <01:49:52.904>here.

2514
01:49:53.745 --> 01:49:56.845
<01:49:53.745>Uh, <01:49:53.885>the <01:49:54.025>next <01:49:54.165>step <01:49:54.305>probably <01:49:54.445>would <01:49:54.585>be <01:49:54.724>to <01:49:54.865>do <01:49:55.005>some <01:49:55.144>sort

2515
01:49:56.845 --> 01:49:57.925
<01:49:56.844>of <01:49:57.331>static <01:49:57.817>analysis.

2516
01:49:58.585 --> 01:50:00.325
<01:49:58.585>Uh, <01:49:58.785>that <01:49:58.985>depends <01:49:59.185>on <01:49:59.385>the <01:49:59.585>language, <01:49:59.785>how <01:49:59.985>well

2517
01:50:00.325 --> 01:50:01.845
<01:50:00.325>that <01:50:00.477>can <01:50:00.629>be <01:50:00.781>applied <01:50:00.933>as <01:50:01.085>we <01:50:01.236>learn <01:50:01.388>in <01:50:01.540>the <01:50:01.692>beginning.

2518
01:50:01.865 --> 01:50:03.245
<01:50:01.865>But <01:50:02.279>static <01:50:02.693>analysis, <01:50:03.107>uh,

2519
01:50:03.305 --> 01:50:05.925
<01:50:03.305>can <01:50:03.445>do <01:50:03.585>it <01:50:03.725>on <01:50:03.865>your <01:50:04.005>code <01:50:04.145>without <01:50:04.285>having <01:50:04.425>a <01:50:04.565>running <01:50:04.705>instance.

2520
01:50:06.275 --> 01:50:09.645
<01:50:06.275>There's <01:50:06.415>one, <01:50:06.554>there's <01:50:06.695>a <01:50:06.835>couple <01:50:06.974>of <01:50:07.115>newer <01:50:07.254>tools, <01:50:07.394>uh, <01:50:07.535>out <01:50:07.674>there.

2521
01:50:09.865 --> 01:50:13.165
<01:50:09.865>One <01:50:10.040>is <01:50:10.215>very, <01:50:10.389>uh, <01:50:10.565>it's <01:50:10.740>limited <01:50:10.915>in <01:50:11.090>its <01:50:11.264>capabilities,

2522
01:50:13.265 --> 01:50:14.445
<01:50:13.264>but <01:50:13.619>it's <01:50:13.973>very <01:50:14.326>fast

2523
01:50:14.465 --> 01:50:17.605
<01:50:14.465>and <01:50:14.620>can <01:50:14.776>be <01:50:14.931>very <01:50:15.087>well <01:50:15.242>integrated <01:50:15.398>into <01:50:15.553>an <01:50:15.709>agile <01:50:15.865>process

2524
01:50:17.705 --> 01:50:19.765
<01:50:17.705>and <01:50:17.880>do <01:50:18.055>it <01:50:18.230>in <01:50:18.405>every <01:50:18.580>push <01:50:18.755>that's <01:50:18.930>called <01:50:19.105>sre.

2525
01:50:20.345 --> 01:50:22.685
<01:50:20.344>So <01:50:20.578>depending <01:50:20.811>on <01:50:21.044>what <01:50:21.278>environment <01:50:21.511>you <01:50:21.744>have,

2526
01:50:22.705 --> 01:50:25.005
<01:50:22.705>but <01:50:22.860>I <01:50:23.016>suggest <01:50:23.171>you <01:50:23.327>to <01:50:23.482>have <01:50:23.638>a <01:50:23.793>look <01:50:23.949>at <01:50:24.105>emre.

2527
01:50:25.065 --> 01:50:27.645
<01:50:25.065>So <01:50:25.265>that's <01:50:25.465>Seman <01:50:25.665>grip <01:50:25.865>in <01:50:26.065>one <01:50:26.265>word, <01:50:26.465>Emre.

2528
01:50:28.465 --> 01:50:32.085
<01:50:28.465>Um, <01:50:28.620>and <01:50:28.776>that's <01:50:28.931>a <01:50:29.087>very <01:50:29.242>lightweight <01:50:29.398>SaaS <01:50:29.553>tool <01:50:29.709>that's, <01:50:29.865>again,

2529
01:50:32.085 --> 01:50:34.925
<01:50:32.085>it's <01:50:32.285>limited, <01:50:32.485>but <01:50:32.685>it's, <01:50:32.885>um, <01:50:33.085>it's <01:50:33.285>very <01:50:33.485>fast

2530
01:50:34.985 --> 01:50:36.605
<01:50:34.985>and <01:50:35.140>you <01:50:35.296>can <01:50:35.451>write <01:50:35.607>your <01:50:35.762>own <01:50:35.918>rules <01:50:36.073>and <01:50:36.229>the <01:50:36.385>rules.

2531
01:50:36.885 --> 01:50:38.365
<01:50:36.885>Emtex <01:50:37.151>is <01:50:37.417>really <01:50:37.684>easy <01:50:37.950>to <01:50:38.217>understand.

2532
01:50:38.365 --> 01:50:39.845
<01:50:38.365>It <01:50:38.555>comes <01:50:38.745>with <01:50:38.935>a <01:50:39.126>couple <01:50:39.316>of <01:50:39.506>community <01:50:39.696>rules

2533
01:50:40.155 --> 01:50:41.645
<01:50:40.155>that <01:50:40.423>you <01:50:40.691>can <01:50:40.959>apply, <01:50:41.227>for <01:50:41.496>example.

2534
01:50:41.645 --> 01:50:44.005
<01:50:41.645>It <01:50:41.800>has <01:50:41.956>a <01:50:42.111>very <01:50:42.267>good <01:50:42.422>rule <01:50:42.578>set <01:50:42.733>for <01:50:42.889>react <01:50:43.045>applications.

2535
01:50:45.755 --> 01:50:49.285
<01:50:45.755>Okay. <01:50:45.930>And <01:50:46.105>then <01:50:46.280>we <01:50:46.455>have <01:50:46.630>another <01:50:46.805>question <01:50:46.980>from <01:50:47.155>pri.

2536
01:50:50.285 --> 01:50:52.765
<01:50:50.285>I <01:50:50.485>hope <01:50:50.684>I <01:50:50.885>got <01:50:51.085>the <01:50:51.285>conversation <01:50:51.485>right. <01:50:51.684>Mm-hmm.

2537
01:50:52.905 --> 01:50:57.125
<01:50:52.905>Um, <01:50:53.060>what <01:50:53.216>would <01:50:53.371>be <01:50:53.527>a <01:50:53.682>recommended <01:50:53.838>frequency <01:50:53.993>to <01:50:54.149>perform <01:50:54.305>sus

2538
01:50:57.125 --> 01:50:58.445
<01:50:57.125>or <01:50:57.521>dust <01:50:57.916>scans <01:50:58.313>of

2539
01:50:59.045 --> 01:51:01.605
<01:50:59.045>companies <01:50:59.200>are <01:50:59.356>in <01:50:59.511>this <01:50:59.667>infinite <01:50:59.822>loop <01:50:59.978>when <01:51:00.133>they <01:51:00.289>release <01:51:00.445>new

2540
01:51:01.605 --> 01:51:04.565
<01:51:01.605>versions <01:51:01.760>or <01:51:01.916>features <01:51:02.071>and <01:51:02.227>keep <01:51:02.382>running <01:51:02.538>scans <01:51:02.693>to <01:51:02.849>fix <01:51:03.004>them.

2541
01:51:05.345 --> 01:51:09.925
<01:51:05.344>Mm-hmm. <01:51:05.544>Um, <01:51:05.744>so <01:51:05.945>when <01:51:06.144>using <01:51:06.344>such <01:51:06.544>tools, <01:51:06.744>one

2542
01:51:09.925 --> 01:51:13.045
<01:51:09.925>of <01:51:10.080>those <01:51:10.236>more <01:51:10.391>capable, <01:51:10.547>more <01:51:10.702>expensive <01:51:10.858>tools <01:51:11.013>that <01:51:11.169>find <01:51:11.325>lot,

2543
01:51:13.075 --> 01:51:17.285
<01:51:13.075>lots <01:51:13.215>of <01:51:13.355>problems, <01:51:13.495>um, <01:51:13.635>I <01:51:13.775>would <01:51:13.915>really <01:51:14.054>start <01:51:14.195>out <01:51:14.335>with, <01:51:14.474>uh,

2544
01:51:17.435 --> 01:51:20.565
<01:51:17.434>with <01:51:17.575>just <01:51:17.714>the <01:51:17.855>most <01:51:17.995>critical, <01:51:18.134>with <01:51:18.275>just <01:51:18.414>a <01:51:18.554>few <01:51:18.695>rules, <01:51:18.834>because

2545
01:51:20.565 --> 01:51:23.165
<01:51:20.565>otherwise <01:51:20.720>you're <01:51:20.876>gonna <01:51:21.031>have <01:51:21.187>a <01:51:21.342>list <01:51:21.498>of <01:51:21.653>thousands <01:51:21.809>of <01:51:21.965>problems

2546
01:51:23.165 --> 01:51:25.405
<01:51:23.165>that <01:51:23.320>are, <01:51:23.476>some <01:51:23.631>of <01:51:23.787>them <01:51:23.942>are <01:51:24.098>not <01:51:24.253>even <01:51:24.409>relevant, <01:51:24.565>many

2547
01:51:25.405 --> 01:51:26.565
<01:51:25.405>of <01:51:25.666>them <01:51:25.927>are <01:51:26.188>false <01:51:26.449>positives.

2548
01:51:27.015 --> 01:51:30.765
<01:51:27.014>Start <01:51:27.170>with <01:51:27.326>critical <01:51:27.481>only <01:51:27.637>have <01:51:27.792>a <01:51:27.948>digestible <01:51:28.103>list <01:51:28.259>of <01:51:28.414>problems

2549
01:51:31.345 --> 01:51:32.645
<01:51:31.344>and <01:51:31.735>what's <01:51:32.125>the <01:51:32.515>frequency?

2550
01:51:32.725 --> 01:51:35.925
<01:51:32.725>I <01:51:32.852>mean, <01:51:32.979>if, <01:51:33.106>if <01:51:33.234>there <01:51:33.361>are <01:51:33.488>few <01:51:33.615>problems <01:51:33.743>you <01:51:33.870>have <01:51:33.997>solved <01:51:34.125>all

2551
01:51:35.925 --> 01:51:38.085
<01:51:35.925>of <01:51:36.100>them, <01:51:36.275>you <01:51:36.450>have <01:51:36.625>come <01:51:36.800>over <01:51:36.975>the <01:51:37.150>security <01:51:37.325>pump

2552
01:51:38.085 --> 01:51:41.205
<01:51:38.085>and <01:51:38.260>you <01:51:38.435>are <01:51:38.610>just <01:51:38.785>dealing <01:51:38.960>with <01:51:39.135>the <01:51:39.310>single <01:51:39.485>outputs

2553
01:51:41.205 --> 01:51:43.125
<01:51:41.205>of <01:51:41.360>those <01:51:41.516>tools, <01:51:41.671>you <01:51:41.827>can <01:51:41.982>do <01:51:42.138>it <01:51:42.293>at <01:51:42.449>every <01:51:42.605>push.

2554
01:51:43.865 --> 01:51:46.405
<01:51:43.865>But <01:51:44.040>when <01:51:44.215>you're <01:51:44.389>just <01:51:44.565>getting <01:51:44.740>started, <01:51:44.915>I <01:51:45.090>would <01:51:45.264>suggest

2555
01:51:46.405 --> 01:51:48.165
<01:51:46.405>to <01:51:46.580>do <01:51:46.755>it <01:51:46.930>maybe <01:51:47.105>once <01:51:47.280>a <01:51:47.455>month <01:51:47.630>or <01:51:47.805>so.

2556
01:51:48.375 --> 01:51:50.125
<01:51:48.375>Right? <01:51:48.608>It <01:51:48.841>depends <01:51:49.075>on <01:51:49.308>your <01:51:49.541>maturity <01:51:49.775>level.

2557
01:51:50.125 --> 01:51:51.765
<01:51:50.125>Start <01:51:50.405>out <01:51:50.685>with <01:51:50.965>just <01:51:51.245>fewer <01:51:51.525>rules.

2558
01:51:51.775 --> 01:51:53.125
<01:51:51.775>Start <01:51:52.078>out <01:51:52.382>with <01:51:52.686>less <01:51:52.990>frequent

2559
01:51:53.745 --> 01:51:57.525
<01:51:53.745>and <01:51:53.885>the, <01:51:54.025>the <01:51:54.165>further <01:51:54.305>you <01:51:54.445>go <01:51:54.585>over <01:51:54.724>fixing <01:51:54.865>all <01:51:55.005>those <01:51:55.144>problems

2560
01:51:57.545 --> 01:51:59.845
<01:51:57.545>or <01:51:57.720>marking <01:51:57.895>them <01:51:58.070>as <01:51:58.245>false <01:51:58.420>positives <01:51:58.595>also <01:51:58.770>very <01:51:58.945>important.

2561
01:52:00.225 --> 01:52:01.925
<01:52:00.225>Uh, <01:52:00.425>the <01:52:00.625>more <01:52:00.825>frequently <01:52:01.025>you <01:52:01.225>can <01:52:01.425>do <01:52:01.625>it.

2562
01:52:05.115 --> 01:52:08.165
<01:52:05.115>Okay. <01:52:05.315>I'm <01:52:05.514>looking <01:52:05.715>up <01:52:05.915>for <01:52:06.115>another <01:52:06.315>good <01:52:06.514>one.

2563
01:52:10.145 --> 01:52:15.005
<01:52:10.145>Um, <01:52:11.545>Jacqueline

2564
01:52:15.025 --> 01:52:16.405
<01:52:15.025>has <01:52:15.439>an <01:52:15.853>interesting <01:52:16.267>question.

2565
01:52:16.595 --> 01:52:17.805
<01:52:16.594>It's <01:52:16.867>also <01:52:17.139>a <01:52:17.411>general <01:52:17.684>one,

2566
01:52:17.825 --> 01:52:20.645
<01:52:17.825>but <01:52:18.000>do <01:52:18.175>you <01:52:18.349>have <01:52:18.525>suggestions <01:52:18.700>on <01:52:18.875>how <01:52:19.050>to <01:52:19.224>practice

2567
01:52:21.305 --> 01:52:22.885
<01:52:21.305>to <01:52:21.771>write <01:52:22.238>secure <01:52:22.705>code?

2568
01:52:23.865 --> 01:52:27.165
<01:52:23.865>Um, <01:52:24.065>practice <01:52:24.264>writing <01:52:24.465>secure <01:52:24.665>code <01:52:24.865>is <01:52:25.065>probably, <01:52:25.264>uh,

2569
01:52:27.585 --> 01:52:29.405
<01:52:27.585>having <01:52:27.865>a <01:52:28.145>challenge <01:52:28.425>by <01:52:28.705>other <01:52:28.985>people.

2570
01:52:30.065 --> 01:52:33.365
<01:52:30.065>Uh, <01:52:30.220>so, <01:52:30.376>um, <01:52:30.531>if, <01:52:30.687>for <01:52:30.842>example, <01:52:30.998>you <01:52:31.153>are <01:52:31.309>a <01:52:31.465>team

2571
01:52:33.365 --> 01:52:36.165
<01:52:33.365>of <01:52:33.598>multiple <01:52:33.831>people <01:52:34.065>who <01:52:34.298>write <01:52:34.531>code, <01:52:34.764>um,

2572
01:52:36.235 --> 01:52:37.965
<01:52:36.235>there's <01:52:36.701>always <01:52:37.168>some <01:52:37.635>people

2573
01:52:37.985 --> 01:52:41.165
<01:52:37.985>who <01:52:38.160>have <01:52:38.335>already <01:52:38.510>some <01:52:38.685>experience <01:52:38.860>in <01:52:39.035>security <01:52:39.210>also <01:52:39.385>establish

2574
01:52:41.235 --> 01:52:45.005
<01:52:41.235>code <01:52:41.390>reviews <01:52:41.546>and, <01:52:41.701>um, <01:52:41.857>maybe <01:52:42.012>also <01:52:42.168>go <01:52:42.323>a <01:52:42.479>bit <01:52:42.635>on,

2575
01:52:45.040 --> 01:52:47.325
<01:52:45.040>on <01:52:45.195>the <01:52:45.351>active <01:52:45.506>side <01:52:45.662>and, <01:52:45.817>and <01:52:45.973>maybe <01:52:46.128>try <01:52:46.284>scanning <01:52:46.440>through

2576
01:52:47.325 --> 01:52:48.845
<01:52:47.325>and <01:52:47.553>try <01:52:47.781>to <01:52:48.009>understand <01:52:48.236>what's <01:52:48.464>behind <01:52:48.692>it.

2577
01:52:48.985 --> 01:52:53.005
<01:52:48.985>So <01:52:49.125>I, <01:52:49.265>I <01:52:49.405>was <01:52:49.545>always <01:52:49.685>approach <01:52:49.825>it <01:52:49.965>from <01:52:50.105>the <01:52:50.245>active <01:52:50.385>side

2578
01:52:53.005 --> 01:52:56.325
<01:52:53.005>and <01:52:53.180>say, <01:52:53.355>find <01:52:53.530>bucks <01:52:53.705>first, <01:52:53.880>use <01:52:54.055>other <01:52:54.230>people's <01:52:54.405>knowledge,

2579
01:52:56.465 --> 01:52:59.045
<01:52:56.465>use <01:52:56.698>some <01:52:56.931>automation <01:52:57.165>tools <01:52:57.398>and <01:52:57.631>so <01:52:57.865>on.

2580
01:52:59.065 --> 01:53:01.205
<01:52:59.065>And <01:52:59.220>then <01:52:59.376>try <01:52:59.531>to <01:52:59.687>understand <01:52:59.842>the <01:52:59.998>core <01:53:00.153>of <01:53:00.309>it <01:53:00.465>and,

2581
01:53:01.345 --> 01:53:04.125
<01:53:01.344>and <01:53:01.544>go <01:53:01.744>down <01:53:01.945>to <01:53:02.144>where <01:53:02.344>does <01:53:02.544>the <01:53:02.744>framework

2582
01:53:04.125 --> 01:53:05.525
<01:53:04.125>or <01:53:04.335>the <01:53:04.545>language, <01:53:04.755>how <01:53:04.965>can <01:53:05.174>it <01:53:05.384>help?

2583
01:53:05.585 --> 01:53:07.445
<01:53:05.585>How <01:53:05.785>do <01:53:05.985>I <01:53:06.185>really <01:53:06.385>fix <01:53:06.585>this <01:53:06.785>problem <01:53:06.985>well,

2584
01:53:07.445 --> 01:53:09.045
<01:53:07.445>and <01:53:07.724>then <01:53:08.005>start <01:53:08.285>learning <01:53:08.565>from <01:53:08.844>that.

2585
01:53:09.065 --> 01:53:12.365
<01:53:09.065>So <01:53:09.205>the <01:53:09.345>best, <01:53:09.485>the <01:53:09.625>best <01:53:09.765>way <01:53:09.905>from <01:53:10.045>my <01:53:10.185>point <01:53:10.325>of <01:53:10.465>view

2586
01:53:12.385 --> 01:53:14.445
<01:53:12.385>to <01:53:12.585>learn <01:53:12.785>security <01:53:12.985>related <01:53:13.185>stuff, <01:53:13.385>also <01:53:13.585>in <01:53:13.785>terms

2587
01:53:14.445 --> 01:53:15.725
<01:53:14.445>of <01:53:14.675>fixing <01:53:14.905>stuff <01:53:15.136>in <01:53:15.366>the <01:53:15.597>code

2588
01:53:15.725 --> 01:53:18.045
<01:53:15.725>and <01:53:15.900>writing <01:53:16.075>security <01:53:16.250>code <01:53:16.425>is <01:53:16.600>approaching <01:53:16.775>it <01:53:16.950>from <01:53:17.125>the

2589
01:53:18.585 --> 01:53:20.005
<01:53:18.585>active <01:53:19.224>attacking <01:53:19.863>side.

2590
01:53:20.185 --> 01:53:23.045
<01:53:20.184>And <01:53:20.301>then <01:53:20.418>try <01:53:20.535>to <01:53:20.651>learn <01:53:20.768>from <01:53:20.884>why <01:53:21.001>did <01:53:21.118>I, <01:53:21.235>why <01:53:21.351>was <01:53:21.468>I <01:53:21.584>able

2591
01:53:23.045 --> 01:53:24.205
<01:53:23.045>to <01:53:23.253>exploit <01:53:23.462>this <01:53:23.671>in <01:53:23.880>this <01:53:24.089>case

2592
01:53:24.865 --> 01:53:26.205
<01:53:24.865>and <01:53:25.066>what <01:53:25.267>was <01:53:25.468>the <01:53:25.669>problem <01:53:25.870>behind <01:53:26.071>it?

2593
01:53:27.515 --> 01:53:29.965
<01:53:27.514>Okay, <01:53:27.748>thank <01:53:27.981>you. <01:53:28.214>Uh, <01:53:28.448>Rafa <01:53:28.681>is <01:53:28.914>asking,

2594
01:53:30.065 --> 01:53:32.805
<01:53:30.065>what's <01:53:30.345>your <01:53:30.625>recommendation <01:53:30.905>to <01:53:31.185>check <01:53:31.465>dependencies?

2595
01:53:32.865 --> 01:53:37.645
<01:53:32.865>Vulnerabilities <01:53:33.020>listed <01:53:33.176>on <01:53:33.331>POM <01:53:33.487>XML <01:53:33.642>package <01:53:33.798>js <01:53:33.953>or <01:53:34.109>PIP <01:53:34.264>files?

2596
01:53:39.305 --> 01:53:42.765
<01:53:39.305>Um, <01:53:39.505>package, <01:53:39.705>Jasons <01:53:39.905>is <01:53:40.105>frontend <01:53:40.305>par <01:53:40.505>ml <01:53:40.705>Maven.

2597
01:53:43.345 --> 01:53:48.045
<01:53:43.344>Uh, <01:53:43.500>there <01:53:43.656>is <01:53:43.811>aas <01:53:43.967>dependency <01:53:44.122>check, <01:53:44.278>um, <01:53:44.433>that <01:53:44.589>has <01:53:44.744>a,

2598
01:53:48.145 --> 01:53:51.965
<01:53:48.145>has <01:53:48.261>a <01:53:48.378>Maven <01:53:48.495>integration, <01:53:48.611>so <01:53:48.728>you <01:53:48.845>can <01:53:48.961>use <01:53:49.078>it <01:53:49.195>as <01:53:49.311>a <01:53:49.428>Maven, <01:53:49.545>um,

2599
01:53:53.105 --> 01:53:55.925
<01:53:53.105>you <01:53:53.280>know, <01:53:53.455>plugin <01:53:53.629>basically, <01:53:53.804>so <01:53:53.980>that <01:53:54.155>when <01:53:54.330>your <01:53:54.504>process,

2600
01:53:56.035 --> 01:53:58.165
<01:53:56.035>when <01:53:56.268>you <01:53:56.501>are, <01:53:56.735>uh, <01:53:56.968>software <01:53:57.201>is <01:53:57.434>building,

2601
01:53:58.315 --> 01:54:01.925
<01:53:58.315>it's <01:53:58.455>also <01:53:58.595>gonna <01:53:58.735>be <01:53:58.875>checking <01:53:59.015>this, <01:53:59.155>uh, <01:53:59.295>the <01:53:59.435>list <01:53:59.575>of, <01:53:59.715>of,

2602
01:54:01.985 --> 01:54:03.645
<01:54:01.985>of <01:54:02.335>dependencies <01:54:02.685>for <01:54:03.035>known <01:54:03.385>vulnerabilities.

2603
01:54:04.225 --> 01:54:06.205
<01:54:04.225>Uh, <01:54:04.400>be <01:54:04.575>aware <01:54:04.750>that <01:54:04.925>don't <01:54:05.100>do <01:54:05.275>that <01:54:05.450>on <01:54:05.625>a,

2604
01:54:06.505 --> 01:54:09.845
<01:54:06.505>or <01:54:06.680>have <01:54:06.855>a <01:54:07.030>local <01:54:07.205>copy <01:54:07.380>of <01:54:07.555>the <01:54:07.730>vulnerability <01:54:07.905>database

2605
01:54:09.845 --> 01:54:12.845
<01:54:09.844>because <01:54:10.078>that's <01:54:10.311>several <01:54:10.544>hundreds <01:54:10.778>of <01:54:11.011>megabytes <01:54:11.244>big.

2606
01:54:12.985 --> 01:54:14.045
<01:54:12.985>So, <01:54:13.303>uh, <01:54:13.621>watch <01:54:13.939>out.

2607
01:54:14.145 --> 01:54:16.125
<01:54:14.145>If <01:54:14.345>the <01:54:14.545>process <01:54:14.745>is <01:54:14.945>very <01:54:15.145>slow, <01:54:15.345>it's <01:54:15.545>probably

2608
01:54:16.125 --> 01:54:18.645
<01:54:16.125>because <01:54:16.325>it's <01:54:16.525>downloading <01:54:16.725>the <01:54:16.925>database <01:54:17.125>every <01:54:17.325>single <01:54:17.525>time,

2609
01:54:18.955 --> 01:54:20.085
<01:54:18.955>have <01:54:19.294>it <01:54:19.633>cached <01:54:19.972>somewhere.

2610
01:54:20.105 --> 01:54:23.765
<01:54:20.105>That's <01:54:20.245>something <01:54:20.384>that <01:54:20.525>I <01:54:20.665>ran <01:54:20.804>into, <01:54:20.945>uh, <01:54:21.084>when <01:54:21.224>doing <01:54:21.365>this, <01:54:21.504>uh,

2611
01:54:23.765 --> 01:54:26.685
<01:54:23.764>for <01:54:23.920>package <01:54:24.076>chase <01:54:24.231>and, <01:54:24.387>uh, <01:54:24.542>front <01:54:24.698>end, <01:54:24.853>there's <01:54:25.009>NPM <01:54:25.164>audit.

2612
01:54:26.865 --> 01:54:28.685
<01:54:26.865>It <01:54:27.098>yields <01:54:27.331>a <01:54:27.565>lot <01:54:27.798>of <01:54:28.031>false <01:54:28.264>positives,

2613
01:54:28.685 --> 01:54:30.485
<01:54:28.684>so <01:54:29.035>it's <01:54:29.384>very <01:54:29.735>noisy, <01:54:30.084>unfortunately.

2614
01:54:31.505 --> 01:54:34.205
<01:54:31.505>Um, <01:54:31.680>but <01:54:31.855>almost <01:54:32.030>dependency <01:54:32.205>check <01:54:32.380>can <01:54:32.555>also <01:54:32.730>be <01:54:32.905>used

2615
01:54:34.205 --> 01:54:37.085
<01:54:34.205>with <01:54:34.360>this <01:54:34.516>one, <01:54:34.671>but <01:54:34.827>I <01:54:34.982>think <01:54:35.138>it's <01:54:35.293>less <01:54:35.449>tested <01:54:35.605>than,

2616
01:54:37.205 --> 01:54:38.885
<01:54:37.205>I <01:54:37.380>think <01:54:37.555>the <01:54:37.730>first <01:54:37.905>integration <01:54:38.080>they <01:54:38.255>had <01:54:38.430>was <01:54:38.605>POM

2617
01:54:38.945 --> 01:54:40.325
<01:54:38.945>xml <01:54:39.193>and <01:54:39.441>the <01:54:39.690>third <01:54:39.938>one <01:54:40.187>was,

2618
01:54:41.265 --> 01:54:42.265
<01:54:41.264>Uh, <01:54:41.714>PIP <01:54:42.164>files.

2619
01:54:43.025 --> 01:54:45.885
<01:54:43.025>PIP <01:54:43.258>files, <01:54:43.491>uh, <01:54:43.724>okay. <01:54:43.958>So <01:54:44.191>Python. <01:54:44.424>Yeah.

2620
01:54:46.065 --> 01:54:49.165
<01:54:46.065>Um, <01:54:46.415>also <01:54:46.765>depends, <01:54:47.115>always <01:54:47.465>depends.

2621
01:54:49.165 --> 01:54:51.005
<01:54:49.165>Check, <01:54:49.340>I <01:54:49.515>think <01:54:49.690>also <01:54:49.865>has <01:54:50.040>support <01:54:50.215>for <01:54:50.390>this <01:54:50.565>one.

2622
01:54:51.005 --> 01:54:53.165
<01:54:51.005>So <01:54:51.160>if <01:54:51.316>you <01:54:51.471>want <01:54:51.627>to <01:54:51.782>use <01:54:51.938>open <01:54:52.093>source <01:54:52.249>software, <01:54:52.405>um,

2623
01:54:53.395 --> 01:54:55.005
<01:54:53.395>that <01:54:53.628>is <01:54:53.861>probably <01:54:54.095>the <01:54:54.328>way <01:54:54.561>to <01:54:54.795>go.

2624
01:54:55.095 --> 01:54:56.845
<01:54:55.094>There <01:54:55.328>also <01:54:55.561>some <01:54:55.794>commercial <01:54:56.028>tools <01:54:56.261>that <01:54:56.494>tend

2625
01:54:56.845 --> 01:54:58.085
<01:54:56.844>to <01:54:57.124>have <01:54:57.402>less <01:54:57.682>false <01:54:57.961>positives

2626
01:54:58.085 --> 01:55:01.565
<01:54:58.085>because <01:54:58.240>there's <01:54:58.396>a <01:54:58.551>set <01:54:58.707>of <01:54:58.862>people <01:54:59.018>behind <01:54:59.173>them <01:54:59.329>who, <01:54:59.485>um,

2627
01:55:01.865 --> 01:55:03.845
<01:55:01.865>manage <01:55:02.098>the <01:55:02.331>lists <01:55:02.565>of, <01:55:02.798>of <01:55:03.031>vulner <01:55:03.264>morbidities

2628
01:55:03.865 --> 01:55:06.205
<01:55:03.865>and <01:55:04.005>make <01:55:04.144>sure <01:55:04.285>that <01:55:04.425>there <01:55:04.565>are <01:55:04.705>not <01:55:04.844>too <01:55:04.985>many <01:55:05.125>false <01:55:05.264>positives.

2629
01:55:06.205 --> 01:55:09.085
<01:55:06.205>So <01:55:06.332>they <01:55:06.459>tend <01:55:06.586>to <01:55:06.714>be <01:55:06.841>better <01:55:06.968>in <01:55:07.095>quality, <01:55:07.223>but <01:55:07.350>also <01:55:07.477>cost <01:55:07.605>money.

2630
01:55:10.795 --> 01:55:15.005
<01:55:10.795>Okay. <01:55:10.995>Then, <01:55:11.195>um, <01:55:11.395>Simo <01:55:11.595>has <01:55:11.795>a <01:55:11.995>good <01:55:12.195>question.

2631
01:55:15.395 --> 01:55:18.965
<01:55:15.395>When <01:55:15.595>static <01:55:15.795>analyzers <01:55:15.995>reports <01:55:16.195>a <01:55:16.395>security <01:55:16.595>risk, <01:55:16.795>um,

2632
01:55:19.225 --> 01:55:22.845
<01:55:19.225>is <01:55:19.341>it <01:55:19.458>always <01:55:19.575>a <01:55:19.691>good <01:55:19.808>idea <01:55:19.925>to <01:55:20.041>write <01:55:20.158>a <01:55:20.275>system <01:55:20.391>test <01:55:20.508>that <01:55:20.625>exposes

2633
01:55:22.845 --> 01:55:24.885
<01:55:22.844>that <01:55:23.311>vulnerability <01:55:23.778>before <01:55:24.244>fixing?

2634
01:55:25.315 --> 01:55:27.845
<01:55:25.315>Because <01:55:25.490>resolving <01:55:25.665>the <01:55:25.840>warming <01:55:26.015>is <01:55:26.190>not <01:55:26.365>always <01:55:26.540>the <01:55:26.715>same

2635
01:55:27.845 --> 01:55:29.965
<01:55:27.844>as <01:55:28.195>resolving <01:55:28.544>the <01:55:28.894>vulnerability <01:55:29.244>issue?

2636
01:55:33.075 --> 01:55:36.805
<01:55:33.075>Yeah. <01:55:33.308>So, <01:55:33.541>um, <01:55:33.775>it <01:55:34.008>would <01:55:34.241>be <01:55:34.474>good.

2637
01:55:36.985 --> 01:55:40.405
<01:55:36.985>So <01:55:37.125>in <01:55:37.265>terms <01:55:37.405>of <01:55:37.545>quality <01:55:37.685>writing, <01:55:37.825>um, <01:55:37.965>also <01:55:38.105>maybe <01:55:38.245>a <01:55:38.385>proof,

2638
01:55:40.405 --> 01:55:42.005
<01:55:40.405>proof <01:55:40.685>of <01:55:40.965>concept <01:55:41.245>that <01:55:41.525>shows, <01:55:41.805>uh,

2639
01:55:42.145 --> 01:55:43.605
<01:55:42.145>how <01:55:42.407>the <01:55:42.670>vulnerability <01:55:42.933>can <01:55:43.196>be <01:55:43.459>exploited.

2640
01:55:44.405 --> 01:55:46.125
<01:55:44.405>I <01:55:44.580>will, <01:55:44.755>I <01:55:44.930>can <01:55:45.105>just <01:55:45.280>tell <01:55:45.455>you <01:55:45.630>from <01:55:45.805>experience,

2641
01:55:46.165 --> 01:55:49.925
<01:55:46.165>I <01:55:46.305>recently <01:55:46.445>reviewed, <01:55:46.585>um, <01:55:46.725>a <01:55:46.865>very <01:55:47.005>big <01:55:47.144>project <01:55:47.285>that <01:55:47.425>we <01:55:47.565>scanned

2642
01:55:49.925 --> 01:55:51.325
<01:55:49.925>with <01:55:50.240>the <01:55:50.555>static <01:55:50.870>analysis <01:55:51.184>tool.

2643
01:55:51.705 --> 01:55:54.165
<01:55:51.705>It <01:55:51.860>was <01:55:52.016>four <01:55:52.171>and <01:55:52.327>a <01:55:52.482>half <01:55:52.638>million <01:55:52.793>lines <01:55:52.949>of <01:55:53.105>code,

2644
01:55:54.705 --> 01:55:56.645
<01:55:54.705>and <01:55:54.905>we <01:55:55.105>got <01:55:55.305>tens <01:55:55.505>of <01:55:55.705>thousands <01:55:55.905>of <01:55:56.105>results.

2645
01:55:56.785 --> 01:55:58.405
<01:55:56.785>So <01:55:56.940>in <01:55:57.096>this <01:55:57.251>case, <01:55:57.407>I <01:55:57.562>would <01:55:57.718>not <01:55:57.873>have <01:55:58.029>been <01:55:58.184>able

2646
01:55:58.405 --> 01:56:00.365
<01:55:58.405>to <01:55:58.685>really <01:55:58.965>proof <01:55:59.245>of <01:55:59.525>concept <01:55:59.805>everything.

2647
01:56:01.185 --> 01:56:05.285
<01:56:01.184>And <01:56:01.325>also <01:56:01.464>a <01:56:01.605>question <01:56:01.745>that <01:56:01.884>it <01:56:02.025>boils <01:56:02.164>down <01:56:02.304>to <01:56:02.445>always <01:56:02.584>is,

2648
01:56:05.425 --> 01:56:06.725
<01:56:05.425>is <01:56:05.815>this <01:56:06.205>data <01:56:06.595>trusted?

2649
01:56:06.865 --> 01:56:08.925
<01:56:06.865>So <01:56:07.005>is <01:56:07.144>this <01:56:07.285>data <01:56:07.425>coming <01:56:07.565>from <01:56:07.705>a <01:56:07.844>trusted <01:56:07.985>source <01:56:08.125>or <01:56:08.264>not?

2650
01:56:08.925 --> 01:56:10.605
<01:56:08.925>So <01:56:09.125>what <01:56:09.325>is <01:56:09.525>definitely <01:56:09.725>gonna <01:56:09.925>help <01:56:10.125>you <01:56:10.325>is

2651
01:56:11.145 --> 01:56:13.885
<01:56:11.145>to <01:56:11.378>draw <01:56:11.611>trust <01:56:11.845>boundaries <01:56:12.078>in <01:56:12.311>your <01:56:12.545>components.

2652
01:56:14.005 --> 01:56:15.645
<01:56:14.005>I <01:56:14.145>have <01:56:14.285>this <01:56:14.425>piece <01:56:14.565>of <01:56:14.705>software <01:56:14.845>in <01:56:14.985>my <01:56:15.125>backend, <01:56:15.265>for <01:56:15.405>example,

2653
01:56:15.885 --> 01:56:16.925
<01:56:15.885>speaking <01:56:16.197>to <01:56:16.509>other <01:56:16.821>microservices.

2654
01:56:17.735 --> 01:56:19.125
<01:56:17.735>Where <01:56:18.047>is <01:56:18.360>the <01:56:18.673>trust <01:56:18.986>boundary?

2655
01:56:19.125 --> 01:56:21.325
<01:56:19.125>Am <01:56:19.265>I <01:56:19.405>gonna <01:56:19.545>trust <01:56:19.685>the <01:56:19.825>request <01:56:19.965>that's <01:56:20.105>coming <01:56:20.245>from <01:56:20.385>that <01:56:20.525>service

2656
01:56:21.585 --> 01:56:23.565
<01:56:21.585>or <01:56:21.785>might <01:56:21.985>that <01:56:22.185>be <01:56:22.385>manipulated <01:56:22.585>in <01:56:22.785>some <01:56:22.985>way?

2657
01:56:23.565 --> 01:56:24.965
<01:56:23.565>So <01:56:23.775>where <01:56:23.985>do <01:56:24.195>I <01:56:24.405>draw <01:56:24.615>those <01:56:24.825>boundaries?

2658
01:56:25.345 --> 01:56:26.845
<01:56:25.344>So <01:56:25.682>writing, <01:56:26.019>um, <01:56:26.357>a <01:56:26.695>test

2659
01:56:26.865 --> 01:56:29.245
<01:56:26.865>or <01:56:27.098>POCA <01:56:27.331>proof <01:56:27.565>of <01:56:27.798>concept <01:56:28.031>for <01:56:28.264>everything

2660
01:56:29.245 --> 01:56:32.005
<01:56:29.245>that <01:56:29.385>you <01:56:29.525>find <01:56:29.665>there <01:56:29.805>would <01:56:29.945>be <01:56:30.085>ideal <01:56:30.224>from <01:56:30.365>the, <01:56:30.505>you <01:56:30.644>know,

2661
01:56:32.275 --> 01:56:33.525
<01:56:32.275>awareness <01:56:33.400>standpoint,

2662
01:56:33.525 --> 01:56:35.725
<01:56:33.525>but <01:56:33.680>it's <01:56:33.836>not <01:56:33.991>gonna <01:56:34.147>be <01:56:34.302>practically <01:56:34.458>possible <01:56:34.613>if <01:56:34.769>you <01:56:34.924>have

2663
01:56:35.725 --> 01:56:37.125
<01:56:35.725>hundreds <01:56:36.040>or <01:56:36.355>thousands <01:56:36.670>of <01:56:36.985>findings.

2664
01:56:39.475 --> 01:56:41.805
<01:56:39.475>Okay. <01:56:39.755>Um, <01:56:40.035>Martin <01:56:40.315>has <01:56:40.595>a <01:56:40.875>question.

2665
01:56:41.985 --> 01:56:43.685
<01:56:41.985>Uh, <01:56:42.218>what <01:56:42.451>do <01:56:42.685>you <01:56:42.918>think <01:56:43.151>about <01:56:43.385>flutter?

2666
01:56:43.785 --> 01:56:46.125
<01:56:43.785>Is <01:56:44.018>it <01:56:44.251>a <01:56:44.485>secure <01:56:44.718>framework <01:56:44.951>for <01:56:45.184>you?

2667
01:56:47.025 --> 01:56:48.725
<01:56:47.025>Um, <01:56:47.304>I've <01:56:47.585>heard <01:56:47.865>about <01:56:48.144>the <01:56:48.424>framework.

2668
01:56:48.765 --> 01:56:50.085
<01:56:48.764>I <01:56:49.002>have <01:56:49.240>not <01:56:49.477>used <01:56:49.715>it <01:56:49.952>myself.

2669
01:56:50.385 --> 01:56:53.725
<01:56:50.385>Uh, <01:56:50.618>I <01:56:50.851>cannot <01:56:51.085>tell, <01:56:51.318>uh, <01:56:51.551>seriously, <01:56:51.785>uh,

2670
01:56:53.725 --> 01:56:55.765
<01:56:53.725>whether <01:56:53.900>it's <01:56:54.075>a <01:56:54.250>good <01:56:54.425>framework <01:56:54.600>in <01:56:54.775>terms <01:56:54.950>of <01:56:55.125>security.

2671
01:56:56.025 --> 01:56:57.525
<01:56:56.025>I'm <01:56:56.250>sorry, <01:56:56.474>I <01:56:56.700>never <01:56:56.924>used <01:56:57.150>it <01:56:57.375>myself.

2672
01:56:57.645 --> 01:56:59.725
<01:56:57.645>I <01:56:57.845>never <01:56:58.045>tested <01:56:58.245>an <01:56:58.445>application <01:56:58.645>that <01:56:58.845>just <01:56:59.045>flutter.

2673
01:57:00.755 --> 01:57:03.085
<01:57:00.755>Okay, <01:57:01.455>then <01:57:02.155>I'm

2674
01:57:03.085 --> 01:57:04.165
<01:57:03.085>Sorry, <01:57:03.571>your <01:57:04.057>friend.

2675
01:57:05.625 --> 01:57:10.165
<01:57:05.625>Um, <01:57:05.800>then <01:57:05.975>Meyer <01:57:06.150>is <01:57:06.325>asking <01:57:06.500>what <01:57:06.675>is, <01:57:06.850>uh, <01:57:07.025>what's

2676
01:57:10.165 --> 01:57:11.765
<01:57:10.165>with <01:57:10.515>security <01:57:10.865>and <01:57:11.215>garbage <01:57:11.565>collectors?

2677
01:57:11.985 --> 01:57:15.005
<01:57:11.985>Um, <01:57:12.265>how <01:57:12.545>can <01:57:12.825>this <01:57:13.105>be <01:57:13.385>secured?

2678
01:57:16.945 --> 01:57:21.605
<01:57:16.945>Um, <01:57:17.144>well, <01:57:17.344>a <01:57:17.545>garbage <01:57:17.745>collector <01:57:17.945>cleans <01:57:18.144>your <01:57:18.344>memory

2679
01:57:21.715 --> 01:57:25.485
<01:57:21.715>with <01:57:21.870>unused <01:57:22.026>pro <01:57:22.181>uh, <01:57:22.337>unused <01:57:22.492>objects <01:57:22.648>and <01:57:22.803>unused <01:57:22.959>uh, <01:57:23.115>parts.

2680
01:57:25.545 --> 01:57:27.405
<01:57:25.545>And, <01:57:25.895>uh, <01:57:26.245>it's <01:57:26.595>not <01:57:26.945>deterministic.

2681
01:57:27.425 --> 01:57:30.245
<01:57:27.425>So <01:57:27.565>it <01:57:27.705>can <01:57:27.845>be, <01:57:27.985>you <01:57:28.125>know, <01:57:28.265>the, <01:57:28.405>the <01:57:28.545>runtime <01:57:28.685>decides <01:57:28.825>when

2682
01:57:30.245 --> 01:57:31.245
<01:57:30.245>that's <01:57:30.425>gonna <01:57:30.605>be <01:57:30.785>called <01:57:30.965>or <01:57:31.144>not.

2683
01:57:32.145 --> 01:57:36.525
<01:57:32.145>Um, <01:57:32.345>it's <01:57:32.545>not, <01:57:32.745>when <01:57:32.945>is <01:57:33.145>that <01:57:33.345>security <01:57:33.545>related?

2684
01:57:36.725 --> 01:57:37.845
<01:57:36.725>I <01:57:36.926>think <01:57:37.128>it <01:57:37.329>is <01:57:37.531>security <01:57:37.732>related.

2685
01:57:37.845 --> 01:57:41.925
<01:57:37.844>If, <01:57:38.000>for <01:57:38.156>example, <01:57:38.311>you're <01:57:38.467>storing <01:57:38.622>secrets <01:57:38.778>in <01:57:38.933>memory, <01:57:39.089>think <01:57:39.244>of

2686
01:57:42.065 --> 01:57:44.325
<01:57:42.065>for <01:57:42.220>example, <01:57:42.376>a <01:57:42.531>piece <01:57:42.687>of <01:57:42.842>software <01:57:42.998>that <01:57:43.153>does <01:57:43.309>disc <01:57:43.465>encryption

2687
01:57:44.325 --> 01:57:45.565
<01:57:44.325>or <01:57:44.510>a <01:57:44.697>piece <01:57:44.883>of <01:57:45.069>software <01:57:45.255>that <01:57:45.441>does,

2688
01:57:45.705 --> 01:57:47.845
<01:57:45.705>that's <01:57:45.985>a <01:57:46.265>password <01:57:46.545>manager, <01:57:46.825>for <01:57:47.105>example.

2689
01:57:48.505 --> 01:57:51.725
<01:57:48.505>Uh, <01:57:48.660>then <01:57:48.816>you <01:57:48.971>cannot <01:57:49.127>use <01:57:49.282>just <01:57:49.438>a <01:57:49.593>string, <01:57:49.749>uh, <01:57:49.905>to,

2690
01:57:52.025 --> 01:57:54.085
<01:57:52.025>to <01:57:52.258>store <01:57:52.491>the <01:57:52.724>passwords, <01:57:52.958>uh, <01:57:53.191>in <01:57:53.424>memory

2691
01:57:54.155 --> 01:57:55.685
<01:57:54.155>that <01:57:54.384>was <01:57:54.614>just <01:57:54.843>input <01:57:55.073>by <01:57:55.302>the <01:57:55.531>user.

2692
01:57:56.305 --> 01:57:59.605
<01:57:56.305>Uh, <01:57:56.460>but <01:57:56.616>most <01:57:56.771>of <01:57:56.927>the <01:57:57.082>time <01:57:57.238>there <01:57:57.393>are <01:57:57.549>some, <01:57:57.705>uh,

2693
01:57:59.825 --> 01:58:02.445
<01:57:59.825>secure <01:58:00.105>implementations <01:58:00.385>that <01:58:00.665>can <01:58:00.945>guarantee <01:58:01.224>you

2694
01:58:02.445 --> 01:58:05.645
<01:58:02.445>that <01:58:02.678>something <01:58:02.911>sensitive, <01:58:03.144>sensitive <01:58:03.378>in <01:58:03.611>memory, <01:58:03.844>uh,

2695
01:58:05.905 --> 01:58:08.205
<01:58:05.905>can <01:58:06.080>be <01:58:06.255>deleted <01:58:06.430>explicitly <01:58:06.605>when <01:58:06.780>it's <01:58:06.955>not <01:58:07.130>used <01:58:07.305>anymore

2696
01:58:08.355 --> 01:58:11.565
<01:58:08.355>because <01:58:08.510>then, <01:58:08.666>uh, <01:58:08.821>the <01:58:08.977>attack <01:58:09.132>surface <01:58:09.288>on <01:58:09.443>that <01:58:09.599>sensitive <01:58:09.754>data,

2697
01:58:11.565 --> 01:58:14.205
<01:58:11.565>very <01:58:11.798>sensitive <01:58:12.031>like <01:58:12.265>passwords <01:58:12.498>and <01:58:12.731>private <01:58:12.965>keys.

2698
01:58:14.205 --> 01:58:16.245
<01:58:14.205>And <01:58:14.438>so <01:58:14.671>it <01:58:14.905>can <01:58:15.138>be <01:58:15.371>explicitly <01:58:15.605>deleted

2699
01:58:16.545 --> 01:58:18.725
<01:58:16.545>and <01:58:16.700>they <01:58:16.856>don't <01:58:17.011>have <01:58:17.167>to <01:58:17.322>wait <01:58:17.478>for <01:58:17.633>the <01:58:17.789>garbage <01:58:17.945>collector.

2700
01:58:19.105 --> 01:58:21.565
<01:58:19.105>So <01:58:19.245>I <01:58:19.384>wouldn't <01:58:19.525>touch <01:58:19.665>the <01:58:19.804>garbage <01:58:19.945>collector <01:58:20.084>when <01:58:20.224>it <01:58:20.365>comes <01:58:20.504>to

2701
01:58:22.165 --> 01:58:23.485
<01:58:22.165>security <01:58:22.561>considerations <01:58:22.957>like <01:58:23.353>these.

2702
01:58:23.905 --> 01:58:25.165
<01:58:23.905>But <01:58:24.188>I <01:58:24.472>would <01:58:24.755>use, <01:58:25.039>uh,

2703
01:58:25.165 --> 01:58:27.605
<01:58:25.165>classes <01:58:25.340>like <01:58:25.515>I <01:58:25.690>think <01:58:25.865>they're <01:58:26.040>often <01:58:26.215>called <01:58:26.390>secure <01:58:26.565>string

2704
01:58:27.605 --> 01:58:31.605
<01:58:27.605>or <01:58:27.745>something <01:58:27.884>like <01:58:28.025>that, <01:58:28.165>where <01:58:28.304>I <01:58:28.445>can <01:58:28.584>tell <01:58:28.724>explicitly <01:58:28.865>now <01:58:29.004>I

2705
01:58:31.605 --> 01:58:33.245
<01:58:31.605>want <01:58:31.780>this <01:58:31.955>to <01:58:32.129>be <01:58:32.304>deleted <01:58:32.480>and <01:58:32.655>it's <01:58:32.830>gonna <01:58:33.004>be

2706
01:58:33.525 --> 01:58:35.045
<01:58:33.525>deterministically <01:58:33.981>deleted <01:58:34.437>from <01:58:34.893>memory.

2707
01:58:35.265 --> 01:58:36.405
<01:58:35.264>So <01:58:35.607>that's <01:58:35.949>what <01:58:36.291>comes

2708
01:58:36.405 --> 01:58:38.805
<01:58:36.405>to <01:58:36.560>my <01:58:36.716>mind <01:58:36.871>when <01:58:37.027>you <01:58:37.182>say <01:58:37.338>security <01:58:37.493>and <01:58:37.649>garbage <01:58:37.805>collector.

2709
01:58:40.355 --> 01:58:43.525
<01:58:40.355>Okay. <01:58:40.510>I <01:58:40.666>think <01:58:40.821>this <01:58:40.977>was <01:58:41.132>the <01:58:41.288>last <01:58:41.443>question <01:58:41.599>for <01:58:41.754>today.