Code as Risk
summary
Argues that code is measurable risk: third‑party and transitive dependencies break builds as with the left‑pad incident on npm, dynamic packages let attackers inject code, and JSON or runtime settings are configuration-as-code—misconfigured flight parameters cause failures like the Russian launch that dropped satellites. Hardware/space examples include the Schiaparelli crash (faulty IMU assumption, premature parachute release at ~3700 m). High‑reliability projects use C99 + static analysis, unit tests and CI because roughly 3/4 reproducible by unit tests — test and sanitize dependencies to reduce exposure.
AI-written summary · about
chapters (7)
- 0:00Start
- 14:52The connections between modules are the assumptions which the modules make about each other.
- 23:15every escape is an entrance
- 33:08Simple Testing Can Prevent Most Critical Failures
- 33:33A majority of the production failures (77%) can be reproduced by a unit test.
- 36:18Early Detection of Configuration Errors to Reduce Failure Damage
- 37:04do, be conservative in what you accept from others.
related talks
05mCode & risk
28mCode, Dependencies and Security: Where Is the Risk
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
58mIncoherent Code: How Code Quality Impacts Security
47mThe Cost of Code
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
22mWhat Could Go Wrong? The Subtle Science Of Coding for Failure
29mDependency Management: Risk vs Crisis Management