dotSecurity 2016
who it's for
application security engineers, web developers, devops engineers, system administrators, platform engineers, security researchers, release engineers
topics
OpenBSD pledge syscall; privilege separation and fd passing; Content Security Policy enforcement; Subresource Integrity usage; SameSite cookie and HSTS priming; secure software distribution with TUF notary; signed collections and threshold signing; multi factor authentication options (TOTP U2F SMS); sudo auditing and rootless workflows; in process SQL query interception
| title | author | length |
|---|---|---|
| Privilege Separation and Pledge | Theo de Raadt | 15m |
OpenBSD adds a pledge(2) syscall that lets a process irrevocably restrict its POSIX surface and gets killed with a core dump on violation so developers can… | ||
| Content Security Policy: The application security Swiss Army Knife | Scott Helme | 17m |
Content Security Policy claims to block inline script execution and greatly reduce XSS by whitelisting script origins, and it actually prevents third‑party… | ||
| The struggle for secure cryptography | Anne Canteaut | 17m |
Claim: only primitives vetted by an open competition and subjected to wide public analysis earn trust. Concrete evidence: Spritz yields an algorithm that… | ||
| Secure Software Distribution in an Adversarial World | Diogo Mónica | 18m |
Argues that distribution infrastructure must be treated as actively malicious, so HTTPS and raw GPG signatures are inadequate because they allow rollback and… | ||
| Web Platform Security | Mike West | 19m |
Browsers still let injected scripts and forged requests act with a site’s credentials so fixes focus on privilege reduction. Google’s bug program pays mostly… | ||
| Implementing Multi-factor Authentication | Jacob Kaplan-Moss | 17m |
MFA choices hinge on concrete trade-offs: adopt out-of-band SMS for broad public audiences because most users have phones, use TOTP soft tokens (Google… | ||
| Sudon’t or going rootless | Ori Pekelman | 04m |
A concrete compliance trick: wire sudo to notify a team channel so each privileged command posts an alert, shaming ad hoc root access and pushing teams to… | ||
| Application security from the inside | Jean-Baptiste Aviat | 05m |
Claims a runnable, in‑process protection component that intercepts low‑level API calls (for example SQL queries) and correlates queries with user parameters to… | ||
| nothing matches | ||