Security First
summary
Argues that developers must own security and shows concrete results: an audit via the node security project across ~40,000 npm modules, a typo-squatting proof where a fake coffeescript typo-squatting package gets ~200 installs before discovery, and a practical checklist — add a security.md, document disclosure, and run typo and dependency audits. Emphasizes iterative cultural change, simple wins (validation, sanitization, crypto awareness), and that tooling plus process reduces risk but never makes software 100% secure.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:25Who am I
- 2:27We are fucked
- 4:28Softwares hard
- 7:02NSA
- 8:12And Yet
- 12:00Ignorance
- 14:20Simple stuff still works
- 18:48Process
- 20:41Community Bridge
- 22:33SecurityMD Files
- 23:23Homework
related talks
15m“Security” in the JavaScript ecosystem
52mBest Practices for Developers to Master Security
58mPractical Secure Development and Operations with JavaScript in 2020
38mThe Security Toolbox For Node
21mThe Security Toolbox For Node
45mSecurity When Working with npm: Threats, Cases and Stories
01h 02mSo long secure coding... Hello secure development!
32mSecurity-First Web Apps