Make It Fixable
summary
Claims that perfect security is impossible illustrated by Meltdown/Spectre and left-pad; practical defenses focus on being able to ship fixes and on having a security hotline. Concrete steps include recreating build environments for legacy binaries, adding auto-update/OTA channels for IoT and cars, auditing transitive dependencies (NPM/left-pad, Android Stagefright, OpenSSL), and rehearsing disclosure workflows so reports (one grocery app reached ~15% of the population) are handled with transparency not PR attacks. Backups must be tested end-to-end; failures exposed honestly can rebuild trust.
AI-written summary · about
chapters (33)
- 0:00Intro
- 0:24Make It Fixable
- 1:13Patricia Aas
- 3:59Outline
- 4:32System
- 6:58Internet of Things
- 8:01Build it yourself
- 8:46Get the fix
- 10:06Framework avalanche
- 10:42Operating systems
- 11:32Examples
- 14:09How did people deal with these
- 15:06The team is gone
- 17:01IT is our business
- 17:53Take it on
- 18:39Back sourcing
- 18:51User experience
- 19:27Vulnerability
- 23:10Live It
- 23:55Backup Fail
- 26:55My Boss Made Me Do It
- 27:07What If
- 27:39AntiCrack
- 28:57Why didnt you say anything
- 33:36Office politics
- 34:22Security Hotline
- 35:02Unfortunate Screen
- 36:45Make Less is More
- 41:48Be Careful
- 42:15Trust
- 42:27Everyone is an Expert
- 42:40So these were the challenges
- 43:07Thats my talk
related talks
29mMake It Fixable: Preparing for Security Vulnerability Reports
37mHow to get developers to want to adopt AppSec
39mSoftware Security Engineering (Learnings from the past to fix ...)
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
27mSecurity: The Thing That Everyone...
03mAn infinite set of security tools
22mGive up! Just stop patching vulnerabilities!
18mKeynote