Achieving Secure Software through Redesign
summary
Claims that representing trust as distinct types and guarding message boundaries cuts XSS: use TrustedHTML and TrustedURL types, template tags that emit safe SH or SQL fragments, and CI hooks that flag sensitive API use. Provides numbers: CSP adoption never tops 10%, surveys find ~99% of policies pointless, researchers catalog ~29 bypasses. Shows practical results: instrumented stacks and template-based guards reduce reported XSS in large products and make review scope small and auditable.
AI-written summary · about
chapters (6)
- 0:00Start
- 11:05Live Close to the Code
- 12:23Type Checks
- 12:45Trusted Html
- 17:22Sequel Injection
- 21:18Continuous Integration Tools
related talks
34mDOM XSS Protection at Scale
47mXSS is dead. We just don't get it.
57mThe Last XSS Defense Talk
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
43mNo Excuses Anymore: The Demise of Cross Site Scripting
24mWe're struggling to keep up
52mDemystifying Front-End Security
24mTowards a post-XSS world.