Preventing Security Bugs through Software Design
summary
Argues that changing APIs, not dev behavior, eliminates whole classes of bugs and shows concrete artifacts: a compile-time-constant builder plus an error-prone static checker that removes SQL injection by refusing non-constant queries; contextual auto-escaping templates and typed HTML/URL wrappers backed by a sanitizer that convert strings to safe types; global refactors take a few person-quarters, get rolled into F1/Spanner/Hibernate use, and produce a drastic drop from hundreds of bugs to near zero.
AI-written summary · about
chapters (9)
- 0:00Start
- 16:30Cross-Site Scripting
- 17:42Injection Sinks
- 18:03Subsidiary Injection Points
- 21:55Ad-Hoc Concatenation of Html Markup
- 28:10Type Mismatch
- 33:39Approaches to the Api Design
- 42:31Surfacing Errors That Pertain to Potential Security Bugs at Compile Time
- 43:42Designed for Review Ability
related talks
48mSecuring Software’s Future
50mCracking the Code to Secure Software
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
43mAPI Security By Design
52mSecure by Design, Revisited - Insights & Pitfalls
59mSecure Coding Back to Basics
01h 01mSoftware Security
23mSecure Code, Safe Future: Mastering Security in Critical Software Development