Erlend Oftedal
where else to find them
what they talk about
all 4 in the filters
where they keep going back
- Øredev2 editions2019–2022
- NDC Security Oslo2 editions2019–2020
- NDC TechTown2 editions2017–2018
all 8 in the filters
on a stage with
- David Mathyonce
- David Molnaronce
- David Rookonce
all 20 in the filters
who talks about the same things
- Julien Topçu52 talks
- Aaron Bedra14 talks
- Niall Merrigan19 talks
- Jim Manico28 talks
- Shane Lawrence13 talks
- Brian Vermeer66 talks
| title | conference | date |
|---|---|---|
| Secure Coding: Back to basics | Øredev 2022 | 2022-11-08 |
Claims that making domain concepts explicit stops many bugs: use domain primitives (email/password/phone types) so wrong strings become compile errors… | ||
| Secure Coding Back to Basics | NDC Security 2022 | 2022-04-06 |
Argues that shifting validation into small, typed domain primitives and using DTOs/contract objects avoids bugs that become vulnerabilities, shows… | ||
| Modern Web Vulnerabilities 2020 | NDC Security Oslo 2020 | 2020-01-22 |
Demos show an ESI injection where SVG uploads force the reverse proxy to fetch internal pages (PNG is blocked, SVG succeeds), enabling content theft, XSS or… | ||
| Modern WebApp Vulnerabilities | Øredev 2019 | 2019-11-06 |
Walks through concrete bugs and exploit paths: XXE via XSLT onParsedText exfiltrates files and internal HTTP metadata, deserialization gadgets (why so… | ||
| Closing Remarks | OWASP Global AppSec Amsterdam 2019 | 2019-09-23 |
Thanks and reminders focus on logistics and community: long gratitude for volunteers and sponsors, mention of a return to Dublin next year and San Francisco in… | ||
| Modern web application bugs | NDC Minnesota 2019 | 2019-05-06 |
Shows reproducible demos of XML external entity attacks that read /etc/password and AWS metadata (including a $10,000 Twitter XXE report), XSLT and blind XXE… | ||
| Securing Kubernetes with Istio | NDC Security Oslo 2019 | 2019-04-04 |
Istio deploys an Envoy sidecar proxy per pod (injected via kube-inject) and uses an init container with NET_ADMIN iptables redirection so app traffic… | ||
| Fuzzing with AFL | NDC TechTown 2018 | 2018-09-27 |
Introduces practical AFL usage: compile with AFL instrumentation (AFL_INST_RATIO=100), run master plus three slaves on a rented Hetzner box (€20/mo), seed and… | ||
| Broken crypto is broken | NDC Sydney 2018 | 2018-09-17 |
Concrete failure modes and fixes: poor randomness yields repeated keys and device-default keys; secrets leak in Git; an Android app truncated keys to one byte… | ||
| Modern web application bugs | NDC Sydney 2018 | 2018-09-17 |
Live demos show concrete exploit patterns and fixes: reading local files and internal services via blind XXE exfiltration and XSLT document(), spawning shells… | ||
| Threat modeling | NDC TechTown 2017 | 2017-10-17 |
Security issues split roughly 50% design flaws versus bugs and threat modeling targets those design flaws early using data flow diagrams and the STRIDE… | ||
| Broken Crypto is Broken | NDC London 2017 | 2017-01-16 |
Shows concrete failures: weak RNGs in VMs and routers, key material stored with the data, and predictable short keys; demonstrates a browser exploit of a… | ||
| nothing matches | ||