Scott Helme
where else to find them
website:https://scotthelme.co.uk
github:ScottHelme
bluesky:scotthelme.bsky.social
linkedin:scotthelme
facebook:scott.helme
what they talk about
all 8 in the filters
where they keep going back
- NDC Oslo6 editions2017–2023
- NDC Security5 editions2022–2026
- NDC London5 editions2018–2024
all 10 in the filters
on a stage with
- Tanya Jancaonce
who talks about the same things
- Halvor Sakshaug6 talks
- Kieran Jacobsen6 talks
- Sarah Allen19 talks
- Andrew Betts9 talks
- Troy Hunt39 talks
- Erlend Oftedal12 talks
| title | conference | date |
|---|---|---|
| Your Website Is Running Code You’ve Never Seen | NDC Security 2026 | 2026-03-02 |
Websites load huge unseen third-party JavaScript — 98.1% of pages and a median of 680 KB of JS — which can be modified via S3 or Google Tag Manager… | ||
| Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack | NDC Security 2025 | 2025-01-20 |
A large cryptojacking campaign is traced to a compromised third‑party text‑to‑speech plugin that silently injects Coinhive to mine Monero to a single wallet… | ||
| Seatbelts for Web App (Security Headers) | RSA Conference 2024 | 2024-05-06 |
Claims that a few browser headers can stop many attacks, with demos and real-world scans (Report URI shows low adoption). Concrete fixes: HSTS with preload to… | ||
| Unlocking The Secrets Of TLS | NDC London 2024 | 2024-01-29 |
Browsers and servers use asymmetric RSA to bootstrap a high‑speed AES session key but that creates a single master decryption key risk — Snowden (2013) and… | ||
| Unlocking The Secrets Of TLS | NDC Security 2024 | 2024-01-09 |
Explains why the old RSA key exchange fails: if a server private key is ever exposed (Heartbleed 2014 or compelled disclosure like the Snowden-era cases)… | ||
| Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack | Copenhagen Developers Festival 2023 | 2023-08-28 |
Uncovering a supply‑chain compromise that infects 5,000+ sites, investigation traces the incident to a Browsealoud asset (likely an S3 breach) that bootstraps… | ||
| Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack | NDC Oslo 2023 | 2023-05-22 |
Finds a live coin‑mining payload impacting more than 5,000 government sites, traced to a compromised third‑party text‑to‑speech library hosted in an exposed S3… | ||
| Hyper Speed! When Big Data Blooms | NDC London 2023 | 2023-01-23 |
Built a telemetry pipeline that scales from a few hundred reports to 65,000 JSON payloads per second at peak, with growth milestones from 1M/day to 1M/hour… | ||
| Keynote: Crypto means Cryptography! | NDC Security 2023 | 2023-01-16 |
A brisk tour from 4,000‑year‑old Egyptian secret glyphs and the scytale to Enigma and modern submarine cables shows how cryptography protects web traffic… | ||
| Hyper Speed! When Big Data Blooms | NDC Oslo 2022 | 2022-09-26 |
Handling and processing huge volumes of data can be challenging and at Report URI we can receive and process almost 65,000 JSON payloads per second, containing… | ||
| Hyper Speed: When Big Data Blooms | NDC Security 2022 | 2022-04-06 |
Report URI ingests browser telemetry and now handles spikes of almost 65,000 JSON payloads per second, routinely receiving one million POSTs in 11.2 seconds… | ||
| Hyper Speed: When Big Data Blooms | NDC Oslo 2021 | 2021-11-29 |
Processes about 65,000 JSON CSP/telemetry reports per second and uses a Bloom filter in Redis to answer “seen before?” queries in memory, returning definite no… | ||
| Live Hacking Session Part 1 | GOTOpia Europe 2020 | 2020-09-15 |
Finds a 2014 ISP router web‑interface flaw while proxying traffic with Fiddler, reports it responsibly, then faces legal threats and media attention; the bug… | ||
| Live Hacking Session Part 2 | GOTOpia Europe 2020 | 2020-09-15 |
Live demo exploits an Supercar Showdown app by injecting a single quote into an order by URL parameter to trigger SQL errors, then uses crafted subqueries to… | ||
| 25 Years of SSL - Secure(ish) Sockets Layer | NDC TechTown 2020 | 2020-08-31 |
Chronicles HTTPS from Netscape 1994 to TLS 1.3, showing concrete adoption numbers and actions: Google moves from ~50% encrypted traffic in 2014 to ~90% by… | ||
| 25 Years of SSL - Secure(ish) Sockets Layer | NDC London 2020 | 2020-01-27 |
Timeline from 1994 to now with concrete pivots: SSLv2 lasted three months then SSLv3 survives ~20 years until POODLE in 2015, TLS 1.0 is basically a 3.1… | ||
| 25 Years of SSL - Secure(ish) Sockets Layer | NDC Security Oslo 2020 | 2020-01-22 |
Timeline from 1994 to today traces concrete breakages and fixes: SSLv1 fails in initial demo, SSLv2 is broken in months, SSLv3 survives until POODLE… | ||
| Crash, Burn, Report | NDC Oslo 2019 | 2019-06-17 |
Explains how browsers send native JSON telemetry via the Reporting API to any off‑domain endpoint, using a Report-To header (JSON with max-age, endpoints… | ||
| Crash, Burn, Report | NDC Security Oslo 2019 | 2019-04-04 |
Browsers send out-of-band failure reports via the Reporting API by a simple response header like report-to header (JSON) with a cached max-age, so Chrome will… | ||
| Crash, Burn, Report | NDC London 2019 | 2019-01-30 |
Browsers send structured failure reports as JSON via a Report-To header so misconnects, TLS errors, redirect loops, deprecations and CSP/XSS blocks are… | ||
| What We’ve Learned From Billions of Security Reports | NDC Sydney 2018 | 2018-09-17 |
Service processes billions of browser security reports per month and scales from ~10,000 reports/month to 16,000 reports per second peak. Ingestion runs on… | ||
| What We’ve Learned From Billions of Security Reports | NDC Oslo 2018 | 2018-06-11 |
Service grows from about 10,000 reports per month to months hitting nearly 10 billion reports and peaks around 10,000 reports per second so infrastructure… | ||
| CSP XXP STS PKP CAA ETC OMG WTF BBQ… | NDC London 2018 | 2018-01-15 |
Content Security Policy stops injected scripts (demo: browser refuses evil.com/keylogger and blocks inline code), supports CSP report-only with report-uri that… | ||
| Emerging Web Security Standards | NDC Oslo 2017 | 2017-06-14 |
Shows that HTTPS deployment is already faster than ever with over half of page loads on secure pages and huge uptake after Let's Encrypt launches, explains… | ||
| Content Security Policy: The application security Swiss Army Knife | dotSecurity 2016 | 2016-04-22 |
Content Security Policy claims to block inline script execution and greatly reduce XSS by whitelisting script origins, and it actually prevents third‑party… | ||
| nothing matches | ||