Discussing Useful Security Requirements with Developers – Ixchel Ruiz – ASW #313
There's a pernicious myth that developers don't care about security. In practice, they care about code quality. What developers don't care for is ambiguous requirements. Ixchel Ruiz shares her experience is discussing software designs, the challenges in prioritizing dev efforts, and how to help open source project maintainers with their issue backlog.
Segment resources:
Ix-chel Ruiz has been developing software applications and tools since 2000. Her technical research interests include server side languages like Java, dynamic languages, client-side technologies, testing, automation and observability. Her humanities research interests include personal, professional and organisational development and transformation. Java Champion, Oracle ACE pro, Testcontainers Community Champion, CDF Ambassador, Hackergarten enthusiast, Open Source advocate, public speaker and mentor.
PyPI’s Quarantine, Phishing & Awareness, Porting Fishshell to Rust, Cyber Trust Mark – ASW #313
Design lessons from PyPI's Quarantine capability, effective ways for appsec to approach phishing, why fishshell is moving to Rust component by component (and why that's a good thing!), what behaviors the Cyber Trust Mark might influence, and more!
Mike Shema
- Project Quarantine – The Python Package Index Blog
Lessons in security by design from implementing defenses again malware on the PyPI repo.
- Top 10 web hacking techniques of 2024: nominations open | PortSwigger Research
Nominations are about to close and voting to begin this week!
We covered a few from last year. Two of my favorites were HTTP parsing inconsistencies and PHP filter chains.
Looking back at the list from 2015, we haven't come too far from web timing, SSRF, XXE, and XSS -- just (thankfully!) a lot less Flash.
- A Day in the Life of a Prolific Voice Phishing Crew – Krebs on Security
An appsec look at phishing, specifically about how product features can be abused. It's also a chance for us to talk about poor security awareness that's focused on jargon vs. helpful education that improves how they use and configure their devices and accounts.
- Consumer products to get ‘Cyber Trust’ marks in 2025, White House says
John Kinsella
- Fish 4.0: The Fish Of Theseus
A year has gone by - and recently the Fish shell team released Fish 4.0 - the first release of the shell after porting it to Rust from C++. As this was on my list last year of things to keep tabs on, I was excited to find their blog post detailing the process, the hits and the misses.
