Episode 535: Dan Lorenc on Supply Chain Attacks

Episode 535: Dan Lorenc on Supply Chain Attacks

Dan Lorenc, CEO of Chainguard, a software supply chain security company, joins SE Radio editor Robert Blumen to talk about software supply chain attacks. They start with a review of software supply chain basics; how outputs become inputs of someone else's supply chain; techniques for attacking the supply chain, including compromising the compilers, injecting code into installers, dependency confusion, and typo squatting. They also consider Ken Thompson's paper on injecting a backdoor into the C compiler. The episode then considers some well-known supply chain attacks: researcher Alex Birsan's dependency confusion attack; the log4shell attack on the Java Virtual Machine; the pervasiveness of compilers and interpreters where you don't expect them; the SolarWinds attack on a network security product; and CodeCov compromising the installer with code to insert exfiltration of environment variables into the installer. The conversation ends with some lessons learned, including how to protect your supply chain and the challenge of dependencies with modern languages.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(726)

SE Radio 721: Rob Moffat on Risk-First Software Development

SE Radio 721: Rob Moffat on Risk-First Software Development

In this episode, Rob Moffat, author of Risk-First Software Development and chief technical architect at the FinTech Open Source Software Foundation (FINOS), speaks with host Brijesh Ammanath about how...

20 Touko 52min

SE Radio 720: Martin Dilger on Understanding Eventsourcing

SE Radio 720: Martin Dilger on Understanding Eventsourcing

Martin Dilger, founder and CEO of Nebuilt GmbH, speaks with host Giovanni Asproni about event sourcing -- a software architecture pattern in which, rather than storing just the current state of your d...

13 Touko 55min

SE Radio 719: Birol Yildiz on Building an Agentic AI SRE

SE Radio 719: Birol Yildiz on Building an Agentic AI SRE

Birol Yildiz, CEO and co-founder of iLert, joins host Kanchan Shringi to explore how iLert built an AI SRE — an autonomous agent for handling production incidents — and what the experience revealed ab...

6 Touko 53min

SE Radio 718: Will Sentance on JS Modernization

SE Radio 718: Will Sentance on JS Modernization

Will Sentance, educator and co-founder of Codesmith, joins SE Radio's Adi Narayan to discuss the evolution of JavaScript and modern best practices. They begin with JavaScript's origins as a simple scr...

29 Huhti 58min

SE Radio 717: Eric Tschetter on Decoupling Observability

SE Radio 717: Eric Tschetter on Decoupling Observability

In this episode, host Amey Ambade sits with Eric Tschetter, co-founder of Apache Druid and Chief Architect at Imply, to dissect the critical move toward Decoupling Observability. To begin, they define...

23 Huhti 1h

SE Radio 716: Martin Kleppmann Local-First Software

SE Radio 716: Martin Kleppmann Local-First Software

Martin Kleppmann, Associate Professor at the University of Cambridge and author of the best-selling O'Reilly book Designing Data-Intensive Applications, talks to host Adi Narayan about local-first col...

15 Huhti 55min

SE Radio 715: Sahaj Garg on Designing for Ambiguity in Human Input

SE Radio 715: Sahaj Garg on Designing for Ambiguity in Human Input

Sahaj Garg, co-founder and CTO of Wispr, a voice-to-text AI that turns speech into polished writing, talks with host Amey Ambade about designing systems for the ambiguity that's inherent in human inpu...

8 Huhti 48min

SE Radio 714: Costa Alexoglou on Remote Pair Programming

SE Radio 714: Costa Alexoglou on Remote Pair Programming

Costa Alexoglou, co-founder of the open source Hopp pair-programming application, talks with host Brijesh Ammanath about remote pair programming. They start with a quick introduction to pair programmi...

1 Huhti 51min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
psykopodiaa-podcast
voi-hyvin-meditaatiot-2
rss-rahamania
adhd-podi
kesken
rss-liian-kuuma-peruna
rss-laadukasta-ensihoitoa
rss-vapaudu-voimaasi
psykologia
rss-narsisti
rss-niinku-asia-on
rss-valo-minussa-2
rss-arkea-ja-aurinkoa-podcast-espanjasta
rss-hereilla
rahapuhetta
aamukahvilla
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-keho-mieli-ja-tekoaly-2
rss-tfa-8020-podcast