Episode 535: Dan Lorenc on Supply Chain Attacks

Episode 535: Dan Lorenc on Supply Chain Attacks

Dan Lorenc, CEO of Chainguard, a software supply chain security company, joins SE Radio editor Robert Blumen to talk about software supply chain attacks. They start with a review of software supply chain basics; how outputs become inputs of someone else's supply chain; techniques for attacking the supply chain, including compromising the compilers, injecting code into installers, dependency confusion, and typo squatting. They also consider Ken Thompson's paper on injecting a backdoor into the C compiler. The episode then considers some well-known supply chain attacks: researcher Alex Birsan's dependency confusion attack; the log4shell attack on the Java Virtual Machine; the pervasiveness of compilers and interpreters where you don't expect them; the SolarWinds attack on a network security product; and CodeCov compromising the installer with code to insert exfiltration of environment variables into the installer. The conversation ends with some lessons learned, including how to protect your supply chain and the challenge of dependencies with modern languages.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(726)

SE Radio 713: Héctor Ramón Jiménez on Building a GUI library in Rust

SE Radio 713: Héctor Ramón Jiménez on Building a GUI library in Rust

Héctor Ramón Jiménez, creator of iced, an Elm-inspired, cross-platform GUI toolkit for Rust, speaks with SE Radio host Gavin Henry about building a GUI library in Rust. Héctor discusses why he created...

25 Maalis 59min

SE Radio 712: Dan Lorenc on Sigstore

SE Radio 712: Dan Lorenc on Sigstore

Dan Lorenc, co-founder and CEO of Chainguard, joins host Priyanka Raghavan to explore Sigstore and its role in securing the software supply chain. They unpack the challenges of supply chain security, ...

18 Maalis 39min

SE Radio 711: Scott Hanselman on AI-Assisted Development Tools

SE Radio 711: Scott Hanselman on AI-Assisted Development Tools

Scott Hanselman, the VP of Developer Community at Microsoft, speaks with host Jeremy Jung about AI-assisted coding. They start by considering how the tools are a progression from syntax highlighting a...

11 Maalis 1h 2min

SE Radio 710: Marc Brooker on Spec-Driven AI Dev

SE Radio 710: Marc Brooker on Spec-Driven AI Dev

Marc Brooker, VP and Distinguished Engineer at AWS, joins host Kanchan Shringi to explore specification-driven development as a scalable alternative to prompt-by-prompt "vibe coding" in AI-assisted so...

4 Maalis 1h 3min

SE Radio 709: Bryan Cantrill on the Data Center Control Plane

SE Radio 709: Bryan Cantrill on the Data Center Control Plane

Bryan Cantrill, the co-founder and CTO of Oxide Computer company, speaks with host Jeremy Jung about challenges in deploying hardware on-premises at scale. They discuss the difficulty of building up S...

26 Helmi 1h 5min

SE Radio 708: Jens Gustedt on C in 2026

SE Radio 708: Jens Gustedt on C in 2026

Jens Gustedt, author of Modern C, senior scientist at the French National Institute for Computer Science and Control (INRIA), deputy director of the ICube lab, and former co-editor of the ISO C standa...

19 Helmi 59min

SE Radio 707: Subhajit Paul on ERP Automation and AI

SE Radio 707: Subhajit Paul on ERP Automation and AI

In this episode, Subhajit Paul joins SE Radio host Kanchan Shringi to discuss how enterprise resource planning (ERP) systems work in practice and where machine learning and generative AI are beginning...

12 Helmi 59min

SE Radio 706: Yechezkel "Chez" Rabinovich on Observability Tool Migration Techniques

SE Radio 706: Yechezkel "Chez" Rabinovich on Observability Tool Migration Techniques

Yechezkel "Chez" Rabinovich, CTO and co-founder at Groundcover, joins SE Radio host Brijesh Ammanath to discuss the key challenges in migrating observability toolsets. The episode starts with a look a...

4 Helmi 39min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
psykopodiaa-podcast
voi-hyvin-meditaatiot-2
rss-rahamania
adhd-podi
kesken
rss-liian-kuuma-peruna
rss-laadukasta-ensihoitoa
rss-vapaudu-voimaasi
psykologia
rss-narsisti
rss-niinku-asia-on
rss-valo-minussa-2
rss-arkea-ja-aurinkoa-podcast-espanjasta
rss-hereilla
rahapuhetta
aamukahvilla
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-keho-mieli-ja-tekoaly-2
rss-tfa-8020-podcast