Episode 535: Dan Lorenc on Supply Chain Attacks

Episode 535: Dan Lorenc on Supply Chain Attacks

Dan Lorenc, CEO of Chainguard, a software supply chain security company, joins SE Radio editor Robert Blumen to talk about software supply chain attacks. They start with a review of software supply chain basics; how outputs become inputs of someone else's supply chain; techniques for attacking the supply chain, including compromising the compilers, injecting code into installers, dependency confusion, and typo squatting. They also consider Ken Thompson's paper on injecting a backdoor into the C compiler. The episode then considers some well-known supply chain attacks: researcher Alex Birsan's dependency confusion attack; the log4shell attack on the Java Virtual Machine; the pervasiveness of compilers and interpreters where you don't expect them; the SolarWinds attack on a network security product; and CodeCov compromising the installer with code to insert exfiltration of environment variables into the installer. The conversation ends with some lessons learned, including how to protect your supply chain and the challenge of dependencies with modern languages.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(726)

SE Radio 697: Philip Kiely on Multi-Model AI

SE Radio 697: Philip Kiely on Multi-Model AI

Philip Kiely, software developer relations lead at Baseten, speaks with host Jeff Doolittle about multi-agent AI, emphasizing how to build AI-native software beyond simple ChatGPT wrappers. Kiely advo...

3 Joulu 202556min

SE Radio 696: Flavia Saldanha on Data Engineering for AI

SE Radio 696: Flavia Saldanha on Data Engineering for AI

Flavia Saldanha, a consulting data engineer, joins host Kanchan Shringi to discuss the evolution of data engineering from ETL (extract, transform, load) and data lakes to modern lakehouse architecture...

25 Marras 20251h 14min

SE Radio 695: Dave Thomas on Building eBooks Infrastructure

SE Radio 695: Dave Thomas on Building eBooks Infrastructure

Dave Thomas, author of The Pragmatic Programmer, The Manifesto for Agile Software Development, Programming Ruby, Agile Web Development with Rails, Programming Elixir, Simplicity, and co-founder of the...

19 Marras 20251h 2min

SE Radio 694: Jennings Anderson and Amy Rose on Overture Maps

SE Radio 694: Jennings Anderson and Amy Rose on Overture Maps

Jennings Anderson, a Software Engineer with Meta Platforms, and Amy Rose, the Chief Technology Officer at Overture Maps Foundation, speak with host Gregory M. Kapfhammer about the Overture Maps projec...

12 Marras 20251h 3min

SE Radio 693: Mark Williamson on AI-Assisted Debugging

SE Radio 693: Mark Williamson on AI-Assisted Debugging

Mark Williamson, CTO of Undo, joins host Priyanka Raghavan to discuss AI-assisted debugging. The conversation is structured around three main objectives: understanding how AI can serve as a debugging...

6 Marras 202554min

SE Radio 692: Sourabh Satish on Prompt Injection

SE Radio 692: Sourabh Satish on Prompt Injection

Sourabh Satish, CTO and co-founder of Pangea, speaks with SE Radio's Brijesh Ammanath about prompt injection. Sourabh begins with the basic concepts underlying prompt injection and the key risks it in...

28 Loka 20251h 4min

SE Radio 691: Kacper Łukawski on Qdrant Vector Database

SE Radio 691: Kacper Łukawski on Qdrant Vector Database

Kacper Łukawski, a Senior Developer Advocate at Qdrant, speaks with host Gregory M. Kapfhammer about the Qdrant vector database and similarity search engine. After introducing vector databases and the...

22 Loka 202559min

SE Radio 690: Florian Gilcher on Rust for Safety-Critical Systems

SE Radio 690: Florian Gilcher on Rust for Safety-Critical Systems

Florian Gilcher, co-founder of Ferrous Systems and the Rust Foundation, speaks with host Giovanni Asproni about the application of Rust in mission- and safety-critical systems. The discussion starts w...

14 Loka 20251h 3min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
psykopodiaa-podcast
voi-hyvin-meditaatiot-2
rss-rahamania
adhd-podi
kesken
rss-liian-kuuma-peruna
rss-laadukasta-ensihoitoa
rss-vapaudu-voimaasi
psykologia
rss-narsisti
rss-niinku-asia-on
rss-valo-minussa-2
rss-arkea-ja-aurinkoa-podcast-espanjasta
rss-hereilla
rahapuhetta
aamukahvilla
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-keho-mieli-ja-tekoaly-2
rss-tfa-8020-podcast