Episode 535: Dan Lorenc on Supply Chain Attacks

Episode 535: Dan Lorenc on Supply Chain Attacks

Dan Lorenc, CEO of Chainguard, a software supply chain security company, joins SE Radio editor Robert Blumen to talk about software supply chain attacks. They start with a review of software supply chain basics; how outputs become inputs of someone else's supply chain; techniques for attacking the supply chain, including compromising the compilers, injecting code into installers, dependency confusion, and typo squatting. They also consider Ken Thompson's paper on injecting a backdoor into the C compiler. The episode then considers some well-known supply chain attacks: researcher Alex Birsan's dependency confusion attack; the log4shell attack on the Java Virtual Machine; the pervasiveness of compilers and interpreters where you don't expect them; the SolarWinds attack on a network security product; and CodeCov compromising the installer with code to insert exfiltration of environment variables into the installer. The conversation ends with some lessons learned, including how to protect your supply chain and the challenge of dependencies with modern languages.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(726)

SE Radio 665: Malcolm Matalka on Developing in OCaml with Zero Frameworks

SE Radio 665: Malcolm Matalka on Developing in OCaml with Zero Frameworks

Malcolm Matalka, founder of Terrateam, joins host Giovanni Asproni to talk about the reasoning behind choosing a not-so-widespread language (OCaml) and (almost) totally avoiding frameworks for the dev...

23 Huhti 202556min

SE Radio 664: Emre Baran and Alex Olivier on Stateless Decoupled Authorization Frameworks

SE Radio 664: Emre Baran and Alex Olivier on Stateless Decoupled Authorization Frameworks

Emre Baran, CEO and co-founder of Cerbos, and Alex Olivier, CPO and co-founder, join SE Radio host Priyanka Raghavan to explore "stateless decoupled authorization frameworks. The discussion begins wit...

15 Huhti 202551min

SE Radio 663: Tyler Flint on Managing External APIs

SE Radio 663: Tyler Flint on Managing External APIs

Tyler Flint, CEO of qpoint.io, joins host Robert Blumen for a conversation about managing external vendor dependencies, including several best practices for adoption. They start with a look at interna...

8 Huhti 202552min

SE Radio 662: Vlad Khononov on Balancing Coupling in Software Design

SE Radio 662: Vlad Khononov on Balancing Coupling in Software Design

Software architect and author Vlad Khononov joins host Jeff Doolittle for a discussion on balancing coupling in software design. They start by examining coupling and its relationship to complexity and...

1 Huhti 202556min

SE Radio 661: Sunil Mallya on Small Language Models

SE Radio 661: Sunil Mallya on Small Language Models

Sunil Mallya, co-founder and CTO of Flip AI, discusses small language models with host Brijesh Ammanath. They begin by considering the technical distinctions between SLMs and large language models.  L...

25 Maalis 202559min

SE Radio 660: Pete Warden on TinyML

SE Radio 660: Pete Warden on TinyML

Pete Warden, CEO of Useful Sensors and a founding member of the TensorFlow team at Google, discusses TinyML, the technology enabling machine learning on low-power, small-footprint devices. This innova...

18 Maalis 202555min

SE Radio 659: Brenden Matthews on Idiomatic Rust

SE Radio 659: Brenden Matthews on Idiomatic Rust

Brenden Matthews, a seasoned software engineer, entrepreneur, and author of the Idiomatic Rust and Code Like a Pro in Rust books (both from Manning), speaks with SE Radio host Gavin Henry about Idioma...

12 Maalis 202553min

SE Radio 658: Tanya Janca on Secure Coding

SE Radio 658: Tanya Janca on Secure Coding

Tanya Janca, author of Alice and Bob Learn Secure Coding, discusses secure coding and secure software development life cycle with SE Radio host Brijesh Ammanath. This session explores how integrating ...

6 Maalis 20251h 11min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
psykopodiaa-podcast
voi-hyvin-meditaatiot-2
kesken
rss-niinku-asia-on
psykologia
rss-valo-minussa-2
rss-narsisti
rss-vapaudu-voimaasi
adhd-podi
rss-rahamania
rss-liian-kuuma-peruna
rss-laadukasta-ensihoitoa
rss-arkea-ja-aurinkoa-podcast-espanjasta
rss-hereilla
rahapuhetta
aamukahvilla
dreamtalk
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-mentalrace