Episode 535: Dan Lorenc on Supply Chain Attacks

Episode 535: Dan Lorenc on Supply Chain Attacks

Dan Lorenc, CEO of Chainguard, a software supply chain security company, joins SE Radio editor Robert Blumen to talk about software supply chain attacks. They start with a review of software supply chain basics; how outputs become inputs of someone else's supply chain; techniques for attacking the supply chain, including compromising the compilers, injecting code into installers, dependency confusion, and typo squatting. They also consider Ken Thompson's paper on injecting a backdoor into the C compiler. The episode then considers some well-known supply chain attacks: researcher Alex Birsan's dependency confusion attack; the log4shell attack on the Java Virtual Machine; the pervasiveness of compilers and interpreters where you don't expect them; the SolarWinds attack on a network security product; and CodeCov compromising the installer with code to insert exfiltration of environment variables into the installer. The conversation ends with some lessons learned, including how to protect your supply chain and the challenge of dependencies with modern languages.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(726)

Episode 53: Product Line Engineering Pt. 1

Episode 53: Product Line Engineering Pt. 1

Michael Kircher and Markus Voelter introduce the topic of software product line engineering. They motivate when and why product lines are important to consider and what makes them so special. Further,...

17 Huhti 200744min

Episode 52: DSL Development in Ruby

Episode 52: DSL Development in Ruby

In this episode, we're talking to Obie Fernandez about agile DSL development in Ruby. We started our discussion by defining what a DSL is, the difference between internal and external DSLs as well as ...

7 Huhti 200750min

Episode 51: Design By Contract

Episode 51: Design By Contract

In this episode, Arno and Michael take a look at Design by Contract, a programming technique formalized by Bertrand Meyer. The idea is that an interface is more than method signatures - it is also abo...

28 Maalis 200737min

Episode 50: Announcements and Requests

Episode 50: Announcements and Requests

This is another episode where we mainly announce topics related to the podcast itself.

22 Maalis 20078min

Episode 49: Dynamic Languages for Static Minds

Episode 49: Dynamic Languages for Static Minds

In this Episode we talk about dynamic languages for statically-typed minds, or in other words: which are the interesting features people should learn when they go from a langauge such as Java or C# to...

18 Maalis 200733min

Episode 48: Interview Dragos Manolescua

Episode 48: Interview Dragos Manolescua

In this Episode we discuss software architecture evaluation with Dragos Manolescu, an architect at Microsoft's patterns & practices group. We start off the discussion by trying to define what softwar...

8 Maalis 200745min

Episode 47: Interview Grady Booch

Episode 47: Interview Grady Booch

In this Episode we are happy to talk to Grady Booch. We started off by discussing his Architecture Handbook, how it came into being, the progress, and how it will look like once it's finished. In this...

26 Helmi 200740min

Episode 46: Refactoring Pt. 1

Episode 46: Refactoring Pt. 1

Changeable software has been a goal of several technique in software engineering. Probably the most important is Refactoring, changing the code without changing the behaviour (or at least without brea...

16 Helmi 200737min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
psykopodiaa-podcast
voi-hyvin-meditaatiot-2
kesken
rss-niinku-asia-on
psykologia
rss-valo-minussa-2
rss-narsisti
rss-vapaudu-voimaasi
adhd-podi
rss-rahamania
rss-liian-kuuma-peruna
rss-laadukasta-ensihoitoa
rss-arkea-ja-aurinkoa-podcast-espanjasta
rss-hereilla
rahapuhetta
aamukahvilla
dreamtalk
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-mentalrace