ASW Episode 222
Thank You!
Hello Protocols, Packets, and Programs,
The year is almost over, which means everyone’s creating their top 10 and best of lists.
I don’t know what my top 10 list is quite yet,
But I do know that the top of my best of list is our listeners.
Thank you!
It makes these Monday mornings worthwhile.
We still need candidates for this year’s appsec top 10…
I really liked this interview segment because our guest, Aviv Grafi, talked about the technical side of securing potentially malicious files as well as the product emphasis on having a tool get out of the user’s way. It’s nice to see modern appsec approaches do away with old, unhelpful premises like “Users are the weakest link” or “Users are the enemy”.
Plus, I like the preventative approach of rewriting files into a known good state. It’s like handling user-generated content like image files, where the system resizes, strips metadata, and rewrites images into a new format in order to avoid attacks against image parsers or leaking a user’s personal information. And I got to sneak in a reference to one of my favorite tongue-in-cheek RFCs, RFC 3514, the Evil Bit.
My over favorite April Fool’s standard is RFC 1149, “A Standard for the Transmission of IP Datagrams on Avian Carriers.” – I suppose I’ll have to do a new intro for “Pigeons, Packets, and Programs” in a future episode.