JSConf 2013 Builders vs Breakers

•

1 gostou•1,377 visualizações

Adam Baldwin

Tecnologia Notícias e política

Builders vs Breakers
Saturday, June 1, 13

Hi, I’m Adam
@adam_baldwin
@liftsecurity
@nodesecurity
Saturday, June 1, 13

Hi, I’m Adam
@evilpacket
Saturday, June 1, 13

“Fix your captcha so the value isn't actually
hidden in the form. (put it in the session and
check the post) Friend of the fritz..”
-Adam
Saturday, June 1, 13

“xss is not a feature”
Saturday, June 1, 13

When we listen, really listen, we reveal respect, support,
understanding, empathy... We also possess the power to impart
a renewed confidence, clarity, and a sense of everything-is-
going-to-be-okay when we listen well.
- Stephanie Maier
http://thepot-luck.com/stephaniemaier/all-you-have-to-do-is-listen/
Saturday, June 1, 13

http://37signals.com/security-response
Saturday, June 1, 13

So what can I do
as a developer?
Saturday, June 1, 13

SECURITY.md
#How to report issue
#Expectations
#List of humans
Saturday, June 1, 13

http://emberjs.com/security/
Saturday, June 1, 13

Self Disclosure
of
Vulnerabilities
Saturday, June 1, 13

Handling a security failure
well can build trust.
Saturday, June 1, 13

A new project based
on what we’ve learned
about
builders vs breakers
Saturday, June 1, 13

Node Security Project
Saturday, June 1, 13

Adam Brault
Nathan LaFreniere
Bear
Mikeal Rogers
Daniel Shaw
Major Contributors
Neal Poole
Luca Carettoni
Steven Rivas Jr
Arlo Breault
Jacopo Tarantino
Saturday, June 1, 13

Fix the broken things
Saturday, June 1, 13

Report Issues we find
Saturday, June 1, 13

Publish the results
Saturday, June 1, 13

- Respect & understand feelings
- Proactively communicate & listen
- It’s okay to mess up—it can even build
trust
Quick Recap
Saturday, June 1, 13

</PRESENTATION>
@adam_baldwin | @LiftSecurity
Saturday, June 1, 13

Mais conteúdo relacionado

Semelhante a JSConf 2013 Builders vs Breakers

Lightning Talk MagmaConf

Manuel Emilio Morato Mungaray

China-Axlr8r, in cooperation with People Squared and EFG, once again hosted the annual 10X10 Shanghai on June 22nd, 2013. The Geeks on a Train tour takes the China-Axlr8r startups on a ride from Dalian to Beijing, then down to Shanghai before returning to Dalian. As part of the tour, the 10x10 conference brings to the stage 10 tech pioneers and top VC's from the startup ecosystem in China. This is an amazing opportunity entrepreneurs to have a peek at the first startup accelerator program in China, meet interesting people and listen to amazing speakers. Each of them will take you on a 10-minute tour of their trials and tribulations, wins and losses, then give you some great advice and maybe a secret or two about what they learned to help make them the superstars they are today.

China-Axlr8r 10 x10 2013 Shanghai

Todd Embley

[PREMONEY 2013] Jeff lawson

500 Startups

Circa

Anthony De Rosa

Lean UX is Haaaard

Zac Halbert

Brendan Schwartz - How to build great product by doing less, slower

RamenCamp

As interior designer graduates, you must think long term about your career, not just about a job after college. That's when having a noticeable brand comes in handy. Developing a brand takes time and effort. So we encourage all students to take action before graduation: - identify your strengths and weaknesses - what makes you different - proper messaging/know your story - branding online - how and where to network Jenny Schrank and Aga Artka outline steps to take to start developing The Brand of You early in your careers. They speak to students and practicing professionals about long term interior design career planning.

How to develop a brand of you

Aga Artka Interior Designer, LLC

China-Axlr8r, in cooperation with Orange Labs and GWC, once again hosted the annual 10X10 Beijing on June 15th, 2013. The Geeks on a Train tour takes the China-Axlr8r startups on a ride from Dalian to Shanghai through Beijing at the beginning of each program. As part of the tour, the 10x10 conference delivers 10 tech pioneers and top VC's from the startup ecosystem in China. This is an amazing opportunity for entrepreneurs to have a peek at the first startup accelerator program in China, meet interesting people and listen to amazing speakers. Each of them will take you on a 10-minute tour of their trials and tribulations, wins and losses, then give you some great advice and maybe a secret or two about what they learned to help make them the superstars they are today.

China-Axlr8r 10 x10 2013 Beijing

Todd Embley

Semelhante a JSConf 2013 Builders vs Breakers (8)

Lightning Talk MagmaConf

China-Axlr8r 10 x10 2013 Shanghai

[PREMONEY 2013] Jeff lawson

Circa

Lean UX is Haaaard

Brendan Schwartz - How to build great product by doing less, slower

How to develop a brand of you

China-Axlr8r 10 x10 2013 Beijing

Mais de Adam Baldwin

Attacking open source using abandoned resources

Adam Baldwin

JavaScript Supply Chain Security

Adam Baldwin

Who might want to attack your application? If they tried, how would they succeed? Answering these questions is an important exercise that helps you understand how to keep your application secure, so you can sleep at night. In this talk, Adam will teach you what threat modeling is and how to build threat models for your organization and applications. Because npm is such a critical part of how your developers build JavaScript applications, Adam will show you how npm fits into your threat model and how to use npm's tools to keep your JavaScript secure.

Building a Threat Model & How npm Fits Into It

Adam Baldwin

Ever since the threat of an npm worm became public we've been thinking about how to detect malicious modules in our ecosystem and how to provide security teams auditing modules with tooling and intel to make informed decisions about module risk. We've built a system to analyze modules based on their installation behavior. This talk will discuss the results of this endeavor and share the interesting findings from this new and previously unexplored dataset and try to answer the question if a npm worm is lurking in the shadows.

Hunting for malicious modules in npm - NodeSummit

Adam Baldwin

Continuous Security - Thunderplains 2016

Adam Baldwin

Nodevember 2015

Adam Baldwin

The Art of Identifying Vulnerabilities - CascadiaFest 2015

Adam Baldwin

Node Day - Node.js Security in the Enterprise

Adam Baldwin

Node Security Project - LXJS 2013

Adam Baldwin

Security First - Adam Baldwin

Adam Baldwin

EV1LSHA - Misadventures in the land of Lua

Adam Baldwin

Writing an (in)secure webapp in 3 easy steps

Adam Baldwin

Pony Pwning Djangocon 2010

Adam Baldwin

Mais de Adam Baldwin (13)

Attacking open source using abandoned resources

JavaScript Supply Chain Security

Building a Threat Model & How npm Fits Into It

Hunting for malicious modules in npm - NodeSummit

Continuous Security - Thunderplains 2016

Nodevember 2015

The Art of Identifying Vulnerabilities - CascadiaFest 2015

Node Day - Node.js Security in the Enterprise

Node Security Project - LXJS 2013

Security First - Adam Baldwin

EV1LSHA - Misadventures in the land of Lua

Writing an (in)secure webapp in 3 easy steps

Pony Pwning Djangocon 2010

Último

Automating Google Workspace (GWS) & more with Apps Script

wesley chun

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

Axa Assurance Maroc - Insurer Innovation Award 2024

The Digital Insurer

Real Time Object Detection Using Open CV

Khem

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Rafal Los

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

DianaGray10

Scaling API-first – The story of a global engineering organization

Radu Cotescu

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

This presentation explores the impact of HTML injection attacks on web applications, detailing how attackers exploit vulnerabilities to inject malicious code into web pages. Learn about the potential consequences of such attacks and discover effective mitigation strategies to protect your web applications from HTML injection vulnerabilities. for more information visit https://bostoninstituteofanalytics.org/category/cyber-security-ethical-hacking/

HTML Injection Attacks: Impact and Mitigation Strategies

Boston Institute of Analytics

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

MINDCTI Revenue Release Quarter One 2024

MIND CTI

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

JSConf 2013 Builders vs Breakers

1. Builders vs Breakers Saturday, June 1, 13

2. Hi, I’m Adam Saturday, June 1, 13

3. Hi, I’m Adam @adam_baldwin @liftsecurity @nodesecurity Saturday, June 1, 13

4. Hi, I’m Adam @evilpacket Saturday, June 1, 13

5. Saturday, June 1, 13

6. Saturday, June 1, 13

7. Builders Breakers Saturday, June 1, 13

8. Builders Breakers Saturday, June 1, 13

9. “Fix your captcha so the value isn't actually hidden in the form. (put it in the session and check the post) Friend of the fritz..” -Adam Saturday, June 1, 13

10. Saturday, June 1, 13

11. “you guys” Saturday, June 1, 13

12. Basecamp Classic Saturday, June 1, 13

13. “xss is not a feature” Saturday, June 1, 13

14. Feelings? Saturday, June 1, 13

15. Saturday, June 1, 13

16. Saturday, June 1, 13

17. Saturday, June 1, 13

18. Saturday, June 1, 13

19. Saturday, June 1, 13

20. Cooperation Saturday, June 1, 13

21. Communication Saturday, June 1, 13

22. When we listen, really listen, we reveal respect, support, understanding, empathy... We also possess the power to impart a renewed confidence, clarity, and a sense of everything-is- going-to-be-okay when we listen well. - Stephanie Maier http://thepot-luck.com/stephaniemaier/all-you-have-to-do-is-listen/ Saturday, June 1, 13

23. Basecamp Classic Saturday, June 1, 13

24. http://37signals.com/security-response Saturday, June 1, 13

25. http://37signals.com/security-response Saturday, June 1, 13

26. http://37signals.com/security-response Saturday, June 1, 13

27. So what can I do as a developer? Saturday, June 1, 13

28. SECURITY.md #How to report issue #Expectations #List of humans Saturday, June 1, 13

29. http://emberjs.com/security/ Saturday, June 1, 13

30. Self Disclosure of Vulnerabilities Saturday, June 1, 13

31. Handling a security failure well can build trust. Saturday, June 1, 13

32. A new project based on what we’ve learned about builders vs breakers Saturday, June 1, 13

33. Node Security Project Saturday, June 1, 13

34. andbang.com Saturday, June 1, 13

35. Node Security Project? Saturday, June 1, 13

36. Adam Brault Nathan LaFreniere Bear Mikeal Rogers Daniel Shaw Major Contributors Neal Poole Luca Carettoni Steven Rivas Jr Arlo Breault Jacopo Tarantino Saturday, June 1, 13

37. Audit every module Saturday, June 1, 13

38. 31233 modules Saturday, June 1, 13

39. Fix the broken things Saturday, June 1, 13

40. Report Issues we find Saturday, June 1, 13

41. Send Pull Requests Saturday, June 1, 13

42. Example: Hubot Saturday, June 1, 13

43. Saturday, June 1, 13

44. Saturday, June 1, 13

45. Saturday, June 1, 13

46. Publish the results Saturday, June 1, 13

47. Saturday, June 1, 13

48. How to Contribute Saturday, June 1, 13

49. nodesecurity.io Saturday, June 1, 13

50. - Respect & understand feelings - Proactively communicate & listen - It’s okay to mess up—it can even build trust Quick Recap Saturday, June 1, 13

51. </PRESENTATION> @adam_baldwin | @LiftSecurity Saturday, June 1, 13

JSConf 2013 Builders vs Breakers

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a JSConf 2013 Builders vs Breakers

Semelhante a JSConf 2013 Builders vs Breakers (8)

Mais de Adam Baldwin

Mais de Adam Baldwin (13)

Último

Último (20)

JSConf 2013 Builders vs Breakers