Learning from Log4j
With Log4j very much in the news, if I could update my new book by magic it would make a terrific real world example to write about because it ties together a number of topics in the book.
[Read More]
A Wicked Problem
A wicked problem is one that is difficult to even clearly describe because of its diffuse and interconnected nature, and this is a useful lens to view software security.
[Read More]
Vulnerabilities are Mistakes
Spilled coffee beans, breaking the sound barrier, and software security
The Right Stuff is Tom Wolfe’s popular history of the US astronaut program, and it begins by recounting the early effort to break the sound barrier which involved such frequent crashes that there were weekly funerals for test pilots.
[Read More]
Scope of the book
One big learning for me from writing a book on software security is realizing the importance of context to security. There was a constant challenge of discovering the right scope — what needs adding, and what can be cut to keep it concise.
[Read More]
Root causes
Each time a high-profile software security bug is reported, I wonder how this happened yet again. I don’t expect vulnerabilities to approach zero any time soon, but still I’d like to know how this keeps happening over and over, so we can do better.
[Read More]
Statement of Intention
I believe that we can do so much better at delivering more secure software, and my book explains how we could do that.
[Read More]
Complete Mediation in Sci-Fi
In the book Project Hail Mary by Andy Weir, there is a short scene (on page 339) that features a very clear example of failure to implement Complete Mediation (one of the secure design patterns described in Chapter 4 of my book).
[Read More]