Appsec adventures

This talk explains how modern attackers increasingly “log in” rather than break in by abusing OAuth tokens and delegated authorization flows. It reviews OAuth as an authorization framework, common grant flows, and the role of scopes and third-party applications. The speaker highlights how tokens, often lacking MFA and visibility in logs, become powerful yet opaque credentials that security teams struggle to monitor. The session emphasizes the risks of poor scope management, token misuse, and limited oversight, urging stronger visibility, validation, and control over token-based authentication and machine-to-machine access.  https://fosdem.org/2026/schedule/event/DMVVQ9-securing-new-attack-vector-oauth-tokens/

Anthropic’s team behind Claude Code described how the tool evolved from an experimental prototype into a new paradigm for software engineering. By eliminating the traditional IDE and integrating AI directly into the terminal, Claude Code lets engineers and models share the same environment, using bash commands, sub-agents, and hooks to automate complex workflows. The developers emphasized “dogfooding,” simplicity, extensibility, and building for power users first. They foresee AI-driven coding shifting from single tasks to continuous, autonomous agents running complex projects across devices and domains.

In a talk at Startup School, Andrew Ng shared lessons from building startups at AI Fund, emphasizing that execution speed is the strongest predictor of success. He urged founders to focus on concrete, buildable ideas, rapid prototyping using AI coding tools, and fast user feedback loops. Ng discussed the rise of agentic AI, the growing importance of understanding AI’s building blocks, and how automation is shifting bottlenecks from engineering to product design. He cautioned against AI hype, defended open source, and stressed ethical, responsible innovation.

The interview features Desmond Lampy, a seasoned software engineering manager, discussing his journey into becoming a "security champion"—a developer who actively advocates for and contributes to secure coding practices. He explains that traditional security labels like “medium” or “low” often confuse developers about the true urgency of a vulnerability, leading to delays or negligence in remediation.  Desmond emphasizes that fostering a culture of security within development teams requires more than mandates; it requires making security enjoyable, relatable, and integrated into everyday workflows. His team succeeded in doing this by gamifying security education, using tools like Secure Code Warrior and rewarding engagement through badges and progression levels.  He highlights that success came not from reducing all vulnerabilities, which is unrealistic, but from increasing awareness and the quality of mistakes, showing developers were thinking differently. He reflects on how...

The transcript is a presentation by a CISO on application security (AppSec), emphasizing the importance of integrating security throughout the Software Development Life Cycle (SDLC) while prioritizing efforts based on organizational needs. Key points include maintaining an application inventory, focusing on true positives to eliminate vulnerabilities, and avoiding over-reliance on tools like SAST and DAST that can produce false positives or struggle with modern architectures. The speaker advocates for contextually relevant training, early threat modeling, and secure templates for microservices, while cautioning about the challenges of bug bounty programs. The overall message is to be intentional in security practices, learn from verified vulnerabilities, and collaborate closely with engineering teams to build a robust and scalable AppSec program.  

 

 

 

 

 

 For over two decades, binary exploitation has been considered a critical and complex challenge, particularly with the exploitation of large applications and operating systems. Despite advancements in exploit mitigations like Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and newer technologies like Control-flow Enforcement Technology (CET) and Virtualization Based Security (VBS), many of these protections remain disabled by default on Windows for compatibility with legacy applications. The rise of safer programming languages such as Rust is promising, but they still need time to match the capabilities of languages like C++. The presentation aims to provide a technical overview of these security mitigations and evaluate their effectiveness in protecting against binary exploitation.

 David Trejo's BSides SF presentation introduced Monocle, an internal Rails application developed at Chime to address security scaling challenges as their engineering team expanded. Monocle assigns letter grades to code repositories based on factors including approved base images, branch protection, vulnerability resolution, and test coverage, displaying these grades via badges directly in repositories. The system performs nightly security score recalculations, monitors pull requests for security rule compliance, and automatically creates JIRA tickets for violations, saving approximately 2,000 engineering hours annually on audits. It communicates through monthly security scorecards sent to team Slack channels and provides dashboards showing security posture across services, meeting engineers where they work - in GitHub, Slack, and their editors. The system's key benefits include gamifying security best practices, reducing engineer stress around compliance, providing clear visib...

  Gain insights into the CISA KEV straight from one of the folks at CISA, Tod Beardsley, in this episode of Below the Surface. Learn how KEV was created, where the data comes from, and how you should use it in your environment. https://securityweeklytv.libsyn.com/the-known-exploited-vulnerability-catalogue-aka-the-kev-tod-beardsley-psw-843