What are the motivations for this security course
Let's talk about
- ... all those false promises and "broken dreams": http://rentry.co/DSRsecuritycoursepart0
- The ridiculously blown up US dominated code base: Billions of LoC - open and closed software - being totally out of control: https://xkcd.com/2347/ and https://justine.lol/lambda/ or http://rentry.co/DSRsecuritycoursepart7
- The psychology behind: https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started and
- https://attack.mitre.org/techniques/enterprise/
- US - hypes motivated by: "Profits, profits, profits!"
- Andy and Bill's law: https://en.wikipedia.org/wiki/Andy_and_Bill's_law
- US foreign surveillance laws and spying:
- The problem with VS and VSC: https://vscodium.com/
- US C/C++ compilers poisoned: https://slashdot.org/story/312289
- Alexey Kutepov aka "rexim" (Tsoding on YouTube) noticed same in Emscripten: https://youtube.com/watch?v=Bafo3hhheHU
- Copilot inherent problems
- The CIA organization In-Q-Tel and it's "portfolio": Cerebras, Julia Language, MemGraph, Databricks, Gitlab, Anaconda, Plotly, PubNub, MongoDB, TaxBit, VeraCode, Coudera, Cloudant, D-Wave, Palantir ... https://www.iqt.org/portfolio and https://en.wikipedia.org/wiki/In-Q-Tel
- Whole world abusing NSA hand crafted backdoors now
- Whole X.509 PKI certificate system is compromised and - with high political motivation now - backdoored by China, Russia, Ukraine, Baltics, former Eastern Europe states, Iran, South America
- European law: GDPR, upcoming Schrems-III EU court judgement, NIS-2 and EU Cyber Resilience act - new duties for programmers. The good old times of hacking around, publishing on Github, Gitlab, NPM, PubNub, Anaconda, ... are over!
- Backdoors in above archives and how they are hidden: "malicious javascript injected into 100,000 websites" The polyfill.io domain: https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-websites-all-you-need-to-know ; watch: https://youtube.com/watch?v=bbatLr98fEY - are we all too naive?
- Misra and NASA coding standards, recommendations and outdated software architecture and - as well - outdated "GOF" software design patterns: https://en.wikipedia.org/wiki/Design_Patterns and https://www.geeksforgeeks.org/introduction-to-gang-of-fourgof-design-patterns/
Goals of this course
- Bringing awareness into participants minds
- Showing up alternatives without losing productivity
- Thinking about how we encode knowledge.
- Developing and visually "seeing, observing" algorithms at work in Pseudo-Language: https://en.wikipedia.org/wiki/Pseudocode
- How does X.509 PKI work? The basic ideas behind the algorithms
- How HTTPS / TLS 1.2 can be intercepted, how does it work? Who is Akamai?
- Introduction into new static analyzers (C, Rust)
- Back to the roots: Introduction into easy verifiable State Machines
- The Dijkstra Monad - the new "secure programming pattern"
- Use of code generators such as Ragel (C, C++, Go, Ruby, ...) to vastly improve security and productivity at the same time: "Writing bug free parsers right from the beginning"
- Massively improving Linux security by using Syd sandbox (the autor might join us in person during the course)
- Developing your own extensions for Interpreters, Compilers, JIT Engines for better debugging and output of flow graphs for verifying the specs.
- What are 'specs'???? We're learning howto define and verify them
- What is "formal verification" and can it hold its promises in practice? Also see Hoare calculus with its preconditions and postconditions from Eiffel, D language
- The efforts will continue after the course - held in Juli 2024
Probably your motivation
- Learning howto do your own security tools without relying on US multinationals' giant code base any longer
- YOU (or as pair programming project) are doing an assisted tiny "highly secure", "formally verified" project as homework in your programming language of choice.
- Active and regularly course participants will receive a DSR certificate
Guido Stepken @ DSR Berlin, you can reach me at: [email protected]