Off Script

Today, Off Script hosts Josh and James discuss all things web application security. It’s something that is getting more and more important to get right. More cyber attacks. More ransomware attacks. They address good application hygiene and the common pitfalls they are seeing people fall for. Big data breaches can lead to losing customer trust so it’s so important to makes sure you’re running a tight ship with security.

Basic security maintenance is essential but what can companies and individuals be doing to make sure their web applications are secure during a time of high value bug bounties being offered to people for finding vulnerabilities?

• Bug bounties. The positives, negatives and relevancy to different sized agencies
• The use of bots to find MongoDB vulnerabilities
• Encrypted vaults
• The Slack issue
• How hard is it to put secure processes in place from the start?
• Canary and environment variables
• If you’re a security researcher, what do you do with responsible disclosure?
• The fine line between helping the hackers and helping the community
• What makes a good, secure app?
• Package managers
• Modern libraries making it obvious when you are doing a bad thing
• Open pull requests
• Get your house in order with OWASP
• Frameworks and the early standards they set with password management and security hygiene
• Importance of rotating keys
• Human interfaces and the floors surrounding them
• What can we learn from Twelve-Factor?
• Github Workspaces and recreatable environments
• The issues of convenience
• Macs vs dev accessibility and Windows catching up
• Github and Atom
• Good, automated test suites
• How to have a good view on what makes a good security test
• Falling into the trap of feeling productive
• Sitting down with the team to discuss testing value and priorities
• The creativity of SQL injection
• Reinventing the wheel
• Dangers of writing an encryption tool and importance of getting an external security company

Resources:

• GitHub Security Bug Bounty
• snyk
• Yarn
• The Open Web Application Security Project
• 12 Factor
• Hyper

Find out more about Stac and Parallax:

• Stac
• Parallax

Why does the cyber security industry need to hire more anthropologists? Because the criminals already are.

By 2025 it is estimated $10.5 trillion will be lost to cyber criminals. Hacking humans is a very lucrative business.

Social engineering is one of the easiest and most effective ways to access a secure system. Cyber criminals know this, and they are increasingly leaning on the research and techniques of the social science disciplines to leverage the human element into letting them into our lives, our businesses and our bank accounts. Yet, while the security industry is always striving to be ‘one step ahead’ of the criminals in terms of technical capabilities, it often neglects the need to consider the very social nature of hacking.

As more of our lives are now online, how can security practitioners increase security awareness and build up our resilience to unite against malicious actors looking to leverage our weakest, but what could be our strongest, defences in cyber-warfare - our people?

This discussion puts people and social science at the centre of the solution. Utilising anthropological theories and methodologies - such as reciprocity, participant observation and tribalism - Lianne will demonstrate why cyber security teams need to hire beyond technical expertise and look towards the social sciences for the next advancements in cyber fortification to respond to this ever-increasing threat.

To face this threat, we need to readdress the fact that technology does not exist without human interaction. Cyber security practitioners must cater for a wide breadth of expertise, capabilities, experiences, cultural norms, along with all equalities and disparities that frame these individuals. This task is not one for the computer scientist alone and it highlights the urgency to address this problem from an anthropological perspective.

Off Script is back with a special episode as hosts Josh and James reflect on another successful All Day Hey! conference in Leeds and via live stream. Running through the talks and the dynamics of the day, listen in for a breakdown of how it all went and their thoughts on the talks of the day.

Hey! Presents are uploading all of the content from the day over the next few weeks so make sure to head over to their website to check out the talks from this year’s fantastic speakers.

• 01 - Intro & thanks
• 04 - Benefit of IRL conversations
• 06 - Emily Cressey’s Design Systems talk and Sketch
• 10 - Different designs for different levels of complexity
• 11 - Power user vs Casual
• 12 - Design system manager
• 13 - Github
• 13 - 'Evaluate what design elements you use and delete what does not get used'
• 14 - Stephanie Stimac’s talk on ‘Progressive Webapps’
• 20 - Live code streaming
• 22 - 3D CSS Stopwatch
• 27 - Luke Murphy’s illustration system in Figma
• 28 - 'Illustrations guiding emotional state'
• 35 - Functional Programming
• 38 - Responsive Design
• 39 - 'Let the browser do the heavy lifting'
• 40 - Utopia fluid type generator

Resources:

• Schedule & watch talks
• Speaker information
• Design Systems - The Monster We Created
• Building Beautiful Web Apps: User experience and visual design best practices for PWAs
• Take your skills to the moon with creative coding
• Branding for Techies
• Building an Illustration System
• Unconscious Mentoring
• Functional Programming in JavaScript
• Be the browser’s mentor, not its micromanager
• Build Excellent Websites
• Utopia Fluid Type Scale Calculator
• All talks from Hey! Presents

Find out more about Stac and Parallax:

• Stac
• Parallax

James and Josh explore the world of SSGs (static site generators)! The differences between SSGs and full stack frameworks, the associated technologies out there and what to consider with your project when deciding what is best for it.

[Recorded 13th July, 2023]

• 01 Intro
• 02 The Personal Website
• 02 Static Site Generators
• 02 ASTRO
• 03 Content driven site vs Logic and functional site
• 04 Jekyll
• 04 Webapps
• 07 Full stack frameworks
• 08 MPA vs SPA
• 10 Islands
• 15 It’s a cms without the cms
• 16 Flexible data structures enforced via TypeScript
• 20 Deployment - compilation step, already do this on most frameworks anyway
• 22 Still require a rich runtime environment of JS deps etc
• 25 Bring your own db and cache
• 26 Environmental impact
• 27 New SSGs

References

• https://docs.astro.build/en/concepts/why-astro/
• https://docs.astro.build/en/concepts/mpa-vs-spa/
• https://docs.astro.build/en/concepts/islands/

Find out more about Stac and Parallax:

• Stac
• Parallax

What are the steps to building a thriving community? What challenges might you face along the way? In this episode, James and Josh draw on their experience of creating and building communities online and offline, sharing their insights on how to make it a success.

• 04 Starting a community
• 06 Building trust
• 08 Give value, not a sales pitch
• 10 Josh on building a conference
• 12 Creating a welcoming environment
• 15 Letting people know your weaknesses
• 16 Trust
• 17 Empathy
• 18 Dealing with conflict
• 20 Don’t fear conflict
• 22 Lack of commitment or direction
• 23 Inclusion
• 24 Avoidance of accountability
• 26 The enemy of accountability is ambiguity
• 27 Shared ownership
• 30 Rethinking views
• 31 Diversity

Resources:

• https://www.executiveagenda.com/resources/blog/five-dysfunctions-team

Find out more about Stac and Parallax:

• https://stac.works
• https://parall.ax