hackertube.io

28c3: The Science of Insecurity

28c3 · talk · Watch on YouTube

Security & hackingComputability & complexity theoryLogic & formal methods

What it is

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Why Hacker News recommends it

HN commenters call it one of the best security talks and the standard introduction to LANGSEC, which they use to argue for simpler, well-specified input formats.

  • 9 people recommended it
  • 9 different months
  • 2 strong recommendations
  • first 2012, last 2024

What HN commenters said

  1. “It's a tour de force, presenting a systematic and practical proposal for how we can build an open and secure future for computing.”

    Systematic proposal for secure computing using linguistics and formal grammars.

    jdietrich, 2013-04 · Strong recommendation · in “Ask HN: What's the best technical talk you've heard?”

  2. “The best talk on computer security I have seen is Meredith Patterson's Science of Insecurity at 28c3”

    Best computer security talk, using grammar theory for security.

    sedachv, 2016-05 · Strong recommendation · in “Remote code execution vulnerability in ImageMagick”

  3. “She contends, and it seems sound to me, that the time has passed to be "tolerant when accepting,”

    Argues for accepting only regular or context-free input grammars.

    mkn, 2012-03 · Recommendation · in “Tanenbaum’s advice for building product, networks, and living life. ”

  4. “Sloppy grammars and bad parsers make data cross into Turing-complete code.”

    TeMPOraL, 2013-08 · Recommendation · in “Comments in JSON”

  5. “Why undecidable input recognition makes protocols unsecurable.”

    majika, 2013-11 · Recommendation · in “Bytecode”

  6. “here is a video that works a bit better as an introduction to LANGSEC”

    Good introduction to LANGSEC.

    noblethrasher, 2015-01 · Recommendation · in “Useful old technologies: ASN.1 (2013)”

  7. “Meredith Patterson and Sergey Bratus gave an excellent talk on the subject at 28c3”

    Talk on context-free formats to avoid memory corruption bugs.

    ShaneWilton, 2015-07 · Recommendation · in “Hammer: Parser Combinators for C”

  8. “this older talk by Meredith Patterson is still worth watching a lot”

    Older talk that could be a gamechanger in IT security.

    hannob, 2015-11 · Recommendation · in “We need less powerful languages”

Excerpts from Hacker News comments, linked to the originals. Summaries and labels were written by a language model from those comments.

Topics: langsec, parsers, formal grammars, input validation, protocol security

Also recommended by the same people