it's not actually I did attend those conferences but I'm not bashing each
other but I have to develop myself actually just talked him up because we
did God we're very crampy every time everybody is special to developers they
do it alone that congress you I got fed up with it because I wasn't afraid of
hostility better but I had to the split in developing and security event
security but my heart is still for developers and then when you see the
best it hurts when they grow up so I wasn't the current renters who called
people as risk of assassination and I'm long haired guy with a beard and the
lady next to me like decent people didn't start bashing developers I want
her getting angry at him again but that's what is talk about it because if
they wouldn't go be no develop us we would have not a lot of stuff we would
have so actually my ancestry overcome from is completed difference I don't
have a night I T history I didn't study I was 17 and other things to do and also
trained mechanic injection molding injection morally it's very heavy iron
molds to be close but a machine liquid plastic were being checked it cause it
opens the parts will be retrieved by am guilty programmed robot sometimes even
though will be in alaska robot robot arm removed from the mall mall closes and
again presumably because its mass production timings range both expensive
so the first I can produce a productive though I was a mechanic greasemonkey
widely hands and was really great because we did sold a million little
aches with a dramatic hydraulics and about as robots and I like and sounds
like things like moving by himself apparently so I like a robot I very
quickly become responsible will keep the rebels running of a you have her
time in mind that there's a problem because you want to save time do you
send the robot arm into towards the mall before the mall has open and you close
in the mall before the over has left them all there's a slight problem
timing what if what if the money is not opening the robotic arm into the mall
reporting unbroken expensive but it's really funny and in president if the
mall closing and relatives still in there and have a given but then neither
defendant he was the development so I was a greasemonkey he wants to develop
the robot arm will be screened by the mall he comes down and I blaming the use
or what have you done this type I could stand it should not be possible I like
logic and certainly possible that this is what I did I let myself be a TV
programming and download the letter diagram twenty compiling and reading
head I hold a really stupid problem and I want middle grade because I found to
be explored
ok I was a hero I was cool I went down there
up there to the office because we were down there in the production area I can
be printed out of the diagram and said I found your for you did it wrong for me
was he happy
we never became really good friends and that's somehow how could people think I
found a weakness I broke your stuff I'm so smart and cooling you I'm small you
because I can bring you let me forget about the complexity of systems
system sometimes you forget about to overuse and you think how can then
though teachers how can this happen and complexity
it's very too complex to write a good cause if it's robotics many pops meeting
the same time if an application so when you do that much complexity sometimes
you forget to look at a detailed or just you don't find it until it well trained
so Beijing development but I'm smart to because it brings you can bring stuff
can you build it yourself
many times up in security conferences and there was another cool I'm so cool
I'll break stuff and he wrote a nice writing script you can download the code
because icon code so I can do what you do but I'm smiling because they've been
breaking the same thing I did my first codrescu's PLC programming I kinda
program penalties but I could trust to the sometimes I think I miss you in the
program actually is indication that smile off ska project they're not
trained to lower interest paid a broken bone you suppose but think about the
mindset of people think of my people minds work this photograph I took an
island had a much less bicycles in the Netherlands and only bicycle I spotted a
placement says no bicycles here it's obvious you mind is like don't think
about it and sometimes by not saying something you just threw me I do
training to develop Estates is a
just come down and abroad program and not be able to say how to fix it will
help them to hear that they're really cool hackers I'm gonna go disappointed
because they're like oh I'm so cool it should be animated but it doesn't work
so I'm so cool look at all the weapons I have to make proposals availability I am
really cool I will get a big guns and shoot your application so hey I'm have
college though I used my deployed it everybody can have now actually I had
one customer receive another company used armitage against their server on
Hail Mary and as I remember how can you do that it's going to be too bad the
trust having to do that doesn't make you real Hecker and I must be over CTF
project I don't feel like I do CTS and I am i three times price windows still not
very good but default security professional because in a PDF challenge
every challenge his availability of it would not be a challenge all you need to
do it's fine just bought it utopian uploaded you don't have to understand
availability is just exploded and dedication thing but it would
occasionally most part there's no writer so I need to talk and I got my points
that it's easy for you to call ahead but if you all don't wait for you have to
cool story babe you for you to help them making stuff only meet you divide
and maybe I'm getting old I don't know this but each other universities and
didn't like the generation gap gets bigger and bigger and it's very hard to
find developers through security and people actually Midlands the pundits
empty and no developers
security stuff I said of course not what do development doom developing and I see
the two turnovers in the Netherlands with a big problem because you are you
available for half a year
men become media 22 years and then you should be seeing it develop otherwise
you are slow and then you see it above what is your career path be more senior
senior developer noting you to be an architect or a manager because then you
get more money so we are killing so much knowledge because there's no period plus
available so you see the development and and move on a device that you like
appreciating developers being towards doing it for years
something that missus and robust security tests even rules because hey
I'm the pool guy with all my stall and I have stuff but experience they like a
lot of young people there that's normal it should be like that it's
understanding communication like the idea of being able to talk we are very
confident in front of a computer somewhere in the basement not be around
us and Mina machine but we have to learn to talk that's one thing but we have to
learn to talk to other people with other mines it understand the take home with
checklist this is all broken so everyone's the possible to do with this
yeah it's broken and get a report saying hold this is all bad reports what is
going what have you done what did you do I see a movie bored that's something in
the Netherlands functional testing is really a high standard with all function
tests are not technical
and David along with security had a really good estimating how much
attention on application whenever security test there's always time folks
because security is expensive to be to blame for says 1341 read-back works
though how much testing do you get because their intake
reporting one half a song so he has three days left
rule what do you do three days running towards an end would you do if your time
trying to false positives and give them and then they get a report so when i
receive a reboard I almost never get the whole intermediate funds because I want
to see what did you do what you haven't done so different things hey let's try
to myself tonight against the same tools the same cruising around the same test
and the only saw a dozen since you have to fix it don't say hey disorder the
false-positive findings I get a difference in findings so what happens
those have you seen them have you ever seen the report also should say those
findings have been reported dead toolbar they were not respond with issues by
mister I'm you get a top-secret PDF reboard
report profile in bed because yes I have things the payload so I can log onto my
application because then the link doesn't work so I have to click the link
and hoped applications the same state so there's a little groups then I can see
what this program and I get a channel description would be fix doesn't help me
develop not really I need a description of what has been done on the stand right
of the people to newburgh worry it's a dynamic application so if the panel
groups many times depending on the stage of the dynamic application form pdf yeah
Thnkx for management mass text me and let me talk to me when you get to report
I get in line what are we paying or develop muscle to develop their best
because if it was having too much from who you are is a developer be proud of
it as somebody seeing him of this
be proud to be developed as you make people proud of what it do to do is the
Follow button to submit it pointedly the moment I appreciate them commit care
about him that's what you need people do care about what it do I thought the
first care about them but their best so many times because all the different
priorities the users don't like to look at is under stress and be more intuitive
history more shiny fleshy application he has to leave yesterday so they never
good to expensive you will be outsourced to while away or usual nobody was
developers are still being rely on them so that's crazy
plants and sweat and tears it's a no Botox when you get a thing to get best
time to time because he said the particular you said you need three weeks
we sold it for two weeks ahead of sierra Sky Map Reduce company when I was so far
was developed by the estimate on how many hours you think this application
will take to complete so I get back to them he comes to me so he has to be 250
hours less is that ok tried something through hugo you save $250 for you are
happy to walk away but then he realized he talks to be just a little bit in the
face
oh yes even you cannot do this you got my judgment that's what you asked to
tell you that it is not OK
trusted people have talked to manager ok he knows me
appreciably do except experience with the continued to agree to work hard we
do it's really got so prevalent to talk to testers development tests on the
tests are people we can talk to them that way to operations even earlier
that's what spring because we are developing stuff we anticipate testers
and then he threw down the basement to operations so no arrests in the greater
so we have continuous delivery companies like 70 released a day then come
security
refers to a poultry few then they may be tested first and then you get a proven
and you can really does not work early integration and very 84 in Horsham chain
Mb
UI developer code code 200 you develop know when something comes by you know
three months ago
unit end of this piece of code is no good read and think of us already know
you think three months ago what did I do that I have a very rare pacific time it
has been it isn't will be I have no idea where three weeks ago and yesterday but
on the menu is developing to think all the complexity of the code for three
weeks ago then you have to fix something only takes time to fix it takes you out
of current process and you to get all the way to make Indonesia all process to
think about how to fix the security should not be like the Ministry of snow
here many times I
come to companies that had the implementing security family life cycles
phones are you do security why because they are you know I'm here for you
really do totally issues I always claimed I have to be talking to team
Cobra if you don't have to talk to teams ok I don't do it we're not doing that I
don't do it cool t-shirt can city do together this team who knows the code
best who knows the code below the developer
stakeholders second term so we fail to approach them
prevails over how to live with the reports them what they think about how
we can improve it and now it's very scary to talk to other people I was not
able to talk about but I got passion about security cooperation will
determine what their hardest will offer comes out of the mouths of lions and I
lost developing a low-security a lot about the tactics are starting to talk
to people in the state and don't always about security for things they are
concerned I didn't offer refuse intake stuff that I mean you dare to first
meetings always mister manager what do you hear me talk to professionals
diminishes everything to me someone to say that what I want to hear actually I
think make rich combination have paid me for Speed smoke because the more you go
out like a secret then you all the frustrations because they know to
understand you know you have been in the same place you have been a developer
tools and Microsoft no I haven't felt the pain so you're equal out there no
manager around lightning secret you hear all the frustrations when they
understand you feel the pain you can be actually there crowbar to get things
changed according to prove to have no time
me because you're dead external expert telling the management you have to fix
it so you actually had been determined to improve that they have trained you
just have to trigger the treated in the media understand they have to be treated
and it's something I really got involved over 2006 I getting all my videos on the
web because most def for developers it was not a security conference or heading
toward know it was a community of developers helping each other to write
SecureCode
first misstatement later why did was the finding fighting and defending of
unsecured code we learned we understood is not possible to make one hundreds of
security code change mission statement I think bigger 2008 and saying from make
the risk invisible to the business so they can do the right decision but what
I found it always thinks few years later we have generation of our project
guidelines it will spill the break-in defendants I was developer to build a
comedy Philip
even though us coming from the development of our meant I think we
understand what if you develop us are you be loose and enjoy myself I'm
develop us something different for building bridges among others not
thinking to do have to say I'm creative so make them the hero and you have to
help me on this computer is the moment but has been born playing and he needs
to make it was your security years as always how to presenters
here for them love them
indians me I don't like having don't be the guy who kicks that job will be to
bullying and said there was blood sweat and cheers the passion it's in the if
you appreciate them
it in the code if they were I was an idiot who spent eight hours because I
was allowed to work longer at the office
coding and other stuff I didn't like and to fix already home to spend the whole
night improvement because I want to be proud of my coat and I know a year later
I look back I did two years ago let's go and we look back and he called like a
year ago
oh my god what did I do it's good that means you are improving so be it a child
doctor look at the trial and see what's good where it needs help not taking it
with children whereas the nice children to be as beautiful
keep the children you don't have to wonder why it upset you already get a
value-added should intend them with your children need more care more attention
to be the best performers petrovic and have so understand him talk to them
understand what the state business what is the 2010 campaign is awesome what do
you do about security and the still existing saying nothing I don't believe
you what we're doing yet because you're not always has a security label on the
front row tested because as we did it created the smell of mystics securities
cryptography its complex is a groom lake metric
you get the security test estate development team and an external even in
a different department desert security orbit resting place between the black
magic outcomes to this report
so what is the development tools are probably use they care about quality
initially quality insecurities not a different because it's about what
appears should not be able to do they have to own death was the metrics like
10 always said if the code policy towards safety performance six holes and
that's our country is to treat them even better job of PMT texts are fine bucks
to approach it takes away the low-hanging fruit and you indicated in
the deferment street so the moment a check the code in 4-5 mins later the
kind of feedback like to get involved and feedback because it will get it also
gives thumbs up a coat rejected
it's good thank you appreciate make them along
make them constructive improving it bit by bit rather than basing them saying
this is my book reports PDF reports I really many companies do teach
developers in you and say how do the report even though they tell you about
the report gives you put your pants down and telling the truth and this will cost
extra if there's a security guy who doesn't called reissue a security review
on its not willing to explain what he did was he afraid to share knowledge
knowledge is not that special anymore and people tend to me wait a minute
you're going to customers you explain them by the tools and methodologies
everything for yes I do and you will be obsolete one time when we're looking
forward to putting back my sympathies on the table to myself a nice whiskey and
always solved but I think we will have to us when we have unicorns rainbows and
families because we have so much new developers every year what a trained 103
look at the most simple coding summer he'll rule it's fraud the box and
branches will eventually break into the court orders from Java 24 hours whatever
language 24 hours and even though to call it seems that look at this is wrong
it's not secure you want to say yes but we have a little remark saying this code
is not meant to be in production this whole lot I teach and universities and
told them about prepared statement promised carries and DBA say yes that's
how we do you talk or database
duty and ICT approach like the head down but this is how he taught us to develop
this comes because teachers and universities to have to cope up with new
technologies are taking whatever language in 24 always learn it making
from glasses and then pitched people cannot explain developers developers
should be trained by developers new technologies like development who knew
who is developing apps anybody the younger people so i dont two teams that
like trendy fashion 60 or over some of the age of 30 2004 general election
always helps to get a tension but they like 150 to develop a 52 you organize
our team development he's doing jobs for 15 years given our history
mobile apps its fleshy and you need a new guys who pushing the boundaries are
really going for but in everybody the young guys and girls run down the clip
you need all the guys in me and my mother you so very Asian Age intended
very very important for a good team for the security team and the development
to make a story when I asked you to report that the right up and I have a
good provider cannot write novels otherwise I would have to guess but tell
them what is how I experienced the application in my right arm I might this
application shortly in certain that I write down what I think its vote
starting up with you the episode eight days and upload functionality or cannot
upload a file bigger than 10 MB and only three lines will reread what would
happen if you do a 10 files with 5 Mb reserve online it may be honest and
using process Tuesday can we believed they were much more on the stand and
tell the story
elimination me personally I will have a hard time understanding why security
people charged with money security test and the change
additionally for delivering the report want to secure taskforce materials
company and the one internal guys have all the people going on security might
be interesting it's not really in the agreement I was lost to them there's no
security requirement so we have one of you team ok the guy from the team called
me thank you again so we ended up with a problem they are developing expect me to
do the security it's a team effort on some have all the Sun is no Java
developer I mean when he started coding I was standing in both patient and call
quality is dead so now he's a child development
changes you talked about so not always interested so the next page here says
security book is like thank you every time it seems like she said told me that
security is what the other security cannot give to other people
security is everybody's responsibility ballistic make the team go well if you
are happy about it
roti making him about its only can be doing what it should do there's been a
location in america
attitudes company has been hacked and of course there's no internal development
today asked the sofa develop hundred companies to deliver our simulation
software it's hard but there's no security requirement is not regulated
because it had the entrance with what money we saw you because they are all
known vulnerabilities and you have them in your code to shoot no responsibility
will change safety military understand the code when you have a child he
described by t-fal should do something else we also honor time technology
leaving time I come to companies about integrating security independent life
cycle what everybody thinks about stars and science technology to solve our
problem had a guy from the Netherlands bunk
banking their lands so I spent about poultry few technical analysis comes out
ok decided to make an honest and a tool helps you but that doesn't mean anything
by himself but we will have units we need to easy access is a report on the
report early feedback but all the tools idea the only confined taking problems
bucks with the condo its flaws function of aggression dermagraph normally ask
the audience so markets a technical problem of lobbying essential problem
what do you think what's more the things that are more bucks influence nobody was
in Stanmore lost embarks
against pick people actually its 50 50 half the world birdies we could
eliminate but definitely looking at the functionality to understand that it's
like the common sense but there we are focusing on it but all the technology
Fogelberg security on the back but the functionality you only can find it using
your brain logical befriended before my line of court was just looking and
functional easy would it be that smart
cannot explain what you found the weaknesses and Spain
problem usually simple maybe you have to understand it just having a two-third
it's not enough
almost and I was avoiding that has been charged with taking Libya pre always
challenges it's a city effort is different why it's not about the Golden
Nugget you upload history we have 10 wins the first three points on
explainable ability not a three points you get for exploiting the booty
you get four points hotel and it's a text to the real people behind the more
efforts to create community so that hundred people over challengers
200 people are big teacher and telling people about security that's all we need
thank you