Application Security Weekly Subscribe

Application security, Security Architecture, DevOps

Discussing Useful Security Requirements with Developers – Ixchel Ruiz – ASW #313

January 14, 2025

There's a pernicious myth that developers don't care about security. In practice, they care about code quality. What developers don't care for is ambiguous requirements. Ixchel Ruiz shares her experience is discussing software designs, the challenges in prioritizing dev efforts, and how to help open source project maintainers with their issue backlog.

Segment resources:

Full episode and show notes

Guest

Senior Software Engineer at Karakun AG

Ix-chel Ruiz has been developing software applications and tools since 2000. Her technical research interests include server side languages like Java, dynamic languages, client-side technologies, testing, automation and observability. Her humanities research interests include personal, professional and organisational development and transformation. Java Champion, Oracle ACE pro, Testcontainers Community Champion, CDF Ambassador, Hackergarten enthusiast, Open Source advocate, public speaker and mentor.

Hosts

Tech Lead at Block

Senior Engineering Leader at AWS

Application Security Engineer at Zipline

Related

Application security

PyPI’s Quarantine, Phishing & Awareness, Porting Fishshell to Rust, Cyber Trust Mark – ASW #313

January 14, 2025

Design lessons from PyPI's Quarantine capability, effective ways for appsec to approach phishing, why fishshell is moving to Rust component by component (and why that's a good thing!), what behaviors the Cyber Trust Mark might influence, and more!

Application security

Removing Rust, Double Clickjacking, h3i CLI, JWT Mistakes, Reviewing Recursion – ASW #312

January 6, 2025

Curl removes a Rust backend, double clickjacking revives an old vuln, a new tool for working with HTTP/3, a brief reminder to verify JWT signatures, design lessons from recursion, and more!

Vulnerability Management

DefectDojo and Bringing Quality Appsec Tools to Small Appsec Teams – Greg Anderson – ASW #312

January 6, 2025

All appsec teams need quality tools and all developers benefit from appsec guidance that's focused on meaningful results. Greg Anderson shares his experience in bringing the OWASP DefectDojo project to life and maintaining its value for over a decade. He reminds us that there are tons of appsec teams with low budgets and few members that need tools...