Application Security WeeklySubscribe
Application security, Supply chain, DevOps

Developer Environments, Developer Experience, and Security – Dan Moore – ASW #319

Minimizing latency, increasing performance, and reducing compile times are just a part of what makes a development environment better. Throw in useful tests and some useful security tools and you have an even better environment. Dan Moore talks about what motivates some developers to prefer a "local first" approach as we walk through what all of this means for security.

Full episode and show notes

Announcements

  • Identiverse 2025 is returning to Las Vegas, June 3-6. Hear from 250+ expert speakers and connect with 3,000+ identity security professionals across four days of keynotes, breakout sessions, and deep dives into the latest identity security trends. Plus, take part in hands-on workshops and explore the brand-new Non-Human Identity Pavilion. Register now and save 25% with code IDV25-SecurityWeekly at https://www.securityweekly.com/IDV2025

Guest

Principal Product Engineer at FusionAuth

Dan Moore is a principal product engineer for FusionAuth, and currently helps build solutions and educate developers about auth and OAuth. He’s written, contributed to or edited 5 books, including “Letters To a New Developer” and “97 Things Every Cloud Engineer Should Know”. A former CTO, technical trainer, engineering manager and longtime developer, Dan has been writing software for (checks watch) over 25 years.

Hosts

Tech Lead at Block
Senior Engineering Leader at AWS

Related

In Search of Secure Design – ASW #325

We have a top ten list entry for Insecure Design, pledges to CISA's Secure by Design principles, and tons of CVEs that fall into familiar categories of flaws. But what does it mean to have a secure design and how do we get there? There are plenty of secure practices that orgs should implement around supply chains, authentication, and the SDLC. Thos...
Avoiding Appsec’s Worst Practices – ASW #324

We take advantage of April Fools to look at some of appsec's myths, mistakes, and behaviors that lead to bad practices. It's easy to get trapped in a status quo of chasing CVEs or discussing which direction to shift security. But scrutinizing decimal points in CVSS scores or rearranging tools misses the opportunity for more strategic thinking. We s...
Finding a Use for GenAI in AppSec – Keith Hoodlet – ASW #323

LLMs are helping devs write code, but is it secure code? How are LLMs helping appsec teams? Keith Hoodlet returns to talk about where he's seen value from genAI, where it fits in with tools like source code analysis and fuzzers, and where its limitations mean we'll be relying on humans for a while. Those limitations don't mean appsec should dismiss...

You can skip this ad in 5 seconds