After making the smallest possible transistors, Moore’s law is coming to an end. Researchers and technologists are pursuing new quantum computers. In this talk I’ll do an intro to what makes these computers special, the code that runs on them, and how we could start securing our systems and servers with post-quantum encryption. jsQuil is a library which allows you to create assembly-like instructions for quantum computers and virtual machines, by writing code in a high-level language (JavaScript/NodeJS). CodeCrypt is a drop-in replacement for GPG which helps you encrypt messages, documents, and emails in ways which confound quantum computer codebreakers. Last year Google, the NSA, and NIST started recommending adopting new encryption tools to prepare for quantum computing, including lattice-based encryption and BoringSSL to keep the web secure. EVENT: Øredev 2017 SPEAKER: Nicholas Doiron PERMISSIONS: Øredev Conference Organizer provided Coding Tech with the permission to publish this video. https://www.youtube.com/watch?v=dRNk2zJ5gvU
Most of us don't have to think too much about module bundlers in our day jobs. However, module bundlers are all around us, and if you’re a web developer you are probably using module bundlers on a daily basis. Having a good understanding of how popular tools like Webpack or Browserify work can be extremely helpful. In this talk, I will help you understand how most module bundlers work and show you that they’re not as scary as you might think EVENT: You Gotta Love Frontend Kyiv 2018 SPEAKER: Ronen Amiel PERMISSIONS: Conference Organizer provided Coding Tech with the permission to republish this video. CREDITS: Original video source: https://www.youtube.com/watch?v=Gc9-7PBqOC8 https://www.youtube.com/watch?v=eoi6U2fBKhU
The discovery of speculative execution side-channel attacks (called "Spectre") fundamentally changes the security model of every modern superscalar microprocessor. Extracting secret data (credit cards, cryptographic keys) through side-channels is not new and has challenged the cryptographic community for decades. Despite this, the industry has often been complacent in our response, viewing these attacks as impacting a tiny amount of code and being nearly impossible to weaponize. But speculative execution attack techniques have fundamentally altered the ease and applicability of side-channels, making them a serious threat to computer security. Responding to these issues has impacted CPU design, compiler design, library design, sandbox techniques and even the C++ programming language and standard. This talk will explain how these kinds of attacks work at a high level and provide a clear set of terminology to describe these classes of vulnerabilities and attacks. It will show how the different variants work at the low level of modern hardware to give a detailed and precise understanding of the mechanics involved on CPUs today. It will also provide guidance about what makes applications and services vulnerable and how to analyze your software to understand the degree of its exposure. It will include an overview of the numerous different mitigation techniques available, how to deploy them, and what tradeoffs come with them. Some of these mitigations will be covered in detail: how they work at a hardware level, where they don't work, and what attack vectors remain. Finally, the talk will show how traditional side-channel risks are made substantially easier to exploit due to speculative execution. This will cover how cryptographic and other libraries dealing in high-value secrets need to be adapted to correctly defend against these attacks. Further, it will introduce general problems of sandboxing untrusted code from secret data and the current best techniques in those circumstances. EVENT: CppCon 2018 SPEAKER: Chandler Carruth PERMISSIONS: CppCon Organizer provided Coding Tech with the permission to republish this video. https://www.youtube.com/watch?v=CAS1R4s8CMs