The statements and opinions expressed here are my own and do not necessarily represent those of Oracle Corporation. Oracle does not reflect my views.
- Please obfuscate your code making it, at best, unobviously broken. Even if the code isn't important.
- Global state has been a known bad idea for forty years. Please don't do.
- Corollary of either of the first two commandments: Singletons are pure evil. Don't.
- Please think about encapsulate. That implies not shoving getters and setters all over the place. Also prefer not use implementation inheritance and avoid protected. Generally limit unnecessary access and implied implementation, even on larger scales.
- Please practice good dependency hygiene. Yeah it's not interesting, but turns out to be really important for a number of reasons.
- If you're doing layers of security, please do check each layer individually.
- Please don't give nulls a meaning. Throw an NPE.
Things that are wrong:
- "Postel's Law". Good for UI, but for machine interface you wont catch errors and differences fixing mistakes allows TOCTOU-style vulnerabilities.
- Given enough eyeballs, all bugs are shallow. Increasing the number of reviewers decreases the depth each one expends on the problem. It's the maximum depth which is crucial unless the problem is trivial in which case who cares.
- Vulnerabilities are the adversary's fault. Vulnerabilities are the fault of the party that decided to ship the faulty product.
Work: A "Vulnerability Engineer" in the Java SE Security team for Oracle Corporation UK Ltd.
Top advice: If I were you, I wouldn't be starting from here.
Toast advice: Look after the corners and the middle will look after itself.
In the next few months, I shall be going to:
- Apr 2015, ACCU, Bristol, UK
Recentish past events:
- Apr 2014, ACCU, Bristol, UK
- Feb 2014, NorDevCon, Norwich, UK
- Aug 2013, DEF CON, Las Vegas, NV
- Aug 2013, BlackHat USA, Las Vegas, NV
- Apr 2013, ACCU, Bristol, UK
- 14-16 Nov 2012, Devoxx, Antwerp
- Aug 2012, DEF CON, Las Vegas, NV
- Aug 2012, BlackHat USA, Las Vegas, NV
- 25-28 Apr 2012, ACCU, Oxford, UK
- 16-18 Nov 2011, Devoxx, Antwerp
- 12 Nov 2011, ACCU Autumn Conference, Bletchley Park
14-15 Nov 2011, Stack Overflow Devdays, London
- 5-7 Aug 2011, DEF CON, Las Vegas, NV
- 3-4 Aug 2011, BlackHat USA, Las Vegas, NV
- 13-16 Apr 2011, ACCU, Oxford, UK
- 12 Apr 2011, "A day of deliberate practice", Oxford, UK
- 17-19 Nov 2010, Devoxx, Antwerp
- 14-17 Apr 2010, ACCU, Oxford, UK
- 18-20 Nov 2009, Devoxx, Antwerp
- 7 Nov 2009, ACCU Security, Bletchley Park
- 2 Nov 2009, Stack Overflow DevDay, Amsterdam
- 28 Oct 2009, Stack Overflow DevDay, London, UK
- 31-2 Jul/Aug 2009, DEFCON17, Las Vegas, NV
- 29-30 Jul 2009, BlackHat USA, Las Vegas, NV
Q&A for professional and enthusiast programmers
Q&A for meta-discussion of the Stack Exchange family of Q&A websites
Q&A for people who build and repair bicycles, people who train cycling, or commute on bicycles
Q&A for professional programmers interested in conceptual questions about software development
Q&A for road warriors and seasoned travelers
Q&A for computer enthusiasts and power users
Stack Exchange Network staging zone, where users come together to build new Q&A sites
Q&A for information security professionals
Q&A for system and network administrators
Q&A for user experience researchers and experts
Q&A for apps, scripts, and development with the Stack Exchange API
Q&A for people who want to be financially literate
Q&A for Ubuntu users and developers
Q&A for scientific skepticism
Q&A for members of the workforce navigating the professional setting
Q&A for contractors and serious DIYers
Q&A for project managers
Q&A for practitioners, researchers, and students in cognitive science, psychology, neuroscience, and psychiatry
Q&A for students, researchers and practitioners of computer science
Q&A for power users of web applications