Did you know Feross taught Web Security at Stanford last Fall? On this episode, Divya and Nick enroll in his security school to learn about XSS, CSP, ambient authority, and a whole lot more.
Matched from the episode's transcript š
Divya: Yeah, so I listen to a podcast called Darknet Diaries. Itās really fascinating, because in my day-to-day I donāt deal with a lot of security issues as a frontend developer; thatās not something ā I think in general, a lot of the times as a frontend developer you donāt really deal with a lot of security things⦠So I listen to it ā itās kind of a guilty pleasure, just to listen to what happens in the black/white-hat world. And thereās actually an episode in March, I think, where they talk about Samy⦠I didnāt realize, because I have not been updated on listening to podcasts, now that I donāt go anywhere.
Itās really cool, because you get to hear about different things, like security vulnerabilities that you might not have heard of⦠And just hear the inside story, because itās not just talking about the vulnerability that happened, but itās also the story of the person, the hacker themselves⦠And I think it humanizes them, because oftentimes when you read stories about things that are hacked⦠For instance, I read Krebs on Security, Krebs on Security ā heās a journalist, Brian Krebs, and he talks about the vulnerability and sort of the solution; what happened, as well as the resolution⦠So thereās not a lot of focus on the hacker themselves, and oftentimes ā I mean, because he is a security researcher, the hacker is always shed in a poor light⦠And Darknet Diaries does sort of the opposite, where you empathize with the hacker a little, and you sort of feel bad for them, and you understand where theyāre coming from, and you hear the back-story of how they started, what made them create a specific bug, and so on⦠Which I think are really cool.
[44:33] The other thing that ā I mentioned Krebs on Security negatively, but I also read it quite positively⦠He posts really frequently. I think the one story that I was really hooked on was when he talked about Mirai, which was like a botnet on the IoT stuff⦠And it was really fascinating just to read about it. I donāt do a lot of IoT work, but he covered Mirai quite extensively, as well as talking about who the people were and how they created Mirai, and how Mirai affected a large portion of the U.S. And I think in general, if you read non-security things, Mirai was not talked about. No one knew that this was a thing, but in the security world it was pretty big. I find that really fascinating to read about.
And then the other thing also - Feross, you mentioned this earlier - is just vulnerabilities that happen in actual hardware⦠So because I read a lot of Brian Krebs, Iām paranoid about credit card machines and ATMs; so one of the things I do ā because thereās a lot of these skimmers that people add onto the ATM machines, so when you put your ATM card into the card reader, it will skim your number, any of the information on the top⦠So people who come to take the thing can grab all of your information and basically clear your bank.
Oftentimes they come with a camera as well, so they can read your PIN⦠So they look at the card number and they see your PIN. So when Iām at an ATM now I always cover my number pad, and I always pull the card reader as wellā¦