Builders Vs. Breakers - Head to Head - BSidesChicago 2012

In this Builders vs. Breakers talk, Jon Claudius and Matt Konda go toe to toe talking about developer and security concerns. The talk was moderated by Dan Schleiffer and given at BSides Chicago in 2012. This was the first talk where the Builder roasted a Breaker by doing some code review.

Transcript

1. Builder vs. Breaker Head to Head
2. Head to Head •Introduce a topic •2 audience members debate •Commentary •Audience Votes •Win Beer!!! •Repeat
3. Builder Functional Quality Dates Features
4. Breaker I’m a badass, of course I’ll own it High Risk Vulnerabilities Speed and Coverage
5. Quick Poll: Builder or Breaker?
6. Let’s get in the mood
7. Breaker “The PHP developers will never learn, never improve because they are repeating the same mistakes over and over again” – Breaker on Twitter
8. Builder “… only good at ranting. Zero contribs, and almost zero constructive feedbacks but bashing” – Developer reply
9. Well, that was productive So... what got fixed? Where’s the patch? Shit’s still broken.
10. Rails and GitHub
12. 12 A default in Rails that makes programming faster and easier manifests in a concrete security issue for github. So called “Mass Assignment” allows a hash of input to be dynamically set onto a model object unless a restriction is set.
13. “Hackers love Mass Assignment” RailsCast 26 5/2/2007 Rails Issue 3453 Rails Issue 4062 Rails Issue 3157 Rails Issue 3952 Github Rails Fun 3/2-3/4 2012 2008 2009 2010 2011 2012
14. 14 Who’s fault is this? Who should fix it?
15. 15 Who’s fault is this? Who should fix it?
16. 16 Who’s fault is this? Who should fix it?
18. OWASP is working
19. A pen-test validates that my app is secure!
20. The Cloud makes me more secure
21. I trust 3rd party libraries libraries to be secure
22. 22 From Aspect Security Research
24. Breaches are cheaper than secure code
26. Builder Rampage
27. “it was also coded under major time crunch” “just bear in mind it’s essentially a POC not real production-caliber tool” “<braces for impact>” “Am I getting pre-emptively defensive?”
28. Code Review Results • Not standard ruby • Naming conventions (case and _ / camel) • File layout • Not abstracted • Input / Options parsing could be shared • Unnecessary imports • Config options externalized / overridden • Rake for gem • Tests • Bundler • Lots of even more nitpicky stuff • Let’s talk about OO
29. Anything weird here?
30. How far do I have to go?
31. So what do you do?
32. 32 “I’m releasing a new vuln today AND I’m including a patch” “Look at you making me more responsible, this sucks!!!” “Funny thing was, I found more vulns fixing (building) than breaking”
34. Breaker Builder
35. Breaker Builder Increase overlap