Allon Mureinik

Eighteen years into my career, I decided to pivot and move from infrastructure-related work to the world of application security. If there’s one thing I’ve learned in the three years of working in application security is that it’s a funny business. Our entire business model is based on pointing out the mistakes of other programmers.

In this talk, I want to shoot myself in the foot and share some concepts that could help eliminate a lot of those mistakes, and reduce my job to snuffing out the more interesting mistakes.

Denial of Service (DoS) bombs are a rudimentary, yet effective, type of attack that's often easy to understand but hard to protect from.

In this talk I'll cover some common "bombs" such as XML Bombs, YAMLs Bombs and Fork Bombs, and some basic techniques that can help defend from them.

Management is difficult even under the best of circumstances and managing globally-distributed teams is even more so. With the global COVID-19 pandemic and the restrictions it forced on all of us, management is nothing like the best of circumstances. With the pandemic, suddenly everyone is a remotee – even people who have no experience in working remotely, and no desire to work in such an environment. In this talk, I’ll explore how the lessons learned from navigating a globally-distributed open source community can come in to play when managing a suddenly disturbed team. I’ll examine how taking a cue from open source communities can help managers handle this new landscape with flexibility, clemency, and above all, empathy.

Node.js’ single-threaded nature makes it very susceptible to DOS attacks. While Node.js’ event loop allows performing some operations in an asynchronous fashion, it’s still quite easy to write a vulnerable Node.js application by making a few simple mistakes. In this talk I’ll cover some common ways a Node.js application may be vulnerable to DoS attacks and some common best-practices and counter measures to defend against such attacks.

Open source thrives on diversity. The last couple of years has seen huge strides in that aspect with codes of conduct and initiatives like the Contributor Covenant. While these advancements are crucial, they are not enough. In order to truly be inclusive, it’s not enough for the community members to be welcoming and unbiased, the communities’ processes and procedures really support inclusiveness by not only making marginalized members welcome, but allowing them to fully participate.