התחל במצב לא מקוון עם האפליקציה Player FM !
פודקאסטים ששווה להאזין
בחסות


1 Battle Camp: Final 5 Episodes with Dana Moon + Interview with the Winner! 1:03:29
How Java Developers Can Secure Their Code (#58)
Manage episode 442378597 series 3366865
Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems. In this podcast, we'll discuss how developers can secure their code. I talked with three authors who posted a security and code quality post on Foojay.io.
Guests
Jonathan Vila
https://www.linkedin.com/in/jonathanvila/
https://about.me/jonathan.vila
https://twitter.com/jonathan_vila
Brian Vermeer
https://www.linkedin.com/in/brianvermeer/
https://brianvermeer.nl/
https://twitter.com/BrianVerm
Erik Costlow
https://www.linkedin.com/in/costlow/
https://twitter.com/costlow
Content
00:00 Introduction of topic and guests
01:35 Brian: Why is Log4Shell still around?
https://foojay.io/today/the-persistent-threat-why-major-vulnerabilities-like-log4shell-and-spring4shell-remain-significant/
03:24 Outdated dependencies are still used a lot
04:31 Who is responsible for dependency updates?
07:55 Snyk tools to help discover issues
10:15 Comparing to Dependabot
11:21 How to keep dependencies up-to-date
14:32 Responsibility to use dependencies with care
17:17 Looking forward to the JFall conference
18:48 About Foojay
19:49 Jonathan: Is SQL injection still a problem?
https://foojay.io/today/top-security-flaws-hiding-in-your-code-right-now-and-how-to-fix-them/
24:50 Deserialization injection
27:30 Logging injection
31:22 Even experienced developers make mistakes
33:17 About Sonar tools
35:53 Other articles by Jonathan
https://foojay.io/today/author/jonathan-vila/
https://foojay.io/today/ensuring-the-right-usage-of-java-21-new-features/
38:20 Other security tools
https://www.youtube.com/watch?v=-wVCYj8oQUY
39:47 Erik: Trash Pandas are attracted by unused code
https://foojay.io/today/trash-pandas-love-enterprise-java-garbage-code/
43:01 How bad are insecure but unused libraries?
45:16 Problem of code only used by unit tests
47:15 Testing in different layers (develop, test, production)
49:31 How much code is not used in production?
50:31 How code becomes unused
https://foojay.io/today/foojay-podcast-57/
54:29 Conclusions
74 פרקים
Manage episode 442378597 series 3366865
Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems. In this podcast, we'll discuss how developers can secure their code. I talked with three authors who posted a security and code quality post on Foojay.io.
Guests
Jonathan Vila
https://www.linkedin.com/in/jonathanvila/
https://about.me/jonathan.vila
https://twitter.com/jonathan_vila
Brian Vermeer
https://www.linkedin.com/in/brianvermeer/
https://brianvermeer.nl/
https://twitter.com/BrianVerm
Erik Costlow
https://www.linkedin.com/in/costlow/
https://twitter.com/costlow
Content
00:00 Introduction of topic and guests
01:35 Brian: Why is Log4Shell still around?
https://foojay.io/today/the-persistent-threat-why-major-vulnerabilities-like-log4shell-and-spring4shell-remain-significant/
03:24 Outdated dependencies are still used a lot
04:31 Who is responsible for dependency updates?
07:55 Snyk tools to help discover issues
10:15 Comparing to Dependabot
11:21 How to keep dependencies up-to-date
14:32 Responsibility to use dependencies with care
17:17 Looking forward to the JFall conference
18:48 About Foojay
19:49 Jonathan: Is SQL injection still a problem?
https://foojay.io/today/top-security-flaws-hiding-in-your-code-right-now-and-how-to-fix-them/
24:50 Deserialization injection
27:30 Logging injection
31:22 Even experienced developers make mistakes
33:17 About Sonar tools
35:53 Other articles by Jonathan
https://foojay.io/today/author/jonathan-vila/
https://foojay.io/today/ensuring-the-right-usage-of-java-21-new-features/
38:20 Other security tools
https://www.youtube.com/watch?v=-wVCYj8oQUY
39:47 Erik: Trash Pandas are attracted by unused code
https://foojay.io/today/trash-pandas-love-enterprise-java-garbage-code/
43:01 How bad are insecure but unused libraries?
45:16 Problem of code only used by unit tests
47:15 Testing in different layers (develop, test, production)
49:31 How much code is not used in production?
50:31 How code becomes unused
https://foojay.io/today/foojay-podcast-57/
54:29 Conclusions
74 פרקים
כל הפרקים
×
1 Celebrating 30 Years of Java with James Gosling (#71) 1:14:29

1 Celebrating 5 Years of Foojay! (#70) 31:10

1 All Things Java at VoxxedDays Amsterdam (#69) 49:13

1 Welcome to OpenJDK (Java) 24 (#68) 54:53

1 Writing a book. Does it make you rich and famous? (#67) 1:15:28

1 Let's Talk About Java Code! Diving into Foojay blog posts... (#66) 54:59

1 Boost Your Career in 2025! (#65) 1:02:44

1 Interviews at JFall about opensource, OpenJDK evolutions, Project Loom, JVM,... (#64) 33:01

1 How do we keep our Java applications up to date and secure (#63) 43:12

1 Better Coding with AI: Friend or Enemy? (#62) 43:46

1 As a developer, how do we keep our body and mind healthy? (#61) 38:04

1 Proud Of Belgium: Devoxx, JobRunr, Timefold, OpenJDK Mobile, OpenJFX, Thymeleaf, htmx (#60) 35:38

1 DevRel Explained and How to Become a Conference Speaker 48:53

1 How Java Developers Can Secure Their Code (#58) 55:06

1 Welcome to OpenJDK (Java) 23 (#57) 1:07:29

1 Vectors in Java Code, Database, and LLMs (#56) 49:48

1 Embedded Java, Part 2 (#55) 1:09:52

1 Music and MIDI with Java and Kotlin (#54) 51:51

1 JCON Report, Part 5 (#53): CQRS, JOOQ, GraphQL, API, Vaadin, OpenRewrite, ErrorProne, Gateways,... 42:48

1 JCON Report, Part 4 (#52): Garbage Collectors, Test Containers, Flaky Tests, ToxiProxy, Virtual Threads 41:47

1 JCON Report, Part 3 (#51) - Persistence, Jakarta EE, GlassFish, Messaging via Telegram 40:52

1 JCON Report, Part 2 (#50) - Maven, Software Security, Code Quality 52:09

1 JCON Report, Part 1 (#49) - JUGs, Communities, Open Source, Generative AI, LangChain4j, Machine Learning 44:45

1 JUG Oberpfalz, JCON Conference, and JAVAPRO Magazine (#48) 38:49

1 Artificial Intelligence and Machine Learning with Java (#47) 44:30

1 JUG World Tour: JUG Switzerland (#46) 37:26


1 JUG World Tour: Quarkus Club (#44) 34:00


1 JUG World Tour: Jozi-JUG and Cape Town Java Community (#42) 52:57

1 The Future of Source Control and CI/CD (#26) 1:14:15

1 Game Development with Java, JavaFX, and FXGL (#25) 56:10

1 JUG World Tour: BeJUG, BruJUG and how Devoxx was born as JavaPolis (#24) 54:38

1 Java Performance and Profiling (#23) 1:15:34

1 When Profession and Fun Overlap (#22) 1:00:32

1 JUG World Tour: Brazil SouJava JUG and How to Grow your Developer Career (#21) 1:08:36

1 Functional Programming, "The Good, the Bad, and the Ugly" (#20) 50:57

1 How working for free for fun brought me fame and fortune — or at least some of each — in the end (#19) 51:49

1 JUG World Tour: Atlanta JUG and DevNexus (#18) 52:58

1 Execute Java code with TornadoVM on CPUs, GPUs, and FPGAs (#17) 54:41



1 Debugging Tools and Skills for Fun and Profit (#14) 57:26

1 JUG World Tour: Denver and Boulder JUG (#13) 43:06

1 State and future of the IDEs (#12) 46:35
ברוכים הבאים אל Player FM!
Player FM סורק את האינטרנט עבור פודקאסטים באיכות גבוהה בשבילכם כדי שתהנו מהם כרגע. זה יישום הפודקאסט הטוב ביותר והוא עובד על אנדרואיד, iPhone ואינטרנט. הירשמו לסנכרון מנויים במכשירים שונים.