Jérémy Matos

Pragmatic Product Security

[Jérémy Matos @SecuringApps]

My talk at #CYBSEC16 on abusing users of WhatsApp, Telegram and Signal with a Man In The Contacts attack: https://t.co/VcLEsK9LRk

[Jérémy Matos @SecuringApps]

This is the way:
"Observing such direct payoff from previous hardening work was even more rewarding than finding and fixing more bugs"
https://t.co/YgLsQDeeYe

[Jérémy Matos @SecuringApps]

Let's try something else with bug bounty programs before deciding to suspend them
https://t.co/2caBKtkGat

[Jérémy Matos @SecuringApps]

A paradigm change cannot be addressed by minor iterations, even with many of those:

"The traditional response is to add more scanning, more automation, more patching"

"You can't close that gap by reacting faster to something that's already too fast"

https://t.co/dViPb5OqXP

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

One of the biggest impacts of AI that goes kind of unnoticed is that we’re about to see an explosion of poorly built applications.

Specifically, applications built completely by AI with no thought of security whatsoever.

🧵

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

My big takeaways from this discussion:

1. It’s largely that many applicants don’t have the skills to do the work

2. Few companies are looking to train anyone

3. Recruiting/HR is a big part of the problem because they are a non-expert and inefficient middleman to the process

4. Another big part of the problem is the entire process around hiring, interviews and how little time hiring managers have to do it right— assuming that even know what that is

So to simplify and exaggerate it—most applicants are under-skilled, and the entire ecosystem around hiring is wasteful and broken.

[Jérémy Matos @SecuringApps]

While brainstorming on how to best combine in my daily work genuine security/confidentiality with meaningful business impact, https://t.co/SPZu7654Ui was born.
More than excited by this mission to foster mutual and honest feedback, starting with the salary expectations use case.

[Gergely Orosz @GergelyOrosz]

Given Microsoft has pretty large security teams, and a newfound focus on security:

How did Recall pass security review - if it even did? Details coming out make it seem like while building this cool-sounding AI feature, there was no emphasis on common-sense security and privacy.

[Jérémy Matos @SecuringApps]

22 years have passed and making "security a top priority in practice" is still an unsolved problem:
https://t.co/O23Xey3gIR vs https://t.co/uy2J5jNCm6

[Christian Folini @ChrFolini]

Imagine a bank got robbed and now they are blaming the cleaning lady who allegedly forgot to close a window.

This is effectively IT security's reaction to ransomware incidents after somebody clicked on a link.

Also: We had a blast at #SCS23 yesterday! The Human Factor is key.

[BlackAlps @BlackAlpsConf]

Black Alps 2023 is next week! We can't wait to gather the community and have a great time again!
If you don't already have your conference ticket, jump on board and get it!
https://t.co/fi5PtBrWqd

[starbuck3000 @starbuck3000]

Interesting. Looks like a rebellion has started.

[GopherCon UK @gopherconuk]

Are you looking forward to @gopherconuk?

We certainly are and so is @securingapps, one of our speakers for this year's event.

They'll be giving a talk on 'Go security pitfalls: 2 lessons from the battlefield at Grafana Labs'.

Grab your tickets here - https://t.co/mEnqbNqu9i

[GreHack @GrehackConf]

Hey folks!
We are happy to announce that #GreHack23 will take place on November 17th and 18th, in Grenoble.
Stay tuned, more information coming soon!

[Grafana @grafana]

The Grafana Labs Bug Bounty Program is intended to encourage ethical hackers to help find and responsibly report security vulnerabilities in our software. https://t.co/iSSvVC3eKj

[Jérémy Matos @SecuringApps]

@h0ng10 @1ns0mn1h4ck https://t.co/HhK7Cum8yy

[Jérémy Matos @SecuringApps]

Here are the slides of my talk at Insomni'Hack
"Go security pitfalls: 2 lessons from the battlefield At Grafana Labs" @1ns0mn1h4ck #INS23
https://t.co/ZguPOJxYqN

[Hans-Martin Münch @h0ng10]

The @1ns0mn1h4ck talk "Go Security Pitfalls" from @securingapps is now available and it is really good. Highly recommended if you are dealing with Golang code. https://t.co/uwtEl7QzrP

[BSides Zurich @BSidesZurich]

#SaveTheDate #BSidesZH IS BACK!🥳
Coming on 9th Sept, with our usual particular format: https://t.co/JxL2kCZcKh hosted again by @OntinueMXDR

We are also opening our #CfP, check deadlines👇 1/2
#PleaseRT #DFIR #InfoSec #ThreatIntel #ThreatHunting
@SecurityBSides

[Jérémy Matos @SecuringApps]

@rationalpsyche Thank you !
The corresponding slides: https://t.co/3KogSP0XR4

[Jérémy Matos @SecuringApps]

Here are the slides of my talk at Insomni'Hack
"Go security pitfalls: 2 lessons from the battlefield At Grafana Labs" @1ns0mn1h4ck #INS23
https://t.co/ZguPOJxYqN

[Christian Folini @ChrFolini]

I've published the slides of my Insomni'Hack / @1ns0mn1h4ck keynote about INCENTIVES in IT security.

https://t.co/8rA4YAcho6

This is a 🧵 with the key points of my talk. 1/17

#INS23