John Benninghoff

Security Geek and Safety Fanboy

[John Benninghoff @jbenninghoff]

@DrGeekthumb True.

[John Benninghoff @jbenninghoff]

@norootcause I take it as (another) sign I need to learn more about formal specifications

[John Benninghoff @jbenninghoff]

@norootcause Well that makes much more sense

[John Benninghoff @jbenninghoff]

@dseverski CRAN has renv version 0.14.0… thanks for pointing out the new features!

[John Benninghoff @jbenninghoff]

@dseverski All the same, renv is going to be that much more useful with the release of R 4.1.0… native pipes?!👍

[John Benninghoff @jbenninghoff]

@dseverski Um, not to be pedantic, but did you mean {{renv}}?

[John Benninghoff @jbenninghoff]

@hillelogram Technical fixes do help, but like aviation safety, we’ve probably reached the point where human factors are needed for additional improvements in reducing bugs.

[John Benninghoff @jbenninghoff]

@hillelogram GitHub's State of the Octoverse 2020 report includes analysis of PRs. Maybe we can convince @nicolefv and her team to look at this specific question in 2021. https://t.co/8PsWpykyTb

[John Benninghoff @jbenninghoff]

@fsmontenegro @hacks4pancakes A curiosity for how things work and at least a basic understanding of how they do work is a fundamental attribute of any good engineer. An accurate mental model is what makes them good.

[John Benninghoff @jbenninghoff]

@hillelogram I agree, and would offer STPA as an additional method that has been used with software, and also considers social factors

[John Benninghoff @jbenninghoff]

@hillelogram Arguably one of the reasons why DevOps is so successful is because of all the social and technical systems in place to support writing better code. Not just magically better coders.

[John Benninghoff @jbenninghoff]

“security is fundamentally about human behavior” https://t.co/xQyC8DcWIQ #InsideDesign via @InVisionApp

[John Benninghoff @jbenninghoff]

@lhochstein @AdamJohns88 Google to the rescue! It seems my alma mater has developed a curriculum for teaching systems thinking! (although focused on geoscience). Carleton historically had a strong Geo department. https://t.co/muy6dPvxly

[John Benninghoff @jbenninghoff]

@lhochstein @AdamJohns88 I suppose it’s more about how to teach systems thinking, not easy to answer

[John Benninghoff @jbenninghoff]

@lhochstein @AdamJohns88 Teach systems thinking?

[John Benninghoff @jbenninghoff]

I have more new posts in draft, and recently did a "Papers We Love" session on From Safety-I to Safety-II: a white paper. It wasn't recorded, but got positive feedback - if there's enough interest, I'd do it again!

[John Benninghoff @jbenninghoff]

Another Secure360 conference wrapped up yesterday! (virtual, of course) I've posted handouts (notes, slides) & references to https://t.co/4yhH9ErKRM, and recently updated the "resources" page with books, academic papers, and other curated lists

[John Benninghoff @jbenninghoff]

To clarify, that's 50% of repos scanned by SAST.

[John Benninghoff @jbenninghoff]

@johnbdickson enjoyed your talk at #SEC360, thanks for fielding my questions. I'm happy to share that in our organization, over 50% of our repos are configured to break builds on "high" SAST findings by our development teams.