Search a title or topic

Over 20 million podcasts, powered by 

Player FM logo
Artwork

Content provided by Stack Overflow and The Stack Overflow Podcast. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Stack Overflow and The Stack Overflow Podcast or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.
Player FM - Podcast App
Go offline with the Player FM app!

What security teams need to understand about developers

22:27
 
Share
 

Manage episode 454773204 series 1123725
Content provided by Stack Overflow and The Stack Overflow Podcast. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Stack Overflow and The Stack Overflow Podcast or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.

NightVision offers web and API security testing tools built to integrate with developers’ established workflows. NightVision identifies issues by precise area(s) of code, so devs don’t have to chase down and validate vulnerability reports, a process that eats up precious engineering resources. Get started with their docs.

Connect with Kinnaird on LinkedIn.

Stack Overflow user Cecil Curry earned a Populist badge with their exceptionally thoughtful answer to In Python how can one tell if a module comes from a C extension?.

Some great excerpts from this episode:

“From the program side, I would say if you're running a security program or you're starting from day one, there's a danger with security people and being the security person who's out of touch or doesn't know what the life of a developer is like. And you don't want to be that person. And that's not how you have actual business impact, right? So you got to embed with teams, threat model, and then do some preventative security testing, right? Testing things before it gets into production, not just relying on having a bug bounty program.”

“With code scanning, you're looking for potentially insecure patterns in the code, but with dynamic testing, you're actually testing the live application. So we're sending HTTP traffic to the application, sending malicious payloads in forms or in query parameters, et cetera, to try to elicit a response or to send something to an attacker controlled server. And so using this, we're able to. Not just have theoretical vulnerabilities, but exploitable vulnerabilities. I mean, how many times have you looked at something in GitHub security alerts and thought, yeah, that's not real. That's not exploitable. Right. So we're trying to avoid that and have higher quality touch points with developers. So when they look at something, they say, okay, that's exploitable. You showed me how. And you traced it back to code.”

  continue reading

835 episodes

Artwork
iconShare
 
Manage episode 454773204 series 1123725
Content provided by Stack Overflow and The Stack Overflow Podcast. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Stack Overflow and The Stack Overflow Podcast or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.

NightVision offers web and API security testing tools built to integrate with developers’ established workflows. NightVision identifies issues by precise area(s) of code, so devs don’t have to chase down and validate vulnerability reports, a process that eats up precious engineering resources. Get started with their docs.

Connect with Kinnaird on LinkedIn.

Stack Overflow user Cecil Curry earned a Populist badge with their exceptionally thoughtful answer to In Python how can one tell if a module comes from a C extension?.

Some great excerpts from this episode:

“From the program side, I would say if you're running a security program or you're starting from day one, there's a danger with security people and being the security person who's out of touch or doesn't know what the life of a developer is like. And you don't want to be that person. And that's not how you have actual business impact, right? So you got to embed with teams, threat model, and then do some preventative security testing, right? Testing things before it gets into production, not just relying on having a bug bounty program.”

“With code scanning, you're looking for potentially insecure patterns in the code, but with dynamic testing, you're actually testing the live application. So we're sending HTTP traffic to the application, sending malicious payloads in forms or in query parameters, et cetera, to try to elicit a response or to send something to an attacker controlled server. And so using this, we're able to. Not just have theoretical vulnerabilities, but exploitable vulnerabilities. I mean, how many times have you looked at something in GitHub security alerts and thought, yeah, that's not real. That's not exploitable. Right. So we're trying to avoid that and have higher quality touch points with developers. So when they look at something, they say, okay, that's exploitable. You showed me how. And you traced it back to code.”

  continue reading

835 episodes

All episodes

×
 
The Trust and Safety team is using aliases in this episode. Learn more about who the Community Management team is at Stack Overflow. Explore how we keep our community safe in our Code of Conduct . Congratulations to Lifeboat badge recipient Arvin Yorro , who won it for their helpful answer to the question Docker Desktop - WSL update failed .…
 
Dane shares his excitement about the Model Context Protocol (MCP), exploring its potential impact on the future of technology. The discussion turns to the growing need for sustainable content monetization and fair compensation for creators in an AI-driven world, and how this connects to Cloudflare’s mission to build a better internet. The conversation also: Explores how Cloudflare leverages AI internally to enhance developer productivity and improve code quality while keeping developers as owners of their work. Covers Cloudflare’s innovative organizational structure and their journey toward becoming an AI-first company. Episode notes: Connect with Dane on LinkedIn or X , and learn more about Cloudflare . Read more about Knowledge Solutions , a data licensing offering that provides continuous access to Stack Overflow’s public dataset. Learn more about creating a private instance of Stack Overflow for your team or org with Stack Overflow for Teams.…
 
Gemini 2.5 is DeepMind’s most advanced model yet, with strong reasoning and coding capabilities. Connect with Tulsee on LinkedIn . Connect with Logan on LinkedIn and Stack Overflow . Check out our previous episode with Logan, we discussed his unique path from coding to AI to product, the challenges of non-determinism in AI models, and surprising lessons from working at the Apple Store. Congrats to Populous badge winner Pascal MARTIN for answering the question PHP echo vs PHP short echo tags .…
 
Explore how Capital One is using tech to innovate the banking experience here . Connect with Kathleen on LinkedIn and visit her blog . Shoutout to user Theraot for answering the questions How to connect a signal with extra arguments in Godot 4 , which won them a Lifeboat badge .
 
Antithesis is an autonomous testing platform that finds bugs in your software with perfect reproducibility. Connect with Will Wilson on Linkedin . Congrats to user hannes neukermans whose question How can I do tag wrapping in Visual Studio Code? won them a Stellar Question badge . Our 2025 Developer Survey is live ! We want to know what your developer life is like!…
 
The discussion also: Touches on the role, evolution, and adoption of AI agents, emphasizing their growing integration into systems, while addressing key safeguarding measures to ensure AI agents can accurately use data to reason effectively. Explores how Abnormal AI utilizes AI to detect and protect against cybersecurity threats, and how Dan and his team are leveraging AI to drive compounding productivity within their organization. Connect with Dan Shiebler on LinkedIn and learn more about Abnormal AI .…
 
DBOS Transact is a lightweight, open-source library that makes durable execution simple so you no longer need to worry about manually coding retries and recovery procedures. Connect with Jeremy on LinkedIn . Connect with Qian on LinkedIn . Shoutout to Stack Overflow user Vanita L. , whose answer to What does the Swift 'mutating' keyword mean? earned them a Lifeboat badge .…
 
The new Salesforce Developer Edition includes access to Data Cloud and Agentforce , Salesforce’s platform for building, customizing, and deploying autonomous AI agents. Developers can sign up here to start building. Connect with Christophe on LinkedIn . Instead of a badge, we have a question for you: If you are a developer who is working with AI agents, what are you building? What tools are you looking for? What problems are you interested in solving with AI tools? Send us an email at podcast@stackoverflow.com.…
 
Loading …

Welcome to Player FM!

Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.

 

Copyright 2025 | Privacy Policy | Terms of Service | | Copyright
Listen to this show while you explore
Play