How Java Developers Can Secure Their Code (#58)

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems. In this podcast, we'll discuss how developers can secure their code. I talked with three authors who posted a security and code quality post on Foojay.io.

Guests

Jonathan Vila
linkedin.com/in/jonathanvila
about.me/jonathan.vila
twitter.com/jonathan_vila

Brian Vermeer
linkedin.com/in/brianvermeer
brianvermeer.nl
twitter.com/BrianVerm

Erik Costlow
linkedin.com/in/costlow
twitter.com/costlow

Content

00:00 Introduction of topic and guests

01:35 Brian: Why is Log4Shell still around?
foojay.io/today/the-persistent-threat-why-majo…
03:24 Outdated dependencies are still used a lot
04:31 Who is responsible for dependency updates?
07:55 Snyk tools to help discover issues
10:15 Comparing to Dependabot
11:21 How to keep dependencies up-to-date
14:32 Responsibility to use dependencies with care
17:17 Looking forward to the JFall conference
18:48 About Foojay

19:49 Jonathan: Is SQL injection still a problem?
foojay.io/today/top-security-flaws-hiding-in-y…
24:50 Deserialization injection
27:30 Logging injection
31:22 Even experienced developers make mistakes
33:17 About Sonar tools
35:53 Other articles by Jonathan
foojay.io/today/author/jonathan-vila
foojay.io/today/ensuring-the-right-usage-of-ja…
38:20 Other security tools
youtube.com/watch?v=-wVCYj8oQUY

39:47 Erik: Trash Pandas are attracted by unused code
foojay.io/today/trash-pandas-love-enterprise-j…
43:01 How bad are insecure but unused libraries?
45:16 Problem of code only used by unit tests
47:15 Testing in different layers (develop, test, production)
49:31 How much code is not used in production?
50:31 How code becomes unused
foojay.io/today/foojay-podcast-57

54:29 Conclusions