August 2021 Summaries

The summer meetup held on August 11 featured a comprehensive overview of the latest enhancements to Semgrep, including updated syntax for crafting more precise rules and recent improvements in taint analysis. Attendees were also informed about the future roadmap for Semgrep, and the session concluded with an open discussion and Q&A segment. For those who could not attend, a recording of the event is available.

At BSides Las Vegas, r2c security researchers Colleen Dai and Grayson Hardaway explored the effectiveness of secure guardrails in reducing XSS vulnerabilities by 50%. They demonstrated, using real code examples, that implementing secure defaults can significantly enhance a company's security posture. Their study included an analysis of XSS occurrences across 125 GitHub repositories using languages such as Java, Ruby, Python, JavaScript, and Golang, and they discussed potential mitigation strategies. Additionally, they introduced a free set of rules that developers can apply to their own codebases to prevent future XSS issues.

Erin Browning and Tim Faraci from Slack deliver a presentation at DEF CON 29 AppSec Village, focusing on optimizing developer satisfaction through rapid scan results and encouraging a mindset that extends beyond mere compliance. They address the challenges of handling false positives and emphasize the importance of incorporating scanning into both developer and security workflows. Additionally, they discuss the need for careful calibration of metrics and performance targets to ensure effectiveness and efficiency in security processes.