July 2022 Summaries

Disability Pride Month is celebrated every July to commemorate the passing of the Americans with Disabilities Act (ADA) on July 26, 1990, aiming to amplify the experiences of the Disabled community through education, action, and support. Ashley Ladd sat down with Alex Fallon, a disabled person, to discuss what Disability Pride means to them, how able-bodied people can be better allies and advocates for the Disabled community, inspirational figures, helpful resources, and more. Alex emphasizes the importance of Disability Justice and its motto "nothing about us, without us" highlighting that disabled individuals know best what they need and should make decisions impacting their lives. Key misconceptions about disabilities include assuming laziness or childlike behavior in those with disabilities, being able to easily identify someone's disability, and not providing accommodations. Alex suggests resources such as books, podcasts, TV shows, movies, and documentaries created by or featuring disabled individuals for learning more about the disability community. Allies can generate impact by joining disability groups, supporting organizations like The Arc, diversifying media consumption, and being aware of how disabilities are presented in media.

The Cloud Security Podcast has grown from humble beginnings into a leading source for cloud security knowledge and a top 100 technology podcast globally, with over 200 insightful episodes featuring cloud security experts and advocates from around the world. The podcast is now powered by Snyk, allowing it to focus on creating more valuable content and bringing cloud security expertise together through meetups and other initiatives. This partnership aligns with Snyk's community-first and vendor-neutral approach, and will enable the Cloud Security Podcast to scale up its efforts without compromising on its core mission of making cloud security knowledge accessible to all. The new partnership is seen as a win-win for both parties, with the podcast benefiting from increased resources and the audience gaining access to more valuable content and expert insights.

The Linux Foundation recently partnered with Snyk to produce a report on the state of security in open source software (OSS). The report, based on 550+ survey responses and 15 interviews, highlights the growing complexity of software supply chains and the need for better OSS security. Experts discuss the importance of creating Software Bill of Materials (SBOMs) and implementing OSS security policies to manage risk and improve transparency. The report also reveals that 49% of organizations have no security policy addressing open source security, and that time to fix vulnerabilities has increased from 49 days in 2018 to 110 days in 2021. Snyk's Director of Developer Relations notes that tools like static application security testing (SAST) and software composition analysis (SCA) can help automate the detection and remediation of open source vulnerabilities, but resourcing challenges remain a major issue.

Container security is vital as vulnerabilities can impact production environments. To create secure container images, developers should follow these five best practices: 1) Secure code and dependencies using integrated scanning tools; 2) Start with a minimal base image from a trusted source like Docker Hub; 3) Manage all layers between the base image and your code by prioritizing necessary tools and removing extras; 4) Use access management to limit user operations over container resources, following the principle of least privilege; and 5) Secure container infrastructure, including registries and orchestration platforms like Kubernetes.

The article provides 10 React security best practices to help developers secure their applications against common vulnerabilities such as cross-site scripting (XSS), URL-based script injection, and JSON injection attacks. It emphasizes the importance of using default XSS protection with data binding, sanitizing HTML, avoiding direct DOM access, and securing server-side rendering. The article also highlights the need to check for known vulnerabilities in dependencies, avoid using vulnerable versions of React, and use linter configurations to detect security issues in code. Additionally, it provides tools such as Snyk and dompurify to help developers identify and fix security issues in their applications.

At Pinterest, integrating security tools into the developer workflow is crucial for protecting against open-source vulnerabilities in their code repositories. They prioritize visibility, scanning, and triaging of vulnerabilities to ensure prompt fixes are applied without overwhelming developers. To achieve this, they use Snyk's developer-friendly features, language-specific repos, and a centralized system for getting visibility across all open source libraries in use. The team automates scans throughout the pipeline, making it transparent to developers and reducing manual efforts into self-service. By providing educational resources and triaging efficiently, Pinterest ensures that developers can stay within their workflows while knowing everything they need to know about vulnerabilities, ultimately achieving a developer-friendly workflow with an emphasis on security.

The field of computer science is often overlooked in higher education, with many programs lacking a dedicated course on computer security. This omission creates a significant problem, as the cybersecurity workforce gap continues to grow, and companies need qualified professionals to defend against cyber attacks. The lack of computer security courses in programs across Canada and the United States means that students may not be adequately prepared for the industry, despite graduating with broad knowledge across many areas. While some universities offer security courses, they are often elective or required only in a limited number of programs, leaving many graduates unprepared for the workforce. To address this issue, organizations like Snyk Learn are providing free and high-quality developer education on computer security, offering lessons that cover vulnerabilities and mitigation techniques to help developers learn more about secure coding practices.

Webhooks offer a simple and effective way to transfer information about occasional events between systems, but they also introduce security risks due to their public nature. To secure webhooks, it's essential to implement multiple security measures, such as encryption, two-way authentication, signing messages with hash-based message authentication codes (HMAC), authenticating connections, adding timestamps to prevent replay attacks, using certificate pinning, and logging all webhook messages sent out. Additionally, webhooks should not be used for sensitive data, and implementing a subscription model with expiration dates can further enhance security by limiting the time privileges are provided. By combining these measures, developers can establish a comprehensive security approach that protects their code and client data from various vulnerabilities.

To build a secure WebSocket server in Python, you need to implement several features such as CORS, authentication, and rate limiting. The python-socketio library provides many built-in features for implementing these measures, including automatic HTTP compression, cross-origin resource sharing (CORS), user authentication, and payload size restriction. To enable CORS, you can set the cors_allowed_origins parameter when initializing the WebSocket server instance. This allows or blocks domains from making cross-origin requests. Additionally, you should authenticate WebSocket clients before connecting using a username and password system. The server verifies the credentials and checks if they exist in a database before authenticating the user. To prevent denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, you can enforce rate limiting on your server by limiting the frequency of API requests each user can make. You should also restrict payload size to protect your WebSocket server from crashes caused by oversized messages. Finally, use TLS/SSL encryption to secure socket communication and ensure that sensitive information is not stolen via man-in-the-middle attacks.