Curl and libcurl are everywhere. Not only has the project maintained success for almost three decades now, but it's done that while being written in C. Daniel Stenberg talks about the challenges in dealing with appsec, the design philosophies that keep it secure, and fostering a community to create one of the most recognizable open source projects in the world.

Segment Resources:

• https://daniel.haxx.se/blog/2025/01/23/cvss-is-dead-to-us/
• https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/
• https://thenewstack.io/curls-daniel-stenberg-on-securing-180000-lines-of-c-code/

Show Notes: https://securityweekly.com/asw-320

This week, in the enterprise security news,

1. we’ve got some funding and acquisitions!
2. ransomware payments are DOWN 35%
3. infostealers on Macs are UP 101%
4. Bybit got hit by a $1.5B heist and shrugged it off
5. A SaaS report says AI is having no impact on pricing
6. Microsoft’s CEO says AI is generating no value
7. Google is dropping SMS as a second factor
8. Google creates a 4th state of matter instead of fixing Teams
9. What it’s like to be named “Null”

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-396

We get a visit from Tanya Janca to discuss her latest book, Alice and Bob Learn Secure Coding!

Segment Resources:

• Tanya's latest book on Amazon
• Tanya's previous book, Alice and Bob Learn Application Security on Amazon
• Tanya's website, She Hacks Purple

Show Notes: https://securityweekly.com/esw-396

In 2011, Marc Andreessen predicted that software would eat the world. Specifically, the prediction was that software companies would take over the economy and disrupt all industries. The economic prediction has mostly come true, with 9 out of 10 of the most highly valued companies being tech companies. The industry disruption didn't materialize in some cases, and outright failed in others.

Healthcare seems to be one of these 'disruption-resistant' areas. Ed joins us today to discuss why that might be, and what the paths towards securing the healthcare industry might look like.

Segment Resources: Ed's podcast, Risk Never Sleeps

Show Notes: https://securityweekly.com/esw-396

Mr. Kurtzmann, Boffins gone Wild, Grasscall, Vo1d, Windows CE, Shadowpad, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-455

Apple, the UK, and data protection, you can get pwned really fast, Australia says no Kaspersky for you!, the default password is on the Internet, topological qubits, dangerous AI tools, old software is not just old but vulnerable too, tearing down Sonic Walls, CWE is good but could be great, updating your pi-hole, should you watch "Zero Day"? my non-spoiler review will tell you, no more DBX hellow SBAT!, and I love it when chat logs of secret not-so-secret ransomware groups are leaked!

Show Notes: https://securityweekly.com/psw-863

This week: CISOs struggling to balance security, business objectives, Signs Your Organization’s Culture is Hurting Your Cybersecurity, Servant Leadership: Putting Trust at the Center, and more!

Show Notes: https://securityweekly.com/bsw-384

Cronenbergs, Dangling Twitchbots, Crypto, Kaspersky, SMS, OT, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-454

Applying forgivable vs. unforgivable criteria to reDoS vulns, what backdoors in LLMs mean for trust in building software, considering some secure AI architectures to minimize prompt injection impact, developer reactions to Rust, and more!

Show Notes: https://securityweekly.com/asw-319

Minimizing latency, increasing performance, and reducing compile times are just a part of what makes a development environment better. Throw in useful tests and some useful security tools and you have an even better environment. Dan Moore talks about what motivates some developers to prefer a "local first" approach as we walk through what all of this means for security.

Show Notes: https://securityweekly.com/asw-319