Pragmatic Product Security
Joined July 2015
- Tweets983
- Following434
- Followers443
- Likes195
My talk at #CYBSEC16 on abusing users of WhatsApp, Telegram and Signal with a Man In The Contacts attack: securingapps.com/blog/ManInT…
Making security by design lovable for humans to keep AI agents on track
appsecmatters.com/threat_mod…
This is the way:
"Observing such direct payoff from previous hardening work was even more rewarding than finding and fixing more bugs"
hacks.mozilla.org/2026/05/be…
Let's try something else with bug bounty programs before deciding to suspend them
appsecmatters.com/bug_bounty…
A paradigm change cannot be addressed by minor iterations, even with many of those:
"The traditional response is to add more scanning, more automation, more patching"
"You can't close that gap by reacting faster to something that's already too fast"
chainguard.dev/unchained/shi…
Jérémy Matos retweeted
One of the biggest impacts of AI that goes kind of unnoticed is that we’re about to see an explosion of poorly built applications.
Specifically, applications built completely by AI with no thought of security whatsoever.
🧵
Jérémy Matos retweeted
My big takeaways from this discussion:
1. It’s largely that many applicants don’t have the skills to do the work
2. Few companies are looking to train anyone
3. Recruiting/HR is a big part of the problem because they are a non-expert and inefficient middleman to the process
4. Another big part of the problem is the entire process around hiring, interviews and how little time hiring managers have to do it right— assuming that even know what that is
So to simplify and exaggerate it—most applicants are under-skilled, and the entire ecosystem around hiring is wasteful and broken.
While brainstorming on how to best combine in my daily work genuine security/confidentiality with meaningful business impact, becandid.tech was born.
More than excited by this mission to foster mutual and honest feedback, starting with the salary expectations use case.
Jérémy Matos retweeted
Given Microsoft has pretty large security teams, and a newfound focus on security:
How did Recall pass security review - if it even did? Details coming out make it seem like while building this cool-sounding AI feature, there was no emphasis on common-sense security and privacy.
This Post is from an account that no longer exists. Learn more
22 years have passed and making "security a top priority in practice" is still an unsolved problem:
microsoft.com/en-us/security… vs wired.com/2002/01/bill-gates…
Jérémy Matos retweeted
Imagine a bank got robbed and now they are blaming the cleaning lady who allegedly forgot to close a window.
This is effectively IT security's reaction to ransomware incidents after somebody clicked on a link.
Also: We had a blast at #SCS23 yesterday! The Human Factor is key.
Jérémy Matos retweeted
Black Alps 2023 is next week! We can't wait to gather the community and have a great time again!
If you don't already have your conference ticket, jump on board and get it!
blackalps.ch/ba-23/
Jérémy Matos retweeted
Interesting. Looks like a rebellion has started.
🎉 Exciting news! Zed Attack Proxy (ZAP) is now a founding member of the @swsecproject (SSP)! Join us in supporting open source security projects at softwaresecurityproject.org. #Cybersecurity #SSP #ZAPROXY
Jérémy Matos retweeted
Are you looking forward to @gopherconuk?
We certainly are and so is @securingapps, one of our speakers for this year's event.
They'll be giving a talk on 'Go security pitfalls: 2 lessons from the battlefield at Grafana Labs'.
Grab your tickets here - buff.ly/2wWLe6K
ALT Are you looking forward to GopherCon UK 2023? We certainly are and so is Jeremy Matos, one of our speakers for this year's event. They'll be giving a talk on 'Go security pitfalls: 2 lessons from the battlefield at Grafana Labs'. Grab your tickets via our website.
Jérémy Matos retweeted
Hey folks!
We are happy to announce that #GreHack23 will take place on November 17th and 18th, in Grenoble.
Stay tuned, more information coming soon!
Jérémy Matos retweeted
The Grafana Labs Bug Bounty Program is intended to encourage ethical hackers to help find and responsibly report security vulnerabilities in our software. grafana.com/blog/2023/05/04/…
Here are the slides of my talk at Insomni'Hack
"Go security pitfalls: 2 lessons from the battlefield At Grafana Labs" @1ns0mn1h4ck #INS23
securingapps.com/blog/Go_sec…
Jérémy Matos retweeted
The @1ns0mn1h4ck talk "Go Security Pitfalls" from @securingapps is now available and it is really good. Highly recommended if you are dealing with Golang code. youtube.com/watch?v=NoFRUywa…
Jérémy Matos retweeted
#SaveTheDate #BSidesZH IS BACK!🥳
Coming on 9th Sept, with our usual particular format: bsideszh.ch/call-for-papers/… hosted again by @OntinueMXDR
We are also opening our #CfP, check deadlines👇 1/2
#PleaseRT #DFIR #InfoSec #ThreatIntel #ThreatHunting
@SecurityBSides
Here are the slides of my talk at Insomni'Hack
"Go security pitfalls: 2 lessons from the battlefield At Grafana Labs" @1ns0mn1h4ck #INS23
securingapps.com/blog/Go_sec…