The Lazy Programmer's Guide to Secure Computing

Google Tech Talk
March 11, 2010

ABSTRACT

Presented by Marc Stiegler.

This presentation starts with a simple block of code written by the Lazy Programmer, to observe how laziness made the code more compact and simpler. We then define the Principle of Least Authority(POLA), and explain why it is a best practice for secure programming. We show how laziness in that first example enabled enforcement of POLA. We then put the Lazy Programmer through a series of increasingly more difficult tasks as management attempts to make the Lazy Programmer work hard. To achieve maximum laziness, the Lazy Programmer is driven toward increasingly more modular, encapsulating OO designs that happen to implement POLA; ultimately compelled to build systems with defense in depth to avoid work. A secret truth is thus revealed: lazy OO programmers have been using secure techniques for decades, if only they had known. We then describe the tools that turn laziness into correctly enforced security for JavaScript, Java, and distributed computing.

Marc Stiegler is a researcher at Hewlett-Packard Labs who has written "Introduction to Capability Based Security," and designed CapDesk and Polaris, a windows overlay that isolates applications from one another to allow virus safe computing.

• Category

  Science & Technology

[naughttube]

He is a funny guy :) This video makes me want to perfect my laziness :)=

[jp3d2k]

"efficiency" is simply a euphemism douchebags use for their laziness ;-P

[Florin Jurcovici]

IMO, laziness is a quality every good programmer must have.

[Lava Kafle]

wowowow great security laziness

[gedq]

he may look sweet but you just know he's got a robot powered island full of minions somewhere just waiting to make his move. His lazy move.

[石村 耕平]

i think His talk is easy to understand and useful.

Thanks for posting this informative video!

[opaqueproductions235]

and what do you do for work...  you merit-less prawn.. It really is the freaks and mutants that save and create this shared world.. hope you enjoy your life in the customer service field loser..

[Alpha Male]

I am being serious! Excellent content and quality video...

[gbsons]

That guy your calling nerd probably has a mansion three times the size of your house.

[James Donnelley]

Mark has considerable experience with Windows, but as you say not working on what is typically considered Windows 'security'. That is not working on internal features of Windows to do permissions checking, authentication, etc. Instead he has focused most on changing the game of Windows security by working on the HP Polaris project that provided a POLA environment for execution of programs running under the Windows API,

[strcmt]

awesome programming explanation!!!