Foojay Podcast #58: How Java Developers Can Secure Their Code
September 30, 2024Author(s)
Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.
In this podcast, we'll discuss how developers can secure their code.
I talked with three authors who posted a security and code quality post on Foojay.io.
Video
Podcast (audio only)
Guests
Jonathan Vila
- https://www.linkedin.com/in/jonathanvila/
- https://about.me/jonathan.vila
- https://twitter.com/jonathan_vila
Brian Vermeer
Erik Costlow
Content
00:00 Introduction of topic and guests
01:35 Brian: Why is Log4Shell still around?
https://foojay.io/today/the-persistent-threat-why-major-vulnerabilities-like-log4shell-and-spring4shell-remain-significant/
03:24 Outdated dependencies are still used a lot
04:31 Who is responsible for dependency updates?
07:55 Snyk tools to help discover issues
10:15 Comparing to Dependabot
11:21 How to keep dependencies up-to-date
14:32 Responsibility to use dependencies with care
17:17 Looking forward to the JFall conference
18:48 About Foojay
19:49 Jonathan: Is SQL injection still a problem?
https://foojay.io/today/top-security-flaws-hiding-in-your-code-right-now-and-how-to-fix-them/
24:50 Deserialization injection
27:30 Logging injection
31:22 Even experienced developers make mistakes
33:17 About Sonar tools
35:53 Other articles by Jonathan
https://foojay.io/today/author/jonathan-vila/
https://foojay.io/today/ensuring-the-right-usage-of-java-21-new-features/
38:20 Other security tools
https://www.youtube.com/watch?v=-wVCYj8oQUY
39:47 Erik: Trash Pandas are attracted by unused code
https://foojay.io/today/trash-pandas-love-enterprise-java-garbage-code/
43:01 How bad are insecure but unused libraries?
45:16 Problem of code only used by unit tests
47:15 Testing in different layers (develop, test, production)
49:31 How much code is not used in production?
50:31 How code becomes unused
https://foojay.io/today/foojay-podcast-57/
54:29 Conclusions
-
The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant
This article was originally published at Snyk.io As developers, we’re constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects. Despite the high-profile …
Read More
-
Top Security Flaws Hiding In Your Code Right Now: And How To Fix Them
Let’s examine the three most common injection attack types—SQL injection, Deserialization Injection, and Logging Injection—and discuss ways to prevent them.
Read More -
Trash Pandas Love Enterprise Java Garbage Code
If raccoons were software engineers, they would feel at home inside many enterprise systems. These systems are often full of unused and dead code.
Read More
