As soon as you rely on someones else's code you most likely get vulnerabilities. The only way around that is to write everything yourself in Assembler, then you will have only your own vulnerabilities.
The best security videos are scary - nice work on this one! For those folks dealing with mobile apps, whether built with JavaScript or not, there are a bunch of other security considerations to keep an eye on. The point is that you're never truly safe. As long as you have something valuable that could be hacked, someone out there will keep trying. You have to dedicate the time and resource to always stay on top of your security, it's not a set-it-and-forget-it thing.
as a security researchet i can validate that we need a ton of awareness to impart to our devs. I've seen some of the scariest vulnerable code making it to production.
The actual way to protect from ddos attacks is by blocking requests from ips that constantly send a bunch of requests, and then ask them to do a human verificiation. Scaling gets reeeeeeealy costly.
@@arnoldas9730 Blocking an IP is a server-side operation, and can be reverted immediately. What I am talking about is this: - Attacker sends a lot of requests - Server notices, and sends a verification - Verification is not received, any more packets from that ip are blocked - Another IP, this one not an attacker, sends a lot of requests - Server notices, and sends a verification - The new IP responds with verification - Server allows higher than normal requests temporarily - If this IP continually sends a large amount of packets, it may be throttled.
I can spend hours watching your videos, they are so informative, i love the fact that they are short and swift, it's the best way to keep up with the ever so growing tech trends
Yeah, he definitely didn't quite go into it. But I guess the main point there was that scaling can be the needed solution if your service just cannot go down. You can set an upper bound on how high your services will scale. And of course, you should do other things as well and not just rely on scaling.
One subject of my course had some vulnerability topics. Searched youtube , found your video. Its helpful. Thanks. This didn't covered all topics but did the main ones.
This is amazing. Thank you for putting this together. Vulnerabilities are endemic to orgs that rush production. My heart always hurts when I hear folks complaining about IAM roles and policies (regardless of hyper scaler). They’re just so darn important to good cloud hygiene.
Kevin Mitnick wrote in his book "Security is an illusion, you will put alarm on a door and feel safe, but what if burglar use window?". Modern frameworks are mostly safe against old methods od exploit unless you overengineer something, but they are not perfect, along the way they made anorher vulnerabilities which we will be talking about in the future
I think the most secure why is to source your own Silicon, make your own CPU, create your own OS and write your own programs on it. +1 for Security if the language is unknown and you are the only person alive knowing about it :D
Hey Jeff, This was a real delight to watch! I hope you do more videos like this which are related to general IT, every once in a while. I really love your editing style, Its quick but never misses out on important information!
For those of you interested I would suggest a book: 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them It really changed how I code my programs and software be it client side or server side.
@@Fireship Thanks , you are the only YTr that inspires me to think of becoming a creator. This video is particularly well done, its like nerdwriter for code. I think it's inspiring me to think of how to help open source with security services. So essentially free doesn't mean safe
@@Fireship Yeah tell me about it, i'm on that road right now. New Subscriber. I imagine that 10 years ago it was a lot more difficult. I have the added difficulty of being born in Venezuela though :P
The principle of least privilege is implemented in Microsoft Windows' UAC (User Account Control), that is included in Windows since Windows Vista. This is also implemented in UNIX and Linux as the sudo (do as superuser) command.
It's the predator/prey thing. The prey evolves to better avoid the hunter and survive, the predator evolves to better hunt it's prey and the cycle continues. Being aware of bugs and vulnerabilities and constantly evolving to identify and patch them is the only real way to keep it as secure as possible, it is a constant evolution as hackers are always evolving themselves.
The CIA part came a little short. You do a great job compressing so much knowledge in these short videos. In some cases a shortcut might be falsy though. You're not done with integrity because an intruder can't just manipulate data. You also must know if a manipulation took place in case of an breach otherwise the first point is... pointless.
About lest priviledge: A few years ago, a bank in Canada (Desjardins) had a huge data leak of 100s of 1000s of their customers, some guy that tried to pawn of all that data into the dark web. Turns out the guy was from marketing, pissed about his job and for some reason had access to whole bunch of things he really didn't need to if all he needed to do in life was like know what % of customers both have a mortgage and car loan with them.
@@DevAcademyCom Most likely the cost of the course itself, even with the discount code it's over 400 USD, that's the amount of money equivalent to two months worth of living costs for a student like me.
What do you think about NodeJS will have real chances in future to be used on the enterprise applications? And what about Java, it seems to loose popularity year after year. What backend language do you think it's worth to lear? Thanks for you awesome contribution!
8:59 Can someone do obviously unethical and illegal your file case because this time is a lot of company allowed they’re employees work form home and you don’t know what they do your case or your file ? Because You are requesting family emergency ? Any idea
I accidentally leaked a Twilio key a few months ago, it cost us $5000 in one day :( But yeah it's good to hear that other people do it, makes me feel a lot less bad about myself.
@@BlazeBubble It is part of the learning process. and btw amazing gesture from the companies to actually notify you and then forgive you for these kind of mistakes (happened to me at least)
2:08 don't say open source projects are the most vulnerable. Look at Linux, it is very secure and then look at windows, the most insecure operating system ever
At 5:12 ish, can someone explain to me why setting the API key as an environment variable is safer than hardcoding it? Wouldn't the environment variable also get published on GitHub?
Well, unless you specifically write a script to dump all of your environment variables *before* pushing to a Git repository, then its because environment variables are stored within your *shell*, not your project, so something like Bash, sh, ksh, csh, and many other UNIX shells.
Environment variables stay on your local computer/server. There is no "file" to be published on Github so that's usually a safe place for information like this.
not if it's DDOS (focus on Distributed). Rate limiting will only reduce usage of individual users, but DDOS has several thousand users requesting at once
This video is so scary that it makes me want to find jobs that are not about web development even though I will graduate for my computer science degree next year. I don't want to be the one who makes bugs in the code and lose millions or billions of dollars for my company. I would feel guilty for the rest of my life. YIKES
If you join the Enterprise Security course, it's a high chance you will be aware of possible security vulnerabilities (and know how to prevent them) 💪.
I lost £1500 by leaking a Google Cloud Translate API key exactly the same way as you describe: hard coded into a file I pushed to a public git repo. After that happened, I learned to use environment variables for credentials (e.g. database credentials too).
Google Cloud Armor and Cloudflare both serve as good protection against DDoS attacks, but also making your own web applications detect DDoS attacks and automatically deny is a (not that) decent way of protection as it'll at least reduce time spent processing requests since they're just rejected. Sure, it's not a 100% foolproof method, but you could cut the cost of the attack way down with this
Is there any tips for hiding the API key when I use a API on a program I’m sharing with others. I’m on a forum where we share script and I sometime share my scripts. So how can I hide the API key I use? I know obfuscation can’t work as the obfuscation can get constant dumped.
AWS only gave me a partial refunded of the extra ec2 charges when someone got a hold of my password that I found out was compromised in an Adobe Breach years ago. I didn't get hacked, I didn't lose the security of my aws key, but only got a partial refund :(
As soon as you rely on someones else's code you most likely get vulnerabilities. The only way around that is to write everything yourself in Assembler, then you will have only your own vulnerabilities.
You can use other people's bugs, or create your own from scratch.
@@Fireship Even if you create completely vulnerability free code there are still hardware vulnerabilities like Meltdown and Spectre.
Until your code meet someone that knows ASM and debug your code.
Rewrite your masterpiece and deploy a patch!
You better start writing your assembly code or you will never get done ;)
@@TheBadFred that's why i like to build my pc from ground up by soldering individual transistors
The best security videos are scary - nice work on this one! For those folks dealing with mobile apps, whether built with JavaScript or not, there are a bunch of other security considerations to keep an eye on. The point is that you're never truly safe. As long as you have something valuable that could be hacked, someone out there will keep trying. You have to dedicate the time and resource to always stay on top of your security, it's not a set-it-and-forget-it thing.
Seeing my favorite youtuber for nativescript tutorials commenting here, proves that this channel provides a good content!
Janno Tabamo that’s so awesome! I’m glad you left that comment. Yes, this channel is pretty great - videos are top notch; great production and value.
ruclips.net/video/nPCfL_fuUk4/видео.html looks like linkedin clone with firebase as well easy explanation with github repo
English is not my first language but I can understand every single word from this guy even he speaks very fast. 💯 👍 Appreciate your videos!
Totally agree
as a security researchet i can validate that we need a ton of awareness to impart to our devs. I've seen some of the scariest vulnerable code making it to production.
(grabs bug spray)
(sprays all over cpu)
hahaha
hahaha
Frick
lol
I don't know how I laughed at this...
The actual way to protect from ddos attacks is by blocking requests from ips that constantly send a bunch of requests, and then ask them to do a human verificiation. Scaling gets reeeeeeealy costly.
So if you block ip, how would your server respond with human verification?
@@arnoldas9730 Blocking an IP is a server-side operation, and can be reverted immediately. What I am talking about is this:
- Attacker sends a lot of requests
- Server notices, and sends a verification
- Verification is not received, any more packets from that ip are blocked
- Another IP, this one not an attacker, sends a lot of requests
- Server notices, and sends a verification
- The new IP responds with verification
- Server allows higher than normal requests temporarily
- If this IP continually sends a large amount of packets, it may be throttled.
that is the basic way to solve dos, NOT ddos
I can spend hours watching your videos, they are so informative, i love the fact that they are short and swift, it's the best way to keep up with the ever so growing tech trends
Last tip could be a very very expensive one. Don't "fix" DDOS by scaling 😄
Can you explain the reasoning for it?
@@OmerMD That could lead to enormous costs.
Yeah, he definitely didn't quite go into it. But I guess the main point there was that scaling can be the needed solution if your service just cannot go down.
You can set an upper bound on how high your services will scale. And of course, you should do other things as well and not just rely on scaling.
One subject of my course had some vulnerability topics. Searched youtube , found your video. Its helpful. Thanks.
This didn't covered all topics but did the main ones.
yesss...... longer videos. Great job as always.
This is amazing. Thank you for putting this together. Vulnerabilities are endemic to orgs that rush production. My heart always hurts when I hear folks complaining about IAM roles and policies (regardless of hyper scaler). They’re just so darn important to good cloud hygiene.
Kevin Mitnick wrote in his book "Security is an illusion, you will put alarm on a door and feel safe, but what if burglar use window?". Modern frameworks are mostly safe against old methods od exploit unless you overengineer something, but they are not perfect, along the way they made anorher vulnerabilities which we will be talking about in the future
I feel like awarding it a million likes
I think the most secure why is to source your own Silicon, make your own CPU, create your own OS and write your own programs on it. +1 for Security if the language is unknown and you are the only person alive knowing about it :D
😂😂😂
😅😅😂
Spend 1 trillion dollars to safeguard your young and ugly photos.
Hey Jeff, This was a real delight to watch! I hope you do more videos like this which are related to general IT, every once in a while.
I really love your editing style, Its quick but never misses out on important information!
concise and precise, I loved it!
As a dev we just create security is never really thought of but this is a huge eye opener
This channel deserves more subscribers and views
For those of you interested I would suggest a book: 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them
It really changed how I code my programs and software be it client side or server side.
Are you self-taught ? How did you get to this level?
run `npm thanks` to see which open source projects are underfunded that you are using
Yep, I would say self-taught or on-the-job learning over the last 10 years. I has not been a quick or easy journey.
@@Fireship Thanks , you are the only YTr that inspires me to think of becoming a creator. This video is particularly well done, its like nerdwriter for code. I think it's inspiring me to think of how to help open source with security services. So essentially free doesn't mean safe
@@Fireship Yeah tell me about it, i'm on that road right now. New Subscriber. I imagine that 10 years ago it was a lot more difficult. I have the added difficulty of being born in Venezuela though :P
The principle of least privilege is implemented in Microsoft Windows' UAC (User Account Control), that is included in Windows since Windows Vista. This is also implemented in UNIX and Linux as the sudo (do as superuser) command.
4:40 might want to mention parameterized queries specifically
I would really like an up-to-date video on this, especially with the ongoing cyber warfares and stuff
Thanks for this! Planning a security review/upgrade for a web application and this video gave me a list of actionable ideas and steps to take.
lol oh that hangover clip was perfect!
That intro animation was SMOOOTTTHHH
It's the predator/prey thing. The prey evolves to better avoid the hunter and survive, the predator evolves to better hunt it's prey and the cycle continues. Being aware of bugs and vulnerabilities and constantly evolving to identify and patch them is the only real way to keep it as secure as possible, it is a constant evolution as hackers are always evolving themselves.
Loved it please make more videos of secure coding and setting up secure development environment
Senior Security Engineer here. 04:42 ORMs are not a fool-proof solution against SQLi. 2nd degree SQLi can still occur.
Andrei IR, Can you please explain me?
Pro tip: never use API keys as authentication. That’s not their intended purpose. They are inherently unsafe.
The CIA part came a little short.
You do a great job compressing so much knowledge in these short videos. In some cases a shortcut might be falsy though. You're not done with integrity because an intruder can't just manipulate data. You also must know if a manipulation took place in case of an breach otherwise the first point is... pointless.
it's an introduction to the subject, not a course.
Man I wish you were my mentor.
every content you created worth it to watch!
Best content on RUclips
Jeff is my favourite tech RUclipsr
your website is awesome
best sponsor intro ever
I was just learning Dijkstra's algorithm for shortest path in graph and RUclips recommended me this....that's spooky.
Weird, I never mentioned him by name. The algorithm just knows.
Yeah. 😂 Thanks for the amazing videos, always! I absolutely love your content and the quality of images/animations. Much appreciated.
I'm in love with your videos...keep the good work up
Your voice changed. I remember seeing this video when it was released and now RUclips recommended it again
Wow, that was nice of AWS! (Long time since I heard something nice about a huge company like that, so thanks. Haha)
They usually refund those things, not everytime though
The guy who ok’d the refund probably got fired.
Don't antropromorphise companies, they can neither be good or bad.
You sound so much more energetic and young in this video Jeff
About lest priviledge:
A few years ago, a bank in Canada (Desjardins) had a huge data leak of 100s of 1000s of their customers, some guy that tried to pawn of all that data into the dark web. Turns out the guy was from marketing, pissed about his job and for some reason had access to whole bunch of things he really didn't need to if all he needed to do in life was like know what % of customers both have a mortgage and car loan with them.
Its treat to watch your videos.
Well, you're right and all, but...
Samy IS my hero.
problems and solutions EXCELENT
this is the best channel
It's not a matter of how, it's a matter of when.
Laws are becoming very strict you said,
Facebook laughing in corner....
LOL...
Power.....
Thanks for these videos...
376 likes 0 hate, you are a legend.
Awesome video! Thanks!
It’s pleasure to watch your videos.
Nice vedio, what about XSRF?
love your videos, keep it up
Yesss .. finally new video
ruclips.net/video/nPCfL_fuUk4/видео.html looks like linkedin clone with firebase as well easy explanation with github repo
wish I could take the course :(. student life is hard sometimes
What is stopping you?
@@DevAcademyCom Most likely the cost of the course itself, even with the discount code it's over 400 USD, that's the amount of money equivalent to two months worth of living costs for a student like me.
@@emanuelfarauanu1760 Why over 400 USD? With the discount, it should be 350 USD. Did they apply some taxes?
@@DevAcademyCom Yes, UK Taxes
@@emanuelfarauanu1760 If you provide a valid VAT ID, the tax will not be added.
What do you think about NodeJS will have real chances in future to be used on the enterprise applications? And what about Java, it seems to loose popularity year after year. What backend language do you think it's worth to lear? Thanks for you awesome contribution!
NodeJS is already used by corporations like RUclips, Google, Facebook, Instagram, etc.
8:59
Can someone do obviously unethical and illegal your file case because this time is a lot of company allowed they’re employees work form home and you don’t know what they do your case or your file ? Because You are requesting family emergency ?
Any idea
The guy on the thumbnail says 5 risks
Dude the AWS stuff happened to me about 2 years ago. Now that I know you also made that mistake, I feel a lot less miserable haha
I accidentally leaked a Twilio key a few months ago, it cost us $5000 in one day :(
But yeah it's good to hear that other people do it, makes me feel a lot less bad about myself.
@@BlazeBubble It is part of the learning process. and btw amazing gesture from the companies to actually notify you and then forgive you for these kind of mistakes (happened to me at least)
@@B1TCH35K1LL3R Yes thank god I was able to keep the job, they understood it was an accident and even the best of developers do mistakes.
Quality content as always!
I had the exact same thing happen to me with AWS.
2:08 don't say open source projects are the most vulnerable. Look at Linux, it is very secure and then look at windows, the most insecure operating system ever
Very informative.
nice aways waiting for videos from your channel
Next to using an ORM, using prepared statements against SQL injection should be just as safe, correct?
At 5:12 ish, can someone explain to me why setting the API key as an environment variable is safer than hardcoding it? Wouldn't the environment variable also get published on GitHub?
env files are usually put in .gitignore file, hence they are not pushed to remote origin like github. They just remains on your local machine
Well, unless you specifically write a script to dump all of your environment variables *before* pushing to a Git repository, then its because environment variables are stored within your *shell*, not your project, so something like Bash, sh, ksh, csh, and many other UNIX shells.
Environment variables stay on your local computer/server. There is no "file" to be published on Github so that's usually a safe place for information like this.
Hahaha this episode had me rolling! Whoopsies!
👍 Thumbs up for making good videos
Awesome collection 👍
Hai bro, are u form TN
@@hariharan-wt6qk Yes, I am
Naanum Tamil Nadu tha anna
@@hariharan-wt6qk Ok Thambi..
@@aravind.a
Na college first year padekuren
Neeinga developer ah anna
Yeah Facebook went down for 8 hours a couple months ago. Anyone remember that?
Oh hey Albert Gonzales went to one of my schools
loving ur vids 🤩
amazing video
Ddos can be mitigated by rate limiting
not if it's DDOS (focus on Distributed). Rate limiting will only reduce usage of individual users, but DDOS has several thousand users requesting at once
Existence is vital part of human
Is there any way to prevent employee from using good old pen and paper to copy the sensitive info? Just asking.
Another top notch video! Thanks!
5:17 wheres this clip from?
Hmm interesting😮
6:57 that usb animation tho XD
This video is so scary that it makes me want to find jobs that are not about web development even though I will graduate for my computer science degree next year. I don't want to be the one who makes bugs in the code and lose millions or billions of dollars for my company. I would feel guilty for the rest of my life. YIKES
If you join the Enterprise Security course, it's a high chance you will be aware of possible security vulnerabilities (and know how to prevent them) 💪.
Losing money is one thing, but google therac-25, that one is really scary.
The scariest bugs are the ones in airplanes' software.
i like vulner😍
I lost £1500 by leaking a Google Cloud Translate API key exactly the same way as you describe: hard coded into a file I pushed to a public git repo. After that happened, I learned to use environment variables for credentials (e.g. database credentials too).
DDOS Attack looks very interesting, how do they prevent it if they dont have the compute power?
Google Cloud Armor and Cloudflare both serve as good protection against DDoS attacks, but also making your own web applications detect DDoS attacks and automatically deny is a (not that) decent way of protection as it'll at least reduce time spent processing requests since they're just rejected. Sure, it's not a 100% foolproof method, but you could cut the cost of the attack way down with this
@@kas-lw7xz what does this mean?
More please
Cruel and unusual punishments 2:35
if an app requires an api key to communicate with some api, how do you even ship that app without risking to expose the api key?
That was very Deep. I understood only 20% :D
ruclips.net/video/nPCfL_fuUk4/видео.html looks like linkedin clone with firebase as well easy explanation with github repo
Is there any tips for hiding the API key when I use a API on a program I’m sharing with others. I’m on a forum where we share script and I sometime share my scripts. So how can I hide the API key I use? I know obfuscation can’t work as the obfuscation can get constant dumped.
What is the outro song?
8:50 what's the music please
Athem by 7keys
📙💯
AWS only gave me a partial refunded of the extra ec2 charges when someone got a hold of my password that I found out was compromised in an Adobe Breach years ago.
I didn't get hacked, I didn't lose the security of my aws key, but only got a partial refund :(
wireless environment is the playground for hacking
lol I interviewed at Heartland, but turned down the job, because I found out about them being hacked.
And now the "The SolarWinds hack" 🤯
Enterprise Security course, fine but no contact email or form for some basic questions?
Hi, you can email contact@angular-academy.com or ask here.
What do you want to know?
Samy stored xss in my mind hahah