28c3: The Science of Insecurity

What this video covers

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Why it surfaced in Hacker News

HN commenters call it one of the best security talks and the standard introduction to LANGSEC, which they use to argue for simpler, well-specified input formats.

Recommendation context

Short excerpts from positive mentions. Open the source to read the full Hacker News discussion.

“It's a tour de force, presenting a systematic and practical proposal for how we can build an open and secure future for computing.”

“The best talk on computer security I have seen is Meredith Patterson's Science of Insecurity at 28c3”

“She contends, and it seems sound to me, that the time has passed to be "tolerant when accepting,”