David Scrobonia's guest appearances

David Scrobonia

Absolute AppSec

Getting Into Infosec

Tanya Janca

Kevin Johnson

Eric Johnson

Dave Ferguson

Jack Rhysider

Nick Jeswald

Jeevan Singh

Rob Carson

Yaron Levi

Elvis Chan

Christina Hanson

Marcus Carey

Adrian Kaylor

Jared Folkins

Hossam Mohamed

OwlTail

From Zero to One, David is a lifelong builder. Wherever he goes, he just builds things. From an electric car to Adhoc android apps to ZAP HUD to an awesome heads up display for ZAP Proxy, he's a game-changer, IMHO. We discuss the lack of UX in the security tooling community, how contributing to Open Source got him his job, and even about imposter syndrome. BIO David Scrobonia is part of the Security Engineering team at Segment, working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and leads development for the OWASP ZAP Heads Up Display project. Notes  Mostly interested in architecture and mechanical engineering when younger. Built his own electric car with his dad, out of a Porsche 914! David explains XSS and why certain languages are better than others, such as React David gets lost in El Segundo. Yes.  Quotes  "It's just a program that listens to these silly protocols." "I wanted to do more hands-on stuff, [and] quickly fell in love with the coding side as a lot of people do." "I was like... what's GET? What's POST? What do you mean?" "Before you know it, right? It seems so daunting." "Still plenty of opportunities out there. [It] will be a long time before the world is perfect and secure." "I've been working in the security industry, but I didn't really feel part of any security community." "I have nothing but good things to say about the open-source community." "They're (security tools) just not built with user experience first." "I think people underestimate what they are able to contribute."  Links  David on Twitter: https://twitter.com/david_scrobonia Rube Goldberg Machine: https://en.wikipedia.org/wiki/Rube_Goldberg_machine Dan Boneh's Cryptography Course: https://crypto.stanford.edu/~dabo/courses/OnlineCrypto/ OWASP Appsensor Project: https://www.owasp.org/index.php/OWASP_AppSensor_Project Zap Proxy Heads Up Display (HUD): https://github.com/zaproxy/zap-hud Article by David on Zap HUD: https://segment.com/blog/hacking-with-a-heads-up-display/ Brakeman Pro: https://brakemanpro.com/ https://samsclass.info My talk at Sam's class: https://www.youtube.com/watch?v=KJvPHZGtGdM Intro: Cascadia by Trash80 (https://trash80.com) Licensed Under Creative Commons Outro: Cancun by Topher Mohr and Alex Elena  Getting Into Infosec:  Twitter: https://twitter.com/coffeewithayman YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/ See omnystudio.com/listener for privacy information.

From Zero to One, David is a lifelong builder. Wherever he goes, he just builds things. From an electric car to Adhoc android apps to ZAP HUD to an awesome heads up display for ZAP Proxy, he's a game-changer, IMHO. We discuss the lack of UX in the security tooling community, how contributing to Open Source got him his job, and even about imposter syndrome. BIO David Scrobonia is part of the Security Engineering team at Segment, working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and leads development for the OWASP ZAP Heads Up Display project. Notes <ul> <li>Mostly interested in architecture and mechanical engineering when younger.</li> <li>Built his own electric car with his dad, out of a Porsche 914!</li> <li>David explains XSS and why certain languages are better than others, such as React</li> <li>David gets lost in El Segundo. Yes.</li> </ul> Quotes <ul> <li>"It's just a program that listens to these silly protocols."</li> <li>"I wanted to do more hands-on stuff, [and] quickly fell in love with the coding side as a lot of people do."</li> <li>"I was like... what's GET? What's POST? What do you mean?"</li> <li>"Before you know it, right? It seems so daunting."</li> <li>"Still plenty of opportunities out there. [It] will be a long time before the world is perfect and secure."</li> <li>"I've been working in the security industry, but I didn't really feel part of any security community."</li> <li>"I have nothing but good things to say about the open-source community."</li> <li>"They're (security tools) just not built with user experience first."</li> <li>"I think people underestimate what they are able to contribute."</li> </ul> Links <ul> <li>David on Twitter: <a href="https://twitter.com/david_scrobonia" rel="nofollow" target="_blank">https://twitter.com/david_scrobonia</a></li> <li>Rube Goldberg Machine: <a href="https://en.wikipedia.org/wiki/Rube_Goldberg_machine" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Rube_Goldberg_machine</a></li> <li>Dan Boneh's Cryptography Course: <a href="https://crypto.stanford.edu/~dabo/courses/OnlineCrypto/" rel="nofollow" target="_blank">https://crypto.stanford.edu/~dabo/courses/OnlineCrypto/</a></li> <li>OWASP Appsensor Project: <a href="https://www.owasp.org/index.php/OWASP_AppSensor_Project" rel="nofollow" target="_blank">https://www.owasp.org/index.php/OWASP_AppSensor_Project</a></li> <li>Zap Proxy Heads Up Display (HUD): <a href="https://github.com/zaproxy/zap-hud" rel="nofollow" target="_blank">https://github.com/zaproxy/zap-hud</a></li> <li>Article by David on Zap HUD: <a href="https://segment.com/blog/hacking-with-a-heads-up-display/" rel="nofollow" target="_blank">https://segment.com/blog/hacking-with-a-heads-up-display/</a></li> <li>Brakeman Pro: <a href="https://brakemanpro.com/" rel="nofollow" target="_blank">https://brakemanpro.com/</a></li> <li><a href="https://samsclass.info" rel="nofollow" target="_blank">https://samsclass.info</a></li> <li>My talk at Sam's class: <a href="https://www.youtube.com/watch?v=KJvPHZGtGdM" rel="nofollow" target="_blank">https://www.youtube.com/watch?v=KJvPHZGtGdM</a></li> <li>Intro: Cascadia by Trash80 (<a href="https://trash80.com" rel="nofollow" target="_blank">https://trash80.com</a>) Licensed Under Creative Commons</li> <li>Outro: Cancun by Topher Mohr and Alex Elena</li> </ul> Getting Into Infosec: <ul> <li>Twitter: <a href="https://twitter.com/coffeewithayman" rel="nofollow" target="_blank">https://twitter.com/coffeewithayman</a></li> <li>YouTube: <a href="https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A" rel="nofollow" target="_blank">https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A</a></li> <li>Book: <a href="https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/" rel="nofollow" target="_blank">https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/</a></li> </ul>See <a href="https://omnystudio.com/listener" rel="nofollow" target="_blank">omnystudio.com/listener</a> for privacy information.

David Scrobonia - Lifelong builder, Appsec Engineer, Creator of ZAP Heads Up Display

Leif Dreizler

Seth and Ken discuss SSRF Rebinding defenses with Segment (Leif, David, and Achille). Additional topics include password complexity, password resets, and using Troy Hunt's breach database.

Episode 42: SSRF Rebinding and Segment Team (Leif Dreizler and David Scrobonia)