Yariv Tal
Secure Coding Mentor
Tel Aviv, Israel
Actions
Yariv Tal is a senior developer, security researcher, and cofounder of Secure From Scratch, a venture dedicated to teaching developers secure coding from the very first line of code.
Leveraging four decades of programming experience and years of bootcamp mentoring , he lectures on secure coding in academia and the private sector, leads the OWASP-untrust project, and researches the intersection of AI and application security, with a focus on secure code generation, LLM evaluation, and secure-by-construction development.
He also wrote "Effective Secure Coding, Part I: Building Safer Features".
Links
Area of Expertise
Topics
The API Made Me Do It - Do Bad APIs Lead AI to Generate Vulnerable Code?
We blame the bot when AI-generated code is vulnerable, but what if it is just using the dangerous APIs we left on the table?
This talk tests whether API design can steer AI coding agents toward safer code. The same agent builds the same Java/Spring task app twice: once in a normal environment with freedom to choose libraries and APIs, and once in a constrained one with secure-by-default scaffolding, deny-by-default settings, safer abstractions, and bans on risky APIs such as raw path handling.
Secure Coding, Tik-Tok Style
Software engineers! Secure coding is simple!
In this talk I'll give you coding habits that eliminate the need to memorize all the buzzwords of the security professionals.
YouTube short style (2 minutes or less per habit).
Pasteur - A C++ library to eliminate injections
Enables forwarding mixed trusted/untrusted concatenated data that can be sanitized at the point of use, when the sanitization requirements are known, instead of at the point of input.
Examples:
With Pasteur this classic sql injection code
sql << pstr / "select email from demo.useremails where username = " + name + " and type=" + emailType;
is *automatically* converted into a parameterized sql query
This os injection code
System(pstr / "ping " + hostname)
automatically sanitizes the hostname parameter.
See more at https://github.com/SecureFromScratch/pasteur
Secure from Scratch: Secure Code Workshop for DEF CON Kids
Want to learn how to stop hackers in their tracks?
Come to the Secure From Scratch coding workshop.
Learn what you need to know to write secure code from the very first line of code.
It's surprisingly easy!
(Some coding experience in either C#, Java, Python or C++ required. You need to know loops, if, arrays and functions).
Secure from Scratch: Secure Code Workshop
Want to learn how to stop hackers in their tracks?
Come to the Secure From Scratch coding workshop.
Learn what you need to know to write secure code from the very first line of code.
It's surprisingly easy!
(Some coding experience in either C#, Java, Python or C++ required. You need to know loops, if, arrays and functions).
Secure From Scratch
This workshop will teach programmers how to analyze code for potential security bugs and develop methods that make these bugs impossible, or at least improbable.
We will explore common languages and go back to the basics of input/output and how to handle them securely.
Languages supported are Java, C#, C++, python.
To build a security-aware mindset, we will analyse real-world examples with real-world security vulnerabilities and develop our own infrastructure for avoiding or reducing risk. By the end of the workshop, you will be more aware of how to write code in a secure way and how a different writing style and different programming constructs can support secure coding.
Hacking Secure Coding into Highschool Education
In this talk, we'll introduce the "Secure From Scratch" approach to secure coding. We'll discuss PREVENT - an acronym and methodology that encompasses secure coding principles for developers who may not have heard of or learned enough from OWASP's top 10. We'll also share our experience in reaching high school students and providing them with a secure coding workshop. In the workshop, they learned the importance of secure coding by putting PREVENT into practice in a lab. They found it interesting and exciting. We'll outline how we structure our workshops so that anyone can replicate them and provide real benefits to developers, without overwhelming them with buzzwords, vulnerabilities, or exploits that they neither want nor have time to deal with.
Creating Your Own Secure Coding Assistant
In the current landscape, generative AI coding tools have become invaluable to developers, but they introduce significant security concerns. The snippets these tools generate are often not secure, and many organizations are hesitant to share their codebases with publicly available models. This talk will guide you through the process of creating a secure coding assistant that is tailored to your specific security needs.
We'll start by examining the security limitations of existing AI coding assistants. You'll gain insights into the challenges these tools face and learn about the importance of fine-tuning models to address these shortcomings.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top