Neil Madden

Looking for vulnerabilities is the last thing I do

There's a common misconception among developers that my job, as a (application) Security Engineer, is to just search for security bugs in their code. They may well have seen junior security engineers doing this kind of thing. But, although this can be useful (and is part of the job), it's not what I focus on and it can be counterproductive. Let me explain.

http://neilmadden.blog/2026/02/20/looking-for-vulnerabilities-is-the-last-thing-i-do/

“What I mean is that if you really want to understand something, the best way is to try and explain it to someone else. That forces you to sort it out in your own mind. And the more slow and dim-witted your pupil, the more you have to break things down into more and more simple ideas. And that’s really the essence of programming. By the time you’ve sorted out a complicated idea into little steps that even a stupid machine can deal with, you’ve certainly learned something about it yourself. The teacher usually learns more than the pupil. Isn’t that true?” — Douglas Adams

“It is not knowledge, but the act of learning, not possession, but the act of getting there which generates the greatest satisfaction.” — Carl Friedrich Gauss

“You think you KNOW when you learn, are more sure when you can write, even more when you can teach, but certain when you can program” — Alan Perlis (of course)

Why I don’t use #LLMs for #programming …

It just occurred to me that if hash functions are message “digests”, then the output of such digestion is…. 💩

Brb, implementing constant-time turd comparison.

Sometimes all you have is a private key and you need the corresponding public key. Today’s “fun” puzzle: implementing this for a range of key types in Java, using only standard library APIs (no BouncyCastle). Some clever/evil hacks needed.

https://codeberg.org/neilmadden/snippets/src/branch/main/PrivateToPublicKeyConverter.java

#java #cryptography