Embracing an Adversarial Mindset for C++ Security Amanda Rousseau 9/18/2024 This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY1 cross-org issues to combat a whole bug class 15% ● Writing tools to help with discovery 4%Adversarial Mindset Not taught in traditional institutionsThinking Like an Adversary Challenging assumptions Creatively libraries: • clang_rt.fuzzer_no_main-x86_64.lib • libsancov.libImportance of a security-focused mindset Considering security from the start of a project Threat modeling at the design stage Know the

complicated... Choose the smallest amount of work that you can write a test for "Engineering" mindset "Hacking" mindset Courtesy of Phil Nash 82TDD is difficult... Takes dedicated practice Requires a new

together Instant evaluation Grow furtherTransformation Resistance low with others Contagious Mindset Each others’ support Let’s try it out!Quality Ownership Knowledge Evolution Transformations

long-term productivity ■ Improves safe development in other languages ■ By adjusting developer mindset 13 “Once you learn Rust, you are one with the borrow checker — it never leaves you. I now see

is only in server, not in browser 7 Principles and philosophy ● A thin wrapper to rcl -- same mindset, fast & easier to adapt change ● Event-driven, non-blocking (promise/event) -- advantage of async

also affect compiler optimizations! 65 skewed profiling is still useful, but requires a different mindset Gotchas Beware excessive instrumentation!• just wait a little bit more (host application may not

92Programming with a value-based language • In a reference-based language like C# or Java, the mindset is different • One gets indirect access by default for class instances • Objects are zeroed by

Models Outlook Summary Abstract Conceptually: std::simd types express data-parallelism. Wrong mindset: std::simd types are specific SIMD registers. Which is why I prefer to call them “data-parallel

borrows some of its terminology from the REST architectural style, so if you are familiar with that mindset, Falcon should be familiar. On the other hand, if you have no idea what REST is, no worries; Falcon

borrows some of its terminology from the REST architectural style, so if you are familiar with that mindset, Falcon should be familiar. On the other hand, if you have no idea what REST is, no worries; Falcon