28c3: The Science of Insecurity

if you haven't recognized it don't goddamn process it

parse those messages in exactly the same way

treat input handling computational power as privilege and reduce that privilege

you cannot efficiently and effectively test or debug when you're when you're intermingling

the vast majority of vulnerabilities come from protocol and message format designs

be definite about what you accept treat inputs as a language