Join 75,000+ Looksmaxxing Members!

Register a FREE account today to become a member. Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox.

  • DISCLAIMER: DO NOT ATTEMPT TREATMENT WITHOUT LICENCED MEDICAL CONSULTATION AND SUPERVISION

    This is a public discussion forum. The owners, staff, and users of this website ARE NOT engaged in rendering professional services to the individual reader. DO NOT use the content of this website as an alternative to personal examination and advice from licenced healthcare providers. DO NOT begin, delay, or discontinue treatments and/or exercises without licenced medical supervision. Learn more

Find the reference in my custom title and I'll give you 100 gold reps manually

Register to hide this ad
Wrong again. Tough luck.
2026-06-26_23-21-42.webp
 
LANGSEC: Language-theoretic Security

"The View from the Tower of Babel"

The Second Language-theoretic Security (LangSec) IEEE S&P Workshop at the IEEE Security & Privacy Symposium 2015 took place in San Jose on May 21, 2015. Workshop program and all presented papers and slides are now posted. The text of Dan Geer's keynote is also posted.

We released a series of video tutorials for Hammer, a LangSec secure(r) parser construction kit: the HammerPrimer on Github. Please help us beta-test this tutorial!

The First Language-theoretic Security (LangSec) IEEE S&P Workshop at the IEEE Security & Privacy Symposium 2014 took place in San Jose, May 18, 2014. Workshop program and all presented papers are now posted.

The Language-theoretic approach (LANGSEC) regards the Internet insecurity epidemic as a consequence of ad hoc programming of input handling at all layers of network stacks, and in other kinds of software stacks. LANGSEC posits that the only path to trustworthy software that takes untrusted inputs is treating all valid or expected inputs as a formal language, and the respective input-handling routines as a recognizer for that language. The recognition must be feasible, and the recognizer must match the language in required computation power.

When input handling is done in ad hoc way, the de facto recognizer, i.e. the input recognition and validation code ends up scattered throughout the program, does not match the programmers' assumptions about safety and validity of data, and thus provides ample opportunities for exploitation. Moreover, for complex input languages the problem of full recognition of valid or expected inputs may be UNDECIDABLE, in which case no amount of input-checking code or testing will suffice to secure the program. Many popular protocols and formats fell into this trap, the empirical fact with which security practitioners are all too familiar.

LANGSEC helps draw the boundary between protocols and API designs that can and cannot be secured and implemented securely, and charts a way to building truly trustworthy protocols and systems. A longer summary of LangSec in this USENIX Security BoF hand-out, and in the talks, articles, and papers below
 
Nice try, I’m not clicking that
LANGSEC: Language-theoretic Security

"The View from the Tower of Babel"

The Second Language-theoretic Security (LangSec) IEEE S&P Workshop at the IEEE Security & Privacy Symposium 2015 took place in San Jose on May 21, 2015. Workshop program and all presented papers and slides are now posted. The text of Dan Geer's keynote is also posted.

We released a series of video tutorials for Hammer, a LangSec secure(r) parser construction kit: the HammerPrimer on Github. Please help us beta-test this tutorial!

The First Language-theoretic Security (LangSec) IEEE S&P Workshop at the IEEE Security & Privacy Symposium 2014 took place in San Jose, May 18, 2014. Workshop program and all presented papers are now posted.

The Language-theoretic approach (LANGSEC) regards the Internet insecurity epidemic as a consequence of ad hoc programming of input handling at all layers of network stacks, and in other kinds of software stacks. LANGSEC posits that the only path to trustworthy software that takes untrusted inputs is treating all valid or expected inputs as a formal language, and the respective input-handling routines as a recognizer for that language. The recognition must be feasible, and the recognizer must match the language in required computation power.

When input handling is done in ad hoc way, the de facto recognizer, i.e. the input recognition and validation code ends up scattered throughout the program, does not match the programmers' assumptions about safety and validity of data, and thus provides ample opportunities for exploitation. Moreover, for complex input languages the problem of full recognition of valid or expected inputs may be UNDECIDABLE, in which case no amount of input-checking code or testing will suffice to secure the program. Many popular protocols and formats fell into this trap, the empirical fact with which security practitioners are all too familiar.

LANGSEC helps draw the boundary between protocols and API designs that can and cannot be secured and implemented securely, and charts a way to building truly trustworthy protocols and systems. A longer summary of LangSec in this USENIX Security BoF hand-out, and in the talks, articles, and papers below
 

Users who are viewing this thread

Back
Top