Category: Security

  • Avoid Python SAST scanners based on AI

    What happened with blockchain technology is also happening with AI technology. Too many people believe that it is a solution for all hard and complex problems. I still love this flowchart that helps you to determine if blockchain is an appropriate technology for your use case. Spoiler: Blockchain is seldom a solution.

    (more…)

  • Stop using assert in your Python code

    Too many Python programs use assert statements to check for conditions, even in widely used modules like Pydantic.


    Using assert can be problematic from a security perspective. The Python assert statement itself isn’t insecure, but its misuse can lead to vulnerabilities.

    (more…)

  • Is Pydantic as safe as it Is popular?

    If you want to keep complexity low and minimize security risks, you always need to decide whether using an external Python library is the right choice.

    Practising 0Complexity design principles is never easy. But when it comes to security and minimising dependencies, you should weigh the advantages and disadvantages of using any external Python library.

    Don’t get me wrong: many FOSS Python libraries are excellent, well-maintained software and you’d be foolish not to use them when appropriate.

    So before using a new module in an MVP, running a quick and simple Static Application Security Test (SAST) on the external Python module will provide valuable information from a security point of view.

    (more…)

  • T-DOSE 2025

    On the Technical Dutch Open Source Event 2025 (t-dose), I gave a talk on ‘Simplifying Security’

    Slides (cc-by-sa) here for download and remember slides are published to be shared:

    (more…)

  • Shift left:  from complex and reactive to simple and proactive

    Cyber security is complex. But effective cyber solutions do not need to be complex and very expensive.

    To avoid misunderstandings: Simplifying your security landscape is not simple at all, but rather means rethinking your strategy and reprioritizing objectives:

    • Risks
    • Costs
    • Value
    (more…)

  • Open Security News week 10-2025

    When using FOSS software you have the advantage to inspect the source code on malicious flaws. However almost all software is distributed to end users as pre-compiled binaries. This creates a problem: How do you know if the software is not injected with malicious code?

    Compiling the software yourself is not enough to be sure that no flaws have been introduced. So check if your software has a reproducible build. A reproducible build is, an approach to determine whether generated binaries correspond with their original source code.

    (more…)

  • Cyber Security Conferences

    Cyber security conferences or seminars are crucial for continuous learning. But the number of annual held cybersecurity events is immense. So on this blog page you will find an opinionated collection of exiting cyber security events worldwide.

    (more…)

  • QR codes: Still a security nightmare?

    QR code attacks are still increasing. But is there a simple solution to reduce the risks when using a QR code? 

    (more…)

  • Simplify Cyber Security: A Practical Manifesto

    Automation has changed our lives. Computers and all kinds of software enabled devices make our daily lives easier. Every year computer devices get more powerful, less expensive but also get more vulnerable to cyber security risks. Too often cyber security breaches have a severe impact on our safety and privacy. But most cyber security accidents are hidden from the public eye.

    (more…)

  • Let’s just do it one more time

    Cyber Security is complex. So it is no surprise that companies get hit by major IT disasters due to cyber security incidents.

    Cyber security vendors often make things very complex. Too complex. Often they sell a lot of crappy expensive security software with security management cockpits and promise that all your risks are mitigated. However being hit by ransomware is no joke. 

    (more…)