Will reveals a major security vulnerability will be found this week as they discuss the updated OWASP Top Ten.
This episode examines the OWASP Top Ten 2021 list of critical web application security risks. Hosts Will, an experienced software architect, and Beej, a journeyman developer, provide a developer-focused overview. They compare the new list to its 2017 predecessor and highlight newly added vulnerabilities.
The hosts systematically review each of the ten categories, including Broken Access Control and Cryptographic Failures. They note that Injection flaws, while still present, have been consolidated and re-categorized from previous lists. A significant change discussed is the addition of Insecure Design as a new, distinct category. Will and Beej explain that this category focuses on flaws in an application's fundamental architecture and design patterns. They contrast this with Implementation flaws, which are coding errors in a sound design.
The conversation covers Server-Side Request Forgery (SSRF), another new entry for 2021. The hosts describe how this vulnerability allows attackers to induce a server to make unauthorized requests to internal systems. They reference the 2019 Capital One data breach as a prominent example of a security failure. The episode notes that the list is published by the Open Web Application Security Project, a non-profit foundation. The update process for the Top Ten list is described as infrequent, with the prior version released in 2017.
An interesting insight is that design-level flaws are now considered separately from implementation bugs, representing a shift in security thinking. The hosts find it ironic that the OWASP website itself could theoretically be a target for the vulnerabilities it catalogs. They emphasize that a major security flaw will likely be discovered in someone's web application within the current week. The discussion connects abstract vulnerability categories to real-world developer experiences, like handling unpredictable support rotations.
The tone is casual and conversational, blending technical explanations with personal anecdotes. The style is educational but delivered through a relaxed dialogue between two practicing developers. Developers and software engineers concerned with application security will find this episode directly useful. Listeners seeking highly technical, deep-dive exploit analysis might find the overview too high-level.
