https://www.ostering.com/ https://www.ostering.com/antlr-and-javacc-parser-generators/ 2026-07-20T10:29:48+02:00 https://www.ostering.com/media/posts/2/tool-592440_1920.jpg https://www.ostering.com/application-security-is-more-than-just-pen-testing/ 2026-07-22T13:46:59+02:00 https://www.ostering.com/media/posts/21/appsec_teaser.png https://www.ostering.com/calculating-risk-across-project-real-estate-using-graph-analysis/ 2026-07-20T10:20:49+02:00 https://www.ostering.com/media/posts/4/sweep.jpg https://www.ostering.com/media/posts/4/dependency_graph_example1.png https://www.ostering.com/media/posts/4/dependency_graph_example2.png https://www.ostering.com/capec-stride-mapping/ 2025-08-07T15:00:41+02:00 https://www.ostering.com/media/posts/3/capec_stride_mapping_thumbnail.png https://www.ostering.com/catasto/ 2026-08-20T00:07:28+02:00 https://www.ostering.com/media/posts/62/blast-radius-header-estate.png https://www.ostering.com/media/posts/62/catasto-cross-boundary-taint.png https://www.ostering.com/media/posts/62/catasto-four-questions.png https://www.ostering.com/media/posts/62/catasto-three-tools-three-scopes.png https://www.ostering.com/configuring-tomcat-7-single-sign-on-with-spnego-kerberos-and-ldap-part-2/ 2026-07-20T10:44:43+02:00 https://www.ostering.com/media/posts/5/rolodex.jpg https://www.ostering.com/configuring-tomcat-single-sign-on-with-spnego-kerberos-and-ldap/ 2026-07-20T10:44:59+02:00 https://www.ostering.com/media/posts/6/buckingham-palace.jpg https://www.ostering.com/cra-nis2-and-dora-for-engineers/ 2026-09-03T22:29:37+02:00 https://www.ostering.com/media/posts/66/blast-radius-cover-cra-nis2-dora.png https://www.ostering.com/media/posts/66/diagram-three-regimes.png https://www.ostering.com/media/posts/66/diagram-sbom-intended-vs-asbuilt.png https://www.ostering.com/cursor-as-you-dev-team/ 2026-07-20T10:22:04+02:00 https://www.ostering.com/media/posts/46/cursor-dev-team.jpg https://www.ostering.com/data-protection-and-data-privacy-part-2-of-2/ 2026-07-22T13:47:16+02:00 https://www.ostering.com/media/posts/59/blast-radius-part-2.png https://www.ostering.com/media/posts/59/privacy-threat-modelling.png https://www.ostering.com/media/posts/59/vinkovits-privacy-suit.png =1800x1350 "Vinkovits Privacy Suit" https://www.ostering.com/media/posts/59/privacy-harms.png =1800x1230 "Privacy Harms" https://www.ostering.com/media/posts/59/dark-patterns-catalogue.png =1800x1590 "Dark Patterns Catalogue" https://www.ostering.com/media/posts/59/data-subject-rights.png =1800x1380 "Data Subject Rights Overview" https://www.ostering.com/media/posts/59/compute-and-discard.png =1800x1069 "Compute and Discard" https://www.ostering.com/media/posts/59/pseudonymisation-vs-anonymisation.png =1800x1170 "Pseudonymisation vs Anonymisation" https://www.ostering.com/media/posts/59/data-inventory.png =1800x1350 "Data Inventory Structure" https://www.ostering.com/media/posts/59/eu-ai-act-pyramid.png =1800x1118 "EU AI Act Risk Pyramid" https://www.ostering.com/media/posts/59/ai-privacy-attack-surface.png =1800x997 "AI Privacy Attack Surface" https://www.ostering.com/media/posts/59/values-vs-actions.png =1800x1140 "Values vs Actions" https://www.ostering.com/dependency-pruning-and-tree-shaking/ 2026-07-30T13:18:15+02:00 https://www.ostering.com/media/posts/53/pruning.png https://www.ostering.com/media/posts/53/reachability_direction_comparison.png =680x340 "Reachability Direction Comparison" https://www.ostering.com/media/posts/53/metadata_table_scan_process.png =680x480 "Metadata Table Scan Process" https://www.ostering.com/media/posts/53/confidence_scoring_model.png =680x460 "Confidence Scoring Model" https://www.ostering.com/media/posts/53/one_method_dependency_cascade.png =680x520 "One-Method Dependency Cascade" https://www.ostering.com/media/posts/53/pruning_impact_before_after_svg.png =680x488 "Pruning Impact — Before vs After" https://www.ostering.com/games-with-purpose-nov-2022/ 2025-08-05T18:16:37+02:00 https://www.ostering.com/media/posts/7/games_small.jpg https://www.ostering.com/get-pqc-ready-pdq/ 2026-07-20T10:03:08+02:00 https://www.ostering.com/media/posts/43/cover-part-1.png https://www.ostering.com/media/posts/43/diagram-1-cryptanalysis-vectors.png =2400x1440 "The Two Cryptanalysis Vectors" https://www.ostering.com/media/posts/43/diagram-2-mosca-timeline.png =2400x1440 "Mosca's Inequality Timeline" https://www.ostering.com/media/posts/43/diagram-3-key-hierarchy.png =2400x1520 "The Key Hierarchy Trap" https://www.ostering.com/media/posts/43/diagram-4-regulatory-timeline.png =3000x1520 "PQC Regulatory Convergence 2024-2035" https://www.ostering.com/get-pqc-ready-pdq-part-2/ 2026-07-20T10:03:37+02:00 https://www.ostering.com/media/posts/58/cover-part-2.png https://www.ostering.com/media/posts/58/diagram-5-inventories-2.png =2400x1480 "Two inventories" https://www.ostering.com/media/posts/58/diagram-6-cbom-vs-usage.png =2400x1520 "What a CBOM is, and what it is not" https://www.ostering.com/media/posts/58/table-2.png https://www.ostering.com/media/posts/58/diagram-8-cost-ranges.png =2400x1440 "The ball park cost for your org" https://www.ostering.com/media/posts/58/diagram-7-roadmap-2.png =2400x1234 "What to do, When to do it" https://www.ostering.com/how-a-hedgehog-got-its-own-house/ 2026-08-31T14:45:45+02:00 https://www.ostering.com/media/posts/65/IMG_6686-2.jpg https://www.ostering.com/media/posts/65/IMG_5100.jpg =2855x2236 "The Scene of the Crime" https://www.ostering.com/media/posts/65/IMG_5550.jpg =5712x4284 "The feeding shelter" https://www.ostering.com/media/posts/65/IMG_6674.jpg =5712x4284 "The Doorway" https://www.ostering.com/media/posts/65/IMG_6622.jpg =4284x5712 "The Nest Lid" https://www.ostering.com/media/posts/65/IMG_6687.jpg =5712x4284 "My failed attempt at yakisugi" https://www.ostering.com/media/posts/65/IMG_6603.jpg =5712x4284 "The Roof Panel Overlapping Aluminium" https://www.ostering.com/media/posts/65/IMG_6604.jpg =5712x4284 "The fixings on the underside" https://www.ostering.com/how-is-learning-a-human-language-like-learning-a-computer-language/ 2025-08-07T15:04:15+02:00 https://www.ostering.com/media/posts/8/books.jpg https://www.ostering.com/ideas-and-opinions-from-the-trenches/ 2026-07-20T10:08:57+02:00 https://www.ostering.com/media/posts/38/michael-caine-idea.png https://www.ostering.com/media/posts/38/reachability-dep-injection.png =1024x1024 "What about the stuff that's in config and not in the code?" https://www.ostering.com/media/posts/38/dependency_injection.png =1344x768 "Dependency Injection" https://www.ostering.com/media/posts/38/runtime_reachability.png =1344x710 "Are we gonna hit that edge case? Maybe when the moon and the stars align!" https://www.ostering.com/media/posts/38/prunning.png =1024x1024 "Lets get rid of these weak dependencies we're not using!" https://www.ostering.com/media/posts/38/sast-fn.png =1024x1024 "Ta da! We have a really low false positive rate" https://www.ostering.com/media/posts/38/graph.png =1024x1024 "If only we had the trustworthyness data" https://www.ostering.com/introduction-to-digital-signatures-for-managers/ 2026-07-20T10:46:17+02:00 https://www.ostering.com/media/posts/10/digital_signature.jpg https://www.ostering.com/introduction-to-kerberos-for-managers/ 2026-07-20T10:44:01+02:00 https://www.ostering.com/media/posts/11/kerberos_myth-01.png https://www.ostering.com/introduction-to-public-key-encryption-for-managers/ 2026-07-20T10:39:12+02:00 https://www.ostering.com/media/posts/12/encryption.png https://www.ostering.com/introduction-to-saml-for-managers/ 2026-07-20T10:43:23+02:00 https://www.ostering.com/media/posts/13/key-96233_1920.jpg https://www.ostering.com/introduction-to-ssl-for-managers/ 2026-07-20T10:39:40+02:00 https://www.ostering.com/media/posts/14/ssl.jpg https://www.ostering.com/is-your-ai-philosophy-broken/ 2026-07-22T14:00:26+02:00 https://www.ostering.com/media/posts/39/ai_vuln_factory-2.png https://www.ostering.com/media/posts/39/aging-subject-matter-experts.png =1024x1024 "Broken Pipeline" https://www.ostering.com/media/posts/39/Salary-Dumping1.png =1024x1024 "Salary Dumping" https://www.ostering.com/kerberos-user-impersonation-on-tomcat-with-apache/ 2026-07-22T14:08:13+02:00 https://www.ostering.com/media/posts/16/padlock.jpg https://www.ostering.com/kicking-off-security-maturity/ 2025-10-13T10:04:51+02:00 https://www.ostering.com/media/posts/45/image-4.png https://www.ostering.com/media/posts/45/17600878635417.jpg https://www.ostering.com/media/posts/45/17602721028630.jpg https://www.ostering.com/media/posts/45/17600874790096-2.jpg https://www.ostering.com/mitigating-third-party-component-risk/ 2026-07-20T10:52:51+02:00 https://www.ostering.com/media/posts/52/TM_Deps_Feature2.jpg https://www.ostering.com/media/posts/52/Screenshot-2026-03-19-at-11.11.21-2.png =3972x2228 "libhunt.com" https://www.ostering.com/media/posts/52/category_vs_feature_level_discovery.svg =680x520 "Category vs Feature-Level Discovery Diagram" https://www.ostering.com/media/posts/52/feature_level_pipeline.svg =680x580 "Feature-Level Alternative Discovery Pipeline" https://www.ostering.com/media/posts/52/dependency_swap_combined.svg =680x420 "Cost-Benefit Example" https://www.ostering.com/media/posts/52/dependency_swap_evaluation_flow.svg =680x540 "The Mitigation Process" https://www.ostering.com/media/posts/52/sbom_graph_dual_mode_architecture.svg =680x500 "SBOM-Graph Dual-Mode Architecture" https://www.ostering.com/one-key-to-rule-them-all/ 2026-09-17T23:41:38+02:00 https://www.ostering.com/media/posts/67/blast-radius-header-one-key.png https://www.ostering.com/media/posts/67/diagram-1-two-gates-2.png =2400x1280 "Figure 1: The same IAM mistake, two very different blast radii. On the left the KMS gate was already open for everyone. On the right it only ever opened for Tenant A." https://www.ostering.com/media/posts/67/diagram-2-envelope-encryption.png =2400x1120 "Figure 2: Thousands of DEKs, one wrapping key, one authorisation question. The caller never touches any of them." https://www.ostering.com/ostering/ 2025-08-05T21:46:39+02:00 https://www.ostering.com/media/posts/15/ostering.jpg https://www.ostering.com/owasp-application-security-awareness-campaigns/ 2026-07-22T14:11:22+02:00 https://www.ostering.com/media/posts/9/top_ten_blog_teaser.jpg https://www.ostering.com/page/2/ https://www.ostering.com/page/3/ https://www.ostering.com/privacy-policy-for-wwwosteringcom/ 2025-08-07T11:41:10+02:00 https://www.ostering.com/programming-language-peculiarities-java-wat/ 2026-07-20T10:25:06+02:00 https://www.ostering.com/media/posts/28/coffee-66850_640.jpg https://www.ostering.com/programming-language-peculiarities-javascript-wat/ 2026-07-20T10:25:31+02:00 https://www.ostering.com/media/posts/29/code-583073_1280.jpg https://www.ostering.com/python3-notes/ 2025-08-06T11:43:35+02:00 https://www.ostering.com/media/posts/23/python.jpg https://www.ostering.com/saml-single-sign-on-with-jboss-wildfly-and-picketlink/ 2026-07-22T14:08:01+02:00 https://www.ostering.com/media/posts/17/saml_jboss.jpg https://www.ostering.com/saml-single-sign-on-with-tomcat-and-picketlink/ 2026-07-22T14:09:22+02:00 https://www.ostering.com/media/posts/18/woman-163426_1920.jpg https://www.ostering.com/sast-vs-claude-code-security-a-deep-dive/ 2026-07-22T13:48:06+02:00 https://www.ostering.com/media/posts/48/SAST_vs_Claude.jpeg https://www.ostering.com/media/posts/48/exploit_poc.jpeg =1344x768 "Exploit POC" https://www.ostering.com/scarno/ 2026-08-20T00:07:46+02:00 https://www.ostering.com/media/posts/63/blast-radius-header-scarno.png https://www.ostering.com/media/posts/63/scarno-missed-references.png https://www.ostering.com/media/posts/63/scarno-four-verdicts.png https://www.ostering.com/media/posts/63/scarno-tree-terminal.png https://www.ostering.com/media/posts/63/scarno-abi-explainer.png https://www.ostering.com/media/posts/63/scarno-ci-pipeline.png https://www.ostering.com/media/posts/63/slsa3-verification.png https://www.ostering.com/security-misnomers/ 2025-08-05T21:47:01+02:00 https://www.ostering.com/media/posts/19/airport_control-2.jpg https://www.ostering.com/slsa-and-provenance/ 2026-07-22T09:42:25+02:00 https://www.ostering.com/media/posts/61/blast-radius-cover-slsa.png https://www.ostering.com/media/posts/61/diagram-slsa-levels.png https://www.ostering.com/media/posts/61/diagram-provenance-anatomy.png =1488x1108 "Anatomy of a Provenance Attestation" https://www.ostering.com/media/posts/61/diagram-provenance-chain.png =2694x940 "Provenance Chain Diagram" https://www.ostering.com/media/posts/61/diagram-slsa-toolchain.png =2500x1120 "Provenance Toolchain Map" https://www.ostering.com/software-engineering-has-regressed-50-years-since-ai/ 2026-07-22T13:48:46+02:00 https://www.ostering.com/media/posts/55/se_regression.jpg https://www.ostering.com/media/posts/55/se_regression_timeline.png https://www.ostering.com/media/posts/55/development_vs_engineering.png https://www.ostering.com/media/posts/55/orchestrator_agent_skills.png https://www.ostering.com/media/posts/55/eight_step_engineering_process.png https://www.ostering.com/software-engineering-security-culture/ 2026-07-22T14:01:41+02:00 https://www.ostering.com/media/posts/36/mold.png https://www.ostering.com/media/posts/36/acme_sec.png =1024x1024 "Aww but that's not fun!" https://www.ostering.com/media/posts/36/the_other_team_arent_doing_it.png =1024x1024 "Not exactly leading by example" https://www.ostering.com/media/posts/36/existed_already.png =1024x1024 "If it's broken why fix it?" https://www.ostering.com/media/posts/36/ramshackle.png =1024x1024 "Yeah that'll work!" https://www.ostering.com/media/posts/36/history_repeating.png =1024x1024 "Déjà Vu" https://www.ostering.com/media/posts/36/monument.png =1024x1024 "Commemorating the ... incident" https://www.ostering.com/media/posts/36/clean-house.png =1024x1024 "Reflections on Clean Code: Why Isn’t This the Norm Everywhere?" https://www.ostering.com/media/posts/36/appsec_ratio.png =1024x1024 "The ratio of appsec engineers to software engineers is frightening" https://www.ostering.com/media/posts/36/budget.png =1024x1024 "Too few people and too few resources" https://www.ostering.com/media/posts/36/appsec-racing.png =1024x1024 "AppSec toys have arrived" https://www.ostering.com/some-thoughts-on-privacy/ 2026-07-22T09:47:45+02:00 https://www.ostering.com/media/posts/44/blast-radius-part-1.png https://www.ostering.com/media/posts/44/personal-data-taxonomy.png =1800x1170 "Personal Data Taxonomy" https://www.ostering.com/media/posts/44/data-lifecycle.png =1800x1470 "Data Lifecycle" https://www.ostering.com/media/posts/44/contextual-integrity.png =1800x1230 "Contextual Integrity" https://www.ostering.com/media/posts/44/privacy-principles-wheel.png =1800x1320 "Privacy Principles Wheel" https://www.ostering.com/media/posts/44/privacy-by-design.png =1800x900 "Cavoukian's 7 Foundational Principles" https://www.ostering.com/sparse-or-dense-claude-mythos-dan-geer-and-where-we-should-actually-be-spending-our-effort/ 2026-07-22T13:49:41+02:00 https://www.ostering.com/media/posts/56/cover-image.png https://www.ostering.com/media/posts/56/density-diagram.png https://www.ostering.com/media/posts/56/foundational-vs-application-layer.png https://www.ostering.com/media/posts/56/mosca-timeline.png https://www.ostering.com/media/posts/56/crypto-agility.png https://www.ostering.com/src2sink/ 2026-08-20T15:11:37+02:00 https://www.ostering.com/media/posts/64/blast-radius-header-src2sink.png https://www.ostering.com/media/posts/64/src2sink-silos.png https://www.ostering.com/media/posts/64/src2sink-stitched-path.png https://www.ostering.com/media/posts/64/src2sink-path-construction-2.png https://www.ostering.com/media/posts/64/src2sink-labelled-trace.png https://www.ostering.com/media/posts/64/src2sink-pii-lifecycle.png https://www.ostering.com/media/posts/64/src2sink-crypto-inventory.png https://www.ostering.com/talks/ 2025-08-19T18:32:30+02:00 https://www.ostering.com/the-wine-has-turned-to-vinegar/ 2026-10-01T09:00:20+02:00 https://www.ostering.com/media/posts/69/wine-to-vinegar.png https://www.ostering.com/media/posts/69/the-extraction-cycle.png =3200x1800 "The extraction cycle. In wine, step 5 produced a co-operative. In software, we are still at step 4." https://www.ostering.com/media/posts/69/the-spending-paradox.png =3200x1800 "Global security spending set against the cost of poor software quality in the US alone. Sources: Gartner (2026 https://www.ostering.com/media/posts/69/ai-as-cost-cutting.png =3200x1800 "Contaminated fertiliser: what happens when AI goes into the pipeline as a cost cut. Sources: GitHub, Veracode, CodeRabbit, Sonatype, Verizon DBIR, IDEsaster research." https://www.ostering.com/media/posts/69/the-farmers-are-leaving.png =3200x1800 "The farmers are leaving, and not because they are weak. Sources: Cybersecurity Ventures (2023 https://www.ostering.com/media/posts/69/someone-must-be-the-mayor.png =3200x1800 "The co-operative doesn't form itself. Who will gather the farmers?" https://www.ostering.com/threat-modeling-ai-systems-a-complete-playbook-for-practitioners/ 2026-07-20T09:55:56+02:00 https://www.ostering.com/media/posts/57/blast-radius-cover-2.png https://www.ostering.com/media/posts/57/adversarial-subspace-diagram.png https://www.ostering.com/media/posts/57/decision-boundary-transfer-diagram.png https://www.ostering.com/threat-modeling-culture/ 2025-09-21T15:13:43+02:00 https://www.ostering.com/media/posts/37/image-4.png https://www.ostering.com/media/posts/37/threat_modeling.png =1024x1024 "Feature Express" https://www.ostering.com/media/posts/37/post-releast-tm.png =1024x1024 "Threat Modeling Too Late" https://www.ostering.com/media/posts/37/without-tm.png =1024x1024 "Exponential Vulnerability Backlog Growth" https://www.ostering.com/media/posts/37/design-phase-tm.png =1024x1024 "Threat Model Early" https://www.ostering.com/media/posts/37/with-tm.png =1024x1024 "Vulnerability Utopia" https://www.ostering.com/threat-modeling-gameplay-with-eop/ 2025-10-12T18:51:54+02:00 https://www.ostering.com/media/posts/1/eop_book.jpg https://www.ostering.com/threat-modeling-mcp/ 2026-07-20T18:06:56+02:00 https://www.ostering.com/media/posts/60/blast-radius-cover-mcp.png https://www.ostering.com/media/posts/60/diagram-mcp-trust-boundary.png =2000x1120 "MCP Trust Boundary Diagram" https://www.ostering.com/media/posts/60/diagram-lethal-trifecta.png =2000x1640 "Lethal Trifecta Venn Diagram" https://www.ostering.com/media/posts/60/diagram-base-rate-funnel.png =2160x1200 "Base-Rate Funnel Diagram" https://www.ostering.com/media/posts/60/diagram-reference-monitor.png =2240x1200 "Reference Monitor Diagram" https://www.ostering.com/media/posts/60/diagram-control-tiers-strip.png =2240x880 "bounds impact vs reduces likelihood" https://www.ostering.com/threat-modeling-remotely-with-miro-and-eop/ 2026-07-20T10:28:32+02:00 https://www.ostering.com/media/posts/34/miroverse_threat_modeling_with_eop.png https://www.ostering.com/media/posts/34/convert_to_jira_issue_dialog.png https://www.ostering.com/threat-modeling-your-dependencies/ 2026-07-20T10:52:33+02:00 https://www.ostering.com/media/posts/51/TM_Deps_Feature1.jpg https://www.ostering.com/media/posts/51/vulnerability_cascade_propagation.svg https://www.ostering.com/media/posts/51/dependency_graph_score_propagation.svg https://www.ostering.com/media/posts/51/effective_score_calculation.svg https://www.ostering.com/three-brass-monkeys/ 2026-07-20T10:17:23+02:00 https://www.ostering.com/media/posts/22/ThreeBrassMonkeys.jpg https://www.ostering.com/why-sast-is-broken/ 2026-07-22T14:03:17+02:00 https://www.ostering.com/media/posts/47/sast.jpg https://www.ostering.com/media/posts/47/sqli.JPG =2752x1536 "Invisible Taint" https://www.ostering.com/media/posts/47/duplicates.JPG =2752x1536 "Duplicate Hell" https://www.ostering.com/media/posts/47/context.JPG =2752x1536 "Path Traversal" https://www.ostering.com/your-sbom-data-has-been-gathering-dust-until-now/ 2026-07-20T10:12:59+02:00 https://www.ostering.com/media/posts/50/sbom-graph-logo.jpeg https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.16.20-2.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-22.14.45.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.15.46.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.15.56.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.15.06.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.15.29.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.23.29.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.23.58.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.23.51.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-09-at-11.54.38.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-09-at-16.32.23.png https://www.ostering.com/media/posts/50/Screenshot-2026-03-04-at-21.16.40.png