Explosive overflow: Lessons from rocket science by Mark El-Khoury

From Pentest PDFs to Systems Thinking

Mark El-Khoury recounts moving from repetitive penetration testing (“bug-to-PDF factory”) to product security engineering, inspired by Kelly Shortridge’s view that security is a subset of system resilience—not isolated component checks.

Ariane 5 and Integer Overflow

The Ariane 5 maiden flight exploded 30 seconds after launch when a 64-bit inertial velocity value converted to 16-bit overflowed, crashing guidance software—a famous case of reused Ariane 4 assumptions without range analysis despite static analysis tooling available pre-launch.

Secure Development Reality

Effective programs pair static analysis, dependency review, IaC scanning, secret removal, threat modeling, and training with engineering-friendly culture: low friction, psychological safety, and avoiding reflexive “no” that teams ignore. White House cyber policy highlights hardware, formal methods, and memory-safe languages—each costly at scale (e.g., rewriting massive C++ game engines impractical).

Google and Industry Memory Safety

Google’s advancing memory safety paper acknowledges gradual Rust adoption plus hardening C/C++ because full rewrites are unrealistic. Formal verification (Amazon s2n-TLS) works but demands enormous specialized effort; Ken Thompson’s trusting-trust essay reminds limits of any single assurance layer.