Monday

This Common Ground stream block gathers several short talks rather than a single presentation. The opening segment treats USB docking stations as small embedded computers and shows how a hub controller's firmware update path can be abused through a browser-based updater, since the controller accepts any well-formed 8051 image. A later segment is a policy talk from a long-time digital rights lawyer, who recounts the court fight that freed strong encryption from export controls and argues that privacy acts as a check on power.

Other segments focus on practical engineering. One covers an application security team's attempt to automate CVE fixes and flaky-test repairs in CI, and why interactive LLM sessions with rich context worked better than autonomous bots. A post-quantum PKI lab walkthrough shows how to build a test certificate hierarchy using ML-DSA and ML-KEM on Windows and Linux. A drone airspace talk explains remote ID coverage, sensor limits, and why jamming or kinetic responses are poor choices. A supply chain segment covers malicious package releases, install scripts, and dependency confusion with private registries.

The main takeaways are defensive: pin dependencies, restrict install scripts, monitor critical packages, keep root certificate authorities offline, and treat recurring pipeline failures as a security signal. Depth varies a lot across the block, from policy discussion for general audiences to firmware and cryptography detail.