Wednesday

This block bundles several Breaking Ground sessions. The opening talk argues that an input parser can correctly reject a file and still leave partial writes in live program state. The speaker demonstrates a loader that returns an error after already overwriting a function pointer, then surveys fifteen widely used C parsers and finds that most mutate caller-owned state before validation. The suggested fix is to parse into a staged copy and commit only after the full input has been validated.

A second talk looks at Apache Airflow deployments exposed on the internet. The speaker reports default administrator credentials, secrets kept in variables and DAG source, an unauthenticated Redis broker, a weak token signing check, and a connections API that masks sensitive fields by name rather than by value, exposing a Slack webhook. A third session describes a red-team exercise that published dependency-confusion packages to npm, which were later analysed and mistaken for a real supply chain campaign. The speaker discusses how public publishing leaks operational details and how such packages persist in caches and mirrors.

The remaining sessions cover an Argentine transport operator whose exposed systems were reached through a chain of small flaws, and a closing keynote about open, replicable pharmaceutical projects. The common thread is that small validation gaps, leaked credentials and careless public publishing create real exposure. The practical guidance includes staging writes, rotating exposed secrets, isolating brokers and consoles, pinning dependencies and tightening rules of engagement for red teams.