DEFCON

Backdooring Git (DEF CON 23)

DEF CON 23 talk (2015), also given at ToorCon 17 and ROOTCON 9, on cryptographic weaknesses and supply-chain attacks through Git internals, and how they put development pipelines at risk.

Open Source Fairy Dust (DEF CON 22)

DEF CON 22 talk (2014) on how much internet infrastructure runs on open-source software that nobody has reviewed and nobody is funded to secure. Built the dataset behind it: 2,000+ open-source projects analyzed with a Jenkins pipeline on an AWS spot fleet.