Speaking

DEF CON 23 talk (2015), also given at ToorCon 17 and ROOTCON 9, on cryptographic weaknesses and supply-chain attacks through Git internals, and how they put development pipelines at risk.

DEF CON 22 talk (2014) on how much internet infrastructure runs on open-source software that nobody has reviewed and nobody is funded to secure. Built the dataset behind it: 2,000+ open-source projects analyzed with a Jenkins pipeline on an AWS spot fleet.

Talks and lectures since 2002, including DEF CON 22 and 23, Chaos Communication Camp, ToorCon, DerbyCon, GrrCON, ROOTCON, BSides, Stanford, JavaOne, and ISC2, where he is listed as a Top Rated Speaker.

Security research on video and audio: the W8MEJ YouTube channel, Complex Systems Live on Twitch, and the Zero Noise Collective podcast.

Lecture for the ISC2 West Michigan chapter on why external scrutiny and bug bounty programs find what internal testing misses. Recurring ISC2 speaker, listed as a Top Rated Speaker.