The statements and opinions expressed here are my own and do not necessarily represent those of Oracle Corporation. Oracle does not reflect my views.

Commandments:

• Please obfuscate your code making it, at best, unobviously broken. Even if the code isn't important.
• Global state has been a known bad idea for forty years. Please don't do.
• Corollary of either of the first two commandments: Singletons are pure evil. Don't.
• Please think about encapsulate. That implies not shoving getters and setters all over the place. Also prefer not use implementation inheritance and avoid protected. Generally limit unnecessary access and implied implementation, even on larger scales.
• Please practice good dependency hygiene. Yeah it's not interesting, but turns out to be really important for a number of reasons.
• If you're doing layers of security, please do check each layer individually.
• Please don't give nulls a meaning. Throw an NPE.

Things that are wrong:

• "Postel's Law". Good for UI, but for machine interface you wont catch errors and differences fixing mistakes allows TOCTOU-style vulnerabilities.
• Given enough eyeballs, all bugs are shallow. Increasing the number of reviewers decreases the depth each one expends on the problem. It's the maximum depth which is crucial unless the problem is trivial in which case who cares.
• Vulnerabilities are the adversary's fault. Vulnerabilities are the fault of the party that decided to ship the faulty product.

2012: 20th anniversary year of getting chucked out of first year CompSci.

Work: A "Vulnerability Engineer" in the Java SE Security team for Oracle Corporation UK Ltd.

Top advice: If I were you, I wouldn't be starting from here.

Toast advice: Look after the corners and the middle will look after itself.

Me:

In the next few months, I shall be going to:

• Apr 2013, ACCU, Bristol, UK

Recentish past events:

• 14-16 Nov 2012, Devoxx, Antwerp
• Aug 2012, DEF CON, Las Vegas, NV
• Aug 2012, BlackHat USA, Las Vegas, NV
• 25-28 Apr 2012, ACCU, Oxford, UK
• 16-18 Nov 2011, Devoxx, Antwerp
• 12 Nov 2011, ACCU Autumn Conference, Bletchley Park
• 14-15 Nov 2011, Stack Overflow Devdays, London
• 5-7 Aug 2011, DEF CON, Las Vegas, NV
• 3-4 Aug 2011, BlackHat USA, Las Vegas, NV
• 13-16 Apr 2011, ACCU, Oxford, UK
• 12 Apr 2011, "A day of deliberate practice", Oxford, UK
• 17-19 Nov 2010, Devoxx, Antwerp
• 14-17 Apr 2010, ACCU, Oxford, UK
• 18-20 Nov 2009, Devoxx, Antwerp
• 7 Nov 2009, ACCU Security, Bletchley Park
• 2 Nov 2009, Stack Overflow DevDay, Amsterdam
• 28 Oct 2009, Stack Overflow DevDay, London, UK
• 31-2 Jul/Aug 2009, DEFCON17, Las Vegas, NV
• 29-30 Jul 2009, BlackHat USA, Las Vegas, NV