DC iOS/iOSoho: Code to Avert Catastrophe
Code to Avert Catastrophe
Mike Sanderson
2021 saw yet another software security catastrophe, when in March a ransomware cyberattack on a pipeline led to its shutdown and to Americans in the southeastern US waiting in gas lines (https://www.reuters.com/business/colo.... Putting an end to this kind of disaster must be a priority for our society and for our industry. Even when making consumer apps, stakeholders don’t like to see critical bugs.
This talk will start with two brief sections: First, I will demonstrate a critical bug in an iOS medical app I found and reported earlier this year, in the wild as a user. The bug was in the UI layer, and required no technical knowledge to find, though iOS developers will be able to identify the simple animation coding mistake led to a highly exploitable breach. Second, I will look at a 2017 article in the Atlantic, "The Coming Software Apocalypse: A small group of programmers wants to change how we code—before catastrophe strikes" (https://www.theatlantic.com/technolog..., and look at its understanding of why the software industry has been unable to prevent these disasters.
Third, the majority of the talk will look at code I wrote in 2021 and how recent software trends are trying to stem this tide of catastrophe: The uses and the limitations of automated tests (or why “test-passenger development” isn’t a thing); the importance of declarative interfaces; and why functional-reactive programming to eliminate entire categories of bugs.
Mike Sanderson has been an iOS developer in Brooklyn since iOS 6. Recent projects include Gatorade Gx, shipped on-time in June 2020. They can be reached at https://mikesand.com.