Recent content on Florian Noeding's blog

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 This is the 45-minute version of my BSides San Francisco 2025 talk of the same name, and nearly identical to the SAINTCON 2025 talk 
 Materials: 
 
 slide deck: The Art of Cybersecurity Mastery.pdf 
 recording: will be added once…

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 Lessons learned and advice I’m giving to my mentees: how to get into cybersecurity or advance their careers. This talk covers my own journey spanning 15 years of professional experience to eventually achieving the Principal (director-level,…

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 Page content will be added later. For now you can watch the video on YouTube. 
 
 recording: How to Ace Your Interview - Navigating the Product Security Interview in 20 minutes 


 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 Lessons learned and advice I’m giving to my mentees: how to get into cybersecurity or advance their careers. This talk covers my own journey spanning 15 years of professional experience to eventually achieving the Principal (director-level,…

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 I’m honored to share that I’ve been invited to be part of the review comittee for BSides San Francisco 2025. I’ve reviewed 100+ proposals (talks, workshops, etc.) for content quality and presentation.

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 During BSides Salt Lake City 2025 I’ve hosted a workshop to practice interviewing skills for application security / product security. 
 Application Security interviews can be challenging, but the right preparation can set you apart. In…

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 The world’s economy relies heavily on C/C++ applications, yet a staggering 70% of CVEs affecting these applications are due to memory safety flaws. Rewriting all code in memory-safe languages is infeasible, necessitating smarter approaches. In…

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 War stories and practical advice from scaling static analysis and software composition analysis across 100s of products and 10k+ developers in a complex enterprise environment. 
 This talk discusses feedback loops, nudging vs enforcement,…
Effective communication is hard: adversary journey mapping applied to curl CVE-2023-38545.
Effective communication is hard: sharing intent, pyramid principle and strategies are useful tools that help me in my work as a security leader.
SBOMs are awesome and make security work transparent. But if we are not careful, they might be used to enforce compliance instead of fixing what really matters.

 
 I am employed as a Principal Security Architect at Adobe at the time I published this article. All opinions
 are my own.
 
 
 I’m writing about Project Kodiak, Adobe’s source code analysis platform, over at Adobe’s tech blog: 
 
 2023-06-22 Overview of Project Kodiak 
 2024-04-12 BSidesSLC 2024 - Scaling Automated Code Analysis Across an…
I always wanted to understand how a CPU works, how it transitions from one instruction to the next and makes a computer work. So after reading Ken Shirrif’s blog about a bug fix in the 8086 processor I thought: Well, let’s try to write one in a hardware description language. This post is a write up of my learning experiment. 
 I’ll walk through my steps of creating an…
German style bread is one of my staple foods. Since living in the US it has become even more important: it’s really difficult to get good bread here. If you want to bake your own, here’s my recipe. 
 
 
 This recipe is designed to be simple to bake and tolerates a wide range of changes to weights and times, even by accident. This is a good starting point without getting…
Hey! 
 I’m a cyber security leader currently serving as a Principal Security Architect at Adobe. As a part-time creator I occasionally share technically deep, long-form content. 
 I believe in a pragmatic, software engineering-informed approach to security - one that balances risk with business velocity. I advocate for a dual-pronged strategy: tackling immediate threats and…
In this talk I gave a brief over the why, what and how of the Amazon EC2 Container Service. 
 The slides are here: ECS - Amazon EC2 Container Service

 Breaking Down Successful Pair Programming 
 
 
 
 
 Would have loved to read this article a few months ago. It describes really well, and goes beyond, what I learned about pair programming as a way of mentoring. 
 
 Summary
 
 
 
 
 Pair efficiency is mostly determined by the effectiveness gap . This value describes the differences in domain…
Load Balancing in the context of websites and webservices is a way to distribute incoming traffic across multiple servers. There are multiple techniques do this which I will explain in this post. But first let me explain the relationship between load balancing, load sharing and high availability. 
 Load sharing statically distributes traffic across servers according to a fixed ratio. Neither…
How do you make sure that a compiler really works? You write some kind of automated tests. But what kind of test is useful and is not too much additional work? 
 The goal of testing is to make sure that the generated programs do what was specified in the source code. Here we need to make sure that we don’t introduce any errors on several stages during compilation: Lexing / parsing, desugaring,…
In the previous post I’ve shown how to compile mathematical expressions to executable code. In this post I’ll show how to add mutable variables to the expression compiler. 
 
 Single Static Assignment
 
 
 
 
 LLVM uses a SSA form to represent variables. In SSA form a variable can be assigned a value only once. This makes it easier to write optimizations, since…
In this post I’ll describe the basic ideas of generating executable code using LLVM and the Python bindings llvm-py . Let’s start with some more details about walking the AST. 
 
 Walking the AST
 
 
 
 
 In the last post I’ve already described that the AST is traversed in postorder. The concrete implementation can be done in several ways. One of them is the visitor…
In the previous stages the Lexer and Parser rejected invalid inputs. That’s also the job of this phase: We want to find out if the program adheres to certain semantic rules – the meaning of language constructs. 
 Let’s start simple. What is wrong with the following top level code? 
 def f (x as int32) as int32
 {
 if x == 0 
 {
 break ;
 }
 return 42 ;
 }
…
Certain syntactic constructs in a programming language are redundant and serve only the purpose of making life easier for the programmer: They are syntactic sugar. A good example is the augmented assign operator in many languages: 
 x += a which is just another way of writing x = x + a but is often more readable and works usually for any operator. 
 To implement this functionality you have…
In this part I’ll explain how I’ve implemented the lexer and parser for Exoself in a simplified manner. I’ll again use the example of a mathematical expression parser to explain the basics and later describe some more advanced problems. 
 If you want to follow this in an interactive manner download ANTLRWorks . That’s an IDE for grammar development using ANTLR. After copy & pasting, click on…
For writing my compiler I’m using the following tools 
 
 Python 
 ANTLR 
 LLVM 
 
 Besides these some of my standard tools for writing code are a Linux environment (Kubuntu) with vim and git. 
 
 Python
 
 
 
 
 The choice of implementation language for my compiler was limited by the available bindings for my tools and my personal preferences. I…
I’m trying to write a new programming language and will document some ideas and problems that I’m encountering here. 
 The elementary structure of my compiler is as follows: 
 
 lexing 
 parsing 
 AST postprocessing 
 semantic analysis 
 code generation 
 
 I’ll explain these terms using a simple evaluator for mathematical expressions. Valid expressions start…