Dan’s upcoming schedule

DASH

The npm registry hosts over 3 million packages and serves 400 million downloads every month, which makes it an attractive target for attackers. In 2025 and 2026, the ecosystem saw a sharp escalation in supply chain attacks: phishing campaigns targeting maintainers, credential theft at scale, and the first self-replicating worms spreading through package dependencies.

In this talk, we’ll review the most impactful supply chain attacks of 2025 and 2026, and share an actionable roadmap that defenders can use to harden their build pipelines and developer practices to prevent compromise.

09 June 2026

Infobip Shift

This talk is a technical field report from building a multi-model security research agent for scattered public evidence: documentation, blogs, RFCs, source repositories, changelogs, and policy pages. The agent has to produce answers a human reviewer can trust, not just well-formed output. That requirement exposes a useful distinction: whereas operational reliability handles broken runs, malformed JSON, retries, and recovery, epistemic reliability asks whether a model’s claim is actually supported by evidence. I will walk through the controls that work: source scoping, deterministic tooling, citation discipline, runtime evidence trails, repeated-run comparison, task-specific model choice, durable human review, and deliberate sandbox constraints. Non-determinism is treated honestly, as both antagonist and superpower: something to constrain for reproducible results, measure when answers vary, and leverage for truly exploratory research. Attendees will leave with practical patterns for building and evaluating production research agents as evidence systems, not just stochastic answer machines.

14 September 2026