Premium Only Content

Into the Rabbit Hole: Grumpy Experts Shed Light on the Repeating AppSec Challenges
In this long-form episode of **Dan on Dev**, I’m joined by **Rafal Los**, veteran security strategist and host of *Down the Security Rabbit Hole*. We go deep into the persistent challenges of application security—why they still exist, what we’ve learned (or failed to learn) over the decades, and what real maturity looks like for dev and security teams in 2025.
Whether you're a security leader, AppSec engineer, or developer trying to understand the tension between feature delivery and secure coding—this conversation is packed with insight, sarcasm, and truth bombs from two battle-tested voices in the industry.
🔍 **What you'll learn in this episode:**
- Why the same AppSec issues keep resurfacing—even decades later
- How metrics like time-to-fix and defect recurrence help (or don’t)
- The danger of building tech without business context
- Why many security efforts fail due to poor measurement and collaboration
- Balancing old code debt with future development priorities
- How developers, not just tools, must be enabled and incentivized
- The legacy of 2600, OWASP, and our collective history in security
---
⏱️ **Chapters:**
1. 00:00 – Introduction & welcome
2. 02:04 – Rafal’s AppSec background: from 286s to ExtraHop
3. 05:00 – Early frustrations: appsec at GE and “magic numbers”
4. 07:25 – Are we winning? Problem growth vs. solution pace
5. 10:30 – Cloud, frameworks, and expanding problem space
6. 13:02 – Fixing isn't just technical: org dynamics and dev behavior
7. 16:25 – Metrics that matter: magic numbers revisited
8. 19:45 – Why devs hate AppSec: legacy issues and bad engagement
9. 22:12 – Risk without business context = meaningless security
10. 25:01 – Real maturity = knowing when to stop spending
11. 28:30 – Law of diminishing returns in AppSec investment
12. 31:00 – The reality of legacy tech debt and microservices
13. 34:50 – Security vs. business pressure: the CTO’s lesson
14. 38:00 – Incentivizing safe code vs. just preaching it
15. 41:10 – Recurring defects and their hidden costs
16. 44:30 – Metrics wrap-up & philosophical closing
---
🌐 **Explore more**
- Website: https://danondev.com
- Twitter: @Dan_On_Dev
- Instagram: @dan_on_dev
- Facebook: @danondev
-
LIVE
Sean Unpaved
1 hour agoSnap Counts & Showdowns: Hunter's Usage, CFB Fire, & Playoff Baseball Bonanza
10,671 watching -
56:09
Steven Crowder
4 hours agoBlack Fatigue is Real and I Told Them Why | Black & White on the Gray Issues
253K769 -
LIVE
Simply Bitcoin
1 hour agoLEAKED CONVERSATION: US SECRET Bitcoin Plan EXPOSED?! | EP 1350
92 watching -
LIVE
StoneMountain64
1 hour agoBF6 Full Release Gameplay Review - I have been playing EARLY
98 watching -
LIVE
Barry Cunningham
13 hours agoBREAKING NEWS: PRESIDENT TRUMP HOSTS FULL CABINET MEETING!
1,494 watching -
LIVE
The Charlie Kirk Show
1 hour agoTurning Point Halftime + Antifa Panel Aftermath + Right-Wing Taylor Swift? |Patrick, Cuomo|10.9.2025
6,418 watching -
4:27:44
Right Side Broadcasting Network
5 hours agoLIVE REPLAY: President Trump Hosts a Cabinet Meeting - 10/9/25
87.2K37 -
LIVE
Mark Kaye
1 hour ago🔴 Schumer BUSTED Celebrating Democrat Shutdown!
955 watching -
1:00:33
Timcast
2 hours agoTrump To Declare Antifa FOREIGN Terrorist Org, Antifa Leaders FLEE Country
120K46 -
2:41:53
MattMorseTV
3 hours ago $4.58 earned🔴Trump's Cabinet Meeting BOMBSHELL.🔴
40.7K27