mkoppmann’s mneme

New talk: Wer ESG sagt, muss auch SCI sagen

me+www@mkoppmann.at (Michael Koppmann) — Thu, 18 Jun 2026 00:00:00 GMT

Wer ESG sagt, muss auch SCI sagen

Kind: Talk

Type: Talk

Venue: sec4dev Dialogues

Date: 2026-06-18

Language: German

Resources

Slides

The Era of Green Software

me+www@mkoppmann.at (Michael Koppmann) — Sun, 22 Mar 2026 00:00:00 GMT

This is a transcript of my talk at TEDxTUWien from December 2022. The talk is about the loss of control in modern software development and its environmental impact. You can watch the video of the talk on YouTube.

Me on stage at TEDxTUWien 2022 giving my talk on the era of green software. © Oana Ianovici

Sustainable software development … what’s that?

Computers and software have taken over the world. There are more processors in this room than humans. The internet of things is growing, and now my watch can speak with my coffee machine. I wonder if they are talking about me when I’m not in the room.

But have you ever wondered why the performance of your devices degrade over time? Why your phone that was snappy 4 years ago is now barely usable anymore? It’s not because hardware gets older and slower. Software does not expire and goes bad. No, the reason is that modern software development is just awful.

Photo by Alex Knight

IT companies like to present their products like these perfectly designed tools. They await your commands and execute them flawlessly.

But in reality, they are more like Potemkin villages. They look nice from the front, but they are only hiding their bad state.

I’m a penetration tester. I get paid to hack into computer systems and find security holes. And trust me, in my career I have seen a lot of code of questionable quality. But over the years I noticed something. Something that is missing. And I don’t mean proper secure code. That’s missing too, but that is getting fixed … most of the time.

No, what I mean is the absence of some deeper understanding. That our decisions have consequences. The digital and the physical world are not two separate entities. They are the two sides of the same coin. Actions in the digital world have an impact on the physical.

When I write a piece of software, that is performing very ineffectively, that is generating way too much network traffic, that is consuming more resources than necessary, that is just using a lot of power, then I created something bad. Sure, maybe it does its job, maybe it’s useful to some people. But at what costs?

Other engineering disciplines don’t do that. Car engines are incredibly optimized. Buildings use just enough material to be safe and fulfill their function. Planes and trains they all basically look the same. Only in software engineering it’s fine that a program runs with 1% or even less of their possible performance. We are wasting resources at a large scale.

In the last couple of months, colleagues and friends came up to me and asked: “What’s the topic of your talk?”, and I usually responded with something like “Sustainable software development.” Their reaction? “That’s a thing?” Everybody speaks about digitization; everybody speaks about sustainability. But somehow these two topics are not seen as related to each other.

If I would ask you: “What is the first thing that comes to your mind when I say computers and their lack of sustainability?” What would you say? Old, inefficient hardware?

Large landfills of electronic waste? Low recycling rates?

Maybe even the use of rare-earth elements and where and how they are mined? We only think about the hardware, not the software. These things are of course also important and need to be dealt with. But it is not enough to tackle the sustainability problem just from the physical side.

The problems in software engineering

So, what are the problems that we are facing in software engineering?

Public Domain

One of them is an increasing level of complexity. This is Margaret Hamilton. She was director of software engineering for the Apollo 11 project. Next to her is a stack of paper with the source code of the Apollo Guidance Computer. About 150,000 lines of code. 150,000 lines to bring someone to the moon and back.

Photo by Caleb White

This is the Ford F150 pickup. It runs on 150 million lines of code. But bigger does not mean that it is better. Bigger means an increase in complexity and a decrease in reliability. We are losing control over the software and don’t fully understand anymore what is going on in our machines.

Another problem that we face is that developers often do not optimize their software anymore. Hardware has become “fast” enough. Memory and storage are abundant. But programs they don’t run in isolation. Running a couple of these unoptimized apps together then leads to problems due to resource exhaustion. For comparison, the operating system Windows 95 required about 50 MB of disk space. Nowadays, the mail application Outlook requires 4 GB alone, which is 82 times as big. But is it 82 times as good?

It’s actually even worse. My laptop is literally more than 100,000 times faster than the computer in the Apollo 11, but somehow it is acceptable that starting the program and opening up a single mail can take up to 15 seconds. Sometimes it is so slow that after finishing writing a sentence, I can still see the individual letters popping up one after another.

Video games can calculate millions of pixels in 16 milliseconds, but I can’t scroll on a web page in my browser without the image being jittery and lagging. Have you ever asked yourself why your expensive phone needs 30 seconds to start but a pocket calculator with a fraction of the processing power starts up instantly? It doesn’t have to be like this. There are no physical limitations that prevent this from happening.

All this also effectively locks out people who cannot afford the equipment or internet speed to run and load these oversized applications and web pages. Or they are forced to buy newer equipment, leading to more electronic waste.

Photo by Vojtech Bruzek

A modern operating system for a smartphone takes up more than 10 GB of space.

The Nokia 3310 had 1 KB of built-in memory. And you could play Snakes on that thing.

You all have probably also heard that you should unplug unused devices because they still consume power in standby. You know what doesn’t get unplugged?

Let me tell you something about zombie servers. A report from 2015 looked at over 16,000 servers in data centers. And their finding was that 25% of them were zombies. Machines that showed no signs of activities in six months or more. Another 25% to 50%, depending on the location, were idle. They were active less than 5% of the time. It would make sense to turn these servers and services off and only start them on demand, right? But we can’t. Many enterprise software projects have a slow startup phase and starting a service can take up to several seconds, even minutes, until they can handle new requests.

But some servers are never turned off because people are afraid to do so. No one in the team is fully understanding the software anymore and turning off that server could lead to problems. They have lost control. The army of zombies is rising and they are on their way to eat more and more brains … uhm I mean energy.

The problems in the world of software engineering are not unlike the problems we face with climate change. We deal with complex systems that are hard to predict. We knew for decades that change should have happened, but we waited for too long. Now we have to pay back debts that have exponentially grown.

A green future

Now, what can we do about that?

We need to work together. Programmers, managers, politicians, citizens. We have to demand that the industry finally raises the bar for what is considered acceptable quality in software. We need standards that enforce a certain level of awareness in sustainability and resource consumption.

Luckily, in the world of software, small changes can already have an impact. To give you one example: A solar-powered blog noticed that less than 1% of the visitors were causing 60% of the network traffic. 6.6 TB out of 11. The software the people used to consume the blog’s content had an error in its code, causing it to revisit the blog every couple of minutes. The change was a fix in three lines of code, eliminating terabytes of data that were no longer needed to be sent. This lowered the power use of the blog which could then stay up for 2.5 hours longer per day.

We need more of that. The Blue Angel eco-certification from the German Environment Agency is a start. They began to evaluate the power efficiency of desktop software and plan to extend the program to other kinds of applications. This makes it possible to test against certain criteria and compare between different products. When I buy a product, I want to be able to do an informed decision. Labels help in that process. Our buying behavior can show that the demand for more sustainable solutions is there.

The ecological footprint of software needs to be a relevant key metric during the development and operation of software projects. This means considering the long-term energy needs of our software and making choices that minimize their energy consumption.

Source

Right at the start of a project, choosing the right programming language can already make a huge difference. When we look at the difference in energy consumption between Java and Python, two popular languages, we can see that Java is requiring two times the energy compared to the baseline, and that Python requires 75 times more energy.

New non-profit foundations and projects like the FOSS Energy Efficiency Project or the Green Software Foundation are working with industry leading partners to create standards, tooling, and best practices for reducing greenhouse gases emissions.

New laws like the right to repair are not only a good way to reduce electronic waste. Together with forcing manufacturers to provide software updates for at least a couple of years, also make sure that the software needs to be usable on older devices. If we don’t have to throw away working hardware, that’s more sustainable.

We also need to invest more in education. In my day job, I see that developers are still lacking in knowledge about security vulnerabilities that have been known for decades. We cannot afford to repeat the same mistakes when it comes to teaching about more sustainable and environmentally-friendly programming.

Software is eating the world. It’s time to take back control. It’s time for the era of green software. Thank you very much and hack the planet!

New talk: Illegal States Are My Favorite Security Vulnerabilities

me+www@mkoppmann.at (Michael Koppmann) — Fri, 13 Mar 2026 00:00:00 GMT

Illegal States Are My Favorite Security Vulnerabilities

Kind: Talk

Type: Tutorial

Venue: BOB Konferenz

Date: 2026-03-13

Language: English

Resources

New talk: Got `Any` Excuses? Wie man sicheren TypeScript-Code erzwingen kann

me+www@mkoppmann.at (Michael Koppmann) — Wed, 01 Oct 2025 00:00:00 GMT

Got `Any` Excuses? Wie man sicheren TypeScript-Code erzwingen kann

Kind: Talk

Type: Talk

Venue: heise devSec()

Date: 2025-10-01

Language: German

Resources

New talk: Got `Any` Excuses? Writing secure TypeScript by design

me+www@mkoppmann.at (Michael Koppmann) — Thu, 04 Sep 2025 00:00:00 GMT

Got `Any` Excuses? Writing secure TypeScript by design

Kind: Talk

Type: Talk

Venue: DevSecCon Netherlands

Date: 2025-09-04

Language: English

Resources

New publication: Mit Java funktional programmieren

me+www@mkoppmann.at (Michael Koppmann) — Fri, 22 Aug 2025 00:00:00 GMT

Mit Java funktional programmieren

Kind: Publication

Type: Article

Venue: iX 2025/09

Date: 2025-08-22

Language: German

Resources

Publisher page

New publication: KI-Assistenten und LLMs – was taugt der Code?

me+www@mkoppmann.at (Michael Koppmann) — Fri, 28 Jun 2024 00:00:00 GMT

KI-Assistenten und LLMs – was taugt der Code?

Kind: Publication

Type: Article

Venue: iX 2024/07

Date: 2024-06-28

Language: German

Resources

Publisher page

New talk: The Era of Green Software

me+www@mkoppmann.at (Michael Koppmann) — Wed, 26 Jun 2024 00:00:00 GMT

The Era of Green Software

Kind: Talk

Type: Talk

Venue: sec4dev Dialogues

Date: 2024-06-26

Language: German

Resources

Slides

New talk: Typed Security: Preventing Vulnerabilities By Design

me+www@mkoppmann.at (Michael Koppmann) — Wed, 08 May 2024 00:00:00 GMT

Typed Security: Preventing Vulnerabilities By Design

Kind: Talk

Type: Talk

Venue: WeAreDevelopers Security Day

Date: 2024-05-08

Language: English

Resources

New talk: 1.400 hours for the preparation of an ISO27001 certification within 15 minutes and the connex to an espresso

me+www@mkoppmann.at (Michael Koppmann) — Tue, 30 Apr 2024 00:00:00 GMT

1.400 hours for the preparation of an ISO27001 certification within 15 minutes and the connex to an espresso

Kind: Talk

Type: Talk

Venue: SaaS Club Meetup

Date: 2024-04-30

Language: English

Resources

New publication: Anwendungssicherheit durch einen sicheren Softwareentwicklungslebenszyklus (SDLC)

me+www@mkoppmann.at (Michael Koppmann) — Tue, 19 Dec 2023 00:00:00 GMT

Anwendungssicherheit durch einen sicheren Softwareentwicklungslebenszyklus (SDLC)

Kind: Publication

Type: Article

Venue: USANCEN: TechGuard 00/23

Date: 2023-12-19

Language: German

Resources

New talk: Secure Software Development – A Short Introduction of the OWASP SAMM

me+www@mkoppmann.at (Michael Koppmann) — Tue, 09 May 2023 00:00:00 GMT

Secure Software Development – A Short Introduction of the OWASP SAMM

Kind: Talk

Type: Talk

Venue: B2B Software Days

Date: 2023-05-09

Language: English

Resources

New publication: Alternatives Autorisierungsmodell

me+www@mkoppmann.at (Michael Koppmann) — Fri, 28 Apr 2023 00:00:00 GMT

Alternatives Autorisierungsmodell

Kind: Publication

Type: Article

Venue: OCG Journal 01/2023

Date: 2023-04-28

Language: German

Resources

New talk: The Era of Green Software

me+www@mkoppmann.at (Michael Koppmann) — Sun, 11 Dec 2022 00:00:00 GMT

The Era of Green Software

Kind: Talk

Type: Talk

Venue: TEDxTUWien

Date: 2022-12-11

Language: English

Resources

New publication: Utilizing Object Capabilities to Improve Web Application Security

me+www@mkoppmann.at (Michael Koppmann) — Wed, 16 Nov 2022 00:00:00 GMT

Utilizing Object Capabilities to Improve Web Application Security

Kind: Publication

Type: Paper

Venue: ACIG Journal 2022, Volume 1

Date: 2022-11-16

Language: English

Resources

New talk: Type-Driven Domain Design: Use the Types, Luke!

me+www@mkoppmann.at (Michael Koppmann) — Wed, 05 Oct 2022 00:00:00 GMT

Type-Driven Domain Design: Use the Types, Luke!

Kind: Talk

Type: Talk

Venue: heise devSec()

Date: 2022-10-05

Language: German

Resources

New talk: Object Capabilities and Their Benefits for Web Application Security

me+www@mkoppmann.at (Michael Koppmann) — Thu, 15 Sep 2022 00:00:00 GMT

Object Capabilities and Their Benefits for Web Application Security

Kind: Talk

Type: Talk

Venue: IKT-Sicherheitskonferenz

Date: 2022-09-15

Language: German

Resources

New talk: Typed Security – Preventing Vulnerabilities By Design

me+www@mkoppmann.at (Michael Koppmann) — Fri, 09 Sep 2022 00:00:00 GMT

Typed Security – Preventing Vulnerabilities By Design

Kind: Talk

Type: Talk

Venue: sec4dev Conference & Bootcamp

Date: 2022-09-09

Language: English

Resources

New talk: Type-Driven Domain Design – Security in the Fabric of Your Code

me+www@mkoppmann.at (Michael Koppmann) — Fri, 25 Mar 2022 00:00:00 GMT

Type-Driven Domain Design – Security in the Fabric of Your Code

Kind: Talk

Type: Talk

Venue: Domain-Driven Design Vienna Meetup

Date: 2022-03-25

Language: German

Resources

New talk: Type-Driven Domain Design – Security in the Fabric of Your Code

me+www@mkoppmann.at (Michael Koppmann) — Wed, 26 Jan 2022 00:00:00 GMT

Type-Driven Domain Design – Security in the Fabric of Your Code

Kind: Talk

Type: Talk

Venue: Security Meetup by SBA Research

Date: 2022-01-26

Language: English

Resources

New publication: Object Capabilities and Their Benefits for Web Application Security

me+www@mkoppmann.at (Michael Koppmann) — Mon, 22 Nov 2021 00:00:00 GMT

Object Capabilities and Their Benefits for Web Application Security

Kind: Publication

Type: Thesis

Venue: Master thesis

Date: 2021-11-22

Language: English