On Fri, 2003-06-20 at 10:26, chewie wrote: > You know, I find myself agreeing with David (wow!) in regards to secure > programming. It's a methodology that programmers follow. Any language > has it's security risks, some more than others. If the programmer uses > the correct methodology and approach to writing software, security > problems are often mitigated before they have a chance to be > distributed. Often is the key word here. The most concientious > programmer can still slip up occassionally; we are fallible. Right. Of course, there's the whole field of Software Engineering that tries to find better approaches to writing software, managing bugs, and estimating the time and manpower needed to do all of that. I'm not nearly anal enought to be a good SE, so I shouldn't say too much ;-) There are a number of simple things that can be done to reduce the number of bugs in code and to assist in the bug-hunting process. Unfortunately, I haven't seen many of these ideas distributed widely -- at least not in a simple form. There is the "Secure Programming for Linux and Unix HOWTO" [http://www.dwheeler.com/secure-programs/], but that document is very hefty. There are a lot of platform- and language-specific techniques out there, but a lot of things are much more widely applicable. Always check error codes, remember to free allocated memory and be careful with pointers (in languages that matter), ensure you're properly handling boundary conditions (in "for" loops, for instance)... Those are just a few. I think many of them should probably be listed in chapter 1 or 2 of programming reference manuals, or at least put in a good frequently-referenced appendix. But, maybe I'm just lazy and haven't bothered to look in the appropriate parts of books I have... That reminds me of Larry Wall's Three Great Virtues of a Programmer: laziness, impatience, and hubris. Of course, you can't be a great programmer by being lazy and impatient, you need to have hubris too (defined in part as "the quality that makes you write (and maintain) programs that other people won't want to say bad things about") [http://www.netropolis.org/hash/perl/virtue.html] -- _ _ _ _ _ ___ _ _ _ ___ _ _ __ Famous last words - Don't / \/ \(_)| ' // ._\ / - \(_)/ ./| ' /(__ worry, I can handle it. \_||_/|_||_|_\\___/ \_-_/|_|\__\|_|_\ __) [ Mike Hicks | http://umn.edu/~hick0088/ | mailto:hick0088 at tc.umn.edu ] -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://shadowknight.real-time.com/pipermail/tclug-list/attachments/20030620/500b2869/attachment.pgp