Full Disclosure mailing list archives
Re: Off topic programming thread
From: Brett Hutley <brett () hutley net>
Date: Thu, 30 Oct 2003 10:50:32 +1100
Alexandre Dulaunoy wrote:
On Wed, 29 Oct 2003, Bill Royds wrote:I agree that one can write secure code in C, but I am saying that C doesn't help in writing it. Perhaps we need to "deprecate" some C standard library functions and syntaxVarious attempts to move to a specific dialect of C exists, I don'treally know the efficiency of that.http://www.research.att.com/projects/cyclone/ On the other side, an interpreter of C can also be used to checkconsistency of the software and reaction inside a 'kind of' vm.http://root.cern.ch/root/Cint.htmlIt's only a part of the cake.Every ingredient are important for the taste of the cake, taste is security and cake is software.
Well, security is one component of the taste. The cake wouldn't taste too good if it didn't do what you wanted it to do. To hammer a round metaphor in a square hole; if you were a prisoner, the cake would taste of ashes if it DIDN'T contain a file :) An email client can be the most secure bit of software in the world, but if it doesn't allow you to send miscellaneous streams of blather to mailing lists at the stroke of a key it's not much good to you, is it? The bit of software *must* fulfill it's original purpose above all else - and just achieving this can be hard.
"Purify" and the ilk are important tools... compiling with maximum warning enabled... Making good use of "const correctness"... linting your source... Having snippets of code available that you've extensively tested for doing various tasks... Using metadata to create boilerplate code... Having a good test environment set up... Code reviews... the list goes on, but the most important thing of all is having a programmer knowledgable enough to USE these tools!
I think the number of "secure programming" books that have hit the bookstores currently are a good thing (I have 2 in my O'Reilly bookshelf at the moment), the problem is that it will take time for the programming culture to give security the importance it deserves. Increasing an application's security is only now starting to have a positive effect on the average programming shop's bottom-line. The tide is slowly turning with regard to being benchmarked on security. People who are buying our systems are starting to put the systems through various security tests, and security has become an important factor in rating the competition - an excellent sign!
Cheers, Brett -- Brett Hutley [MAppFin,CISSP,SANS GCIH] mailto:brett () hutley net http://hutley.net/brett _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Off topic programming thread Schmehl, Paul L (Oct 27)
- <Possible follow-ups>
- RE: Off topic programming thread madsaxon (Oct 27)
- Re: Off topic programming thread Bill Royds (Oct 27)
- Re: Off topic programming thread Brett Hutley (Oct 28)
- Re: Off topic programming thread Bill Royds (Oct 29)
- Re: Off topic programming thread Alexandre Dulaunoy (Oct 29)
- Re: Off topic programming thread Brett Hutley (Oct 29)
- Re: Off topic programming thread Bill Royds (Oct 29)
- Auditing code for security problems Bill Royds (Oct 29)
- Re: Off topic programming thread Bill Royds (Oct 27)
- Re: Off topic programming thread Brett Hutley (Oct 29)