full-disclosure - Off topic programming thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3FA05248.5080305@hutley.net>
From: brett at hutley.net (Brett Hutley)
Subject: Off topic programming thread

Alexandre Dulaunoy wrote:

> On Wed, 29 Oct 2003, Bill Royds wrote:
> 
> 
>>I agree that one can write secure code in C, but I am saying that C doesn't
>>help in writing it.
>>Perhaps we need to "deprecate" some C standard library functions and syntax
> 
> 
> Various attempts  to move to a  specific dialect of C  exists, I don't
> really know the efficiency of that. 
> 
> http://www.research.att.com/projects/cyclone/
> 
> On  the other side,  an interpreter  of C  can also  be used  to check
> consistency of the software and reaction inside a 'kind of' vm. 
> 
> http://root.cern.ch/root/Cint.html
> 
> It's only a part of the cake. 
> 
> Every ingredient  are important  for the taste  of the cake,  taste is
> security and cake is software.

Well, security is one component of the taste. The cake wouldn't taste 
too good if it didn't do what you wanted it to do. To hammer a round 
metaphor in a square hole; if you were a prisoner, the cake would taste 
of ashes if it DIDN'T contain a file :) An email client can be the most 
secure bit of software in the world, but if it doesn't allow you to send 
miscellaneous streams of blather to mailing lists at the stroke of a key 
it's not much good to you, is it? The bit of software *must* fulfill 
it's original purpose above all else - and just achieving this can be hard.

"Purify" and the ilk are important tools... compiling with maximum 
warning enabled... Making good use of "const correctness"... linting 
your source... Having snippets of code available that you've extensively 
tested for doing various tasks... Using metadata to create boilerplate 
code... Having a good test environment set up... Code reviews... the 
list goes on, but the most important thing of all is having a programmer 
knowledgable enough to USE these tools!

I think the number of "secure programming" books that have hit the 
bookstores currently are a good thing (I have 2 in my O'Reilly bookshelf 
at the moment), the problem is that it will take time for the 
programming culture to give security the importance it deserves. 
Increasing an application's security is only now starting to have a 
positive effect on the average programming shop's bottom-line. The tide 
is slowly turning with regard to being benchmarked on security. People 
who are buying our systems are starting to put the systems through 
various security tests, and security has become an important factor in 
rating the competition - an excellent sign!

Cheers, Brett
-- 
Brett Hutley [MAppFin,CISSP,SANS GCIH]
mailto:brett@...ley.net
http://hutley.net/brett