Secure Coding: Principles and Practices

What This Book Does Not Cover

The following topics are outside the scope of this concise book. We generally do not supply:

Cookbook examples

Fine books have been written (and no doubt will continue to be written) that provide the reader with detailed examples of how to code securely in various programming languages. How can you open files securely? We talk about it. How can you do better than Kerberos 4 (first release) at random-number generation? We explain the problem. But we rarely show with a code excerpt how to do X in Y. That goal—a worthy one—was not what we set out to do. Indeed, we firmly believe that attempting to write secure software using nothing but examples (however good they are), while lacking the fundamental understanding of security we try to convey in this book, would be akin to trying to cook a great gourmet meal armed with nothing more than an ingredient list. While a great chef could certainly do just that, most people couldn't. The chef, you see, already has the fundamental skill of knowing how to cook food properly.

"How to [verb] the net-[noun] in [vendor-name] [product-name]"

You will find very few references here to specific operating systems, products, or utilities. Unless we need to clarify a concept, we avoid that territory. For one reason, it dates quickly. For another, there are many good books and magazines available already that fill that need. Most importantly, we believe that such specifics would distract you (and us) from the reflective ...