Secure Programming Cookbook for C and C++

Foreword

There is a humorous, computing-related aphorism that goes like this: “There are 10 types of people: those who understand binary, and those who don’t.” Besides being amusing to people who understand number representation, this saying can be used to group people into four (or 100) categories:

• Those who will never quite get the meaning of the statement, even if it is explained to them

• Those who need some explanation, but will eventually get the meaning

• Those who have the background to grasp the meaning when they read it

• Those who have the knowledge and understanding to not only see the statement as obvious, but be able to come up with it independently on their own

There are parallels for these four categories in many different areas of endeavor. You can apply it to art, to cooking, to architecture...or to writing software. I have been teaching aspects of software engineering and security for over 20 years, and I have seen it up close. When it comes to writing reliable software, there are four kinds of programmers:

• Those who are constantly writing buggy code, no matter what

• Those who can write reasonable code, given coaching and examples

• Those who write good code most of the time, but who don’t fully realize their limitations

• Those who really understand the language, the machine architecture, software engineering, and the application area, and who can write textbook code on a regular basis

The gap between the third category and the fourth may not seem like much to some readers, but there ...