Secure Programming Cookbook for C and C++

We Can’t Do It All

There are plenty of things that people may find to criticize about this book. It’s too broad a topic to make a perfect book (that’s the motivation for the web site, actually). Although we believe that this book is likely to help you a great deal, we do want to address some specific issues so at least you’ll know what you’re getting if you buy this book:

This book is implementation-focused.

You’re not likely to build secure software if you don’t know how to design software to be secure from the get-go. We know that well, and we discuss it at great length in the book Building Secure Software. On the other hand, it’s at least as easy to have a good design that results in an insecure implementation, particularly when C is the programming language you’re using. Not only do our implementation-level solutions incorporate good design principles, but we also discuss plenty of issues that will affect your designs as well as your implementations. The world needs to know both how to design and how to implement with security in mind. We focus on the implementation so that you’ll do a better job of it. Nonetheless, we certainly recommend that you read a book that thoroughly covers design before you read this book.

This book doesn’t cover C++ well enough.

C++ programmers may grumble that we don’t use any C++ specific idioms. For the most part, the advice we give applies to both languages, but giving all the examples in C makes them more applicable, because practitioners in both ...