d

Secure programming: The Complete Documentation

• This category contains 5 Papers
• The last paper was added on 2007-03-26 (YYYY-MM-DD)

Best Practices for Secure Development

Published on 2001, by Razvan Peteanu, ©Razvan Peteanu.

The following document is intended as a guideline for developing secure applications. It is not about how to configure firewalls, intrusion detection, DMZ or how to resist DDoS attacks. In short, it is not about infrastructure and network security. Compared to a year ago, the availability of consolidated material intended for developers has definitely improved but effort is still required to make the developer community more security-aware.

Secure programmer: Minimizing privileges

Published on 2004-05-20, by David A. Wheeler, ©David A. Wheeler.

Secure programs must minimize privileges so that any bugs are less likely to be become security vulnerabilities. This article discusses how to minimize privileges by minimizing the privileged modules, the privileges granted, and the time the privileges are active. The article discusses not only some of the traditional UNIX-like mechanisms for privileges, but some of the newer mechanisms like the FreeBSD jail(), the Linux Security Modules (LSM) framework, and Security-Enhanced Linux (SELinux).

Secure Programming for Linux and Unix HOWTO

Published on 2003-03-03, by David A. Wheeler, ©David A. Wheeler.

This book provides a set of design and implementation guidelines for writing secure programs for Linux and Unix systems. Such programs include application programs used as viewers of remote data, web applications (including CGI scripts), network servers, and setuid/setgid programs. Specific guidelines for C, C++, Java, Perl, PHP, Python, Tcl, and Ada95 are included.

Secure Scripting

Published on , by Dan Goscomb, ©Dan Goscomb.

These days there are a lot of people that release scripts and programs on to the internet which people will then download and use without a second thought that they may contain the simplest of security holes which can allow malicious people to attack their servers.

Wrong-Errors Bugs: A New Class of Bug?

Published on 2004-02-09, by Dan Tow, ©O'Reilly Media, Inc..

Above all else, we count on databases to reflect the truth consistently, or at least to reflect the table data perfectly. The database cannot be blamed when an application (or the end users of an application) place inaccurate data in its tables, but a database must accurately report the data it holds. Therefore, bugs are not all created equal; there are bugs, and there are wrong-rows bugs, bugs that silently misrepresent the data that the tables hold. Even the craziest, most obscure corner case that potentially misrepresents your data should rightly bring a loud chorus: "The emperor has no clothes!" We depend on the database, above all, not to lie.