1–10 of 14 posts
Can you recommend any resources on secure development for new C programmers?
One thing to note, they split them into recommendations and rules. Recommendations are more stylistic and open to debate, whereas violations of rules generally result in definite security concerns.
https://www.cs.fsu.edu/~redwood/OffensiveComputerSecurity/
Not many.
If anyone has any resources to suggest, we'd like to increase our section in the Awesome Appsec list for C programming too. :)
Along the same lines are the MISRA guidelines, though they are 1) targeted more towards embedded systems and 2) stupidly not freely available. There's an ISO standard for secure C coding (ISO/IEC TS 17961:2013) which is also not free. While you might not get to source document, there are hundreds of sites that summarize the requirements and recommendations.
SANS has a secure coding track worth checking out.
There's a tremendous amount of useful stuff in the NIST SAMATE project.
The OpenBSD folks write a lot about secure C coding.
Mozilla has some pretty good general advice at https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines
So does Apple: https://developer.apple.com/library/mac/documentation/Securi...
http://c.learncodethehardway.org/ by Zed Shaw is an introduction to C that seems to have emphasis on writing secure C programs. It's an introduction to C so I'm not sure if it's a comprehensive guide to security in C but it does aim to teach C with security in mind, especially buffer overflows.
Seconding CERT. Lots of good advice. Certainly the place to start. Along the same lines are the MISRA guidelines, though they are 1) targeted more towards embedded systems and 2) stupidly not freely available. There's an ISO standard for secure C coding (ISO/IEC TS 17961:2013) which is also not free. While you might not get to source document, there are hundreds of sites that summarize the requirements and recommenda…