The CERT C Secure Coding Standard
securecoding.cert.org
The CERT C Secure Coding Standard
1–10 of 32 posts
Re: The CERT C Secure Coding Standard
#2Should be compulsory reading for any developer.
Not only C, but the other CERT standards as well.
Re: The CERT C Secure Coding Standard
#3Can C code be linted according to those rules?
I wonder if that kind of coding standards can be part of ISO standards.
Re: The CERT C Secure Coding Standard
#4Actually it's hard to obey them all. And C makes it so easy to create pitfalls.
Is there a language specially designed for secure programming?
Re: The CERT C Secure Coding Standard
#5Actually it's hard to obey them all. And C makes it so easy to create pitfalls. Is there a language specially designed for secure programming?
SPARK aims for that since the 80s. http://www.spark-2014.org provides information about the current version.
Re: The CERT C Secure Coding Standard
#6I'm well aware this is full-on "middlebrow dismissal", but still, I feel that in 2015 this standard isn't complete without a chapter saying
just don't.
I understand why a standard like this is necessary, but really it's like a CERT Safe Highway Cycling Standard or a CERT Healthy Smoking Standard. If security is an important enough goal to want to apply this entire standard in detail, maybe there are better options than C.
Re: The CERT C Secure Coding Standard
#7Actually it's hard to obey them all. And C makes it so easy to create pitfalls. Is there a language specially designed for secure programming?
Ada and SPARK power many safety critical things like airplanes fighter jets space rockets railways and so on.
I've been recently trying to learn Ada and it's a beauty. Many people have misconceptions or think it's obsolete so they miss out.
Re: The CERT C Secure Coding Standard
#8Actually it's hard to obey them all. And C makes it so easy to create pitfalls. Is there a language specially designed for secure programming?
Also see here: http://www.seas.gwu.edu/~mfeldman/ada-project-summary.html
Re: The CERT C Secure Coding Standard
#9I'm well aware this is full-on "middlebrow dismissal", but still, I feel that in 2015 this standard isn't complete without a chapter saying just don't. somewhere. I understand why a standard like this is necessary, but really it's like a CERT Safe Highway Cycling Standard or a CERT Healthy Smoking Standard. If security is an important enough goal to want to apply this entire standard in detail, maybe there are better…
I wish you were right, but C is still the only way to hit all platforms with a good product. It also still rules performance, which does matter in some cases.
Hopefully this won't still be true in 10 years. Hopefully. But I was hopeful about that 10 yers ago.
Re: The CERT C Secure Coding Standard
#10I'm well aware this is full-on "middlebrow dismissal", but still, I feel that in 2015 this standard isn't complete without a chapter saying just don't. somewhere. I understand why a standard like this is necessary, but really it's like a CERT Safe Highway Cycling Standard or a CERT Healthy Smoking Standard. If security is an important enough goal to want to apply this entire standard in detail, maybe there are better…
I wish you were right, but C is still the only way to hit all platforms with a good product. It also still rules performance, which does matter in some cases. Hopefully this won't still be true in 10 years. Hopefully. But I was hopeful about that 10 yers ago.
Ada is about as portable as C, given that both are implemented as gcc frontends.
For performance, the type-safe SPARK Skein implementation (http://www.adacore.com/press/spark-skein/) matches the C implementation, after the optimizer phases in the compiler were matched up. While doing the translation from C, they even uncovered a bug in the C implementation.
Anecdata, sure, but that's mostly a popularity issue.