Secure Programming Resources

Contributed by jose on 2002-08-05 from the going-beyond-grep dept.

Since a lot of OpenBSD users are curious about improving the quality of software out there, here is a brief list of secure programming resources. Mind you it's biased towards C and static analysis, but this should be helpful. Nothing replaces a good, thorough manual code audit by knowledgable eyes, but this can be a start. Also be sure to follow many of the links from these references, these are just some places to start.

A presentation by Frederic Raynal on secure programming methods.
Splint , the next generation of LCLint
Sharefuzz , which can be used to find environmental variable overflows
Secure Programming HOWTO by David Wheeler. Geared towards Linux but still mostly useful for OpenBSD.
Sardonix's resources list from the Wirex team.
MOPS from David Wagner, who has written a lot of good papers on UNIX security.

(Comments are closed)

Comments

By negative () on 2002-08-05 18:32

When we think about " Secure Programming ", perhaps we should remember " InSecure Programming " too. [ Thi-Chi?! ]
By Anonymous Coward () on 2002-08-07 00:43

Of the tools for scanning code listed in the Sardonix link, RATS is currently the strongest/most complete.

There is another list of resources at the Shmoo Group's website.

Latest Articles

Tue, Oct 15
- 08:46 LibreSSL 4.0.0 Released (0)
Mon, Oct 14
- 07:05 sshd(8) splitting continues (0)
- 06:02 OpenSMTPD 7.6.0p0 Released (0)
Mon, Oct 07
- 20:42 OpenBSD 7.6 Released (1)
Wed, Sep 25
- 11:09 Major change to sysupgrade(8) behaviour (0)
Tue, Sep 24
- 16:38 OpenBSD -current is now "7.6-current" (0)
- 10:57 OpenBSD now enforcing no invalid NUL characters in shell scripts (0)
- 09:21 EuroBSDCon 2024 presentations (0)
Mon, Sep 23
- 18:02 rpki-client 9.3 released (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]