Best Practices for Secure Programming

Picking Your Programming Language

• To C or C++ or Not to C or C++ ?
  • C is hard: Even the experts have trouble with it

  • If performance is paramount, you may want to consider one of
    these. Depending on the application, C++ may be a better choice,
    as there are already existing class libraries out there (STL, etc).
    

    However, the security of these libraries isn't guaranteed.

  • C programs will almost always require more LOC than other languages, and the fewer LOC the better

  • Historically, bad C programming the cause of *many* security holes over the years

• Java: it's everywhere
  • Security features built in, especially when using applets

  • OO, for those who like it

  • Garbage collection, growable strings

• Perl: it's also everywhere
  • Great Docs

  • CPAN: lots of code already written

  • Fast for a scripting language

  • Garbage collection, growable strings

  • Taint checking! Let the language help check your user data.

  • Can be difficult to maintain with large projects

• PHP
  • Great for web programming

  • Similar to perl

  • Garbage collection, growable strings

  • Quite a number of security holes over the years

• OO Scripting Languages: Python and Ruby
  • If you like OO, you'll like one of these

  • Code generally cleaner than perl code

  • Jim likes Ruby a lot

  • Garbage collection, growable strings

  • Ruby has taint checking as well

  • Ruby on the slow side

• VB/C#
  • The Good: Tight integration with MSWin platform

  • The Bad: Tight integration with MSWin platform

  • Garbage collection, growable strings (GC is new in VB.net)