Re: Extreme Hacking

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Marcus J. Ranum, sie wrote:
> Ge' Weijers wrote:
> > On the other hand: those who need to develop security-related code,
> > protocols etc. do need to have an awareness of common exploits.
>
> Yes, and no. They need to know classes of bugs to avoid, and
> categories of common mistakes. For example, if you're developing
> security critical code you need to know what buffer overruns are
> and how to prevent them -- you do not need an exploit script that
> tickles a bug in the latest version of BIND.

Allowing buffer overruns is just bad programming, irrespective of
whether or not it is being used in a sitatuation where it is a
security risk.  Function calls such as gets() should just be banned >:)

Other problems which can be introduced (race conditions with files,
etc), are sometimes more a question of design and implementation than
just bad programming.

Darren