C 和 C++ 安全编码
Secure coding in C and C++
Robert C. Seacord · 初版 2005 年
7人推荐
9位读者提及
11次提及
“常被利用的软件漏洞通常源于可避免的软件缺陷。CERT/Coordination Center（CERT/CC）在分析了过去十年近18,000份漏洞报告后发现，造成其中大部分漏洞的根本原因其实为数不多。本书指出并剖析了这些原因，并展示了可用于防止被漏洞利用的应对步骤。此外，本书鼓励程序员采纳安全最佳实践，树立安全思维，以帮助软件抵御未来的攻击，而非仅仅应对眼前的威胁。”——封面护封
Hacker News 上怎么说
正在加载完整评论……
…http://www.embedded.com/electronics-blogs/embedded-systems-d... 关于安全代码这个相关话题，这几本书很不错：Mark Dowd，2006 年，《The Art of Software Security Assessment》。Robert Seacord，2013 年，《Secure Coding in C and C++》（第 2 版）。想要深入了解 C 语言底层到底在发生什么：Paul Anderson，1998 年，《Advanced C: Tips and Techniques》。Kenneth Louden，1997 年，《Compiler Construction: Principles and Practice》，第 7 章。关于 C……
…http://www.embedded.com/electronics-blogs/embedded-systems-d... For the related topic of secure code, these books are good: Mark Dowd. 2006. The Art of Software Security Assessment. Robert Seacord. 2013. Secure Coding in C and C++, 2e. For details on what is really going on inside C: Paul Anderson. 1998. Advanced C: Tips and Techniques. Kenneth Louden. 1997. Compiler Construction: Principles and Practice. Chapter 7. For C…
……问题，还包括如何去思考设计安全软件或 Web 安全。在看下面那些专业书之前，先读读那本或许挺合理的。C++ 方面的经典是 Seacord 的《Secure coding in C and C++》。至于技术手段，你会需要结合使用：* 设计层面（使用智能指针、善用 array、vector 和 string，使用 optional、atomic 等）* 编译器标志（比如 gcc 可以让整数……
…issues, but also how to think about designing secure software or web security. It might make sense for you to read that, before moving to the specialised books below. The classic for C++ is Seacord's "Secure coding in C and C++". As for techniques, you'll want a mix of: * design (using smart pointers, taking advantage of array, vector and string, using optionals, atomics, etc) * compiler flags (gcc can for example make integer…
……非常快。总的来说，K&R 的 C 语言用来给新手入门 C 极其出色。我建议刚开始完全别管什么安全性问题之类的，只管享受刷题的乐趣就行！--- [1] 《Secure Coding in C and C++》是这个主题下一本极好的书。http://www.amazon.com/Secure-Coding-Robert-C-Seacord/dp/0321... 另外：既然你对逆向工程感兴趣，读完 K&R C 之后我建议看看……
…very quickly. To summarize, K&R C is excellent for introducing people to C. I would suggest completely ignoring safety issues et cetera at the start and just have fun solving the exercises! --- [1] Secure Coding in C and C++ is a really good book on this topic. http://www.amazon.com/Secure-Coding-Robert-C-Seacord/dp/0321... PS: Since you are interested in reverse engineering, after finishing K&R C I would recommend reading…
……真想写出更安全的 C 代码，一定要去查阅 Robert Seacord 的这两份资源：- SEI CERT C 编码标准：https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Cod... - 《Secure Coding in C and C++》：https://resources.sei.cmu.edu/library/asset-view.cfm?assetid...
…serious about writing safer C code, certainly check up the following two resources from Robert Seacord: - SEI CERT C Coding Standard: https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Cod... - Secure Coding in C and C++: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid...
我（目前）还没完整读过 CERT C++ 规则，但我强烈推荐读一读《Secure Coding in C and C++》[0]。不出所料，书里对边界检查有很棒的探讨。但是，全书将近一半的篇幅都花在了整数下溢/溢出（以及有符号/无符号）问题上（大多数开发要么无视、要么根本……
I've not read through the CERT C++ rules (yet), but I highly recommend reading "Secure Coding in C and C++" [0]. Expectedly, there's a good discussion on bounds checking. But, nearly half the book is dedicated to integer underflow/overflow (and signed/unsigned) issues (which most devs either ignore or are…
我想在那个书单里加上：《Secure Coding in C and C++, Second Edition》https://www.oreilly.com/library/view/secure-coding-in/978013... 以及《Extreme C》https://www.packtpub.com/product/extreme-c/9781789343625
I would add to that list, "Secure Coding in C and C++, Second Edition" https://www.oreilly.com/library/view/secure-coding-in/978013... "Extreme C" https://www.packtpub.com/product/extreme-c/9781789343625