Re: How to do secure coding and create secure software

[Jeremy Stanley <fungi () yuggoth org>]

On 2025-09-27 23:40:13 +0200 (+0200), Solar Designer wrote:
[...]
> However, if in "functions/methods are secure" you refer only to 
> smaller building blocks, then no, the program built from them may 
> still be insecure. Also "the whole software" isn't necessarily 
> just one program.
[...]

Yes, in practical terms the majority of security vulnerabilities I 
handle day to day lately stem from insecure design choices. The 
software is working as designed, but the design was poorly chosen.

Insecure coding patterns are mostly caught by static analyzers 
during development or review, and so don't typically even merge to 
the public code repository much less end up in the hands of users.
--
Jeremy Stanley

Attachment: signature.asc
Description: