Re: How to do secure coding and create secure software

[Michael Jumper <mjumper () apache org>]

On 9/27/25 1:30 AM, Amit wrote:
> -----------------------------------------------------------------------
> How to do secure coding and create secure software
> -----------------------------------------------------------------------
>
> I can do secure coding and no one can hack my code unless the language/OS have
> some issues. You can challenge me on this.
>
> Ultimately, all software boil down to functions/methods. If functions/methods
> are secure then the whole software is secure.
Unfortunately, this is simply a faulty premise. You need to consider the 
security of what you've built separately from the security of your 
building materials.

Security of software isn't inherited from the isolated security of each 
of its functions, and it is generally not valid logic to assume that a 
particular quality of the components of a whole will extend to the 
entire whole:

https://en.wikipedia.org/wiki/Fallacy_of_composition

Consider individual CPU instructions as an easy counter example. Every 
function is made up of such low-level instructions, and these 
instructions are functions in their own right. The original core premise 
would imply that no software vulnerabilities can exist except where 
individual CPU instructions are vulnerable, which is clearly not the case.

When you build something out of lower-level components, focusing purely 
on the security of those components ignores the *arrangement* of those 
components. From arrangement ("I'm made up of atoms"), higher levels of 
behavior emerge ("I'm writing this email"), and you're left with 
something that has its own security model that must be freshly considered.

- Mike