Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


March 27, 2000

Good Programming and the Rules for Writing Secure Code


RSS
View this exclusive article with VIP access -- click here to join |
See More Security Articles Here | Reprints | Or sign up for our VIP Monthly Pass!

Welcome to the first in a series of articles about writing secure code for the Win32 API, specifically for Windows 2000 (Win2K) and Windows NT. Although some of the topics also pertain to Windows 9x, these systems don't have the rich set of security features provided by the Windows NT-based line of OSs, so some columns in this series won’t apply.

In this column, I'll focus on writing secure code using C and C++ because I'm most familiar with these programming languages. In addition, Microsoft used C and C++ to write Windows 2000 and Windows NT, and you can most easily access some of the OSs' security features using these languages. Finally, these languages are also the ones developers most commonly use to code commercial software.

So why not discuss Java or Visual Basic (VB)? Both languages make writing secure code easy by properly bounds-checking arrays, and Java has the nice automatic garbage-collection feature. To some extent, my choice to focus on C and C++ is personal preference because only these languages provide such speed and full access to system calls that I use on a daily basis. Unfortunately, one of the reasons C and C++ executables provide such speed is because these languages give you plenty of room to shoot yourself in the foot. A friend of mine once said that if C lets programmers shoot themselves in the foot, then C++ just gives them a machine gun! My experience is that poorly written C++ code is often worse than poorly written C code. However, C++ provides some convenient features and lets you write code that is better organized. I encourage anyone entering a career as a developer to learn C++ thoroughly. This education is essential to learning Distributed COM (DCOM), which developers are increasingly using to interface with Win2K and NT.

Finding Resources
The discussions in this column assume that you have some fundamental familiarity with basic programming techniques. If you’re new to programming in C or C++, I recommend that you start with a good reference. One of the best titles available is A Book on C: Programming in C by Al Kelly and Ira Pohl (ISBN: 0201183994). Another good reference is C: A Reference Manual by Samuel Harbison and Guy Steele (ISBN: 0133262243). Ira Pohl has also authored some excellent books on C++, and if you’re learning C++, make sure you spend some time getting to know the standard template library (STL). STL simplifies many difficult tasks—once you get past the learning curve. If you're already familiar with coding basics, a great reference that will improve your coding skills is Writing Solid Code by Steve Macguire (ISBN: 1556155514). Even if you’ve been programming in C for 15 years, this book is worth reading. Some of the best programmers I know have told me that they’ve learned from this text, and it's essential to anyone starting out. . . .


Already a VIP member?
Please log on to view the full article

Why become a VIP member?

VIP-only online access
VIP CD delivered twice a year: offline access to the entire Windows IT Pro article library
Monthly issue of your choice of Windows IT Pro or SQL Server Magazine

Subscribe Now
Reader Comments

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now




Top Viewed ArticlesView all articles
Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...

2009 Windows IT Pro Editors' Best and Community Choice Awards

Picking a favorite product from an impressive crowd of competitive offerings is never an easy task, and such was the case with our Editors' Best and Community Choice awards this year. ...

WinInfo Short Takes: Week of November 23, 2009

An often irreverent look at some of the week's other news, including some post-PDC some soul searching, a Google Chrome OS announcement and a Microsoft response, Windows 7 off to a supposedly strong start, the Jonas Brothers and Xbox 360, and so much more ...


Security Whitepapers Reducing the Costs and Risks of Branch Office Data Protection

Solving Desktop Management Challenges in Healthcare

Solving Desktop Management Challenges in Education

Related Events Introduction to Identity Lifecycle Manager "2"

SQL Server Security: How to Secure, Monitor & Audit Your Databases

Protecting Mobile Users' Data

Check out our list of Free Email Newsletters!

Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys

Related Security Resources Introducing Left-Brain.com, the online IT bookstore
Looking for books, CDs, toolkits, eBooks? Prime your mind at Left-Brain.com

Discover Windows IT Pro eLearning Series!
Clear & detailed technical information and helpful how-to's, all in our trademark no-nonsense format


Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement