Problem - Kevin Tafuro

the C programming language, with some quick forays into C++ when important,
and a bit of assembly when there’s no other way.
We hope this book will do well enough that we’ll be able to produce versions for
other programming languages. Until then, we are going to solve both of the aforementioned
problems at once with our web site, http://www.secureprogramming.com,
which you can also get to from the book’s web page on the O’Reilly site (http://
oreilly.com/catalog/secureprogramming/). Not only can you find errata there, but you
can also find and submit secure programming recipes that are not in the book. We
will put on the site recipes that we validate to be good. The goal of the site is to be a
living, breathing resource that can evolve as time progresses.
We Can’t Do It All
There are plenty of things that people may find to criticize about this book. It’s too
broad a topic to make a perfect book (that’s the motivation for the web site, actually).
Although we believe that this book is likely to help you a great deal, we do
want to address some specific issues so at least you’ll know what you’re getting if
you buy this book:
This book is implementation-focused.
You’re not likely to build secure software if you don’t know how to design software
to be secure from the get-go. We know that well, and we discuss it at great
length in the book Building Secure Software. On the other hand, it’s at least as
easy to have a good design that results in an insecure implementation, particularly
when C is the programming language you’re using. Not only do our implementation-level
solutions incorporate good design principles, but we also discuss
plenty of issues that will affect your designs as well as your implementations.
The world needs to know both how to design and how to implement with security
in mind. We focus on the implementation so that you’ll do a better job of it.
Nonetheless, we certainly recommend that you read a book that thoroughly covers
design before you read this book.
This book doesn’t cover C++ well enough.
C++ programmers may grumble that we don’t use any C++ specific idioms. For
the most part, the advice we give applies to both languages, but giving all the
examples in C makes them more applicable, because practitioners in both languages
can still use them. On the rare occasion that there are things to note that
are specific to C++, we certainly try to do so; examples include our discussions
of buffer overflows and the use of exception handling to prevent leaving programs
in an insecure state. Over time, our coverage of C++ will improve on the
book’s web site, but, until then, C++ programmers should still find this book
relevant.
xviii | Preface
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.