Defensive programming: Difference between revisions

Revision as of 15:21, 11 December 2005

Revision as of 12:22, 24 December 2005

Line 13:

* If possible, reuse code instead of writing from scratch.

* Encrypt/authenticate all important data transmitted over networks. Do not attempt to implement your own encryption scheme, but use a proven one instead.

* All data isare important until proven otherwise.

* All code is insecure until proven otherwise.

* Never make programs [[setuid]] unless you're ''really'' sure it's secure.

* If data isare checked for correctness, verify if it'sthey are correct, not if itthey isare incorrect.

Crackers are likely to invent new kinds of incorrect data. For example, if

you checked if a requested file is not "/etc/passwd", a cracker might pass another