Dangerous coding errors revealed

[Ruprect]

Where are

‘CWE-1: Outsource coding to Bob Shawadiwadi’
and
‘CWE-2: Outsource functional testing to his brother Bill Shawadiwadi’?

CWE-3: Outsource documentation to Randy Shawadiwadi

[Purple Dalek]

WTF does "CWE-94:Failure to Control Generation of Code" actually mean.

I think this list starts to make sense if you are a Web front end serving up something like jsp pages (not Jackson structured programming).

For the real programming that real men do it doesn't make much sense.

Typical Yanks, all they're bothered about is putting up a good front...

[Mich the Tester]

I think this list starts to make sense if you are a Web front end serving up something like jsp pages (not Jackson structured programming).

For the real programming that real men do it doesn't make much sense.

Typical Yanks, all they're bothered about is putting up a good front...

Is it what happens when some kid from an Accidenture training course uses a 4GL to produce undecipherable spaghetti without actually checking the code to see if it’s any use?

[bored]

A more proper name for the list would be "top 25 coding errors that can lead to security problems in a website". But it wouldn't make such a good headline would it?

From the article:

The US National Security Agency has helped put together a list of the world's most dangerous coding mistakes.

The 25 entry list contains errors that can lead to security holes or vulnerable areas that can be targeted by cyber criminals.

[Purple Dalek]

A more proper name for the list would be "top 25 coding errors that can lead to security problems in a website" - from the article:

Well, even then it doesn't quite fit as one of the top 25 would be running windows as the OS and server the website was running on.

[bored]

Well, even then it doesn't quite fit as one of the top 25 would be running windows as the OS and server the website was running on.

There are plenty of websites that run Windows and are quite secure. Also, there are plenty of websites that run on LAMP and are hacked regularly. So no, the choice of Windows vs Linux has no place in that list (and besides, it's not a coding issue).

[darmstadt]

More than 30 organisations, including the US National Security Agency, the Department of Homeland Security, Microsoft, and Symantec published the document. THE TOP 25 MOST DANGEROUS PROGRAMMING ERRORS
CWE-20:Improper Input Validation
CWE-116:Improper Encoding or Escaping of Output
CWE-89:Failure to Preserve SQL Query Structure
...

Probably not COBOL, PL/1, Assembler, etc. but only those new fangled kiddie script languages

[OwlHoot]

One of the biggest howlers, which many OS coders don't really understand, is failing to weaken pointers passed inside structures to core functions. If you find an example of that (and it's easy to test a function call), the whole OS is wide open.

The hardware automatically weakens pointers in the argument list when the call crosses from the user address space into the shared core address space. But there's no way it can know to delve into structures those pointers reference.

Outfits like the NSA probably keep quiet about this, as *they* exploit those weaknesses as back doors.

[moorfield]

delete * from trade

- not a good one to try in a sql session you have kicking around thinking its a dev database, and finding out, ooh about 43 seconds later, that it wasn't

[tim123]

Open Season on Programmers...the new Terrorists....

The US National Security Agency has helped put together a list of the world's most dangerous coding mistakes.

The 25 entry list contains errors that can lead to security holes or vulnerable areas that can be targeted by cyber criminals.

Experts say many of these errors are not well understood by programmers.

Wot!

Who the **** are they using as programmers, 12 year olds?

tim