Secure coding practice

Some hints how should you code to avoid security problems. Many of these techniques also improve general quality of code. That's because almost any major bug can be potentially used by a cracker in [Denial of Service]? or other attack.

Please expand this article. These random notes should be changed to more coherent article.

One of the the most common problems is usage of constant-size structures and functions for dynamic-size data. This is especially usual problems for string data in C. You should never use functions like sprintf and strcpy.

Never make your code more complex that necessary. Complexity is very common source of bugs, including security problems.

Either leave your code available to everyone on the Net (see Free software) or hire someone who will do [security audit]? for you.

If possible, reuse code instead of writing from scratch.

Encrypt all important data that flows the Net.

All data is important until proved otherwise.

All code is unsecure until proven otherwise.

Never make your program setuid? unless you're really sure it's secure.

If you check data for correctness, check if it's correct, not if it is incorrect. Cracker are likely to invent new kinds of incorect data. For example if you checked if requested file is not "/etc/passwd", cracker might pass other name of this file, like "/etc/../etc/passwd".

/Talk?