Secure coding in C and C++
by Robert C. Seacord · first published 2005
78% recommend22% neutral
Why HN recommends it
Focuses on the C and C++ coding errors that cause security flaws, especially integer overflow, signed/unsigned issues, and bounds checking. It is suited to working developers who want safer C and C++ code.
Summarised by Claude from recommending comments
"Commonly exploited software vulnerabilities are usually caused by avoidable software defects. Having analyzed nearly 18,000 vulnerability reports over the past ten years, the CERT/Coordination Center (CERT/CC) has determined that a relatively small number of root causes account for most of them. This book identifies and explains these causes and shows the steps that can be taken to prevent exploitation. Moreover, this book encourages programmers to adopt security best practices and develop a security mindset that can help protect software from tomorrow's attacks, not just today's."--BOOK JACK
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
The CERT C secure coding standard
Robert C. Seacord
Recommended by 3 · mentioned by 33 recommend · 3 mention3 recommend · 33 recommend
2009–2026Pointers on C
Kenneth A. Reek
Recommended by 8 · mentioned by 108 recommend · 10 mention8 recommend · 108 recommend
2011–2023Test-driven development for embedded C
James W. Grenning
Recommended by 6 · mentioned by 96 recommend · 9 mention6 recommend · 96 recommend
2013–2025Understanding and Using C Pointers
Richard M Reese
Recommended by 12 · mentioned by 1712 recommend · 17 mention12 recommend · 1712 recommend
2015–2025Modern C
Jens Gustedt
Recommended by 37 · mentioned by 4537 recommend · 45 mention37 recommend · 4537 recommend
2009–2026The Standard C Library
P. J. Plauger
Recommended by 17 · mentioned by 2117 recommend · 21 mention17 recommend · 2117 recommend
2009–2025C programming
K. N. King
Recommended by 26 · mentioned by 3026 recommend · 30 mention26 recommend · 3026 recommend
2008–2026Expert C programming!
Peter Van der Linden
Recommended by 88 · mentioned by 11188 recommend · 111 mention88 recommend · 11188 recommend
…http://www.embedded.com/electronics-blogs/embedded-systems-d... For the related topic of secure code, these books are good: Mark Dowd. 2006. The Art of Software Security Assessment. Robert Seacord. 2013. Secure Coding in C and C++, 2e. For details on what is really going on inside C: Paul Anderson. 1998. Advanced C: Tips and Techniques. Kenneth Louden. 1997. Compiler Construction: Principles and Practice. Chapter 7. For C…
on “Ask HN: Books to learn advanced C programming” ↗…issues, but also how to think about designing secure software or web security. It might make sense for you to read that, before moving to the specialised books below. The classic for C++ is Seacord's "Secure coding in C and C++". As for techniques, you'll want a mix of: * design (using smart pointers, taking advantage of array, vector and string, using optionals, atomics, etc) * compiler flags (gcc can for example make integer…
on “Ask HN: Resources for learning how to write more secure code?” ↗…very quickly. To summarize, K&R C is excellent for introducing people to C. I would suggest completely ignoring safety issues et cetera at the start and just have fun solving the exercises! --- [1] Secure Coding in C and C++ is a really good book on this topic. http://www.amazon.com/Secure-Coding-Robert-C-Seacord/dp/0321... PS: Since you are interested in reverse engineering, after finishing K&R C I would recommend reading…
on “Ask HN: Should I use K&R to learn C?” ↗…serious about writing safer C code, certainly check up the following two resources from Robert Seacord: - SEI CERT C Coding Standard: https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Cod... - Secure Coding in C and C++: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid...
on “OpenBSD, C, httpd and SQLite – Web App stack” ↗I've not read through the CERT C++ rules (yet), but I highly recommend reading "Secure Coding in C and C++" [0]. Expectedly, there's a good discussion on bounds checking. But, nearly half the book is dedicated to integer underflow/overflow (and signed/unsigned) issues (which most devs either ignore or are…
on “Software Engineering Institute Makes CERT C++ Coding Standard Freely Available” ↗I would add to that list, "Secure Coding in C and C++, Second Edition" https://www.oreilly.com/library/view/secure-coding-in/978013... "Extreme C" https://www.packtpub.com/product/extreme-c/9781789343625
on “Modern C” ↗…Using C++" and finally 4th edition of "The C++ Programming Language". There are others for C++, but this would be a good start. As for C, "Extreme C" has nice up to day content. And in both cases, "Secure Coding in C and C++", https://www.amazon.com/Secure-Coding-2nd-Software-Engineerin...
on “Ask HN: What are your resources for learning modern C and C++?” ↗Learn C using the classical books, but also care about how to mitigate security issues while coding in C. "Secure Coding in C and C++" https://www.oreilly.com/library/view/secure-coding-in/978013... "The CERT C Secure Coding Standard" https://www.oreilly.com/library/view/the-cert-c/978032160319... MISRA-C https://www.misra.org.uk/…
on “Ask HN: Learn C in 2023?” ↗Read over "Secure Coding in C and C++".
on “Ask HN: Good practices for my first C project” ↗…written a modern C Book? Resume-wise, I've been writing C code since 1985, and I've been an expert on the C Standards Committee (WG14) since 2004. I've written two prior books on C Programming including "Secure Coding in C and C++" and "The CERT C Coding Standard". I also teach Secure Coding in C for NCC Group https://www.nccgroup.trust/us/our-services/cyber-security/se... and I also taught these topics to Computer Science undergraduates…
on “Effective C: An Introduction to Professional C Programming” ↗…standards and style guides to understand what I should be trying to do. Given that Misra has a C:2012, does anyone know how this compares to SEI Cert C Coding Standard (which im reading right now along with Secure Coding in C and C++)?
on “Misra C++:2023 Published” ↗