Secure Programming Practices in C++ - NDC Security 2018

C++ for (Java) Programmers
Bjarne Stroustrup, the creator of C++, once said : “C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do it blows your whole leg off.” He has also said : “Within C++, there is a much smaller and cleaner language struggling to get out.” Both are true. C++ provides powerful capabilities that should be used with extreme caution. However, when starting to code C++ it’s often non-obvious which constructs are safe and which are dangerous.
This talk is for programmers wishing to feel more comfortable navigating the C++ landscape. We will explore the programming culture that has developed around the C++ language. Specifically, we will look at programming patterns that navigate around or through some of the dangerous parts of the C++ language. The goal is to build a set of programming practices based in the “smaller and cleaner language” inside C++. And by doing so, we will also build an awareness around code constructs that can potentially “blows your whole leg off”.

Speaker: Patricia Aas

NDC Conferences

[alexsol]

Pictures are fabulous. Thnx for a talk.

[mahzadzahedi]

zeroization of local variable is not urgent because are removed from stack . Is it correct?

[sentdc]

12:29 this will actually never happen. The if statement will never execute because there's no way a function will reserve a 2GB local array on the stack for her `char first[INT_MAX];` variable. It probably won't even happen on the heap for a 32-bit app either.

14:16 this is the bane of all of the Adobe Flash existence (or infamy.)

Also, if you watched this and agreed with her approach, I'd say, "I'd rather you go and program in C# or Java instead."

This video should've been called, "Why noobs should not code in C. Go learn C# instead."