Free ebook from Microsoft Press: Writing Secure Code, 2nd Ed

[atidball]

Showed up in my MSDN newsletter. Offer good through August 27 (tomorrow).

https://www.microsoftelearning.com/e...enterCode.aspx

A valid Windows Live ID is required. The access code is 7234-N4E8-4995.

It's in PDF format. You can download individual chapters or the whole book. There must not be any DRM on it because I downloaded and viewed within Linux.

[igorsk]

Three more free ebooks:
http://www.microsoft.com/learning/vs...ult.mspx#EBOOK

[simond]

Not available in LIT format?

[acidzebra]

I'm having a hard time reconciling "secure code" with "Microsoft"

Still, nice of them to make it available for free.

[zelda_pinwheel]

Originally Posted by acidzebra

I'm having a hard time reconciling "secure code" with "Microsoft"

i found that pretty ironic too, to be honest... but yes, nice of them to make it available for free...

[pilotbob]

Originally Posted by acidzebra

I'm having a hard time reconciling "secure code" with "Microsoft"

Still, nice of them to make it available for free.

Why is it that the legacy of MS from 20 years ago is still applied to it today?

BOb

[acidzebra]

Originally Posted by pilotbob

Why is it that the legacy of MS from 20 years ago is still applied to it today?

Unreasonable I know, because Vista and XP before that were pinnacles of secure code.


...
...


On a related note, you might enjoy this PDF.

[pilotbob]

Originally Posted by acidzebra

Unreasonable I know, because Vista and XP before that were pinnacles of secure code.

Well, I don't want to get into a history lesson... but since XP SP2 Windows has been very secure. Yes, there have been vulnerabilities found in various parts of it since then... but most of the issue was due to the fact that all users of XP pretty much ran as admin. If you know the *nix world you know that most people never run as admin/root.

But, due to the lazyness of Windows developers 99% of apps didn't run if you ran as a standard users... this wasn't really windows fault, but it is the perception.

They are changing that perception and actually being more pro-active with UAC. If people see the UAC prompt alot it is due to the fact the MS is now enforcing those best practices. Of course, now the perception is that "Vista" is the problem because of the UAC prompt showing so often... but the UAC prompt is only a response to an application that is doing something it probably shouldn't be doing such as accessing system folders or settings, etc.

Also, when Apple or Linux has the same issues or makes the same mistakes people are much more forgiving... I just don't understand that either? Did you know FireFox 2 had more security vulnerabilities reported against it than IE 7 did in the same time frames?

BOb

[acidzebra]

Originally Posted by pilotbob

If people see the UAC prompt alot it is due to the fact the MS is now enforcing those best practices. Of course, now the perception is that "Vista" is the problem because of the UAC prompt showing so often... but the UAC prompt is only a response to an application that is doing something it probably shouldn't be doing such as accessing system folders or settings, etc.

Right. Make the system nearly unusable, but hey, at least it is secure. Might as well pull the plug, that would be REALLY secure. You know what the response is of most users to UAC? Turn it off before it drives them nuts - because 90% of the time it pops up for completely innocuous things. End of security. And you still might want to read that PDF I linked to - because UAC is not the be-all end-all that they pretend it is.

Strangely enough, almost the only time when I see my "root password" prompt on my linux box is when I run the package update system.

Originally Posted by pilotbob

Also, when Apple or Linux has the same issues or makes the same mistakes people are much more forgiving... I just don't understand that either?

I'm sorry, I failed mob psychology 101 - and this is not relevant to the discussion of security.

Originally Posted by pilotbob

Did you know FireFox 2 had more security vulnerabilities reported against it than IE 7 did in the same time frames?BOb

And a quicker fix rate. While Microsoft was still denying certain vulnerabilities have impact, instead calling them 'theoretical', or scheduling them for next months patch batch.

Look, I don't want to step all over your Microsoft fandom, but I have been working with a mixed unix/windows environment as a system and later on network admin for many years now. I'm not just parroting what someone told me. I don't mind working with Microsoft, it is pretty much what you are going to get in a corporate environment, and they have made improvements, but XP wasn't exactly the most secure system, and Vista is a bust for various reasons. Let's hope the next iteration fares better.

And if I make little jokes about them, it is only because they so richly deserve it.

[pilotbob]

Originally Posted by acidzebra

Strangely enough, almost the only time when I see my "root password" prompt on my linux box is when I run the package update system.

Sure, that's because unix/linux has always enforced the security permissions and boundaries. Due to this unix programmers followed the rules and saved user data only to folders users had access to, etc.

Originally Posted by acidzebra

I'm sorry, I failed mob psychology 101 - and this is not relevant to the discussion of security.

Right, it has nothing to do with security, which you claim XP and Vista has none... that was what I was originally responding to. Above you still say people turn UAC off because "Vista" is unuseable. But, it is actually the porrly written apps which cause the prompt.

Originally Posted by acidzebra

Look, I don't want to step all over your Microsoft fandom, but I have been working with a mixed unix/windows environment as a system and later on network admin for many years now.

Belive me, as a Windows developer I am far from a fanboy... the opposite in fact. But, you have to remember you can't judge someone who wrote a book that was published by MS Press as not knowing how to write secure code. If MS took the Apple route and threw away backward compatiblity in order to be 100% secure people would be trash talking them more than they do for the baby steps they took in Vista. You are complalining that they did exactally what you are asking for! Imagine if they went all the way and only 2% of current windows apps ran?

Originally Posted by acidzebra

And if I make little jokes about them, it is only because they so richly deserve it.

If you say so.

BOb

[acidzebra]

Originally Posted by pilotbob

Sure, that's because unix/linux has always enforced the security permissions and boundaries. Due to this unix programmers followed the rules and saved user data only to folders users had access to, etc.

So windows didn't have these permissions and boundaries from the get-go, yet when it all goes pear-shaped, it is the fault of the developers who built on top of that shoddy codebase? How does that work?

Originally Posted by pilotbob

Right, it has nothing to do with security, which you claim XP and Vista has none

*reads back* nope, didn't claim that.

Originally Posted by pilotbob

Belive me, as a Windows developer I am far from a fanboy... the opposite in fact.

So you are a windows developer who doesn't like windows but who jumps in every time you perceive a slight against Microsoft being made? I mean seriously, that was a totally innocuous joke at the beginning of the thread.

Originally Posted by pilotbob

But, you have to remember you can't judge someone who wrote a book that was published by MS Press as not knowing how to write secure code.

Again, something I didn't say. Let's revisit my original quote:

"I'm having a hard time reconciling "secure code" with "Microsoft"

I didn't say the guy who wrote it was crap, I didn't say Microsoft was crap, all I said was that given past experiences, I can see some irony here.

Originally Posted by pilotbob

If MS took the Apple route and threw away backward compatiblity in order to be 100% secure people would be trash talking them more than they do for the baby steps they took in Vista. You are complalining that they did exactally what you are asking for! Imagine if they went all the way and only 2% of current windows apps ran?

They didn't do what I was asking for at all. In fact, I didn't ask for anything. UAC is a lame stopgap measure - typical bolt-on security and implemented in the worst possible way. I know they had very little choice and none of the choices were particularly appealing, but Microsoft must lie in the bed it made for itself.

[haridasi]

Actually, writing secure code by Microsoft press is a classic for c++ developers (rated high up in the "must read" section). Things written there doesn't only apply for windows/microsoft world.

I have read several books from Microsoft press and they are high quality books. Right next to O'Reilly books.