The top 25 most dangerous programming errors

Posted at 00:45 on 14 January 2009

(Via BBC News and Coding Horror): The 2009 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most significant programming errors that can lead to serious software vulnerabilities, published by the US National Security Agency. Everyone working with code in any capacity whatsoever, at any level, needs to know this stuff cold. Everyone who manages them needs to make sure that they do. And everyone who recruits them needs to ask about this stuff at interview time. There's really no excuse for hiring people who think that it's okay to construct SQL commands by smashing strings together willy-nilly with user input.

I was rather disappointed to see that it isn't explicit enough on the issue of plain text passwords in your user database, nor is there any mention of the increasingly popular password anti-pattern of asking users for their Gmail passwords so you can import their contact list. Both of these are particularly insidious because in addition to being frighteningly dangerous from the point of view of identity theft and phishing, they are frequently demanded by bosses and clients who either don't see why they should be a problem or are willing to take on the quite unacceptable risks that they introduce.