Vulnerable C++ - Peter Sommerlad - CppNorth 2023

www.cppnorth.ca​
---
Vulnerable C++ - Peter Sommerlad - CppNorth 2023
Programming languages contain features that could cause code to behave badly. Either by creating hazards in safety critical software, or by creating entry points for attacks in security-critical software.
ISO SC22 WG23 working group collects common language vulnerabilities and provides standards that map the common vulnerabilities to specific programming languages and their mitigations.
This talk will give an overview of typical vulnerabilities and will demonstrate examples on how C++ maps to those generic vulnerabilities and how the upcoming standard 24772-10 provides advice for mitigation.
---
Slides: github.com/CppNorth/CppNorth_...
Sponsored By:
think-cell: www.think-cell.com/cppnorth
JetBrains: www.jetbrains.com/
---
Peter Sommerlad
Peter Sommerlad is a consultant and trainer for Safe Modern C++ and Agile Software Engineering. Peter was professor at and director of IFS Institute for Software at FHO/HSR Rapperswil, Switzerland until February 2020. Peter is co-author of POSA Vol.1 and Security Patterns. He inspired the C++ IDE Cevelop with a unique C++ feedback, refactoring, and code modernization experience. Peter is a member of MISRA-C++, Hillside, ACM, IEEE Computer Society, ACCU, ISO WG23 and the ISO WG21 C++ committee.
---
CppNorth is an annual C++ conference held in Toronto, Canada.
- Annual CppNorth C++ conference: cppnorth.ca/
- CppNorth Twitter: / cppnorth
---
CZcams Videos Edited & Optimised by Digital Medium: events.digital-medium.co.uk
#cppnorth #cpp #cppprogramming

[@Roibarkan]

43:53 Herb Sutter’s talk about this taxonomy: czcams.com/video/ARYP83yNAWk/video.html

[@Heater-v1.0.0]

Any professional software engineer concerned with vulnerabilities (or needs correctness, robustness, reliability, safety...) in the code they write should be using a language that helps provide that. Not one in which it is so easy to make fatal mistakes. If one is going to rigorously follow hundreds of coding guidelines and rules is it not better to use a tool that enforces them by default. That tool being the language. I'd go as far as to say it is professional negligence to not use such a safe language.