• The programmer's search engine

Some languages I code in

• The C Programmers FAQ
• Sun's Java site.
• Perl home page
• Python language home
• VBScript

Languages I'm learning

• Cyclone
• C# language reference
• Scheme
• Haskell

Interesting Languages

• C--
• Dylan

Algorithms and Data Structures

• ADS in java

Secure coding

• Shmoo's excellent list of resources
• SANS papers
• Software Security
• Writing privileged programs
• Defending Against an Internet-based Attack on the Physical World
• On the Importance of Secure Coding
• The secure progamming standard
• UC Davis Vulnerabilities Project
• Security focus secure coding guidelines
• EnGarde's Secure Programming Tutorial
• The Unix Secure Programming FAQ
• Sun's secure coding guidelines
• Best practices for secure development
• Secure Programming for Linux and Unix HOWTO
• Secure UNIX Programming FAQ
• A Lab engineers check list for writing secure Unix code
• setuid - checklist for security of setuid programs
• perlsec - Perl security
• Setuid man page
• Why you shouldn't trust DNS
• Codemonkey
• Validating Cold Fusion
• A discussion of some common flaws
• Writing secure web applications
• DevX Security
• Twelve rules for developing more secure Java code
• interactiveinfosec.com secure programming links
• Signal handling
• Avoiding security holes when developing an application
• Preventing CPU Starvation Attacks
• Boran's Application security resources
• Remote User Authentication in Libraries
• Secure C Programming
• The Java Security Website
• Securing Software
• Oulu University Secure Programming Group
• NCSA Secure Programming Guidelines
• Writing secure programs
• Setuid Demystified
• msdn security

• How to Design Secure Web Applications
• Improving Web Application Security: Threats and Countermeasures
• cgisecurity library
• The open web application security project
• Best practices for input validation with Active Server Pages
• Auditing Web Site Authentication
• JSP Security
• Secure Programming in PHP
• PHP and the OWASP Top Ten Security Vulnerabilities
• Ten Security Checks for PHP
• Maintaining Secure Web Applications
• HTML Filtering
• The Cross Site Scripting FAQ
• Twenty Don'ts for ASP Developers
• HOWTO: Review ASP Code for CSSI Vulnerability
• Secure CGI/API Programming
• Safe session tracking
• Writing secure CGI scripts
• CGI Security
• CGI Security Tutorial
• Secure Internet Programming
• http://www-genome.wi.mit.edu/WWW/faqs/www-security-faq.html
• Are You Safe?
• Safe Scripting in Perl
• CGI Security Tutorial
• CGI Security Compilation
• Infoseek's Computer/Web security - CGI Scripts
• Artistscope Secure Image Source
• Dos and Don'ts of Client Authentication on the Web

Secure Design

• Threat modeling
• Security analysis of an information system using an attack tree methodology
• Architectural patterns for enabling application security
• Security Patterns
• A Meta-notation for Protocol Analysis
• Designing Secure Software
• Matt Bishop's homepage
• User-centered design of secure software
• Coalition Design for Secure Protocols
• TSS Protocol Design course
• COVERT CHANNEL ANALYSIS
• Implementing Java Policy
• Java Security
• Sub-Operating Systems: A New Approach to Application Security
• The Stanford SRP Authentication Project
• A protocol for Password-Authenticated Key Exchange
• WWW Authentication
• Capability Theory by Sound Bytes
• OCTAVE

Code review/quality assurance

• Application Security Assessments
• Application Assessment Questioning
• Code reading and program comprehension - Annotated bibliography
• Reading Computer Programs: Instructor's Guide and Exercises
• Auditmongers
• Sardonix
• Security Code Review Guidelines
• Encyclopedia: Code Review
• Mozilla code review
• How to find security holes
• Auditing Code
• Tools for source code auditing
• Google software QA directory
• Automated testing
• Free QA software for download
• Vulnerability Testing of Software System Using Fault Injection
• An Analysis of Some Software Vulnerabilities
• Sticky minds
• Software Measurement Plan for the Software Inspection Group
• The Software Inspection Process
• Formal Technical Review and Software Inspection
• Software Testing and Analysisor Practitioners (tutorial)
• Software Testing and Analysis (lectures online)
• Software QA/Test Resource centre
• Software Quality, Software Process, and Software Testing
• Fault Injection in glibc
• Practical Code Auditing
• WAVES: Web Application Vulnerability and Error Scanner

Static analysis, tools and papers

• Reverse Engineering and Program Understanding
• Program Analysis (links)
• Program Analysis (course)
• Program Analysis - Lecture notes
• Introductions to Abstract Interpretation on the Web
• Analysis and Compilation of Object-Oriented Languages
• Semantics-Based Program Analysis and Manipulation
• Static analysis and computer security: New techniques for software assurance
• Splint
• RATS
• ITS4
• Interview wih John Viega about its4
• JLint
• Finding faults in multi-threaded programs
• Set-based Program Analysis
• Detecting Format-String Vulnerabilities with Type Qualifiers
• Statically Detecting Likely Buffer Overflow Vulnerabilities.
• Cleanness Checking of String Manipulations in C Programs via Integer Analysis.
• Trust and Dependence Analysis
• Reverse Engineering and System Renovation - An Annotated Bibliography -
• Improving computer security via static software analysis
• Supporting Program Comprehension Using Semantic and Structural Information
• Reverse engineering
• Increased Software Reliability Through Input Validation Analysis And Testing
• Steering Clear of Triples: Deriving the Control Flow Graph Directly from the Abstract Syntax Tree in C Programs
• Static Analysis for the pi-calculus with Applications to Security
• Static Analysis of Processes for No Read-Up and No Write-Down
• Security Analysis using Flow Logics
• Casper: A Compiler for the Analysis of Security Protocols
• Considerations on porting perl to the java virtual machine

Researchers and groups

• Flemming Nielson
• Patrick Cousot
• David Wagner
• William G. Griswold
• Stuart G. Stubblebine
• Robert O'Callahan
• Prem Devanbu
• James Power
• Daniel Jackson
• Dominic Duggan
• Project Lande
• HOG Research: Secure Language Environments
• Secure Internet Programming Languages
• NIST High Integrity Software Systems Assurance
• Center for High Assurance Computer Systems
• The Stanford SUIF Compiler Group
• David von Oheimb's Research Papers

Better development procedures

• The One Person Project Software Process
• The personal software process
• Cigital Labs
• Software Engineering Institute
• Software Process Resource Collection
• Data & Analysis Center for Software
• Some best practices (work in progress by )
• Joel on Software
• Software Reality
• Software Engineering for Security: A roadmap
• Achieving airtight code
• Audits from Hell
• Writing more secure software
• A Comparative Analysis of Methods of Defense against Buffer Overflow Attacks
• IBM Security resources for developers
• Assembling Configuration Management Environments
• The Art Of Web Application Development
• Maintaining Secure Web Applications
• Process improvement that works
• The Myth of Open Source Security Revisited
• Large Software Systems-- Back to Basics

Breaking programs

• Bug Hunting: The Seven Ways of the Security Samurai
• How to write Buffer Overflows
• Smashing the stack for fun and profit
• Buffer overflow tutorial
• Heap overflows
• The TAO of Windows buffer overflow
• Writing shell code
• Buffer overflows
• Win32 Buffer Overflows (Location, Exploitation and Prevention)
• Yet more shellcode stuff
• Various shell code examples for different platforms
• NTFS Alternative data streams
• Various papers on ELF
• Exploiting Common Vulnerabilities in PHP Applications
• Insecure Programming by example
• Abusing poor programming techniques in webserver scripts
• Brute Force Exploitation of Web Application Session IDs
• Advanced SQL injection in SQL Server Applications
• Evolution of Cross-Site Scripting Attacks
• Diehard: a battery of tests for random number generators
• Session Fixation
• Open Vulnerability Assessment Language

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10

Misc Technologies

• Various server pages resources
• Windows NT Services
• Links on objects and components
• Free corba links
• PostgreSQL 7.1 Documentation
• Practical PostgreSQL (online book)
• CVS Best practices
• Getting started with XML Security
• SSL/TLS information

Misc links

• The Reengineering bibliography
• Designing reusable classes
• Sun Software Whitepapers
• Java blueprints
• IBM Redbooks
• Notes about Java
• Why php is broken
• What's wrong with perl
• A C Programming tutorial
• Build your own Forth
• Catalog of Free compilers and Interpreters
• Catalog of Compiler Construction Tools
• Abstract Syntax Description Langauge
• The OM Project
• Executable Editing Library
• Reverse Engineering Malware
• Lisp for web applications
• A Quick Program Profiling and Tracing System
• A retargetable compiler for ANSI C
• JavaCC
• A Source Measurement Suite for Java
• Manta
• C Programming
• A programmer's introduction to ASP
• Teach yourself Visual C++ in 21 days
• Examples of programs in difference programming languages
• Computer Vulnerability Analysis (Ivan Krsul)
• A Taxonomy of Computer Program Security Flaws, with Examples
• Patterns homepage
• A Secure and reliable bootstrap architecture
• Generating Dynamic Program Analysis Tools
• Increasing Security in Aviation Oriented Computing Education
• Aspect Oriented Software Development
• Principles of Programming Languages (notes)
• Industrial Strength C++
• Java Symbol Table Design Issues
• Softpanorama: (slightly skeptical) Open Source Software Educational Society
• Developing Applications With Objective Caml
• Regular Expression Library
• Some good C coding standards links
• NT Commands
• OBJECT-ORIENTED PROGRAMMING AND THE OBJECTIVE-C LANGUAGE
• Dive into python
• Automated Construction of Testing and Analysis Tools
• A Basis for a mathematical theory of computation
• Parsing Techniques - A Practical Guide
• javacc grammars
• Test coverage analyser
• Implementing AF-independent application (ipv6)
• Functional Programming and Formal Systems
• An Introduction to Scheme and its Implementation
• OpenC++
• GDB Documentation
• Software's challenge
• Software Security (Reverse Engineering, Disassemblers, Code Obfuscation)