discuss: Thread: New HOTWO Proposal - Source Code Auditing HOWTO

  I've been interested in computer security for a while, and have been 
 performing a lot of source code audits in my spare time.

  As part of a website I'm trying to put together a document explaining
 how these are constructed, and it seems logical to me that this could
 be written in docbook format and submitted to the TLDP.

  I've had a look over the current HOWTOs and I don't see anything 
 immediately comparable.

  My intention is that the source code auditing HOWTO will fit the
 gap between those documents describing secure programming practises
 and those which describe how to exploit buggy software.

  The piece is work in progress and is devided up as follows:

   1.  General
   2.  Intro
   3.  Choosing a target program.
   4.  Automated auditing with tools.
   5.  Manual inspection.
   6.  Reporting problems.
   7.  Further information.

  Any comments would be greatfully received.  I guess my biggest 
 concern right now is that the subject scope might be very narrow
 and too specific to be interesting to other readers?

Steve
--
# Debian Security Audit Project
http://www.shellcode.org/Audit/

On Mon, May 10, 2004 at 03:16:13PM +0100, Steve Kemp wrote:
> 
>   I've been interested in computer security for a while, and have been 
>  performing a lot of source code audits in my spare time.
> 
>   As part of a website I'm trying to put together a document explaining
>  how these are constructed, and it seems logical to me that this could
>  be written in docbook format and submitted to the TLDP.

I think this is an excellent idea, even if it isn't Linux
specific. Software engineers should be conscious of security issues
from the very inception of a project all the way through to end of
life.

-- 

Charles Curley                  /"\    ASCII Ribbon Campaign
Looking for fine software       \ /    Respect for open standards
and/or writing?                  X     No HTML/RTF in email
http://www.charlescurley.com    / \    No M$ Word docs in email

Key fingerprint = CE5C 6645 A45A 64E4 94C0  809C FFF6 4C48 4ECD DFDB