Secure C coding standards by SEI
Is anyone else finding some of these rules to be bizzarely tone deaf?<p>Recurring pattern:<p><i>&quot;Don&#x27;t do such and such that is obviously wrong.&quot;</i><p>Well, no kidding! I would never do such a thing ... <i>on purpose</i>! It&#x27;s the not-on-purpose occurrences that I need help with.<p>Without a concrete plan on how to <i>prevent</i> or <i>detect</i> that situation, this advice isn&#x27;t helpful. I know I shouldn&#x27;t rely on uninitialized memory, and, believe me, I do not want to. Give me a coding <i>strategy</i> which minimizes the occurrence of uses of uninitialized memory. Recommend a compiler and its particular compiler options, or some lint or other static checking tool or run-time detection.<p>&quot;Don&#x27;t read uninitialized memory&quot; isn&#x27;t something I can turn into a concrete action to somehow improve software quality.<p>It&#x27;s like a driver&#x27;s manual which says &quot;stay on the road and don&#x27;t run over people&quot;.