Resilient C++ - Mitigate C++ Vulnerabilities

CppNorth 2024 Sponsors

Gold

Video Sponsors

Bronze

Instructor

Peter Sommerlad

<p>Peter Sommerlad is a consultant and trainer for Safe Modern C++ and Agile Software Engineering. Peter was professor at and director of IFS Institute for Software at FHO/HSR Rapperswil, Switzerland until February 2020. Peter is co-author of POSA Vol.1 and Security Patterns. He inspired the C++ IDE Cevelop with a unique C++ feedback, refactoring, and code modernization experience. Peter is a member of MISRA-C++, Hillside, ACM, IEEE Computer Society, ACCU, ISO WG23 and the ISO WG21 C++.</p>
<h3>1 day workshop</h3> <h2>Abstract</h2> <p>C++ programmers suffer from the language's complexity as well as from its "super power" of backward compatibility that manifests known and sometimes lesser known deficiencies in language and standard library design.</p> <p>In application areas where human live or capital is at risk, safe and secure code is a must, but even in other domains the internal quality of C++ programs is an important factor for programmers' effectiveness.</p> <p>Writing safe and secure code is hard, and requires to circumvent undefined behavior and also portability issues, when development and target platforms differ. Knowing C++ vulnerabilities and potential mitigations is a first step to write better code. Fortunately, there exist guidelines and collections of potential programming pitfalls to draw from. Those might recommend to not use a language feature or use it in a specific way. Often enforced by static analysis tools, such guidance and tooling falls short when applied as an afterthought.</p> <p>Also, guidelines might be formulated in a way that require you to violate them to achieve the goals of a system. Each deviation from such guidelines should be well thought of, must be documented for safety critical systems, and at best becomes tightly encapsulated.</p> <p>Using dedicated libraries can help with sidestepping some of the vulnerability problems, such as the woes of implicit conversions of built-in integer types.</p> <p>This workshop will show you where to look for pitfalls, as well as highlight specific ones and provides concrete design guidance and some libraries to use for your own C++ design and code to follow, so that your code becomes safer and less risky.</p> <h2>Outline</h2> <ul> <li>Properties of Safe and Secure Code</li> <li>Origins and Evolution of Guidelines</li> <li>From "Dos and Don'ts" to Design</li> <li>Conscious Class Design</li> <li>Value Values</li> <li>Flavors of Manager Types</li> <li>Strong Types (optional)</li> <li>Integer types without UB and overhead (optional)</li> <li>Understand Relationship Risks</li> <li>Putting Plain Pointers away</li> <li>AMA (ask me anything)</li> </ul> <h2>Dates</h2> <p>The workshop takes place on Saturday, July 15th prior to the start of the conference. Find out more details about fees and about the schedule <a href="workshops.html">here</a>.</p>

When

July 20-23, 2025

LinkedIn

CppNorth Group