2011 CWE/SANS Top 25 Most Dangerous Software Errors

Through lwn.net, the top 25 dangerous software Errors can be found here.  Makes for some nice or frightening reading depending upon your point of view. It is a bit weird that

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

is still there and at an astounding 3rd place.  I was under the impression that the new C/C++ standards would have done and fixed that at the compiler level or something of that sort. Again, assuming the bulk of these errors were in C/C++.

Makes me think that the OpenBSD folks were in the right to fix things by changing the insecure libraries so that this kind of error cannot be triggered at all.

And oh, I do like this one too

Use of Hard-coded Credentials

even mentioning espionage implications and Stuxnet.

Go on, read the full list here.

CWE/SANS TOP 25 Most Dangerous Programming Errors

Via the TheRegister, finally, someone has come up with a list of errors that will generally get you knackered when you develop your application.

Nice.

Obviously, this list will be useful to people who want to code better and  crackers, who know that things rarely if ever get patched.  Don't get me wrong, I'm all for full disclosure and all that but given the way automated patch cycles work, I'm not hopeful that  a manual sweep of applications will ever be done.

And the rest of the programming world will move on; creating "better" classes of gargantuan errors that will make the security world weep.

Bet on it.

Only when a super massive botnet gets created by some cracker which exploits some or all variations of the errors, will some cosmetic re-arrangement of the deck chairs happen.