http://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-...
[0] https://github.com/isocpp/CppCoreGuidelines [1] https://github.com/microsoft/gsl/
I feel like roller coasters started because people wanted to go fast, and this crazy death contraption was the only way how. Subsequently, ride operators, in order to avoid the death of their patrons, advised them not to stick their limbs outside of the car. Unfortunately, this mechanism only reduced injuries, but far from eliminated them. Not only do accidents occur because of the actions of the riders themselves, but ride operators can pose introduce risk not only by malice, but negligence. In extremely rare cases, riders can be injured by compiler failures.
Roller coaster operators soon learned that these contraptions were fundamentally unsafe, and the only way to induce safety was if the systems which drove the coaster had safety as a fundamental concern. Therefore they introduced these things like "PLCs" -- a type of computer to make sure the operators could only do so much to endanger the riders. In addition, by following the basic rules of physics at build time of the coaster they further increased safety. Since people have stopped building coasters that relied on the rider's healthy sense of caution, and the operator's awareness of safety, they've become one of the safest ways to enjoy oneself. Or at least this is how I was hoping the story went.
For instance, I went through the I/O section, and most of the rules seem quite intuitive even to a novice C++ programmer like myself.
It disturbed me a little because this is the kind of stuff you learn in school, and they all have been there. Maybe they did not paid enough attention. Given the kind of programs we are writing, I could be rejecting candidates who don't cite deadlocks has a classic problem, and give a locking order as a classic solution to avoid them, even if they are right out of school.
All of that to say: IMO "novice" or "experienced" C++ programmer very often bear the risk of not really predicting the ability to write correct and maintainable code, because for the experienced ones, they can very well never have had any serious approach or mentors to get them to a decent mindset, while at the same time a smart and motivated novice can quickly figure out more and more of what matters, given some predispositions, a proper mentor, and/or a project inducing that.
If you find some of the CERT rules basic, you will quickly find most of them in that case. However, they are still useful to be used as a checklist, or for programmers who don't care enough about programming, or simply have been busy implementing piles of features in some kind of spaghetti code (and fixing 10% of the resulting bugs during 75% of their time) during a decade, etc.
Those that treat it like a craft aim to understand what they are doing, how to do things better.
Those that treat it like "just a job" or a means to an end don't want to know or learn anything beyond what is immediately required to do the task.
An example could be using "git push --force" if git push returns with errors
It's easy to forget that alignment is important on some architectures (other than for performance reasons), so be careful when using placement new: https://www.securecoding.cert.org/confluence/display/cpluspl...
This may seem obvious, but even the C++ committee got this one wrong when they created auto_ptr (which has since been removed from the standard): https://www.securecoding.cert.org/confluence/display/cpluspl...
This one is totally obvious but has a stunning number of ways you can fail to adhere to it, some of which look reasonable at first blush: https://www.securecoding.cert.org/confluence/display/cpluspl...
If memory safety is actually important to you, there's now an actual practical solution: SaferCPlusPlus[1].
A tool to automatically retrofit memory safety to existing C/C++ code is in early development (but resources are limited so it might be a while).
[1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus
[0] https://www.amazon.com/Secure-Coding-2nd-Software-Engineerin...
[1] https://github.com/duneroadrunner/SaferCPlusPlus#cint-csize_...
http://www.sis.pitt.edu/jjoshi/courses/IS2620/Spring07/Lectu...
Some recommendations seem little bit like "don't make mistakes" but still I like it.
Kudos to the SEI.
