RE: Microsoft Writing Secure Code

In the simpler dictionary definitions of propaganda, "information that
is spread for the purpose of promoting some cause" or "material
disseminated by the advocates or opponents of a doctrine or cause", of
course this book fits (as do most).  But, this is a semantically
charged word with other connotations, so I can see why Michael would
deny it.  (Sophisticated propaganda always denies that it is so. ;-) 
But, I agree it gives a reasonably balanced view and exposes Microsoft
some security history "warts and all."

Overall, the book is a tremendous resource.  The original poster can of
course read comments to that effect on amazon or mspress site.  

But, for the more picky among us, there's a few items that appear to
need some improvement.  I don't like how the companion examples haven't
kept up with the 2nd edition of the book.  For example, the
CleanCanon.cpp example softcopy installed via secureco2.exe off mspress
matches the 1st edition of the book, but not the second much-improved
version in the book.

Another example: in the 2nd edition of the book, on p. 684, the
CREATE_ALWAYS flag is advocated as best to use when creating a temp
file, and assumes in a race condition attack that the attacker's file
(well, its contents) will be destroyed.  But, if the attacker created a
hard link to some other important file as part of his race condition
attack, your app could end up destroying the contents of some important
file, especially if your app runs with higher privileges than the
attacker.  Seems to me that using the CREATE_NEW flag instead, checking
the return value to see if you did indeed create the temp file and
looping until you are successful (or jumping out to error handling when
you determine that you are being race condition attacked successfully n
times in a row!) would be better advice.  [Credit Pascal Meunier for
pointing this out to me.]

If it were more clear where updates of the book's contents and
companion material were to be kept and where they should be reported,
it might improve the book's value to the security community at large -
doubt this thread is the best place to do it, but seems like many in
this audience would be interested in this.  Errata for the 1st edition
of the book is on mspress,
http://support.microsoft.com/default.aspx?scid=kb;en-us;833560 and for
the second edition appears to be kept on Michael's blog
http://blogs.msdn.com/michael_howard/archive/2004/10/25/247417.aspx.

-Alan