Michael Howard's Web LogA Simple Software Security Guy at Microsoft!The First Step on the Road to More Secure Software is admitting you have a Problem- February 21, 2008 I just wrote an article over on the SDL blog about my observations from the industry to Jeff Jones' vulnerability analysis and the lack of security progress by our competitors.http://blogs.msdn.com/michael_howard/archive/2008/02/21/the-first-step-on-the-road-to-more... FAQ about HeapSetInformation in Windows Vista and Heap Based Buffer Overruns- February 19, 2008 219 - Added some Minor Tweaks Perhaps it's the phase of the moon or something, but over the last few weeks I have received more email about correctly using the HeapSetInformation function than any other topic. I really don't know why! This was added last year as an SDL requirement. So here's a quick FAQ: Q: What does the HeapSetInformation function doA: It lets your application configure the Windows heap manager with a small number of options. The only security-related setting kills your...http://blogs.msdn.com/michael_howard/archive/2008/02/18/faq-about-heapsetinformation-in-wi... |