1. Towards Secure Programs: How to Write Unreadable Programs
Dr. Mohamed Yehia Dahab

2. Agenda Understanding how a programmer thinks Why unreadable code
Golden rules
Conclusions

3. Understanding How a Programmer Thinks
He has program from a web
He has no time to read it all
Much less understand it
He wants to rapidly find the place to make the changes
He wants to make it and get out the results
He has not expected the effects of the changes
He can only see a tiny piece of a program at a time

4. Why Unreadable Code
Writing unreadable code for the purpose of security
Scripts in HTML pages
Templates (reusable components)
Negotiation among agents
Copy rights
Understanding how to write a readable or a maintainable code
Evaluating your programmers

5. Golden Rules Naming variables Use Hungarian notation for variables
char *szMxQtBlTyAcC;
Use long similar variable names (intercapitalization, adding number(s), swapping)
char *szMxQtBlTyACc;
char *szMxQtlBTyACc;
Use single letter variable names
Name some of local variables as global variables
Create nested local variables inside {} blocks
Exploit compiler name length limits
Use ASCII characters as variable names, including ß, ∂, ℓ, and ñ characters
Never use i for the loop variable
Use I and l interchangeably
Misleading names
conventions

6. Golden Rules (Cont’)
Naming functions, in addition to the conventions of naming variable
Make use of abstract words like Everything, data, stuff
Do not begin the function name with a verb like do, perform, handle
Don't indent your code
Write extremely long lines of code, well over 80 characters per line
Put all your code into a single function
Do not write a single version of a constructor
Do not put a single statement in a line

7. Golden Rules (Cont’) Hide some code among long comments and vice versa
for(j=0; j<array_len; j+ =8)
{ total += array[j+0 ]; total += array[j+1 ]; total += array[j+2 ]; /* Main body of total += array[j+3]; * loop is unrolled total += array[j+4]; * for greater speed. total += array[j+5]; */ total += array[j+6 ]; total += array[j+7 ]; }

8. Golden Rules (Cont’) Recycling Revisited
Use scoping as confusingly as possible by recycling variable names in contradictory ways. For example, suppose you have global variables A and B, and functions foo and bar. If you know that variable A will be regularly passed to foo and B to bar, make sure to define the functions as function foo(B) and function bar(A)

9. Golden Rules (Cont’) Code names must not match screen names
Never document the units of measure of any variable, input, output or parameter. e.g. feet, meters, cartons
SQL Aliasing : Alias table names to one or two letters. Better still alias them to the names of other unrelated existing tables

10. Conclusions Use the mentioned conventions randomly
Try to mix the mentioned conventions as possible
A real programmer writes code that anyone can fix or expand
Generating unreadable code as an instance of the original program and you are guaranteed the original and generated programs will still work
Developing an application to convert readable code to unreadable one will be very useful (as generating a documentation)

11. Thanks!