Computer Incident Response Center Luxembourg

16, bd d'Avranches Luxembourg L-1160 Luxembourg +352 247 88444 alexandre.dulaunoy@circl.lu

Computer Incident Response Center Luxembourg

16, bd d'Avranches Luxembourg L-1160 Luxembourg +352 247 88444 andras.iklody@circl.lu

Security This document describes the Programming Methodology Framework also known under the PMF methodology. The methodology is based on the manifesto written by Zed A. Shaw which describes a natural approach to software engineering with a strong focus on the act of programming. The PM methodology uses a soft naming to allow for a non-partisan reference to official engineering or project documents describing one of the most used software engineering methodologies.

In 2011, Zed A. Shaw published a blog post which describes: I think I'm going to create the ultimate software development methodology. It'll be revolutionary compared to others because it will focus on the one thing that gets software done. Its entire focus will be this one, glorious, completely useful activity for writing software. It's name even embodies the perfection of this programming methodology. The programming methodology was published as a manifesto later . The manifesto clearly describes the focus on programming to avoid the surrounding management overhead and pivot towards the delivery of the software. The describes similar methodologies which strongly focus on coding, scripting and programming. The overall concept of PMF methodology follows the following process: Compose a list of features to be implemented and use an iterative programming process. Enhance said features using trial and error programming. Orchestrate your testing and integration processes using pragmatic programming. Repeat the above process until the software is delivered. A simplified overview of the process can be described as follow:

+----------+ | | | idea <------+ | | | +----+-----+ | | | | | +----v-----+ | | | | it doesn't work | code | | | | | +----+-----+ | | | | | +----v-----+ | | | | | release +------+ | | +----------+

A simple management process is a required of the PMF methodology. The management process is meant to be complementary instead of interfering with the programming aspect and solely serves to support the PMF methodology. Collect requirements of the users/customers. Provide programmers with the desired requirements. Review whether the software to be delivered matches the requirements.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .

Secure and defensive programming can only come by practicing programming and this also includes the act of simplifying or removing code to reduce the attack surface.

The authors wish to thank all the programmers who program.