Computer Incident Response Center Luxembourg

16, bd d'Avranches Luxembourg L-1611 Luxembourg +352 247 88444 alexandre.dulaunoy@circl.lu

Computer Incident Response Center Luxembourg

16, bd d'Avranches Luxembourg L-1611 Luxembourg +352 247 88444 andras.iklody@circl.lu

Security This document describes the Programming Methodology Framework also known under the PMF methodology. The methodology is based on the manifesto written by Zed A. Shaw which describes a natural approach to software engineering especially on the strong focus towards the act of programming. The PM methodology uses a soft naming to allow a non-partisan reference into official engineering or project documents to describe one of the most used software engineering methodology.

In 2011, Zed A. Shaw published a blog post which describes: I think I'm going to create the ultimate software development methodology. It'll be revolutionary compared to others because it will focus on the one thing that gets software done. Its entire focus will be this one, glorious, completely useful activity for writing software. It's name even embodies the perfection of this programming methodology. The programming methodology was published as a manifesto later . The manifesto clearly describes the focus on programming to avoid the surrounding management overhead and pivot towards the delivery of the software. The describes similar methodologies which strongly focus on coding, scripting and programming. The overall concept of PMF methodology follows this iteration: Write a list of things to be done and use an iterative programming process. Do some of the things with additional programming. Build testing and tests using programming. This process is run in a while loop until the software is delivered.

A simple management process is required in addition to the PMF methodology. The management process is complementary to the PMF metholody and not interfering with the programming aspect. The management process is there to support the PMF methodology. Review requirements of the users/customers by asking them. Give the list of things to be done to the programmers. Review the delivered software to see if it matches the requirements.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .

Secure and defensive programming can only come by practicing programming and this also includes the act of simplifying or removing code to reduce the attack surface.

The authors wish to thank all the programmers who program.