The Pragmatic Programmer
Your Journey to Mastery · 20th Anniversary Edition
Thomas and Hunt's career-defining set of practical heuristics for writing software professionally — orthogonality, broken-windows, DRY, tracer bullets, and the underlying argument that craftsmanship is a posture, not a process.
As an Amazon Associate we earn from qualifying purchases. The link above is sponsored.
- Authors
- David Thomas,Andrew Hunt
- Published
- 2019
- Publisher
- Addison-Wesley Professional
- Pages
- 352
- Edition
- 20th Anniversary Edition
- Language
- English
Read this if
Every working software engineer, regardless of years of experience. The 20th-anniversary edition is the most current version of the field's most quoted book on professional software development; security engineers benefit because most security failures are software-quality failures wearing a different name.
Skip this if
Readers wanting domain-specific (security, ML, distributed-systems) depth; the book is deliberately general. Also not a methodology book — Thomas and Hunt are anti-methodology in spirit and explicitly so in the text.
Key takeaways
- Most security defects are software-quality defects; the book teaches the foundations that make secure code possible to write.
- The list of heuristics is shorter than the book — 100 tips on a card — but the prose is what makes them stick.
- The 20th-anniversary updates (concurrency, declarative thinking, observability) are the parts that justify the new edition for someone who read the original.
Notes
Pair with Designing Secure Software (Kohnfelder), Designing Data-Intensive Applications (Kleppmann), and Security Engineering 3e (Anderson) to put a security frame around the craft frame. Read it twice five years apart; the same chapters mean different things at different career stages. The most recommended 'first book' on professional software development and the rare instance where the marketing's claim of evergreen is approximately true.
What to read before
What to read before The Pragmatic Programmer →Beginner · 2019
Foundations of Information Security
Jason Andress' compact tour of the field: confidentiality / integrity / availability, identification and authentication, network and OS controls, written for newcomers and adjacent disciplines.
Beginner · 2021
How Cybersecurity Really Works
Sam Grubb's gentle, exercise-driven introduction for non-specialists who need a working mental model of attacker behaviour and basic defence.
Beginner · 2020
Alice and Bob Learn Application Security
Tanya Janca's hands-on AppSec primer covering threat modeling, secure design, secure coding, testing, deployment, and the social side of running an AppSec program — through a friendly, narrative-driven structure.
What to read next
What to read after The Pragmatic Programmer →Intermediate · 2025
La norme ISO/IEC 27005
A three-part guide to the ISO/IEC 27005:2022 standard, running from information-security governance foundations to the detail of every risk-management process, with fictional case studies to practice against.
Intermediate · 2026
Maîtriser la cryptographie d'aujourd'hui et de demain
A cryptography engineer specializing in information-system security mechanisms, who also teaches the subject, builds from cryptography's mathematical foundations up to today's post-quantum standards.
Intermediate · 2005
Reversing
The book that taught a generation how software actually looks once you strip away the source. Still the clearest on-ramp to thinking in assembly, even with dated tools.
Explore similar books
Alternatives to The Pragmatic Programmer →Beginner · 2021
How Cybersecurity Really Works
Sam Grubb's gentle, exercise-driven introduction for non-specialists who need a working mental model of attacker behaviour and basic defence.
Intermediate · 2025
La norme ISO/IEC 27005
A three-part guide to the ISO/IEC 27005:2022 standard, running from information-security governance foundations to the detail of every risk-management process, with fictional case studies to practice against.
Beginner · 2019
Foundations of Information Security
Jason Andress' compact tour of the field: confidentiality / integrity / availability, identification and authentication, network and OS controls, written for newcomers and adjacent disciplines.