> Every piece of software that takes inputs contains a de facto recognizer for accepting valid or expected inputs and rejecting invalid or malicious ones. This

> Every piece of software that takes inputs contains a de facto recognizer for accepting valid or expected inputs and rejecting invalid or malicious ones. This should be expanded: Langsec isn't about adding complexity so much as it's about getting the complexity right. You say you want a revolution, well, you know, those things have a way of coming back around. In this case, your "revolutionary" ideas about YAGNI and Do The Simplest Possible Thing have already occurred to others, and they're the ones who wrote the parser libraries you're so sure you're not going to need. All you need is a simple lexer and some extra state... and a little more extra state, with a bit of recursion to get nesting right... and now you're unsure how string escapes should work... The end result isn't an input language without grammar. Every language has grammar. The problems come when nobody actually knows what that grammar is. Because if you don't know, you don't know if one of your grammar's productions is INSERT ZERO-DAY HERE. So Go YAGNI Yourself and use some pre-written code, or at least act as if you did by writing an actual grammar first and then implementing it, and then implement it again, correctly this time. Your users will thank you.