> ...a person openly said they're ex-CIA. It was my understanding that he first misrepresented himself as a State Department employee, then for some reason cam

> ...a person openly said they're ex-CIA. It was my understanding that he first misrepresented himself as a State Department employee, then for some reason came clean several years later. I think filtering that sort of behavior out has a lot more pros than cons. > I considered something like Cyclone... A lot of that can be done with compiler annotations, the disadvantage of course being that it isn't default behavior... which is consistent with the rest of the C universe - things are no more secure than you design them to be. > If not, please elaborate. That is what I'd say if I was an OO programmer, yes. But I'll elaborate anyway because... have you ever just been in the mood to write gibberish C? /* New unreviewed code from untrusted source */ __attribute__((const)) /* More pure than "pure" */ static int newfunc(char* src, int len){ return src ? 0 : len; } /* Imagine an incredibly comprehensive spec for this public function, right here */ __attribute__((nonnull(1,2))) /* No Cyclone needed for null safety here */ int pubfunc(char* a, char* b) { /* ... */ if (a[0] == '4') return newfunc(b, 4); /* Untrusted function covered under that amazing spec you imagined */ /* ... */ }