K&R C had no formal spec. It wasn't until 10 years after its invention that it did, and that was after a lot of real-world experience. I would argue that early

K&R C had no formal spec. It wasn't until 10 years after its invention that it did, and that was after a lot of real-world experience. I would argue that early specifications don't work out very well. In fact, they are often problematic. One example is that standard ANSI C had a proposal for a while that included an Alias keyword. This was such a bad idea, that Dennis Ritchie showed up to the meeting personally to help kill it. Standards committees are not usually staffed with practitioners, who are busy developing the language and are quite expert in nuance, feasibility, and utility. Attendees to standards committee meetings are almost always not. And reality does meet the standardization expectations quite frequently. Look at the number of "undefined" or "implementation choices" in C alone. Therein lie careers for security folks.