> But anybody can plug a new container type into a for each statement and get new behavior that silently breaks the assumptions of the original code. How would

> But anybody can plug a new container type into a for each statement and get new behavior that silently breaks the assumptions of the original code. How would it be "silent"? You're changing the container at the point where you're making any assumptions about it. This would just fall under normal code review purview, just like code reviews are how Linux enforces that anyone even used this linked list macro in the first place. C certainly doesn't care if you use list_for_each_entry for your container iteration, after all. But it'd be a lot easier to replace these linked lists with a vector that has the same observable contract if C++ was used, just would be way faster to iterate on.