Everything about this post by deraadt is wrong. First of all, all of those software projects rolling their own implementation should consider libbsd (installed

Everything about this post by deraadt is wrong. First of all, all of those software projects rolling their own implementation should consider libbsd (installed on my system as a dependency of the Samba client libs, so it should be on most desktop Linux distros already) http://libbsd.freedesktop.org/wiki/ http://libbsd.freedesktop.org/wiki/ Secondly, it's fallacious to point out that lots of people already use these functions and therefore it must be sane and should be encouraged. People used gets() for decades. https://en.wikipedia.org/wiki/Argumentum_ad_populum https://en.wikipedia.org/wiki/Argumentum_ad_populum Thirdly, strlcat and srlcpy are awful. The fact that people have already moved from awful to maybe slightly less awful variants actually means they have some will to improve their code, which should be encouraged. strl* should not be encouraged. You should be strung up (pun intended) if you're not using a modern string handling library in 2014.