Thou shalt have no other gods before the ANSI C standard 1369

D. J. Bernstein

That is the most absurd thing DJB has said yet. Who (besides him) even *thinks* that buffer overruns have anything to do with sofware portability?

However, by teaching his students that portability is unimportant, he has practically guaranteed that they will generate an increased supply of problem code that others will have to deal with downstream. In fact a byte might be not only 9 bits but 12, 16, 24, or 32 bits, as found in some *current* C implementations. In fact integers might have not only ones-complement implementations, but also sign-magnitude or twos-complement-with-holes, as found in some *current* C implementations. In fact calloc not only might not set pointers to null values, but also might not set floating-point data to zero values, as found in some *current* C implementations.

If the purpose of the course was to teach the C programming language, then concentrating on security analyses at the expense of the properties of the language does the students a great disservice. If the purpose of the course was to teach security analysis, then of course spending the time instead teaching about software portability would do the students a great disservice. If the purpose of the course was to teach both, then it should do that.