> Everyone that cares about security hates VLAs,

Love and hate are emotional considerations not really worthy in this context. I would say that everybody that sees C as a valid replacement of Fortran loves and relies on VLAs and complex types. And there's probably much more people in the world interested in numeric codes than in "security" codes.

> that is why ISO acknowledged the mistake of placing them into C99 and removed them from the standard in C11.

This is most certainly not true. First, I'm almost sure that ISO never acknowledged any mistake with VLAs. Can you point me to where ISO acknowledged that purported mistake?

More importantly, your statement is false because ISO never removed VLA from the standard. That would be untoward and very contrary to their traditions. If they really wanted to remove them they would start by first deprecating them, and they are not deprecated. They are merely an optional feature of the language, just like the "main()" function is. The standard defines different kinds of conforming implementations, and some of them include VLA. Thus it is an official part of the language.

> WG14 has acknowledged their mistake

LOL. Funny that you mention that, since WG14 has added a whole new principle (the fifteenth) to their design document to acknowledge for VLA in future interfaces: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm

Anyone that knows ISO standardese knows that when a feature moves from compulsory into optional, it is a synonum for deprecated, as compilers that haven't yet adopted the specific feature never bother to spend resources implementing it.

You should read the link contents before posting them here.

"In particular, the order of parameters in function declarations should be arranged such that the size of an array appears before the array. The purpose is to allow Variable-Length Array (VLA) notation to be used."

Notation for what?

"Application Programming Interfaces (APIs) should be self-documenting when possible."

And why is that?

"This not only makes the code's purpose clearer to human readers, but also makes static analysis easier. Any new APIs added to the Standard should take this into consideration. "

On top of that, if you bother to actually read the ongoing C2X mailings, there are no plans to bring VLAs back to life, besides adopting the syntax to describe function parameters.

Most devs that take security seriously actually take the effort to know the details of the devil that we have to deal with.

You didn’t address any of his points and your rebuttals come across as little more than frantic handwaving. Moreover, as has been pointed in this post, VLAs don’t necessarily need to have security implications since they can be implemented outside the stack. Yet you keep bringing up Google and KSPP as if they are arbiters of truth instead of corporate entities with their own agendas.

You are also spreading misinformation. VLAs being optional does not mean they have been removed from the standard as you keep claiming.

Whatever, enjoy your C99 then.