Is this an interesting observation? I doubt it a little. What security-conscious developer believes C is a good language in which to write complicated, security-critical code? You write code in C because you have to.

> Is this an interesting observation?

Actually people seem to need frequent reminding that we don't live in the best of all possible worlds, and that some of the difficulties in working with the best-available current tools aren't inescapable but rather shortcomings that can and should get fixed sometime. It's great if everyone now knows how suboptimal C-everywhere-forever is on security grounds, at least—but tbh 'security-conscious developer' sounds a little like 'true Scotsman' here. A hae me doots.

Personally I believe C is the best language to develop in. Anything you write in C can be easily used in any other language you care to use; this characteristic is not true for any other language you could name.

There is nothing wrong with developing security-critical code in C if you're an experienced C programmer and know what you're doing. The GnuTLS programmers were neither experienced C programmers nor knowledgeable about security; they should not have been writing security-critical code in the first place. And no one should have ever believed that their code was trustworthy.