Caveat Emptor

• sysinfo hasn’t got the telltale “printf” word in it.

  • It is all too easy to mistake it for accepting a plain string.

• Accepting a format string is all too common with error functions.

  • An error is usually a situation triggerable by an attacker.

• Projects usually have similar, private, functions.