[shawnz]

Other important security features like N^X are also not specified in the C standard either, so what's the point of worrying about just printf format strings?