[pjmlp]

Depends on much they value security, even std::string has an extra null for c_str() calls.