[abcde666777]

That just takes you back to the debate about the code being the spec.

[986aignan]

The code lets you shoot yourself in the foot in a lot more ways than a spec does, though. Few people would make specs that include buffer overflows or SQL injection.

[magicalist]

"and don't have any security vulnerabilities" isn't a spec though. As soon as you get specific you're right back in it.