Another type of security solution is "if people want to do something
stupid, offer a ready-made alternative that is less stupid than the one
they would make themselves". Functions like strlcpy() and strlcat() fall
into this category. I'm thinking of Marc's comments (which are good) and
can't decide whether this SRFI is that type of solution. In principle,
it's indeed better to have a bespoke little language that can only
generate safe programs, but how many people have the skills to craft a
language that is more airtight than the language this SRFI would provide?