The security brag list at the bottom linking qmail and seL4 is a little funny.<p>qmail has the property that (if it is indeed secure, which is a disputed claim) it&#x27;s secure by virtue of djb&#x27;s superhuman awesomeness. I&#x27;m happy to believe that djb can come up with secure elliptic curves, but I&#x27;m under no delusions that reading all his papers and coming up with my own elliptic curves is in any way a good idea. Similarly, even if I take the djb way of software writing to heart, I don&#x27;t see a reason to believe that <i>I</i> could write software with qmail&#x27;s level of robustness. I am just not a world-class expert the way that he is.<p>seL4, meanwhile, has a formal model of the C programming language in the proof assistant Isabelle&#x2F;HOL, a formal model of what they want their C codebase to do (and not do), and a formal proof that, in fact, their C codebase has the properties they hope that it has. The C is handwritten, but it may as well not be; you can&#x27;t do feature additions, significant refactoring, etc. to the C without needing to replicate those all in a language that is completely unlike C.<p>If these are the best arguments in favor of writing secure software in C, you don&#x27;t really need any counterarguments....