Funny how these faults keep happening over and over again in the same set of languages.

We've all been trained to sanitize user input, but the WiFi SSID isn't a user input string, so why should I need to sanitize it? --some poor dev wondering where their Twitterverse sympathy is

In a better language than C, format string injection would be less likely to lead to arbitrary read/write/RCE.

I'll admit I looked around before writing this and saw that Python's str.format() can be pretty bad. So let's say a reasonably constrained formatting language in a good runtime -- the attacker is limited in what they can see or control, and the formatter can see how many arguments were actually passed so it doesn't tromp off into other memory.

You are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing a string you didn’t mean to parse is a fault of C’s outdated API design, a design flaw that keeps tripping people up again and again.

It's completely their fault either way. They are responsible for the technology they use.

This nasty printf()-like way of formatting is a giant footgun though. Apple are not the first ones to fall into this trap.

Apple uses C for some bits.

Also there are Objective C APIs which take format strings, like +[NSString stringWithFormat:] and the system function NSLog().

Even Swift uses format strings in places. https://developer.apple.com/documentation/swift/string/31267...

But it doesn't need to, and we are talking about a modern system.

C was great for its time, now its time to move on and use a sensible language.