tinyformat VS printf-tac-toe

printf has some pretty serious security implications. When I want more complicated text printing options than what is easy or terse in iostream then I use the tinyformat library.

The usual way I do I/O is via combining C++ stringstremas with either tinyformat or via an implementation of p0117 "variadic to_[basic_]string, depending on the particular need.

Haven't been able to make it work with MSVC 2012 (the earliest Windows-side compiler I need to support). I myself use tinyformat instead.

However, not all is lost. While there are libraries like {fmt} I don't pay attention to them because they are far away into The Future and unusable with my requirements (C++03 support at the earliest, work reasons). Most newfangled libs I've seen are intended for Compilers of the Future, for C++20/C++23 and the like, and with that among other reasons are not generic enough for me. Instead I just use tinyformat that lays on top of both and bridges them, not to mention the biggest sell that is rrtaining the POSIX style printf notation (why didn't {fmt} go with that is still a mystery to me).

Somewhat related to this, printf alone in a loop is Turing-complete, by using %-directives like that. It was introduced in “Control-Flow Bending: On the Effectiveness of Control-Flow Integrity” (Carlini, et al. 2015) and the authors have implemented Brainfuck and an obfuscated tic-tac-toe with it.

[0]: https://nebelwelt.net/publications/files/15SEC.pdf

[1]: https://github.com/HexHive/printbf

[2]: https://github.com/carlini/printf-tac-toe

My favourite is still that printf is Turing Complete

C implementation of Tic-Tac-Toe in a single call to printf\ (17 comments)