The guy says he's been a security engineer for 17 years.

Someone who's a dentist will get exasperated if you don't floss religiously twice a day, a mechanic will have the vapors if you don't change your coolant every two years, etc. Not that those aren't excellent ideas, but it's not like the entire world will end if you don't do those things.

Everything looks like a nail when you have a hammer.

It's good to have a security policy, but it should be realistic not idealistic. That is, if there isn't anybody willing to fix and resolve issues promptly then the policy should directly state that it may be weeks before we can respond.

That is, while we are not under any moral obligation to provide emergency response to code we've given away for free, we also should be clear in the amount of support we can provide in such instances. Then people can make informed decisions on if they want to use Allegro or not.

That said, most security issues in Allegro are irrelevant if you are using it for its intended purposes of user-mode local games. But sure, if you are using it as root or in a shared environment where you are letting users control input, then there's probably a lot of ways for them to crash your system.

Now I want to know what are the security flaws in Allegro. I'm intrigued.