After reading the links posted by the OP, I'll say in Microsoft's
defense that this is not a bug but a feature
A somewhat common source
of security problems in C programs are so-called "format string
vulnerabilities"; if a user-supplied string is passed to a function like
printf(), the user might include %n specifiers, which would have the
effect of writing to some area of memory. In some cases this can be
exploited to get the program to do something that it is not supposed to,
perhaps letting the user do things that he ought not be allowed to do.
The proper fix, of course, is not to pass user-supplied strings to
printf(), at least not without sanitizing them first. However, since
there is a substantial amount of old (and, sadly, new) code written by
people who didn't realize the danger of such code, and relatively few
legitimate uses of %n, Microsoft made the decision to disable this
feature by default. Enabling requires calling a Microsoft-specific
function. This breaks ISO compliance, of course, and evidently confuses
some programmers, but does make the world a somewhat safer place, at
least in the short term.
The wisdom of this decision is certainly subject to debate, but it *was*
a decision, not an accident, and has at least some justification.
