Security patterns and anti-patterns in embedded development

The remark about obscure languages is really an obscure tangent. Understanding the autoconf m4 code is vastly more complicated than understanding the m4 syntax. And the same is true for any complex software system (written in a mix of different programming languages). The Yocto copy I have lying around here consists of 100,849 non-blank lines of text. A lot can be hidden in there even from people who are perfectly familiar with all the involved programming languages because the sheer volume of code mean most of it will always simply be taken for granted without even trying to understand what it does.