Do you think it's a bad idea that git and the Linux kernel are written in C?
Is the possibility of a buffer overflow important in a program that's not processing input from random people on the internet?
No, because they are both legacy software. I understand momentum in codebases - that's why I'm reserving my vitriol for fresh bluesky projects like this one.
As for exploitability, privilege escalation and shellcode injection is still very much a thing, internet-facing or not.
Shellshock is a flaw in bash parsing and has nothing to do with that fact that bash happens to be written in C. Also, it's only a problem for untrusted input sent to bash. Typically, from the internet.
