@phryk Format strings are good. The security issues you've seen are probably based around the printf() family of functions in C and C-likes -- basically, passing in values to printf without giving it a format string is Bad Practice, and if an attacker can control the format string, they can dump some amount of memory.
This isn't really an issue in languages like Python, since there tend to be argument checks to not let formatstringless printf work in the first place. :)
