Hi,
Some comments on this topic:
- LaFoSec was started in 2010, which explains why it focuses on OCaml 3.12.
- If some observations seem obvious (for smart people that you are ;-) ), a lot of them are much less obvious (the fact for example that you can discover a secrete key using polymorphic comparisons without breaking the type system). Also, they give an interesting set of arguments for pushing OCaml instead of other programming languages, so for me, they are really going in the good direction, it's a very good thing for the OCaml community.
- There is a document that was also written, but has not been published (it was described at the last JFLA'2013 seminar, also in French), providing a set of recommendations to improve OCaml for security applications. I don't know why it was not published with the other ones, maybe because it would become obsolete faster than the other ones.
--Fabrice