3 ms·

You make it sound like it's developers fault, while in my experience that's merely the market that does not ask for nor reward spending time on correctness (or

• nickpsecurity 11y ago
  I think it's both but mostly the market. I've written essays condemning the demand side before as ultimately responsible. Yet, remember the users make up most of the demand. They want it faster, more features, cheaper, and so on with very few willing to sacrifice any of that for quality or security. So, companies focusing on the latter mostly withered with remainder in niche. Most deliver users (or shareholders) what they wanted or a knock off of it. The part where I see developers at fault is rejecting options that improve things, for them and users, that they can actually use within this mess. An example might be the web security frameworks for PHP while developing a PHP service. It takes almost no work to use them with many components pre-built. They prevent total disruption of service or record theft from hackers. So, why aren't the developers using them? This problem manifests all over the stack for many preventable issues. Most developers consistently refuse to put in a little extra rigor or effort upfront to prevent problems down the line. Those that do... a little closer to engineers to me... experience rewards then write blog posts or papers encouraging others to do it. They're mostly ignored. This is the problem. Management and users aren't causing this one.