Java, C#, and Node.js come to mind immediately as good candidates, but any beginner-friendly language probably need it to some degree. The Node.js core is part

Java, C#, and Node.js come to mind immediately as good candidates, but any beginner-friendly language probably need it to some degree. The Node.js core is particularly bad: It only offers OpenSSL's userspace RNG rather than the operating system's CSPRNG. (That's what window.crypto.getRandomValues() hooks into.) Many of node's deficiencies are tackled by the community, of course. For example: https://www.npmjs.com/package/scrypt-for-humans https://www.npmjs.com/package/scrypt-for-humans versus the native PBKDF2 (with no constant-time comparison). I hear Ruby's SecureRandom still refuses to switch from /dev/random to /dev/urandom as well. Feel free to throw your hat in the ring on that issue. Historically, C# doesn't have as strong of an open source culture, but if you wanted to make an impact, you could try to nurture it into growing explosively. But generally: Look at the languages you're already familiar with and see if bad security advice gets more attention from non-experts than from experts. If that's the case, go out of your way to learn how to do things better (if you aren't already well informed) and publish your corrections.