> Hence my conclusion: if you can’t hire web devs that understand how to write secure web apps then writing secure web apps is impossible. Furthermore, the web

> Hence my conclusion: if you can’t hire web devs that understand how to write secure web apps then writing secure web apps is impossible. Furthermore, the web devs that understand how hard it is to write secure web apps generally don't want to do it for a living. I've found that the most straightforward way of avoiding problems on the web is to sidestep them as much as possible. Draw UI with canvas or WebGL, overlay native widgets, use RPC over a WebSocket for everything except for public assets.