The problem is, these kids are from college. They don't teach you stuff like "writing a secure web application" in college, or even try to. Bingo. I went to Ge

The problem is, these kids are from college. They don't teach you stuff like "writing a secure web application" in college, or even try to. Bingo. I went to Georgia Tech, which has a pretty damn good CS program, and I had to hunt for security classes. One was a "special topics" course that wasn't available very often and didn't have anything to do with application security (was a Net. Sec. course). The other was not a CS course but a Comp. Eng. course and was focused on penetration testing. :/ I actually earned a "Network Security" certificate with my degree which I never even knew was available (it wasn't mentioned anywhere in the course literature). Since I've graduated they have redone the whole CS dept so I don't know if things have changed, though. But like someone else said, a lot of this stuff is common sense, especially if you're a programmer and have systems knowledge. And I think most programmers have the habit of imagining all the different ways things could break when they are coding, too. Like a hackers curiosity that most of us share. I know when something looks obviously wrong on a website or in an application I'm using I start to poke around and see what I can uncover.