> Developers are very much the main problem here. > But each time is even hinted "why not ACTUALLY fix things?" the answers is "nope, too much work", but for c

> Developers are very much the main problem here. > But each time is even hinted "why not ACTUALLY fix things?" the answers is "nope, too much work", but for create chat apps and more tools for surveilance and privacy invasion the money pit is bottomless. You're blaming developers but citing product/economic/business decisions. In all likelihood, the problem is as much organizational/economic as it is technical. For example, consider the manager who was warned about the security risks by the engineering team, but decides to ship the product on schedule and get promoted long before any serious vulns are discovered. Or the case where engineering raises the issue, but fails to effectively communicate the severity of the concern. Or the case where engineering _assumes_ management understands the risks. I'm sure there are lots of developers who do think they should just use C because it's what they've used forever and _lesser developers_ might make mistakes but _they_ don't, but I'd be surprised if these folks are the primary driver of the situation.