The way you have defined "developer", you have defined an idiot. An unethical, incompetent idiot. Our purpose, as computer engineers, is to convince piles of c

The way you have defined "developer", you have defined an idiot. An unethical, incompetent idiot. Our purpose, as computer engineers, is to convince piles of carefully-cooked rocks ("computers") to do a very specific thing repeatedly ("computing"). Since humans are terrible at understanding specificity, we design languages and abstractions that help us encode our goals into computer-readable codes. At no point is "build something cool" the goal other than during recreational programming; our goal is not even to build, necessarily, but to understand the requirements of our users and to help them use their resources more effectively. To this end, "cool" is totally worthless; it is a facet of design, of product, and of marketing. Let them focus on the spectacle. We must focus on the specification. Why don't developers care about security? Because we have raised them to not care about security. We have failed to instill a desire for security into our culture. Consider: Computers have been remotely hackable since the dawn of the Internet. (Check out the history of SSH or email for terrifying examples.) We do not have the cultural norms necessary for getting security correct; we barely know how to distrust soliciting strangers on the street, let alone Martian or Christmas-tree TCP packets. How can I help? Well, I can try to shove POLA [0] and capabilities [1] down everybody's throat, but so far, it's been like trying to convince people that the world is a globe [2]. Here's how you can help. Pick up a single easy security meme, think about it for a while, and then pass it on. I recommend starting with "security should not be optional" if you're a FLOSS developer, or "everybody is on the security team" if you have a corporate employer. [0] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege [1] http://habitatchronicles.com/2017/05/what-are-capabilities/ http://habitatchronicles.com/2017/05/what-are-capabilities/ [2] https://corbinsimpson.com/words/globe.html https://corbinsimpson.com/words/globe.html