> the mindset of someone who is writing an application is to build something cool As a developer, this rubbed me the wrong way. "Building something cool" is de

> the mindset of someone who is writing an application is to build something cool As a developer, this rubbed me the wrong way. "Building something cool" is definitely a thing we all like to do, and every developer worth their craft has introduced some features just because they found them "cool"; that said, developers' "mindset" nearly completely focuses on several activities, with a varying level of importance depending on a number of factors: a) building something that works as close to the specifications as possible b) making sure that other developers can maintain it, and also that it can be deployed, tested etc c) (optional) making it as efficient as possible Or, as the saying attributed to Kent Beck [1] goes: "make it work, make it right, make it fast". The "cool" factor is usually present, but is on a much lower level of importance than the above three. There are others, sitting in between and sometimes even rising to the top, with security definitely being one of them. But because of the focus on particularly "a" and "b" above, the developers simply don't have the level of understanding of security issues as is implied that the experts expect ("idiots" being a shortcut for anyone below that level). So they introduce the security features the best they can, such as that example of the key in the PHP app described in the article. [1] http://wiki.c2.com/?MakeItWorkMakeItRightMakeItFast http://wiki.c2.com/?MakeItWorkMakeItRightMakeItFast