This article is a great illustration to me as well of how hard it is to do security right even if you're a professional, much less a developer who's mostly resp

This article is a great illustration to me as well of how hard it is to do security right even if you're a professional, much less a developer who's mostly responsible for implementing features not building secure systems. The internet is rife with self-proclaimed experts, all offering directly contradictory advice as loudly as possible on best practices for security.