If it was true that trust is enough to market software, there would be much more investment in application security by the long tail of startups, consultancies,

If it was true that trust is enough to market software, there would be much more investment in application security by the long tail of startups, consultancies, and webdev "shops". What I've found over the years is that most people who sell software think of security as a value-add. At best, it's something to bill enterprise customers for. At worst, it's a cost center that will only be invested in if a big paying customer asks for it explicitly, and not a moment sooner. [1] For background: I spent years pushing the PHP ecosystem forward in cryptography and security. I published a lot of open source libraries [2], cleaned up a lot of StackOverflow answers [3], and had a lot of discussions with small and medium businesses about security improvements that ultimately went nowhere because they couldn't find budget for security. I don't believe it's fair to say that trust is "at the core" of software marketing if so many successful software companies can get by without investing in making their products trustworthy. After all, deception can obviate trust in this context. (I do believe that software ought to be more trustworthy, and society should reward companies that act with integrity. But at the end of the day, that's not my call to make.) [1]: https://sso.tax https://sso.tax [2]: https://github.com/paragonie https://github.com/paragonie [3]: https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-php-software-thing-past https://paragonie.com/blog/2018/01/our-ambitious-plan-make-i...