> Why do people keep making the same mistake? Because there are always new developers showing up that haven't been taught. (Eternal September if you will) The

> Why do people keep making the same mistake? Because there are always new developers showing up that haven't been taught. (Eternal September if you will) The real solution would be: 1. We are past the point were our practice needs professional licensure. We need standards, a governing body, and ethics. 2. Those above items need to be taught to new developers. How long has security been an after thought to CS degree programs? I know I never touched it in an academic setting. We didn't even have a class that covered it. You wanted to learn about it you had to seek it out. 3. Vendors to do the right thing and stop offering default passwords. That isn't going to happen, so we have to force them to, either trough legislation or through other means.