> As someone who works in compliance, I have observed that many developers do not have a strong interest in secure coding. This is just selection bias. Your jo

> As someone who works in compliance, I have observed that many developers do not have a strong interest in secure coding. This is just selection bias. Your job is to make people comply, most likely with something that hasn't been a priority until something happened to make it a priority. If you have a team built around shipping lots of functionality quickly, well, you are going to get a lot of blank stares when you start slowing things down. So, compliance is a hard job. And people who haven't made security a priority over time are not going to have much awareness of best practices, or OWASP. > It appears to me that the development of secure software is primarily led by cybersecurity folks rather than developers themselves. Whats HN's view on this? If you want to shift from "move fast and break things" to quality + security (which are peas in the same pod), it will often take new leadership. The processes, people, systems, and culture will need to change a lot. An observation: being good at finding problems is not the same as being good at fixing and preventing problems, and this where you have to be careful when you are changing leadership. It's not as simple as hiring a certification. It's actually a big organizational challenge.