It's a social problem. People make mistakes, or are coerced into letting mistakes persist, because you have to get the features out. And if you stand your groun

It's a social problem. People make mistakes, or are coerced into letting mistakes persist, because you have to get the features out. And if you stand your ground on security, management will find someone who won't. If software "engineers" were engineers who had the duty and authority to say "no, I won't build something unsafe" we'd have fewer problems. Not to say that improved tools isn't also a worthy goal, but why not attack the problem from all angles?