Every week a story like this comes out. And a lot with really large companies that have huge amounts of funding and are certainly capable of hiring people who k

Every week a story like this comes out. And a lot with really large companies that have huge amounts of funding and are certainly capable of hiring people who know what they are doing. As fun as they are to read about, I don't care so much about the actual attacks. How to do it wrong is well known. I am interested in what causes this problem in general. What is causing so many companies to have such abysmal security practices even though we know how to do it better? Can it be fixed? If the industry does not police this, the government will have to regulate us to ensure compliance with more reasonable practices. That means auditing of our code by independent agencies, paying the fees to do so, suffering the inevitable cases where code is stolen by corrupt auditors, and the foot in the legal door for future and expanding governmental code regulation and auditing at all levels, not just web facing. It would be much better if we could solve this problem ourselves as a responsible industry and avoid the necessity for invasive regulation.