> "You won't find good engineers interested [in fixing vulnerabilities]. It's a waste of their talent." > "He said engineers dedicated to coding will not devot

> "You won't find good engineers interested [in fixing vulnerabilities]. It's a waste of their talent." > "He said engineers dedicated to coding will not devote time to fixing bugs." Unless he meant to say finding the bugs or doing quality assurance, this is very elitist. Engineers dedicated to coding should fix bugs they themselves created, because it means they know the source code better than anyone, and will be able to do so with minimal effort and minimal side-effects. Saying it's a waste of their talent made me puke a little. Coding is fixing bugs. It's a big part of development, and often takes the hardest work or most thinking. You can't just start throwing code around and expect someone else to come around and fix your bugs for you. That's ridiculous and will probably result in a culture where new bugs are created faster because there's no responsibility. > "You have to analyse the vulnerabilities of these apps and understand attacks, at a very fast speed. We don't have that time anymore." If you're coding a web app and you're (calling yourself) a topnotch engineer, you should understand the basics of web app security, and how to avoid the top attack vectors such as XSS, SQL injection, XSRF, etc... You really have no excuse not knowing about them, and should from the ground up code the app to avoid these vulnerabilities. Saying it'd be a waste of talent just doesn't make sense, because if you have any talent in coding, then you know about these, and you know how to code the app without creating them. It's like a reflex. My conclusion: this CEO Philippe Courtot is full of shit.