The Developer Is the Enemy

The authors argue that application developers, while often viewed as allies in the effort to create software with fewer security vulnerabilities, are not reliable allies. They have varying skill sets which often do not include security. Moreover, they argue that it is inefficient and unrealistic to expect to be able to successfully teach all of the world's population of software developers to be security experts. They suggest more efficient and effective alternatives, focusing on those developers who produce core functionality used by other developers (e.g. those who develop popular APIs - Application Programming Interfaces).