> because 98% of us are completely clueless

Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious.

I suspect there could be a startup idea here somewhere.

> absolutely not thinking about this stuff as we're trying to clear a sprint board

Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.

I had exactly one course that touched on security.

A course in web programming.

The instruction we received consisted of: "If your project is not secure, it will lose points."

I'm not sure a single person on that class had one point taken off for getting security wrong.

Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?

(Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)