That doesn't put the primary fault onto devs though. There is a significant amount of pressure to actually build all these stupid systems coming from multiple fronts (e.g. people who believe it is more secure, business who demand certain features). Surely primary responsibility goes to the person who demands the feature. If one developer refuses, they can find another developer without too much difficulty. It would require most developers to refuse, whereas it only requires a few business owners to make other choices.

(Senior Developers could probably respond "here's some better ways". But Junior devs often hardly know their own name, let alone what better alternatives there are to this security theatre.)

>That doesn't put the primary fault onto devs though

I agree on that, the primary fault is at the hands of the one who thought that up and pushed it through to completion, but "just doing my job" and "if I don't do it someone else will" doesn't pass the smell test to me.

Developers can always not have a job.

Meta: This comment was dead a moment ago. Now it's alive and shows no indication of being voted down. How do comments become undead? Are some people still able to vote on them?

If you have enough reputation you can "vouch" for dead comments. As far as I can see, it at least temporarily resurrects them (perhaps if enough people "vouch").

Oh I see, it makes sense, thanks.

There are literally thousands of dev jobs where doing stupid shit is not a requirement.