But will users in aggregate pay more when extra effort and resources are expended on security? Will you?

If the answer is no, then the smart developer has no financial incentive to do so, and every reason to segment security out as a premium feature.

Maybe MITM vulnerability counts as broken code. But as always, markets win. I don't think the status quo will change until users consider security assurances worth hard dollars.

Good luck getting your users to come back and trust you after a major security incident that compromises their systems. I would turn it around and think of it this way, is it worth giving up some profit to help ensure you don't have embarrassing and damaging security issues? It's like insurance, you pay the premium and hope you never need it.

If they aren't paying you, they aren't your users.

This reinforces my priors that there is very little "free-as-in-beer" software.

The software that runs the repository is nearly irrelevant for the purpose of this discussion. The question is solely about services, which are a lot more difficult to fund at scale.

By that logic, smart developers have no financial incentive to fix bugs unless it's for a paid upgrade.

Think through that a little more and I think you'll find there is long-term ROI in the form of customer trust and goodwill. You'll buy the product because it works and won't hurt you, and basic security should be part of "won't hurt you".

>> By that logic, smart developers have no financial incentive to fix bugs unless it's for a paid upgrade.

Right! And that's actually a valid model. Ask HP about what it'll cost to upgrade the firmware on your enterprise server..

It's valid, but the claim was that it's the only valid model for smart developers, which is false.

Think through a little more of what the parent poster said. If companies truly did gain that much more trust and good will from secure code, they would all be doing it.

But they are, with increasing intensity. Companies really suffer from security blowups and customers are becoming more aware of its importance. This is why the attitude I cited is so dated and needs to finally come to an end.

I've heard "companies are finally taking security seriously" mantra for almost 20 years.[1] Maybe it's true this time. But often the customers don't give a hoot whatsoever, and so the company doesn't either. Admonishing them might feel good, but unless you are paying them money, your opinion is not really an issue to them.

[1] I had a boss who insisted that TJ Maxx was going to collapse because of their security holes. Nope.

When someone bakes kerfuffle muffins, you need to screenshot that shit.

Screenshots can be easily faked.