There are other issues at play, of course. In cases where quality and business profitability are strongly aligned - think avionics - then there is plenty of high quality software.
There are other issues at play, of course. In cases where quality and business profitability are strongly aligned - think avionics - then there is plenty of high quality software.
I disagree.
Looks at any exploit database. A large percentage of the exploits on any typical day are the sorts of mistakes that a well-educated developer wouldn't make, or that best practices and modern tooling would prevent.
That's not even a cost/benefit problem, because in many cases there's no additional cost to doing things the right way. It's a culture and education problem[1].
[1] by which I do not mean traditional university education, fwiw.
At the risk of splitting hairs... there are costs associated with finding developers who have this education and/or fostering a company culture where security best practices are important.
If software companies were seriously punished for compromising PII, then I imagine we'd see a change.