I'm married to an attorney. I like to think she's generally honest. She has put together some form contracts for software businesses I've been in, and they have the nice attribute that everybody says "this is a fair deal" and signs them.

I can say that the legal code of ethics has some bright lines in it.

If a client gives you funds to hold for some reason, and you put them into your own account, and you get caught doing that, you get disbarred : you lose the right to call yourself a lawyer and/or appear in court for your clients.

If you give another lawyer money to induce him to tell his client to sue your client so you both get fees, you get hauled up before the bar overseers on charges.

If you talk about your clients' business without their permission, you get hauled up on charges.

To say "lawyers are unethical" is to fall prey to the availability heuristic. We all know about scumbag pols who happen to be lawyers.

I think gregwtmnto has a point. If we software people had something like Professional Engineer (PE) registration (civil engineers have that), it would help. Companies gathering sensitive information could ask for a PE to sign off on the security measures. That would serve them as a defense should somebody sue them for damages after a leak.

The same is true for bridge designers. PEs sign off on the designs, after making sure the bolts are strong enough and the pilings are deep enough and all that stuff.

This cyber security subject is near to me; my present (small) company finished our PCI (payment card industry) audit yesterday. We've worked hard to avoid the stupid webdev tricks in Troy's article, and even some not-so-stupid vulnerabilities. These stupid tricks erode confidence in all of us.

Hold my beer. Watch this!