Programmers Who Don't Understand Security Are Poor at Security

I feel like this should be an obviously true statement. It would be inordinately improbable to be good at something complex that one doesn't understand.