As basic and important as salting + hashing passwords is, it is the sort of task that ends up on the technical debt list or scrum back-log, never to be looked at until it becomes a problem.
As basic and important as salting + hashing passwords is, it is the sort of task that ends up on the technical debt list or scrum back-log, never to be looked at until it becomes a problem.
Sure, once they've been on the wrong end of a high-profile identifying information leak, they'll never forget to do it right. But the best of the best? They're building air traffic control systems, or embedded missile guidance, or airbag controllers, or F1 ECUs, or million-simultaneous-call telecoms payment processors, or any one of a thousand other systems where you don't get a second chance to get it right.
1.- How do those companies get the best of the best?
2.- Are you sure it's talent and not process? Where you can't fail, you usually have even the smallest change specified in thousands of pages and reviewed by many people.
2. I think, at it's best, the process is the safety net. At it's worse, it's a substitute for talented people - but I don't think that's sustainable for long. Perhaps it's just a different talent, for working in an extremely tightly controlled way without going crazy.