> Does every single web and mobile app that gets made by anyone these days now require an extensive knowledge of how to do security right?Everyone should know the basics, and should know enough to know when to consult someone else or learn the not-so-basics. They should also know the key rules:
* Security should never be an afterthought unless you are doing proof-of-concept development and even then as soon as you move from PoC to prototype/alpha then relevant security should be baked in to the design
* Relevant is the key word above. Everyone should know when security is needed/desirable. Not being aware that bad security is a problem is not acceptable these days, if it ever was
* Don't try be clever and roll your own
* Don't be lazy or NIHy and roll your own because you have trouble integrating with something else
* Get someone else to review the design and code occasionally, how-ever informally - mistakes will be made, particularly in security, and finding your own is sometimes more difficult than finding someone else's. Also your users won't find security issues like they will easily spot functionality ones.
* Don't claim any security claim that you can't definitively back up. You make the rest of us developers look bad when you get called out on the matter.
* Better still, make sure that your users know where your security is intentionally lacking ("this is not designed as an NSA secure service, we do not encrypt data server-side, if you are storing a secure document here encrypt before sending" or such).
* Absolutely everyone who implements something that needs to authenticate a user needs to know what good password handling is, even if you use third party services for authentication you need to understand what is going on in order to judge if a given third party is good enough at what they do.
> It really gets in the way of just making things and putting them up; I think kind of kills the spirit of creation and entrepreneurship.
If what someone is just putting up" is something that holds personal or otherwise sensitive data, then I don't think this is a bad thing. If they are collecting that sort of thing (actively or passively) then they should be careful about it or should reconsider doing it at all (or should warn their users that what they are "just putting out there" is not production ready yet so may not be secure).
Of course if you are not doing anything with sensitive data these requirements reduce greatly. If you are doing anything that require authentication then you still need proper auth handling code no matter what though.
> Are you doomed to fail at the startup game if you don't know security well?
If your startup handles personal or otherwise sensitive data you should be, if by "startup" you mean that you intend to make a living (or just make a name) with what you are doing. This sounds harsh, but that is just the way it is. The world is harsh.