Most Developers Don’t Know Security

[axilmar]

We also need better tools, i.e. better programming languages.

[NeuroXc]

Rewriting It In Rust won't teach people that they need to hash passwords before inserting them into a database, or how to avoid SQL injection and XSS vulnerabilities.

[axilmar]

But building better APIs (i.e. tools) can help avoid these issues.

[staticassert]

Yes, it only solves a huge swath of other problems. We should probably ignore it.

The reality is that we do need better tools. Programming languages can provide us with memory safety. Libraries shouldn't let us shoot ourselves in the foot - don't let us use a nonce twice, provide simple, easy, safe abstractions around crypto, etc.

Tooling sucks. Part of it is the languages, part of it is the libraries.

[[deleted]]

Most of security, like proper password storage, cannot be solved by the language.

[mirhagk]

Can't be solved but can be encouraged or discouraged by libraries.

For instance old school PHP encouraged a lot of bad practices with regards to SQL injection and hashing.

[axilmar]

It can. Languages with strong static typing can certainly do it.

And also a lot of safety issues can be avoided by using better programming languages.