Developers need to learn secure coding practices, but it is difficult to reach all developers. To help address this issue, programming frameworks and libraries should be designed securely by default to prevent common vulnerabilities like buffer overflows. Framework designers should make insecure code harder to write while still allowing overrides for skilled developers. Overall, the development process needs to guide and "babysit" developers more to prevent security mistakes from the beginning.

1. THE CAUSE OF LACK OF SECURITY Abu yusuf and muhaimin

2. As mentioned above Java and Microsoft's . NET Framework allow. We've been stating for years developers need to learn to code securely. Sure this is great, however is essentially limited to skilled professionals

3. This isn't to say we shouldn't keep teaching however rather than simply focusing on those paying attention we should start babysitting the write unmanaged code if there's a need, however by default manages it to prevent those darn buffer overflows from 'magically appearing'.

4. So how do you watch what a developer is doing? One of the things that needs to happen is to build better libraries and frameworks. Java stopped the overflow issues (minus specific VM issues), and Microsoft's ..

5. NET has followed in Java's tracks and done the same. Microsoft's .NET has also done one better and made development of vulnerable ASP.NET web applications harder

6. Injection or cross site scripting shouldn't be writing code!' and its a nice fantasy! ASP.NET detects if html is being taken in a user modifiable input, and if this input is echoed checks to see if HTML has been injected.

7. If it detects HTML Injection (usually an XSS attack) it prevents the application from behaving 'vulnerably' by halting it's execution, and displaying a warning message. I always hear the argument 'people who write applications vulnerable to buffer overflows,

8. New people are always learning to code, being put into situations to develop things maybe they shouldn't be and this isn't going to ever stop. The majority of skilled developers start out the same way and faulting them for 'learning the ropes' is just plain stupid

9. We need to start hand holding what developers are doing by preventing them (by default) from making common security mistakes. Just as important we need to provide overrides for those who 'know what their doing', because hindering application development isn't going to fly.