Good article (although I thought it was going to have something to do with the grsecurity thing), but it doesn&#x27;t mention the <i>other side</i> of the problem:<p>&quot;<i>To them, we’re Chicken Little crossed with the IRS crossed with their least favorite elementary-school teacher: always yelling about the sky falling, demanding unquestioning obedience to a laundry list of arcane, seemingly arbitrary rules (password complexity requirements, anyone?) that seem of little consequence, and condescendingly remonstrating anyone who steps out of line.</i>&quot;<p>That is often true.<p>It might help if security knew what the hell we did. The last three &quot;Java is broken forever!!!&quot; issues, when the problem was with <i>applets</i>, nearly killed me. Or possibly if they knew <i>their job</i>. The last employer&#x27;s security policy was defined by the latest vendor tool they bought, never mind that it couldn&#x27;t possibly find any issues in the applications we were writing.<p>Of course there was the code review I did where I pointed out that it had a giant, monstrous hole in it. The other dev nodded and said, &quot;yeah, that&#x27;s a good point&quot;. But the app had to be in production now, so nothing happened. To escalate, I would have had to go to security, which would be like complaining about a hangnail to an axe murderer. So, nope.