How many example websites are out there about how to use sql in programs have:
sql = “select * from User where firstname = ‘“ + firstname + “‘“;
And it was just posted today about people committing their AWS credentials. Mostly because every AWS example has client = S3Client(secretkey,accesskey,”us-east-1”)I was responding to the idea of just “googling for the answer”. In both of the situations above, the student would search for the answer and get back an example that was insecure, but how would they know that? In the first case, the sql statement is a prime target for a sql injection attack where they should have used parameters and in the second case, they should have not included their credentials in their code at all and configured their local box to store credentials in their user directory and used a role on AWS.
And you wonder why not only can’t Johnnie do FizzBuzz, but why in 2019 developers are writing insecure applications.
But why would I as a hiring manager (I’m a reformed dev lead), hire a junior developer who just knows theory and will spend the first six months to a year doing “negative work” when I could pay the boot camp grad or the recent immigrant who was focused on learning useful skills a few thousand more?
Before landing at my current job, I was passed on by lots of tech companies because I was good at theory and bad at interviewing/coding.
Again, let's keep in mind the premise: CS and SE are separate departments in a uni. Professors who gravitate more toward forwarding computational science are in CS; professors who gravitate more toward the science of building software systems are in SE. I posit that such a division would put people where they belong and make people going for SE better prepared.