[troyhunt]

Years and years of experience? Often not, and that's speaking from years and years of experience!

Vast sums of money? Yes, at least the outsourcing vendors who churn this sort of thing out.

Unfortunately you're the exception Mark so good on you for that. Well I mean unfortunate for the greater web using population, but very fortunate for you!

[ZoFreX]

To expand further on those points with a personal anecdote... I worked on a "big website" for a very big government department. I was still in university at the time, had about a year's experience with the platform, and was earning close to callcenter wages.

The government only contracts to companies on a particular whitelist, which we weren't. They paid a company something in the region of £300,000 for the website.

That company then outsourced 100% of the work to the tiny (single digits employee count) company I was at.

They paid us £40,000.

My share of that works out at about £2,000.

The fact something cost half a million dollars in no way implies any kind of quality, or that the people working on the software will know what they're doing. (Really: another horror story involved a website that only needed to work in IE6... and had been built and tested purely in Firefox)

[iaw]

I'm scared to death of making a more-subtle security mistake that can be exploited. I find it surprising that people can be so negligent.