[twstdroot]

I don't think that is an over estimation of the impact of universities. First, are the majority of university educated programmers really learning from CS professors? I'd venture that more programming is taught outside of the CS programs these days. Second, as someone finishing a degree in information security and having worked in IT for 14 years and IT security for 4 years, universities are not doing a great job in teaching applicable security. It is a rapidly evolving space and course materials just aren't keeping up.

[mathattack]

I think we're saying the same thing. Universities aren't teaching security, so folks learn it elsewhere. Most people hiring new grads know this.