not that stupid as leaving a million passwords in plaintext. There's a limit to what a great developer can do due to oversight, laziness or whatever.
back
2 comments
The coders who join these companies are not in it to do the right things (cf. the popular things), to make sound decisions (even if they are based on "old" thinking, like the notion of privacy, and appear to be boring). These developers are in it for the perceived prestige of working for a high profile company, for the nonserious working environment (if they are young), and often simply for the money. These jobs often pay better than, e.g., working on projects where there is great concern with doing things the right way. But the high-profile "Web 2.0" company does not necessarily produce better code.
Doing The Right Thing (tm) is always easy when looking from the outside in. In my experience, good developers write shitty code all the time, because the world is a messy place and quality comes at a price.
As an anecdote, I once worked on an application where we had to store passwords in plain text, because the password should also be used in a piece of hardware and to provision that hardware, we needed to send the password to said hardware. There's just no good and easy way to solve that and when you're constrained by real world limitations, sometimes you just have to accept a suboptimal solution.
You could at least encrypt the passwords on disk an decrypt them when needed. this is not ideal because you still need to keep the key around, but it is better than plaintext.
That's what we ended up doing. As you say, not ideal and given that we were in a hurry, it didn't get priority for a long time (Since it was mostly futile anyway).
Anyway - Just an anecdote to show that things aren't always that simple.