You don't kill a bug by finding it

I've never really believed that you just kill a bug by finding it. This is the guy who started Bugcrowd, so I need to actually say that out loud from time to time, because people assume that I do believe that. I don't.

Fixing the basics isn't going to come from screaming at people: "You still suck at this, and now we're just going to tell you more often." It comes from reducing the cost of actually fixing stuff. If we do that, I think we've got a good shot at clearing out some of the cruft, and then we can get to work on the more gnarly stuff.

From my conversation with Fede Kirschbaum on XBOW's Offense Taken.