The InfoSec community likes to argue. From conference ethics & dress codes, through disclosure policies, the security of open/closed source software, and whether vulnerabilities should be allowed fancy names and logos. Thankfully, nobody argues with 0-days, that’s why we found a dozen of them, In the most popular web applications in the world. This talk will give one hacker’s perspective of the Hackers vs. Developers never-ending debate. We will show the critical differences and the gaping asymmetry of how each side perceives the world and views code, and come to the unavoidable conclusion: they hate us cause they ain’t us. Starting with the MediaWiki vulnerability (RCE on wikipedia.org) we discovered last year, we will delve into increasingly significant fails in modern web application software, all the way up to dropping vulnerabilities in absolute web giants, revealing findings awarded with max bounty payouts of >$10,000s USD. For each vulnerability, we will explore the context of the vulnerable code, looking through the eyes of the developer, and witness the true absurdity of the secure coding fallacy. We’ll show that no matter how much money is spent on security, despite security awareness training sessions and rigorous code reviews, vulnerabilities still exist in the most secure code, simply because developers just don’t have the privilege of thinking like hackers.