  We surveyed 97 developers who had used cryptography in open-source projects,
in the hope of identifying developer security and cryptography practices. We
asked them about individual and company-level practices, and divided
respondents into three groups (i.e., high, medium, and low) based on their
level of knowledge. We found differences between the high-profile developers
and the other two groups. For instance, high-profile developers have more years
of experience in programming, have attended more security and cryptography
courses, have more background in security, are highly concerned about security,
and tend to use security tools more than the other two groups. Nevertheless, we
observed worrisome patterns among all participants such as the high usage of
unreliable sources like Stack Overflow, and the low rate of security tool
usage.
