"you cannot expect a person working in academia to be held to the same standards as professionals working in the industry for many years"<p>This is absolutely BS, especially in security and cryptography. Most security related code written by most so-called "professional" software developers is astonishingly terrible (e.g. ECB mode encryption, storing encryption key in code, reusing encryption keys, relying on (unauthenticated) encryption for authenticity, reusing IVs, linear time MAC verification, ...). Most cryptographers are academics. Also, anecdotally, the poisonous "demo an exploit or it doesn't happen" attitude in response to hints at a flawed system design is much more prevalent among "professional software developers" than in academia.<p>If anything, we should encourage more security experts in academia to engage in implementation, verification, and improvement of security code, not the other way around.<p>(Not that most academics write good code either, but this is not an academia/industry issue. It is a security expert/non-expert issue.)