Full-Disclosure Paper Edition?

While the cats over at sla.ckers (and others) do a great job of finding real vulnerabilities in real applications, we don't actually spend much time calling out book authors for the same.

A couple of guys had a presentation at a recent conference (I won't mention names because they certainly weren't the first to call out a book for telling people to do stuff in a silly way) where they followed design patterns from books on web application coding and ended up with a really horrible (in terms of security) application. They were gutsy enough to name the books they used for the design patterns. But this is really rare.

It seems that while we want for developers to be trained as real engineers who apply real engineering and computer science principals to problems, many developers writing real-world, high-visibility applications were mostly trained from bad tutorials on the internet and books at the local bookstore.

I churned on the idea of setting up a full-disclosure paper edition website, modeled after the other full-disclosure sites, but then there are issues with copyright violation and such - whereas with reporting web vulnerabilities is mostly a question of ethics, I think full-disclosure in a paper edition would be a question of copyright issue and legality. While I'm all for publishers and authors being accountable for the material they publish (hey, bloggers too - call me out when I'm wrong), I can't in good conscience stand up a site that I don't know the legality of the material that would end up on it.

That being said, do we take programming examples with a grain of salt? Do we look at them with the same scrutiny as we do the sites themselves? Where a single vulnerability on a single website is genuine, it's also one person's mistake in the end result. But flaws in books are by people who claim to be experts in the field of development, published by publishers who vouch for the authenticity of that expert opinion, fool users into believing that the book indeed tells the right way to do something.

Is this all a result of the internet, where niche experts are considered authoritative on more subjects than they ought? Where somebody writes a few blog posts on a subject and are "discovered" by a publisher who needs to get some print out in that niche market? If that's the case, how do we convince developers to use a greater level of discernment when they do that google to figure out how to use a new API?