As a dev, you should start learn about the most common bug classes and get a proper understanding on what is happening and how you can prevent them. Then it's worth looking into how you can exploit them. If you work for a big company, you may be able to spend some time working along your security team, that will help you get a foot in the door. Security teams are always looking for people who already understand the code bases and deployment processes and want to inject security everywhere :)
<shameless_plug>You may like https://pentesterlab.com/ if you are looking for a course</shameless_plug>
Fair point and you're (obviously) spot-on for the attacks and very valid point on the names used.
It's a problem with most learning resources, you get what you put it. Most people get out of these exercises one of these two things (or both):
#1 a real understanding of the issue (best case scenario)
#2 awareness that encrypted/signed doesn't mean bulletproof.
Worst case scenario, I think these exercises help people with #2 and may get them to look a bit deeper when they are reviewing applications. It's not meant to be a crypto training (IANAC), the goal is to help people gain some awareness around crypto issues they may encounter during an assessment.
Got in during the beta. Incorporated in less than 2 weeks. The process was quick and straightforward. I started the paperwork to get a debit card from SVB 3 weeks ago and I should receive it in few days.
Long answer: it's a risk game, you may get away by showing that you have processes in place to manage this risk for open source projects:
* internal backup of the source tree.
* in-house skills to perform basic patching of the software if the development get discontinued.
* alternative solution and roll-out plan in case the development of your current solution gets discontinued.
* ...
Finally, risks can be accepted and someone ("the business") can sign-off on them. You don't have to remediate everything. It's just an awareness exercise for "the business".