Living with HTTPS
This is pretty great. I guess he gave this talk at HOPE, but it's laser scoped to startups, down to the order in which he gives the advice:<p>* Enable HSTS<p>* Don't link to HTTP:// javascript resources from HTTPS pages<p>* Set the secure flag on cookies<p>Very few of the sites we test enable HSTS. But it's easy to do; it's just an extra header you set.<p>The only quibble I might have is the fatalism he has about mixed-security Javascript links. I'd go further than he does: when you source Javascript from a third party, you have leased your users security out to that third party. Don't like the way that sounds? Doesn't matter: it's a fact. Companies should radically scale back the number of third parties that they allow to "bug" their pages.