Living with HTTPS
This is pretty great. I guess he gave this talk at HOPE, but it's laser scoped to startups, down to the order in which he gives the advice:* Enable HSTS* Don't link to HTTP:// javascript resources from HTTPS pages* Set the secure flag on cookiesVery few of the sites we test enable HSTS. But it's easy to do; it's just an extra header you set.The only quibble I might have is the fatalism he has about mixed-security Javascript links. I'd go further than he does: when you source Javascript from a third party, you have leased your users security out to that third party. Don't like the way that sounds? Doesn't matter: it's a fact. Companies should radically scale back the number of third parties that they allow to "bug" their pages.