1. What you require you must also retire
2. Browser indicators: we are currently in a transition phase. A few years ago, the browsers only indicated secure behavior. In the near future, they will only indicate insecure behavior (ex: Chrome 75 shows HTTP sites as ‘Not secure’, but it also shows the green address bar for HTTPS sites with EV certificates)
3. HTTPS usage: 78% overall according to Firefox telemetry, but only 58% among the first 1M websites. However, we are a long way until the browsers will default to HTTPS scheme for loading a website.
4. Plaintext HTTP/1.1 is about 8 times slower compared to encrypted HTTP/2 HTTPS. https://www.httpvshttps.com/
5. Fiddler is really powerful (ex. replay requests, intercept mobile traffic, etc), but Havij (SQL injection) is close to magic when it comes to penetration testing
6. Certificate transparency is a really useful tool. The CT monitoring tool is arguably the only useful thing ever created by Facebook
7. A few tools: SuperLogout (maybe try this in an incognito window; it will log you out of all the popular websites), ZoomIt (screen zoom and annotation tool), Windows key + . (just try it if you’re on Windows 😉)
8. The expectation of privacy is different on a tech website compared to an online dating one
9. Trust, but verify: you should trust the CDNs and rely on them for the massive performance improvements, but you must verify them using SRI. Tip: you don’t need to SRI your own assets.
10. The main value proposition of the Content Security Policy is mitigating XSS attacks. A strategy to get started: use a non-production environment, report only, default-src ‘none’, watch the console and build your CSP by cleaning the console errors one by one.

The problem-solving process requires two preliminary steps: explain and incubate.

The process of problem-solving is first to explain and explore the situation and objectives. We can ask questions and share information, but we can’t propose solutions. Then we require an incubation period for subconscious problem-solving during which we undertake some mundane activity. Then we cooperate on finding solutions.

Graeme Simsion – The Rosie Result

Security exists in a continuum. Something pretty obvious for the people in the industry, but which has to be stated more often since there are many parties claiming perfect security or, as in the case of Bloomberg, arguing that better security is just as useless as little security:

Security is not binary,  which is obvious if you give it even a moment’s thought. A locked door is more secure than an unlocked one. A door with two locks is more secure than one with a single lock. A locked door with a locked gate in front of it is more secure than one without a gate.
In the same way a door is more secure locked than unlocked, messaging of any sort is more secure encrypted than unencrypted. End-to-end encrypted messaging is more secure than encryption that is not end-to-end.

John Gruber – Bloomberg on cybersecurity

The Locard’s Exchange Principle – met in one of the best books I read recently:

NOT EVERYBODY KNOWS THIS – OR CARES PROBABLY – BUT THE FIRST LAW of forensic science is Locard’s Exchange Principle, and it says ‘Every contact between a perpetrator and a crime scene leaves a trace.’ As I stand in this room, surrounded by dozens of voices, I’m wondering if Professor Locard had ever encountered anything quite like Room 89 – everything touched by the killer is now in a bath full of acid, wiped clean or drenched in industrial antiseptic. I’m certain there’s not a cell or follicle of him left behind.

Terry Hayes – I Am Pilgrim

The efficiency gain of the electric vehicles is overwhelming. This time Bloomberg gets it right:

About 10 million barrels a day of oil demand – roughly what Saudi Arabia produces now – isn’t merely switched into another form of energy. It’s just gone. Such is the power of efficiency. EVs convert a far higher proportion of the energy from the socket to power their wheels than a conventional vehicle does. 
Thermal energy generates a lot of waste in the form of heat. Only about one in four or five of those gallons of gasoline you pump and pay for provide energy you actually use, and perhaps 60-70% of what statisticians call the world’s primary energy use is really just waste

Liam Denning – Electric vehicles are overwhelmingly more energy efficient

Abusability testing – funny name found by Ashkan Soltani in his Enigma talk where he looks into the ways the technology can be used to cause harm. Abusability testing is an innovative and intriguing way to look into the possible ways the technology used in un-intended ways can cause harm to the others. Red teams are used to explore the ways that other can harm your organization, but it’s time to think about the possible ways that technology can be (mis)used and have a negative impact on others. The leading example (with the Kim Jong-nam) is eyes opening.

Bayrob malware: a fascinating story about 3 Romanians behind an extremely complex online fraud operation along with a massive malware botnet. Tens of millions of dollars in nine years, but they are fortunately going to jail.

The first image of a black hole has been recently taken by EU-funded scientists. Two notes: (1) the EU should make more efforts to advertise its research efforts and (2) for me this is a remarkable achievement, comparable to taking a photo of an emotion. It’s borderline philosophical, and the scientists effort has been tremendous.

The Norwegians are moving in the right direction. After launching a project to install in Oslo the world’s first wireless electric car charging stations for taxis, it recently decided to withdraw its support for oil exploration offshore the sensitive Lofoten islands in Norway’s Arctic.