What security resources should a white-hat developer follow these days?
A colleague of mine already has some understanding of security fundamentals but still needs "get in sync" with what is happening in the international security scene today. What online resources should I suggest?
My suggestions so far have been:
Follow developing stories by regularly reading something like SANS Newsbytes, Cryptogram etc.
Follow a number of "Security Rock Stars" at their blogs or on twitter.
Attend security conferences (preferably ones short on marketing, generous on technical presentations)
Check the questions at this site to see trends. Read technical papers, explore technologies to gain a deeper understanding, as needed
I'd be grateful to hear your suggestions too. Which are the really good mailing lists? Any security blogger/twitterer one should not miss? Other approaches?