What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
- Late breaking information on new security issues (RSS, Twitter, etc)
- A website that tracks unpatched security issues per vendor
- Twitter accounts, blogs, etc from well known people in the information security world.
- Who are these people?
- What are they known for?
- Communities that publish information regarding zero day exploits
- Blogs, twitter, conferences, chat rooms (irc)
- A subject matter expert that provides up to date guidance on Cryptology (algorithm, key length, etc.), and up to date information on how secure each one
- Open Source Software & tools that assist developers interested in the security space
- Information regarding bills and laws that apply computer hacking in the US and abroad (preferably in language a programmer would understand).
- Would probably include CAN-SPAM act, and per-state privacy legislation
- A site that publishes an exhaustive list of XSS techniques and permutations; and hopefully code that you can use to protect yourself
Please, Do NOT include:
- Guidance that is common among the infrastructure and network support groups
- An exception would be the recent ASP.NET security issue.
- Any list or notification that doesn't focus on code or programming.
- Software and tools that aren't open source
- Deployment checklists (especially if there is no code associated with it)
- General forums and discussion lists, unless they are well known and trusted by the security community
Since readers are likely not an expert in all these areas, please let us know a little about each link and not create a "dumping ground" of links. Do make an earnest attempt to not post duplicate links.
Since this is "security".stackexchange.com I hope to get a more diverse range of responses than the typical sysadmin site. In my experience, sysadmins stay away from code, and developers really have no fear when it comes down to the wire.