Best of Application Security (Friday, Oct. 9)

Ten of Application Security industry's coolest, most interesting, important, and entertaining links from the past week -- in no particular order. Regularly released until year end. Then the Best of Application Security 2009 will be selected!

• null-prefix certificate for paypal
• Statistics from 10,000 leaked Hotmail passwords
• OWASP Interview with Andy Steingruebl
• Web Application Security Scanner Evaluation Criteria Version 1.0
• All about Website Password Policies
• 9 Ways to Improve Application Security After an Incident
• CSS History Hack Used To Ban Torrent Users
• BSIMM Begin
• Identifying Denial of Service Conditions Through Performance Monitoring
• XSS Protection by Default in Rails 3.0