I'm not normally one to post the same thing on both blogs, but this deserves double posting: Michael Howard (author of Writing Secure Code) has a blog, in which he discusses all sorts of tasty security stuff. (Too bad gotdotnet doesn't support trackbacks.)