Every non-trivial app has vulnerabilities. One indication of a vuln is not "blatant incompetence"
I've responsibly reported my fair share of Twitter vulns over the years. In general Twitter fixed them quickly. (Except some CSRF/XSRF issue which was non-trivial and was when they had fewer resources.)
Dave Naylor was just irresponsibly publicizing something, which makes him somewhat of a jerk. Being a jerk is not necessarily a Bad Thing and of course we/I don't know the entire story here, but that's what it sounds like.
webpagetest actually renders the document and all referenced items. It's more similar to what firebug/yslow will tell you, and very useful for designing a site to load quickly.
This article's argument against using custom headers is a bit bunk. If you're not properly disabling proxy caching for sensitive data, you're asking for trouble anyways. Disabling caching properly is a bit tricky, but there are some useful details here: http://code.google.com/p/browsersec/wiki/Part2#Document_cach...
just received an email letting me know they've deactivated my account:
"Microsoft contracted with us, Intrepid Consultants, Inc, to conduct the TechNet Plus Pilot Study program research and manage the activities of the pilot study. Our records show that you have recently signed up for a free TechNet Plus subscription through a registration link that was made available without authorization on a public blog.
The registration link is part of a proprietary study and the party that shared the information was in violation of the terms and conditions to which they agreed to participate in the study. Membership to the Pilot study is limited and all members of the program are required to first meet survey requirements and then complete tasks and assignments over a two month period in order to qualify for and have access to the free TechNet Plus subscription. Since this was a privately conducted pilot study, at no time was it ever intended that a free TechNet Plus registration link would appear on a public internet site, which was done in violation of the terms to which participants agreed upon registering to participate in the pilot study.
We are very sorry for the inconvenience, but for this reason, we have deactivated your subscription, as well as all other subscriptions resulting from the unauthorized publication of the TechNet Plus Pilot Study program registration link on a public blog. Again, we apologize for any inconvenience.
It's definitely a useful trick for only showing certain content to certain users. For example, I wrote a script so you only show Digg buttons to visitors that have been to digg.com: http://int2e.com/blog/improved-digg-integration-script/