Probably the best article on security I've ever seen come up on Hacker News. I would take the security@ recommendation and move it up a few notches though. It costs nothing and you get tremendous benefit if someone is trying to tell you something.

And the irony about Evernote being hacked (http://evernote.com/corp/news/password_reset.php)... I'm surprised they were even able to find the compromise and prepare a coordinated response. Who knows, maybe this event is what caused the CTO to see the light? Learn from other's mistakes, people.