whatismyip

You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.

HSTS is not something you can realistically implement until every path under the domain can be served via HTTPS. For the BBC this is problematic because there are hundreds of products and inter-dependencies under the bbc.co.uk/bbc.com endpoints. The amount of work required to do this is non-trivial, and not something that can be done in blanket - each product needs to test their product, its dependencies etc. There's also other issues like CDN endpoints (and the BBC uses several providers, including its own CDN), a relatively large and complex traffic management set up and the politics that comes with a relatively large organisation running a very big website.

Is there a reason why you decided to completely overlook the aspects in the film around discrimination and segregation of the labour force?

When it's available in my region, sure. It's coming up to 2 and a 1/2 years old and still only available in 5 countries.

AWS keys are already being detected and the account owners get notified when they are found. Private key material was a bigger issue at one point in time (i.e dotfiles/.ssh/id_rsa).

There's been at least one attempt to make LLVM verifiable, however it's largely stalled: http://www.cis.upenn.edu/~stevez/vellvm/