Bletchley is actually a different piece of our infrastructure: it protects keys by storing them in hardware, whereas Keywhiz is aimed at distributing the secrets that apps really need (API tokens for 3rd party services, eg).
I probably shouldn't have phrased that so definitively: I don't have any evidence that Flash is to blame here. In fact, given that this problem required a framework-level fix (rather than, eg, a simple patch from Adobe) I suspect that this affects a lot of things.
In my tweet, I just meant to say that Rails checked for something very simple: a header that Flash's addRequestHeader() can trivially fake out. As Neal points out, that can't be the whole story — but I suspect it's part of it.
I don't have any inside information on this, but my guess is that this is going to come down to confusion about 302/303/307 redirects. In theory, clients receiving a 302 in response to a POST are supposed to re-send the POST wherever the redirect leads; in practice, clients do all kinds of different things. This feels like just the kind of weird edge case that defeats fragile security mechanisms like crossdomain.xml.
"The C Programming Language", commonly referred to as just "K&R", is probably one of the best introductions to a programming language ever written. It's short, clear, and concise — even today, 31 years after its first publication, it should be your first stop: http://en.wikipedia.org/wiki/The_C_Programming_Language_(boo...
As previous commenters have said, don't worry about the details early on. Advanced pointer arithmetic tricks and the like are to C what zany metaprogramming tricks are to Ruby: dangerous, and almost always a bad idea — except in those few cases where they're exactly what you need. For your first pass, you can ignore anything that's not obvious. You probably won't need it anyway, and you'll pick the truly important things up with time…
Code on UNIX, preferably Linux, using CLang and a simple text editor to start. The Windows APIs are just plain confusing for beginners, and OS X adds some wrinkles to the compilation process that it's better not to worry about in the beginning. Linux isn't as austere as some of the BSDs, but that makes it an easier platform to learn on. Similarly, while GCC is more common than CLang, CLang has a bunch of features — actually useful error messages, for example — that make it much much easier to deal with. Fancy IDEs like XCode and Eclipse have their place, but are more complicated than they should be for "hello, world"-type exploration. All you really want is syntax highlighting…
Since it sounds like you're coming from Ruby, check out the FFI project: http://github.com/ffi/ffi FFI makes it reasonably easy to call C from Ruby, meaning you can build scaffolding in a language you're comfortable with while you focus on particular bits of C code. Similarly, it's not worth trying to learn the arcana of the C tool stack — make, autotools, etc — all at once, especially if you already know Rake.
Read other people's code. It's probably better to stick to smaller projects at first, especially reasonably modern ones which haven't gone too far off the deep end with the optimization. I don't have any great pointers here, unfortunately — the only thing that comes to mind is that (C) Python has some really nice, well-commented code and .txt files in its source tree, and that MRI Ruby is horrible. The libev API also strikes me as a good example at the moment — but that's probably at least partially because I've been staring at it so much recently…
Once you're feeling reasonably literate, the next step is to read some algorithms and data structures books. It's both a strength and a weakness of C that you essentially always end up implementing your own; even if you don't end up writing a lot of C code, getting a solid footing (or refresher course) in these will help make you a better programmer. After that, you can probably read code with the best of them. If you're still looking for more, I'd suggest maybe "UNIX Network Programming" by Stevens, Fenner, and Rudoff (a good introduction to the sockets API); or "Modern Operating Systems" by Tanenbaum … really, it just depends on what you're interested in.
They use it in Gerrit — http://code.google.com/p/gerrit/ — which is an open-source code review system built to mimic Google Mondrian, but which uses Git rather than Perforce. Shawn Pearce, the author of the linked email, is also the primary maintainer of Gerrit.
We presented Keywhiz at Baythreat in 2012: http://www.baythreat.org/2012/speakers.html I'm not sure if that was recorded, though.