Comparing the Usability of Cryptographic APIs
Experimentally testing APIs by making developers write code and examining their mistakes. Turns out what’s easy and what’s hard makes a difference. Also, documentation matters. I don’t think the result is surprising, but instead is concrete reinforcement that this stuff can be tricky.