I've heard again and again that many crypto systems have been broken in the past for one reason or another and that it is best to use one that has been peer reviewed, etc etc. However, I've yet to see a source (website, book) that gives information about these systems. Is there such a thing?
If you want to look back in time, ENIGMA was the standard used by the nazis in the 30-40's. It would be useless to encrypt anything with it now.
More recently, pratical attacks have been done against parts of the GSM standard (what cell-phones use). The cipher A5/2 which is considered completely broken and has for this reason been remove from the standard. Actually, A5/3, supposed to be better, is not looking great either right now as an attack requiring a regular computer has been done recently (2010, see wikipedia link).
These are example of practical attacks against "real life" algorithms.
You also have algorithms which never made it outside academia because of their weakness. For instance, MacGuffin was broken at the same conference it was presented!
At last, "broken" is a rather vague concept. An algorithm is usually considered "broken" if attacks much more efficient than brute-force can be done... But that does not mean they are pratical! For instance, PUFFIN (a lightweight cipher) is considered broken due to vulneranility against differential cryptanalysis. However, the amount of data required to perform the attack remains unpractically high.
For this reason, you may consider DES to not be broken because no attack is more efficient than brute-force in its case (as far as I know). However, the problem is that a brute-force attack is possible nowadays because the key size (56 bits) is too small.
This is specific to TLS, but this paper lists the (surprisingly large) number of security flaws that have been found in TLS and TLS implementations.