skysight-inc/HackerNews huggingface dataset:
Yes, cryptographers should take on the surveillance state.

So should developers, and entrepreneurs, and politicians, and the common citizen that thinks AES is some foreign sports conference or IND-CCA is a new trade agreement.

I'm growing tired of watching journos try to point the fingers of "encryption is good, says cryptographers" and "encryption is bad, says this guy in a federal law enforcement position" and completely miss the greater point that unless everyone takes on the surveillance state, everyone will lose. The intelligence community is made up of humans. Some of them are there idealistically; others are there solely for power, just like in any megapolitical organization.

Should <x> take on the surveillance state is a shit clickbait title. It can always be reduced to:

Should you take on the surveillance state?

If you care at all about a semblance of privacy and the expression of individual ideas, the answer is always yes. Of course, there's a whole lot less to write about there to generate ad revenue.

Any approach in which a single subculture, whether it is thought leaders or soccer moms, tries to enact meaningful change in a system that at least pretends to be a representative democracy, will not be enough to reach a critical mass to actually do something. Cultures correct negative behavior through consistent reinforcement of a norm. Until people want privacy as a norm, and fight for privacy as a norm, the flames fueling a surveillance state are simply being retarded, not extinguished.
Wow. Really awesome! Great work.
The Secret History of One Hundred Years of Solitude
Easy DVD Player 4.6 Registration Code, Crack Free Download
The participants will add $100M yearly from 2020.

That doesn't seem insignificant, and I think part of the thing about the deal is that it puts a public focus on green development -- WORLDWIDE.
best wishes to you also,incase you need a HACK contact WAlTSTEPH82@GMAIL.COM he his an incredible hacker
One of my all time favorites and used many, many times daily. Zsh and z = highly productive day.
Precisely - disproportionate wealth skewing causing market shifts that favor the wealthy.
> In this particular case, Facebook is advocating for using a SHA-1 certificate only if they know that the client doesn't support SHA-256, and if that knowledge is cryptographically protected. Since TLS supports a way of securely detecting MITMs in the handshake, you can in fact get the client TLS version in a trustworthy manner. This prevents SHA-1 attacks on clients that support SHA-256 (which was the goal all along), while continuing to provide non-plaintext service to clients that don't.

Their proposal doesn't actually stop SHA-1 attacks. If an attacker can forge a SHA-1 cert, they can set up a MitM in which the victim talks exclusively to the attacker's server. Facebook's servers won't be contacted, so the downgrade-proof logic on Facebook's servers won't even be executed. The attacker's server will present only the forged SHA-1 certificate, which web browsers will accept in the name of backwards compatibility. Long-term, browsers will stop accepting SHA-1 certificates, but this is not scheduled to happen until 2017.

> It's not at all clear to me that this prevents the internet from getting more secure.

Two ways this prevents the Internet from getting more secure:

1. Their proposal would make it possible to obtain SHA-1 certificates past December 31, 2015, which means there's more time for an attacker to exploit a collision to forge a cert. It's important to understand that exploiting a SHA-1 collision requires a certificate authority to issue you a certificate, so if no one is able to find a SHA-1 collision in the next 19 days, the Internet will be safe from SHA-1 collisions in 2016 even if browsers continue to accept SHA-1 certificates until 2017. Allowing continued SHA-1 issuance removes this safety net.

2. It sends the message to companies that deadlines can be ignored because they'll be pushed back at the last minute. This will make it difficult to deprecate insecure practices in the future.
This had to be added due to those in Congress paid off by Koch brothers to deny anthropogenic climate change. They are abhorrent to any effort to mitigate greenhouse gas emissions: http://mobile.nytimes.com/2015/11/18/us/politics/senate-bloc...

Getting everyone on board is a huge win and setting targets of 1.5C (max 2C) will help humanity stand together against the threat of climate change.
Sorry, I'm on my phone, but you could start with "Trading and Exchanges" which is available on Amazon (really, any of the highly rated books on market microstructure are pretty good IMO). Also IMO, It would be helpful to use traditional market makers as a baseline when making any kind of comparison to HFT, and asking if it's really worse. For example, total HFT profits have declined from like $5 billion to a little over $1 billion per year, whereas vanguards fees alone allow savers to keep roughly $40 billion per year. There are also a multitude of interviews with large, institutional investors who are extremely sophisticated and who are arguably the main people affected by HFT activities, for example this interview with cliff asness of AQR, which manages $100 billion ++ in quant strategies. https://soundcloud.com/bloombergview/masters-in-business-aqr... I think he starts talking about it around the 30min mark.

Also, my own experience working on a trade floor as a source.
" tries to enact meaningful change in a system that at least pretends to be a representative democracy, will not be enough to reach a critical mass to actually do something. Cultures correct negative behavior through consistent reinforcement of a norm. Until people want privacy as a norm, and fight for privacy as a norm, the flames fueling a surveillance state are simply being retarded, not extinguished."

That's my exact point. The laws need to change to reduce what they can do, punish offenses, and optionally encourage the better approaches. To get that, a huge amount of people have to lean on Congress. That will only happen if they start valuing their privacy or at least have common sense that scumbags + unlimited power/knowledge + immunity is a bad idea. Cryptographers, past speaking out, can't solve that problem and hence are just irritating to opponents who continue to win while laws enable them to.
How to Stop a DDoS Attack
The Rise of Hate Search
but its still not a symptom of "facebook depression".
They do not intend fusion of the type you'd run in a power plant to occur. There will be some fusion processes happening, but as far as I understand the sources that's an unavoidable side effect of running Deuterium plasma. It is a plasma containment experiment, not a reactor test.
Sorry to piggyback on your point and rip off Matt Levine a little bit, but most of the cage rattling seems to ultimately come from people who are mad that it's harder to slip in their huge orders without having a price impact like it should.
It seems like the causal link on those statistics might be wrong. Sure, happy families might do better then divorced single parents. But how do unhappy couples forced to stay togather compare to single parents?
I'm told my grandfather photographed early atomic bomb tests, which is why my mother grew up on a Strategic Air Command base. He died in the 1980s, relatively young (though smoking contributed) and matters of his health and his pension were also subject to bureaucratic limbo.

My other grandfather trained to operate a Davey Crockett missile (the shoulder-launched missile with a M388 atomic warhead). I'm mostly just glad to live in a world where I worry about terrorism instead of global thermonuclear annihilation...
A coherent, baseline platform that ratchets up in intensity every 5 years and forces the hand of domestic politics (rather than simply allowing them to block intnl agreements) seems like a positive, I'm not sure why everybody is so entirely cynical.
Japanese Suicide Apartments
Facebook's user base as of January 2014 was at 1.24B monthly users[1]. According to FB's post, up to 7% of their users do not support SHA2 certs. This would mean approximately 86.8m FB users alone would affected by full-stop SHA1 degradation. I'm happy to see FB has implemented a mechanism selective cert selection and other organizations that care about their user's security ought to look at them for a model on how to approach this methodically.

SHA1 isn't great, but it is certainly better than plaintext communications.

[1] http://thenextweb.com/facebook/2014/01/29/facebook-passes-1-...
How is this relevant?

At least also mention how many are hurt or killed by kerosene..
Pointers to (seemingly) frivolous prosecutions (3) and pointers to anything resembling 4 or 6 would make them a lot more interesting.

Without just a little bit of evidence, they are like saying the NSA will shoot your dog.

My naive, facile reading suggests that systems like Signal, Pond and Tor tend to be more effective at actually securing communications, so it would be especially interesting to hear about the jackboots kicking them.
Reading it more closely, the nations are required to reconvene every 5 years to report on progress and discuss the next round of tightening. So it's a partial victory with a ratchet mechanism. The mechanism isn't guaranteed to work, but as the consequences of global warming become more impacting, urgency will increase.
China's pollution because of coal powerplants left over from industrialization, not special favors to industrial leaders or under-the-table deals. The Chinese government is also the largest green energy producer in the world.
Hmm. I need perspective on 'trillion'. calculates

$1T is basically telling every employed person and factory in the USA that they're going to spend three weeks working to pay for the new nuclear weapons. I wonder how long that investment is good for.
how come we all became boring since gnome3 and unity
What’s Something That Was Said to You That’s Forever Changed the Way You Think?
https://news.ycombinator.com/item?id=10693671
I'm getting more optimistic too, but I remain worried that there seems to be a fundamental disconnect between scientists and the bureaucrats.

Science will find out that within some small error bar we need to do exactly X, but bureaucrats see everything as a negotiation and will negotiate some number smaller than X. Now we're still slowly getting boiled to death (bad) albeit at a slower rate (good).
We'll see on monday when the stock exchanges open if this agreement actually matters.

If Oil/Coal companies tank: Yes

If not: No

Always follow the money.
Given the sophistication of the HotSpit JIT compiler, I'm surprised that zlib hasn't yet been replaced with a pure-Java implementation in the JRE. Of course, I'm presuming that a pure-Java implementation would be much less likely to leak.
Can anyone elaborate if these are the hot tip for people that don't care about this stuff (expats?) to get a cheap place, or not so much in reality? Seems like an obvious thing, so I bet it isn't ;)
The possibility of human-level artificial intelligence poses significant risks to society [...]

No. It simply does not outside of the realm of science fiction. Understanding HGI will help us understand enough about ourselves and our motivations and ethics that it won't be an issue.

Humans augmented by machine learning systems, on the other hand, are here now and a wholly different question. Institutions empowered by AI research have a power / person ratio unlike any of those of the past.
Banksy: “Steve Jobs – The Son of a Migrant from Syria”
No ext4 or other alternative file systems support, no file system snapshots, no file system write overlay, no alternative schedulers, no kernel upgrades without reboot...

Just regular things from Linux.
Ah, sorry, I see your point now. I suppose I got it wrong when I replied to your comment. Yes, I fully agree with you here on the point that the laws that allow this are wrong and they must be rolled back. Those are legal issues and they must be fixed as such.

I must make it clear that I stand that both legal and technological measures are necessary and are equally important. And I believe that neither would work well without the other one.

Current mass surveillance relies on lack of technical measures that protect from one. So, I believe that if everyone and their dog encrypts their correspondence in a secure manner, it would cause much greater hit on mass surveillance programs than any lawmaking could do. Please note I don't say that lawmaking is not necessary here. On the contrary, it is equally important to prevent TLAs from even trying to break technological measures and hold them responsible for their actions.
You're making a very strong value judgement that cheap goods and low cost production trump tradition and the ability for people to make a living. I simply don't accept your premise as a blanket statement.
>> In other words, you don't need to actually have consumed something to share it.

Point taken. However - and entirely anecdotally - longform content has been discussed, shared and consumed by my immediate circle of colleagues and friends in the past year or two far more than I can ever remember previously.

>> I'd bet the most shared pieces were around hot button or politically ferocious topics.

Maybe so. You could get a flavour for this by checking out aggregators like Longreads though: longreads.com
>It simply does not outside of the realm of science fiction.

Why?
Personally I never let my browser remember my passwords, synchronized or not, precisely because it's a huge point of failure. I still think it's valuable for my history to be securely synchronized, but my Firefox Sync account does not have my passwords. Even though I do trust Firefox Sync and I have a very secure password, so this has nothing to do with that. But imagine that you leave your laptop open, then somebody passing by can get any password just by going to any website in your browser. And of course, with an open laptop, you can argue that you can be compromised regardless, as that passerby could install a keylogger. But security is all about raising costs for potential attackers.

Lately I've been a 1Password user, so that has made things easier. But even before that I've had a system of generating unique passwords and I could tolerate the pain of a fresh browser instance, because "remember me" works just fine. The only account you should not lose access to is your email account, because that email account can be used to recover the passwords for every other account. It's also the one account for which you need a really strong password and preferably 2-factor authentication.
Battlefield where Julius Caesar slaughtered 150,000 tribespeople discovered
Please don't dump time into making it mobile friendly. Nobody with any sense is trying to diagram their infrastructure from a mobile phone, so you may as well focus on higher value features. Preferably ones you can charge for so I'm not mourning the loss of this great tool in six month's time!
That's a lot of dancing to avoid condemning hateful, repressive beliefs. We condemn hateful, racist bigots all the time. Rightfully so. Just because said hate is derived from religion does not excuse it from condemnation.
Facebook's proposal is that only organizations that are a) demonstrably using this technique and b) validated at a higher level than automatic domain validation be allowed to get new SHA-1 certs. This means that an attacker will have to identify themselves fairly strongly in order to conduct a collision attack. It is a vast improvement from anyone being able to register a random new domain name and get a SHA-1 cert for it. It's probably not a huge roadblock for a superpower's well-funded intelligence agency, but I think that the threat model is not primarily about protecting against them.

I agree about the political part of the issue, but on the other hand, the SHA-1 deprecation is one of the most proactive things the CA/Browser Forum has done. Having it go not quite perfectly is still a vast improvement from reactively deprecating things only when they are fully insecure.
> Nope, we seem to be hardwired from the monkey inheritance to fear the "other" or "stranger".

again, hate is different from fear. It's similar, I know. but it's not the same emotion. I think we're wired to hate the other, not to fear them.

Fear is the emotion I feel when I'm bicycling on a busy street. I'm afraid that one of the giant trucks six inches from my left shoulder will make an error and leave me as a thin, red, road-paste, or as a head with no functional arms.

Fear, it has to do with danger.

Hate, well, I think I kind of understand the in group out group hate, but my out group is a little different. I hate salespeople. I know they pose zero physical threat to me, and they only pose a monetary threat when I talk with them, but I still feel hatred and anger that they are in my industry, that I need to see them every day.

If you want to analyze it, it probably has to do with growing up as a nerd when that was something you really didn't want to be. Generally speaking, I have a mild negative reaction to anyone who seems too smooth, too socially skilled, anyone who seems to fit in too well.

Hate, hate is an irrational emotion you feel when you see someone you don't like.

Now, I could write a paper about how salespeople have negatively impacted my life, and how they are destroying everything good, rational and beautiful about Capitalism, but it would all be a post-hoc rationalization; Hate of the other is a fundamentally irrational emotion, and while it's usually not hard to graft on some post-hoc weak-sounding fear, it's still post-hoc rationalization. If I actually want to understand my feelings on the matter, I think that they are shaped more by my idea of who "my people" are, by who I felt was oppressing and/or threatening me during my childhood.

Now, I also think that having an irrational feeling and recognizing that the feeling is irrational is way better than having an irrational feeling and coming up with a rationalization for that feeling, and I think most people disagree with me there; most people would much rather come up with a rationalization for the feeling they are having, and that's probably where this confusion of hate and fear comes from.

(to be clear, I recognize my feelings here are irrational, and I try pretty hard to look past it. Any remaining effects that get past my filter, I'm sure, are smallish. I'm just giving it as an example, because I believe it's very similar to the way racist people feel. Hell, I even have that one salesperson friend who is a really good guy even though he is in sales.)
Seems interesting, but I only could read the text: All these videos playing in parallel, without a way to stop them, make the normal view of the page unusable for me (browser locks up).
This comment doesn't make a whole lot of sense to me.

What's all this talk about America? We've been talking about China the whole time. You're seriously blaming the Chinese people for their heavy-handed government? By focusing their work in directions that harm freedom, computer scientists and developers make it easier for the Chinese government to use surveillance to hold onto power.
I'm not sure that because you envision a different, more plausible scenario, that completely invalidates the original claim, which was only simply denied before sketching out the alternative.

* I don't see how "Understanding HGI" prevents a "human-level artificial intelligence" from doing anything it pleases.
Sadly, the "bureaucrats", or politicians are the ones in the right, and the scientists are not.

In little scientific echo chambers like Hacker News, we generally put science and rationality above human emotion. Unfortunately the world at large is not a technocracy, a good majority of people see science as an equivalent worldview to religious dogma, most are not particularly educated, and they primarily live to create their own families and provide them with sufficient resources for evolutionary success.

With things like climate change, you are attempting to change a mass behavior of people that often do not see the change as being in their best interest. This requires both negotiation on a regulatory level, as well as a lot of new level-setting within those communities. It is extremely possible that the best we will ever get is to be slowly boiled to death until it's too late to fix it.
"If SkyNet is a threat, it's 50 or 100 years off I think."

Well we work on global warming even though the worst effects are likely decades off. I think one computer science professor put it something like this: "If experts told us aliens were likely arriving on Earth in 50 or 100 years, it'd make sense to start preparing now." You don't want to wait until it's too late to do whatever needs to be done.
Is this a treaty?
If so 2/3rd of the U.S. Senate must concur.

Should be an interesting, spirited debate.
It's $70K per certificate you're colliding, not $70K per user. A single expenditure of $70K before the end of the year gets you a valid SHA-1 facebook.com certificate with your own private key, which you can use in as many MITMs as you want. (That is, this is not an attack on the encryption, where it's $70K to decrypt a conversation; it's an attack on the signature of the certificate.)
CDPATH is kind of obnoxious. It's confusing to have phantom subdirectories no matter where you are, which interact with auto-completion, and they can alias real subdirectories, which is always surprising and annoying when it happens. Furthermore, the autocomplete support for CDPATH directories didn't work satisfactorily.

I found a somewhat better way to use CDPATH. I made the only thing in my CDPATH a special directory into which I placed symlinks, and all of the symlinks were prefixed with an underscore. So if I wanted to jump to one of these "bookmarks," I'd start with the underscore prefix; this reduced the likelihood of them aliasing subdirectories in $PWD. I wrote shell functions to automate adding and deleting links, which automatically enforced the underscore rule. I eventually got sick of even this system and stopped using it.

My final conclusion was that CDPATH is not useful. When I want quick access to a directory, I just make a symlink in $HOME. It's not that hard to type `cd ~/symlink`, and it always does what you expect.
Wasn't an agreement well known in advance?
Shouldn't this have already been baked into stock prices?
Yikes! Glad you found a good lawyer in the end.

For those of you wondering, yes there are really terrific immigration lawyers in the Bay Area that work their butt off, care genuinely, and charge a fair price.
> I really don't know why Mozilla implemented it this way and login UI is not a part of the browser itself.

How does making the login part of UI help, would you blindly trust part of native UI instead?

the password is secured with JS locally on the client and you can clearly and easily inspect all the requests that firefox makes via dev tools.
> a good majority of people see science as an equivalent worldview to religious dogma

Is this also common outside of the US?
> Which means adversaries could break the encryption, but could only afford to attack a small number of people

No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/