skysight-inc/HackerNews huggingface dataset:
> In modern messaging protocols, they don't have to care about encryption. The protocols are designed to reliably encrypt messages without user intervention, and security isn't "opt-in".

Sounds good. Doesn't sound worth giving up decentralisation for. Doesn't even seem like something we'd need to give up OpenPGP to get - if client design were equal (and it isn't at the moment, but I see no reason it can't be) I'd far rather have that client experience but with the more established/tested protocol.

> The people who most need encryption are not the ones who are most aware of the need. In fact, the Venn diagram of "need" and "want" for crypto has very little overlap.

I think that's even more true for decentralization than it is for encryption.
If you can avoid it, I would not raise this kind of amount in Berlin. Not worth the troubles.
Show HN: PersonalDev – a simple Gomix app for personal development
I would dislike having to get visas to visit other parts of Europe. And inevitably, if the EU falls apart, at least some parts will get very nasty towards others.
Diving into JavaScript on Microcontrollers
Company url?
Obviously, this is anecdotal and I'm not advocating that anyone else do what I did until they consult with their own doctor but this is my experience.

I had some long term digestive issues.

I began supplementing my diet with magnesium and within a week, the problem began to abate. Within a month, all of my abdominal cramping was gone. All of my constipation issues were gone.
I've been researching various masters programs and bootcamps, including talking to graduates of both.

My sense is that while there's a huge variance in quality on both, the median bootcamp seems to be more in touch with industry and better at imparting real-world skills than the median master's program. I'm not sure if employers have started to recognize this yet (from your comment, it seems that they haven't). But once the feedback loop completes, I'd wager that they will.

Also, getting a graduate degree and attending a data science bootcamp doesn't seem to be mutually exclusive. For instance, there are data science bootcamps that specifically target PhDs.
It's clearly a political piece, written from a particular point of view, so in that sense you could consider the piece biased. The title accurately represents the intent of the piece.

For the title to be biased in the sense that it requires modification would mean that it is in some way either misrepresenting the piece (i.e., click bait) or misrepresenting facts. "In Support of Free Speech" is doing neither. If you're of the opinion that that Shopify's stance is wrong, that's fine, but that doesn't mean that the title of the piece is wrong or biased in a way that requires updating. Shopify's position is one where people disagree, as is abundantly clear from this (and similar) threads.

At this point it's pretty clear we're at best talking past each other, and as there's not much else I have to say on this topic, I'll leave it at that.
> […] there is the possibility of side-channel attacks on the u2fzero.

Interesting. How does that work? Have you any references to that?
What are the current alternatives to Yubikey?

Preferably looking for something open-source and in no way associated with Google.
Creating a self-replicating Pokemon Red save file
Because biometric authentication is a joke in the security industry?

Biometrics are fine to identify someone. Biometrics, being public data, is not acceptable for authentication nor authorisation.

To use another example:

You get to border control, and present your passport. The agent ensuring that the description in the passport matches the person standing in front of him/her, that is identification. The agent verifying that your passport is genuine and valid, that is authentication. The agent giving you access to a country based on the laws and arrangements between those two countries, that is authorisation.

Anything that can be copied/stolen with a good enough picture or forgotten glass/mug is not good enough for authentication/authorisation.
And how is that different from the US intervening in "non-neighbouring" countries like Iraq or Afghanistan, or the UK going to war with the "neighbouring" Falkland Islands?
Via https://www.reddit.com/r/programming/comments/5tqs8q/creatin...
Any AI we will build in the foreseeable future is going to have incredible energy requirements. All we have to do to keep control of it is retain control of its power source.
> Looking at the long history of evolution, I'd say no.

This entire lecture series on Human Behavioral Biology is worth watching from the beginning, but I've linked to a moment where Sapolsky describes tit-for-tat strategies arising in animals. First example: Vampire Bats.

[]: https://www.youtube.com/watch?v=Y0Oa4Lp5fLE&feature=youtu.be...
> * Every year, the number of people and businesses that rely on email gets smaller --- in the last 5 years or so, by something like 15%.

If that's true then where's that stat from and how are these businesses getting contacted online?

There's no decent replacement for email in that department at all to my knowledge.
I use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back.

That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that).

For this reason I also bought a nitrokey as a backup. It's a bit slower than the yubikey (I use 4096bit keys) but it works well. I really don't like the plastic cap on the nitrokey though, I feel like I'd lose it within a week if I started using it as my main key. The Yubikey doesn't have any protection at all but it looks sturdy enough that it doesn't really matter. It's been on my keyring for months and it seems to handle the abuse just fine.
By making the discredited argument that WhatsApp's key-change behavior is a fatal flaw, you're disagreeing with:

* The EFF

* Moxie Marlinspike

* Matthew Green

* Bruce Schneier

* Isis Lovecruft from Tor

* the grugq

* Matt Blaze

* Avi Rubin

* Steve Bellovin

* Joseph Lorenzo Hall

* Bart Preneel

* Peter Honeyman

* Jon Callas (who cofounded PGP Corp)

* Paulo Barreto

... and about 50 more experts equally respected in the field if less known to the typical HN reader.
Ask HN: Gobot vs. Nerves
Has anyone had any experience with either (or both) of these projects to give a quick opinion on which one you liked better any why?

I love Golang development, but have recently gotten into Elixir as well and am interested in trying out some IoT stuff, but not sure where to start.

Thanks!
> Musk explained what he meant by saying that computers can communicate at "a trillion bits per second", while humans, whose main communication method is typing with their fingers via a mobile device, can do about 10 bits per second.

Humans communicate in much more complex ways than computers. Facial expressions, intonation, language, body language, etc. All things we do not quite understand.

Elon Musk is a little arrogant due to his success in business and likes to make 'fun' predictions based on his very limited understanding of whatever field he happens to be talking about. He sounds like an eager undergrad student that tries to demonstrate his genius to his professors and the class. I don't understand how anyone can take him seriously in technical fields.
I think that is a report that is sponsored by Thyssen Krupp or by Kraus Maffei (or by both of them) - they want to push their products because the largest arms shop will dominate an integrated commands procurement process.

Why is this report bullshit? Because Europe and Russia are interdependent: Europe stops buying Russian gas - Gazprom and the Russian state by extension are toast; Europe stops buying - everything that is made in Europe will be much more expensive.

With this information everything else is trivial.

Now a non related question: is the no politics period for HN now officially over?
> at best you're attempting to tunnel encrypted messaging over an unencrypted transport.

That covers pretty much all communication encryption: ultimately, encrypted data goes out over an unencrypted link.

> A protocol that leaks metadata, including some message content, at the envelope layer.

That is indeed the major problem I have with it.

> Hundreds of millions of users that primarily access messages through browser clients that can't meaningfully implement crypto.

The solution IMNSHO is to get off of the browser. Browsers are great for what they were designed for, but they're a terrible general-purpose computing platform.

> End user demands for things like search that can only be delivered efficiently at scale by databases of plaintext (most likely at centralized servers).

I think that one's home computers can probably handle the load of searching all of one's own data. If that's not the case, encrypted search protocols may be of use.

In general, though, your last point argues against any encryption or other user-privacy measure: if users are right when they demand centralised search, then encryption is a bad thing. I don't agree that encryption is a bad thing, thus I refuse to believe that users are right to demand centralised search.

> But: why bother? Email is just one of dozens of messaging systems available to Internet users.

It's the only decentralised one atop which a trustworthy system could be built. Signal, WhatsApp & Wire all have critical flaws which prevent their widespread use (Signal is centralised, tied to a phone number, leaks contact information to OWS; WhatsApp is centralised, owned by Facebook & default insecure; Wire looks appealing, but it too is centralised and controlled by a single company).

I tend to agree with your conclusion that email encryption is not worth the trouble; I disagree that it cannot be used securely.
Thank you for thinking of us.
-- A Carrot Seed grower and breeder
Yes, we process data visually much faster than the ten bits per second example
We already are cyborgs.

We just haven't implanted our augments yet, and haven't come up with a direct neural bus. We communicate with them via touch and sight instead.

Which of the following transitions is more world-shaking?

1) Going from being a plain old human to a human with a smartphone, internet access practically anywhere.

2) Implanting the functionality of that phone in our bodies.
Here's an option on DB (DeutscheBank) that moved 10x THIS MORNING.

http://finance.yahoo.com/quote/DB170217P00017000?p=DB170217P...

Here's a PUT option on WMT (Walmart) that moved 35x also this morning:

http://finance.yahoo.com/quote/WMT170217P00062500?p=WMT17021...

Here's an option on CL (Colgate Palmolive) that moved 8 this morning as well.

http://finance.yahoo.com/quote/CL170217C00077500?p=CL170217C...

SOMEBODY made money today on these, and the market hasn't been open for an hour yet.

Before calling my comment "ridiculously incorrect", I would appreciate it if you would show a better understanding of capital markets.
You're right: checking this out further, the nginx resolver seems to have a bunch of issues [1] which is concerning.

I've modified the config accordingly.

[1] http://blog.zorinaq.com/nginx-resolver-vulns/
With all due respect you're confusing diplomacy with morality. The question isn't if Socrates would find the behavior pleasingly moral, but if pragmatically at least one country has been invading random 3rd world countries on the other side of the planet for decades without the world collapsing into WW3 then what is the likely outcome of a much more minor ... international misbehavior. Therefore a country "invading" direct neighbors who historically have always been part of the empire is extremely unlikely in a pragmatic analysis to cause geopolitical instability or WW3 or whatever warhark ridiculousness.

Don't get me wrong, it can still be morally and ethically "wrong" in an abstract sense. But most people are concerned with the fearmongering "Oh no, Russian tanks will be rolling down the boulevard in Paris next year unless we ..." is all completely ridiculous. Russia already fought and lost a COIN "Vietnam" against a majority Islamic nation of Afghanistan, once demographic replacement takes hold Russia isn't going to want a piece of France or Germany even if handed to them on a plate, oh no last thing they want is the suburbs of Paris in revolt as usual.

The Russian Bear has been content to be contained in its den, as long as its not poked, for centuries. The odds of the Russians regime changing Mexico and fighting a failing counter insurgency in Mexico on our border for decades is approximately zero, like space aliens landing on the white house lawn is a more realistic concern. There are world wide geopolitical problems, none of which involve the Russians.

As a land empire on the other side of the planet, with people more or less like us, following a religion more or less like ours, and a economic system vaguely similar enough, a space alien would assume the Russians should be our closest ally... and if it were not for unfortunate temporary historical anomalies they almost certainly would be. In an unperturbed system (LOL as if international diplomacy has ever been that) they would be great allies.
Yubi's position on why they went closed source on the hardware seems reasonable to me:

https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
Why is this done on such a small level? I would have thought that with systems now in place that evolutionary game theory could be done in simulations on such a much larger scale (say 7bn agents +) ... if anything AI systems should be able to determine if certain strategies work (like items like blocking resources - such as a case of geopolitical theory) so see what cooperations occur at that level. Still amazing work but it should be applied to a larger scale for real meaning. More eager to see how RL applied to RTS games will explore and develop strategies more than anything.
> 10 bits per second

In a space of millions of words and countless meaningful combinations, not just raw data without meaning. Computers communicate raw data. Humans communicate meaning. We don't know how to represent or compute meaning yet, that is the domain of deep learning (NLP and vision).
> You are looking for anticipatory repudiation.

I don't think so. I'm looking for straightforward contract termination, and the providing of notice for contract termination, where the contract already explicitly permits termination. I don't think failing to perform on a contract needs to come in to it.

I assume that contracts for services such as electricity and cable already have such termination clauses, so it just a matter of how notice of termination is served.
Managing to pack that much condescension for Europe in a sentence is a wonderful feat.

Why do you need to be a self-hating European like that? Do you think if you cast a good enough light on the US and shit on your own enough, people from the States will somehow recognize you as one of their own?
Not sure if it's still going on, but Russia banned food imports from the US, EU, and friends last year.
From my reading of the ThinThread program we're not talking about a post-hoc analysis.

Thinthread ... was one of the first things
Michael Hayden's NSA got rid of

...

Was your programme, Thinthread, ready for 9/11?
"Yes, actually it was ready in November 2000

So if you look at that, then ThinThread, was available to the NSA before 9/11 but canceled for (ostensibly) political, ideological, and possibly corrupt reasons. Maybe incompetence?

(Corrupt may be too strong, if there is a softer term like "crony-ist" or selfish / self-interest it might be more appropriate. But then, seeing the number of lives lost due to the failure to prevent 9/11, maybe corrupt isn't too strong at all)

You have declared that after 9/11 you heard the
high echelons of the NSA saying: we can milk this
cow for the next 15 years. What did they mean?
"They meant: we can keep the money flowing for
the next 15 years to keep programs running.

Though - if they are really willfully incompetent in order to keep funding their operation that certainly looks bad.
But why willingly introduce extra complexity to the system?

Websockets are way less trivial than SSE. Polyfills for a less popular browser seem to be a simpler solution to the problem, compared to websockets stack everywhere. Even if I don't have to implement websockets on my own and would use some mature library (because bugs happen even in such libraries).
Azure beats rivals in high performance cloud computing
Neural lace + Retinal implant, brought to you by Musk industries.
[Mesa-dev] [ANNOUNCE] mesa 17.0.0
>So you are putting forth the idea that all forms of personal service require sacrificing dignity?

Well yes. Following orders is always a sacrifice of dignity, even when we make it a small, subtle one.

> What does equality even mean with respect to one's work role?

That you can give input and have as much voice in the group's direction as anyone else.
There are actually companies selling living bacterias for that
Well, the point of the analogy was to illustrate the business model.

I think there's room for a spotify model in writing. As a consumer, instead of a centralised platform, I'd like it to be an integration on the various websites I get content from.

I.e. the normal internet with it's various publishing engines, but paywall automatically bypased, ads automatically disabled and producer automatically credited & paid because I'm signed in to my 'servicename' account.
It's not hard, IMO.

But it would be nice if these critical projects created gitlab or bitbucket mirrors.
Furthermore, if you're using PGP to evade a state-level adversary, the odds are overwhelming that you've own-goaled yourself many times over:

* You keep plaintext archives and drafts of your messages, because that's a fundamental feature of email clients going back 3 decades.

* You use a server-mediated PGP provider like Protonmail that has your security one surreptitious Javascript injection on an XHR call away from complete collapse.

* Your peer accidentally forgot to encrypt a response and quoted your own plaintext back to you.

These things aren't intrinsic problems of encrypted messaging systems, which is something I feel like HN is not doing a good job of grokking. They're intrinsic problems of email.
I prefer Scapple but this comes close. I'll be curious if they offer a desktop version.
It does work well, except when there's a macOS major version bump (10.9 -> 10.10 -> 10.11 etc.).

Then you update your system (maybe after a prudent 3 week wait) and everything works, except the GPG Suite, and you can't send encrypted emails for a while, nor can you read ones you receive, or old ones stored locally.

(For macOS 10.12 sierra, released 2016-09-20, there's now a beta of the GPG Suite, released 2017-01-23, 4 months later.)

There was also a bug (or feature?) a while ago where email drafts that you had open in windows would vanish after a while.

It is a good solution for the Mac, but this is something to be mindful of (and it sort of supports the main thrust of the article).
There are a large number of other things we need to fix to make individuals able to resist state attackers, sure. We need much better software security in general, more transparency around firmware.... Still, good crypto makes attacking more costly, even for states. My sense is that the cost of attacking someone using email and OpenPGP will be higher than for any existing alternative (including WhatsApp/Signal), at least for an adversary with the US security services onside.
You have to remember that the hill _is_ the dam (of the type[1]). so when water flows down that spillway, it's going to pick up dirt with it - making the hill smaller and smaller, ie. making the dam thinner and thinner.

[1]https://en.wikipedia.org/wiki/Embankment_dam
Seeking Ideas to expand and monetize video learning site
I wonder if the Tibetans and Inuits benefit from the fact that their dietary fats come from animals who lived healthy, whole lives. Much of the US consumes dairy and meat that comes from animals who were shoved into dark, overcrowded, stressful, unnatural habitat and fed strange feed that they'd normally not eat such as corn and grain.
The Yubikey 4 does a lot more than just U2F though.
>Sometimes I just sit back and wonder at what the designers or manufacturers of common things had to deal with.

I do the same, and probably the one item that I've thought about more often than others is, hilariously, those novelty testicles they sell to attach to your car's trailer hitch. Between design, materials, manufacture, distribution...just how much work goes into truck nuts?
There are also people that use OpenOffice on Desktop Linux, and believe in their bones that everyone else should too.
It's a comment, not a logical proof
And if you were aware that a state-level actor is targeting you, you'd be using a programmable, self-contained HSM for all sensitive computation. This is a topic I'm working on actually.
Newspapers also destroyed human interactions, before radios, TV, mobile phones and tablets did.

http://thefuturebuzz.com/wp-content/uploads/2014/10/train.jp...
More or less analogous to when the Germans went into Austria in '38.
To be honest, Yubikey was never really open source. Sure, they open sourced _some_ compomnents before but you coulnd't do anything with the source.
You're disagreeing with an argument I didn't make. "Cannot" isn't the word I would choose.
users cannot use the NFC chip in it except for Apple Pay

That... boggles my mind :-O

Thanks for the info. My wife is unfortunately locked into iPhone due to work standard, but something to keep in mind long-term.
https://github.com/conorpp/u2f-zero/wiki/Security-Overview
> Better to move sensitive conversations to things like Signal, WhatsApp, or Wire

Really? Come on!

WhatsApp is owned by a company whose business is done by retrieving all the information it can from users and by tracking their behaviors.
> Not having it inserted defeats the whole point

How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?
I think the symbiotic relationship b/w humans and machines is more on the lines of interaction based rather than a stereotypical sci-fi chip implant one.
Built with WebRTC: Peloton Cycle
Do you have to leave it plugged in to your computer the entire time? or just times you need 2FA?
I'm shocked by how many people (on HN!) responded to you and explained why they might not buy an app.

It seems like this hurdle is real.
Speaking of web sockets and simplicity:

I never understood why web sockets aren't just a straight break out of HTTP(S) to a naked TCP or SSL socket. Why all the extra complexity? All it does is degrade performance and bloat software.

I hate the way protocols are designed by committee, virtually guaranteeing that everything has layers upon layers of cruft that have never actually been needed by anyone for anything but must be implemented because it's in the spec.