skysight-inc/HackerNews huggingface dataset:
I find it hard to use the term "stagnate" to describe an industry that is developing its own specialized languages/systems (see Q/KDB) and is currently in the process of exploring FPGA technology to improve performance. The secretive nature of the industry means that people outside it don't know what's happening on the inside, not that participants lack awareness of developments in more open industries.

Just to answer your point about CLR/JVM code performance: one early comment in the original article that stood out for me was "Pure computational performance (ignoring memory allocation/deallocation) under .NET runtime (ignoring vectorization) is pretty close to the performance of raw C++", which is all well and good except for the fact that you are going to end up with worse code than someone who doesn't ignore memory allocation and vectorization.
Minor quibble:

WHY CAN'T I USE TLS/SSL TO DELIVER THE JAVASCRIPT
CRYPTO CODE?

You can. It's harder than it sounds, but you safely
transmit Javascript crypto to a browser using SSL. The
problem is, having established a secure channel with SSL,
you no longer need Javascript cryptography; you have "real"
cryptography. Meanwhile, the Javascript crypto code is still
imperiled by other browser problems

My minor quibble is that there are other reasons one might want cryptography besides establishing a secure channel, and so using SSL does not necessarily solve whatever problem one was trying to solve with JavaScript.

For instance, the client might need data that is stored encrypted on the server, and you want to do the decryption on the client.
Keynote motivational speakers idaho
The URL should only be part of the signal. There might also be legal remedies to you if your competitor is spamming people with your URL.
Show HN: Multiplayer Tetris built in 48hrs
A user looking at the "cryptocat session verifier plugin" has to think to herself, "What is this thing verifying? Is it just checking a digest of the Javascript files? How does it know if the CSS files have surreptitious Javascript in them that negates the crypto?"

Which is funny, because if cryptocat just required a browser extension that implemented all the crypto, it wouldn't need to verify anything at all. What was the point of Javascript crypto at all, if you're just going to push an extension onto people?

Your unease with SSL/TLS and its X509 PKI is entirely orthogonal to whether Javascript crypto works or does not work. Wanting an alternative to TLS does not give you an alternative to TLS.

It's funny how many arguments supporting Javascript crypto devolve to "but the world would be so much better if this stuff worked".
If Apple "invented" the GUI by commercializing some ideas that started at Xerox, how is it that the Xerox Star was released before the Lisa?

Now, the Macintosh was a far more impressive execution of those ideas than either of its predecessors, but to say Apple "invented" the GUI, and to downplay Xerox's contribution, is unfair.

I'm not saying this because I'm "invested" in any product or company; I owned a 512-K Mac, I covet my wife's MacBook Plus, but I don't find identification with any particular company's fictional narrative a useful way of discussing technology or history.
So basically, you start with Java, and then you rip out a lot of the features, such as GC, which differentiate it from C++ in order to make it faster. Why not just start with C++?
Hyperbole much?

I've run a few mail servers in my time, never having used RBLs, and they do just fine with statistical filtering. I've used email services (and did admin work for a couple), and had nothing but trouble with RBL-related issues.

RBLs are run by people with political axes to grind, and RBLs are used by people who haven't been burned enough to know any better.
Show HN: Social beat machine built on Node.js #NKO
How Console Developers Improve Performance When the Hardware Hasn’t Changed
Hello mod_wsgi
I think the fourth of fifth graf of this (poorly written, I agree) article explicitly calls out that there are reasons beyond a secure channel why you might want clientside browser crypto.

So, I'm actually going a step past the obvious argument against jscrypto ("this is an inferior way to build a secure channel"). Not only is it an inferior secure channel, but it's also an inferior and dangerous place to try to build crypto functionality even if you're using SSL/TLS to establish a secure channel.
Replica Louis Vuitton, Louis Vuitton Outlet, Fake Louis Vuitton Handbags
That's a problem with serving java applets which do crypto, too. (there were some better protections for applets, but they're still vulnerable to code replacement by the server (thus not able to do hostproofing))
Online Review of Business in Cincinnati, Ohio Results in Libel Suit
> JS crypto remains better since there exists techniques to verify the crypto, and the server does not receive plaintext.

You are giving the plaintext to code that has (at best) the same trust level as the server itself.

What data is it safe to give to that code, that isn't safe to send (in a way that can't be mitm'd) to the server?

> That's ridiculous. Integrity checks exist for many crypto-systems, don't perform crypto - they are an extension.

I'm not sure what you're saying here - you might want to clarify exactly what you mean.

In doing so, perhaps you could tell me why you think "browser plugin validator + untrusted JS crypto code" is more secure or otherwise better than "browser plugin crypto with no JS".
Exactly. I always considered JS Crypto orthogonal to TLS. You still want TLS for authentication and establishing a secure channel to ensure you're getting the right code from a person you trust.

Javascript (or generally, client-side) crypto would still be invaluable for other things. If it can be implemented safely, you could do stuff like GPG for mails and OTR for instant messaging. For Javascript, that appears to be a pretty big "if", though. If it can't be implemented safely, well, then it's a matter of opinion. Some will argue the crypto is still useful despite a couple of viable attack scenarios, others will argue that an appearance of securiy is much worse than no security at all.
I don't even want to think about what the commentary on Reddit is for this.
Bitcoin has a long hash chain already in existence and a large amount of computing power currently lengthening it. Bitcoin may or may not be valuable, but the amount of total CPU time invested into it and the current rate of CPU use are criteria one can use to decide if one proof of work network is superior to another.
Actually, in the case of that particular plugin, every bit of code, including CSS, JS, and HTML, are verified.

> It's funny how many arguments supporting Javascript crypto devolve to "but the world would be so much better if this stuff worked".

It's hilarious how you completely ignore the much more pressing issues in HTTPS that I've pointed out. The server can read plaintext in the case of HTTPS, which is mitigated in JS crypto; not to mention that things such as SSLStrip and the COMODO hack have put many chinks in HTTPS's armour - HTTPS is a technology that derives a lot of trust from being able to authenticate the server, whereas we've seen authorities such as China create entirely passable fake certs to fool dissidents.
You're talking about computational difficulty. He's talking about practicality for people who aren't experts. AFAIK there is no browser plugin that you can download that will help you MITM an HTTP session, whereas there is a browser plugin that will let you passively capture plaintext from said session.
What cryptosystem are you talking about in which integrity checking is an optional feature?
I agree that Apple develops and polishes ideas to an impeccable degree. But to say that Apple had original ideas is grossly overstating the truth.

Laptops existed before Powerbooks. MP3 players existed before the iPod. Smartphones (remember Handspring?) existed before the iPhone. In fact, one could argue that Apple is amongst the last into a market for a good reason: being last allows you to learn from the mistakes of others and see which approaches are dead-ends.

The early bird might get the worm, but its the second mouse that gets the cheese.
Here are some ways to modify traffic on typical networks, most have command-line or GUI point-and-click attack tools available. Some of these are documented to have been conducted on wide blocks of internet traffic.

The attacker broadcasts a SSID of 'Free Public Wifi', or one similar to what you normally use, then DoSes all other access points when you try to use them.

The attacker is on the same ethernet broadcast domain and replies to your DHCP query quicker than the legitimate DHCP server does.

The attacker poisons the router's ARP cache and impersonates your MAC.

The attacker leverages the unauthenticated nature of Spanning Tree Protocol STP.

The attacker pwns your home wifi router through a default password on its admin page or any number of other bugs.

The attacker messes with your DNS name resolution for sites of interest. Remember that time DNS resolution for some S. American (and a few US) ISPs got routed through the great firewall of China?

The attacker advertises a more-specific route for your IP address or that of a target site. Remember when that little ISP in Pakistan took YouTube offline?

The attacker could be your ISP working under order of some government. Yours, that of a country you're visiting, or of some territory the packets pass through along the way.

Or you could be using a hotel, airplane, library, mobile, etc. internet connection where transparent intercepting MitM proxies are standard fare. How good do you think the hotel staff are at securing that internet billing appliance they bought?

And of course, the attacker could always cut a cable somewhere and install a tap.
No, I'm talking about practicality. An attacker can intercept a session simply by controlling any part of the DNS resolution chain. An attacker can passively observe an entire session only by being situated somewhere in the actual path between the victim and the server.
1) Institutions optimize to capture value for themselves.
2) Therefore, any “standard deal” offered by such an
institution has been optimized towards their benefit,
and away from yours.

I think there are some good insights in this article, but I don't think that 2 follows from 1. Yes, the institution prefers its own needs, but it's not necessarily true that these needs are opposite of one's own. A business benefits from having satisfied workers, the workers benefit if the business continues to operate, etc.

I like the restatement at the bottom even worse: The problem with the Standard Deal is that it’s optimized to take value away from you.

There is a difference between optimizing for one thing and optimizing against another. It doesn't have to be a zero sum game between the owners and the workers. Optimizing for the institution does not imply trying to minimize benefit for the employee. There are win-win situations, especially if one is willing to count the consumer and the environment as external.
And how do you do that at the corner Starbucks without using the command line?

Edited to clarify since apparently I can't reply to a child comment: There are tools that require next-to-no technical expertise to passively observe HTTP sessions. There are no such tools that I'm aware of to execute an HTTP MITM without control of the network infrastructure.

I think what the original poster meant was basically just "in a situation where you absolutely, definitely, cannot have SSL, javascript crypto is an iota better than nothing, because at least it breaks Firesheep and Wireshark".
There are even free certs available from at least one trusted root CA.
I see no spam in the results, they are just not relevant.
Yes, knockoutjs doesn't have it's own validation rules. Yes knockoutjs doesn't have routing. Yes, knockoutjs doesn't have ajax helpers.

In all these frameworks that add those features, they forgot to copy two that I personally love to death. data bind attributes can contain arbitrary javascript, and creating new types of data bindings is insanely trivial.
CORRECTION: it's require-macros not refer-macros.
What do I care whether there's a pretty UI for an attack?

HTTPS/TLS is designed to be secure against adversaries with millions of dollars dedicated to attacking it. Why am I even dignifying systems that rely on the attacker's inability to use a command line, or write Perl code?

Have you reasoned through how much code it would take to make a "Firesheep" that worked against Javascript crypto implementations? It's not even a little bit hard.
What are the circumstances under which a browser will refuse to run an unsigned Java applet in place of the legitimate signed one?
The inevitability argument can be made for YouTube, but I don't think it can be made for Google search. Remember, before the PageRank algorithm, people thought Internet search was a dead end. The leading search providers were continuing to push pure boolean queries; an approach that was quickly becoming unsustainable under the mass of spam that was starting to exploit text-relevance metrics.

Google's use of link-based popularity metrics was truly revolutionary, in that it wasn't apparent by simply extrapolating existing trends in Internet search engines.
What would be very interesting is getting MinGW for Xbox 360 working, and then getting an OpenSSH server working as well.
Ron Paul is the last hope
Cool. I have a nit:

91 for Mac meta/command is the left-hand button in webkit only. It's 224 in Firefox, and the right-hand one in webkit is 93.

Also, how to I bind to page up/down?
At that point, why bother implementing crypto in JavaScript anyway? You might as well just use a proper clientside app (a halfassed version of which is your suggestion).
I'll agree that RBLs are simply one weapon in an arsenal of those used to fight spam, and that they can be abused just like anything. However, I personally think they are among worst of the tools, and that they should be avoided.

Simply based on aesthetics, the idea of generating extraneous traffic for 3rd party opinions about the spamminess of each of your emails offends my sensibilities. Next is the enormous time overhead of getting removed from such lists. The fact that some RBLs actually charge to be moved immediately is unconscionable.

Large sites that maintain their own internal RBLs are no better. Ever try to get a tainted IP address to deliver to AT&T, or Yahoo, or Comcast? It's a nightmare. If you're unfortunate enough to purchase hosted IP space that was once home to a spammer, you may as well demand they give you a new IP block or cancel the account ASAP.
When the server is providing the client with its crypto code, the server can read the plaintext no matter what. I don't like these bullshit false promises.

If you are worried that China may own one of the root certs in your browser, remove the certs you don't trust. Hell, remove all the certs. Every mainstream browser allows you to do that. In most of them, you can even set up permanent exceptions for Amazon.com after you strip your certs out.

Meanwhile, HTTPS/TLS has over a decade of the most intensive study anywhere on the planet, and your favorite half-assed ad-hoc bespoke random "crypto-cat" scheme... does not.
I just recently found out that Robin (the CEO of Baidu) was also working on algorithms similar to Pagerank. It changed my perception of Google as a brilliant once-in-a-lifetime flash of insight to much more "the idea was in the air" and these guys rocked the execution.
I took a look but D -> DTrace, not the D I thought it would be. :)
Don't get me wrong, browser plugin crypto probably works fine, but it's also possible to use a browser plugin to turn untrusted JS crypto code into trusted JS crypto code. The plus side of that is that the crypto code would still work without the plugin.
TechStars gathers some info on their results to date: http://www.techstars.org/results/
While I have only the most elementary understanding of the concepts these exploits use (even more elementary in such a low-level hack as this), there's always an undeniable bit of adventure to reading them. It's espionage and subterfuge on a microscopic and high-frequency scale.
... and what feature of any Javascript browser crypto makes it anything more than trivial to defeat by such an attacker?

You can use sslstrip or malicious trusted CAs to argue the imperfection of SSL/TLS as deployed by browsers and users, but it does not follow that that somehow makes Javascript browser crypto any less broken.
SSL/TLS doesn't solve this problem noted by GP:

Furthermore, and most importantly, by using SSL/TLS, the data being sent by the browser to the server is encrypted as it passes through the network, but however remains readable by the server when it reaches it. Whereas with client-side JS crypto, the server cannot read the sensitive data.

This is a shortcoming in the argument made in the article, because it wrongly assumes that we would always want the server to decrypt our data.

I am not saying JS does solve this, but SSL doesn't, and it isn't even meant for that use case.
Don't forget Bram Cohen for Bittorrent.
Is this a puppet? That's really sad :\
I tried doing this for a while, but actually, it's hard work picking out blogs that do good writing, and thoughtful/incisive commentary.

Plus, when you find ones that do, they invariably only keep it up for a few months to a year because it's so much damn hard work to write and research well.

Much easier just to pluck an economist of the shelves at the bookstore than to continually refresh your rss feeds.
Why are people using BitCoin?

Language-seeking behavior, maybe.

Conceptually understandable and highly desirable.

BitCoin is in mind as word is bond|currency|techlogically valuable. An alternative value.

People beg and question $, and given alternative, goldmind rush wins.

Alternative values are worth risks.

A bit of sense.
I think jacquesm makes a really good point in his article (thanks for that link!). In the article, he explains how some incentives within HN are resulting in negative side-effects:

> the race to post my stuff in order to harvest the associated karma got a little out of hand

Points/upvotes on articles should not be allocated to the user who submits that article (unless perhaps, it's an "Ask HN" submission); points/upvotes should be allocated to users only on the comments they make. I agree with Jacques that this would improve the level of discourse on HN and also remove down-vote capability from those who have not earned it through quality comments.

There are a number of ways to make this change: (i) points received from article submissions could be retroactively eliminated from a users score (ii) or separated out from points received on comments--possibly an interesting new data point, (iii) or the points could simply be associated with the root URL of the content source and then displayed on a new page as a list of "Top Ranked Content Sources"--this might also encourage less duplicates and an effort to find the best source before submitting a story... (iv) or maybe this is all just wishful thinking?

edit: here is the associated HN discussion for that article: http://news.ycombinator.com/item?id=2386443
Try playing some of the older CoD games (4/WaW), they're full of various types of cheaters.
You're right. It's been some time since I've looked at any intel-like assembly :)
sslstrip is also in large part a solved problem.

There are definitely major problems with HTTPS/TLS as a security system, but I think most of them are UI/UX issues.

What that means is we get a choice:

* Rebuild everything from scratch and spend 15+ years testing it back into reliability, or

* Rebuild just the UX for a protocol we otherwise known to be sound.
Because the asset managers who are not immune to the problems of retail investors get fired very quickly.

Just as it is hard to generalize from your average facebook user to programmers, it is hard to generalize from retail investors to professional traders.
> When the server is providing the client with its crypto code, the server can read the plaintext no matter what.

What? I don't see how that's necessarily true. The crypto code can be verified and if it turns out to be fine, then the server shouldn't be able to read the plaintext "no matter what." That's silly.

> Hell, remove all the certs.

Is this seriously your solution?

> ...does not.

This borders on ad-homimen - under this logic, we should never strive to attempt creating new techniques but always rely on 10+year old ones. There will always be new techniques that need testing, and the fact that older ones exist is not sufficient to prevent the study and advancement of new research.
This is a hardware hack relying on the CPU's response to an overly-short reset pulse. It's highly doubtful that it can be used on PPCs unchanged.
Heh, I read a blog post a few days ago about the differences between various URL parsing/slicing implementations.

http://tantek.com/2011/238/b1/many-ways-slice-url-name-piece...

(Quick reference image:
http://farm7.static.flickr.com/6203/6082913622_c953b1fc96_o.... )
I think skype could do this (and frankly, I'm mystified that they haven't), but I know of few other companies that have such a wide user base who keep their accounts charged up regularly.
So do it, and render the entire line of discussion pointless. This argument comes up often when discussing JS crypto, and while I agree it's silly for any system that actually has assets worth protecting--personal or financial info, for example--there are plenty of attackers that don't have financial motivation, resources, or knowledge, and just want to use the easiest crap available to them to mess with other users.
He honestly looks like he has for a year, he just normally combs his hair and covers his legs
So your answer as to why JS+validator is better than a plugin doing crypto is that "it still appears to work fine even when the system is utterly broken".

...

When it comes to security, that is actually a negative.
Well, unlike this thread, it only has 2 people spreading misconceptions and inaccuracies about cryptography. And also unlike this thread, they're heavily downvoted. So there's that.
Yes. I'm saying that if your execution environment is a browser, and your security code comes from a server, that server is going to be able to read your plaintext no matter what.

Yes. If you think China is intercepting your HTTPS traffic, remove all the root certs in your browser. Then browse to the key sites you're worried about protecting and create exceptions for each of them. China will not be able to use "fake certs" to intercept traffic to those servers.

Yes. In cryptosystems, 10+ years of study does count for a lot.
I don't understand why a protocol with known major problems that can be compromised by oppressive governments is a better solution to client-side crypto that can be verified for integrity and hides the plaintext from the server.
The BGP examples are a little far fetched. Few adversaries have that capability, and when someone fucks with BGP, the world knows about it.
C++ has failure modes that should horrify anyone who can conceivably use anything else. The slightest mistake is likely to make even correct parts of your program fail in non-deterministic ways. Worst case in a managed runtime like the JVM is an exception and/or a big performance problem, and even those are a lot more likely to happen reproducibly during QA.
And it likely still is immature for the mass market, all these years later.

Notice that handwriting recognition was not part of ipod/iphone/ipad/ios. Rather than continuing down that path, Apple went in a different direction altogether.
Top lawyers aren't paid the most because
they know the law the best; that's ancillary.
They're paid big bucks because they win money
for their clients, prevent their clients from losing
money and build networks to people that have
money to give them.

Actually, the top people are called "rainmakers". These people are able to find, smooch and retain new customers. The technical people are the first to get laid off.