skysight-inc/HackerNews huggingface dataset:
This article seems to make the most sense. As a hypothetical example, Google might have been manually fulfilling thousands of FISA requests. It sucked up time, took engineering resources, was error-prone, and lacked the legal paper trail to track such requests. In addition, the government wanted something faster, that used fewer agents to submit/collect data, and could more easily get updates.

So one day, an NSA agent negotiates with Google to build fisarequest.supersecret.google.com. NSA agents can directly upload FISA request documents, as easily as submitting expense receipts. In turn, Google's legal department can view each request and decide to comply with the click of a mouse, as easily as approving an expense report. If authorization is granted, the NSA can now view the emails of the requested user, and new emails can simply be viewed with a refresh of the browser. As Schmidt and Drummond say, Google can decline a request if it's improper or overly broad, and ask for additional information -- again, as easily as a manager looking at a questionable minibar expense on a trip report.

Said NSA agent does this with multiple companies, internally brands this as PRISM, puts together a Powerpoint deck, and declares victory. It's "direct access" since it's coming straight from Google and on a Google server, and it's "real-time" in that a request can be authorized quickly, and there are no more .zip files with data dumps involved.

Google has never actually heard of PRISM, and only knows that they built a tool to make it easier to do what they were already doing with legal FISA requests. To them, the NSA doesn't have "direct access," which is a loaded term for unfettered superuser access.

The entire program costs only $20mm because the government now requires only a few agents to submit requests and collect data. The cost of building the tools is borne by the companies, who see it as a cheaper way to comply with an existing legal obligation.
Torservers.net: Professional Global Tor infrastructure
What about the post reads like it came directly from a lawyer?

I don't disagree that a lawyer vetted it -- lawyers generally vet anything legal related that comes out of an organization. All of the major news stories on this topic have likely been vetted by lawyers.
Solving the Mystery of Prism
Let's all do a blogpost on PRISM and see how many eyeballs we can get.

Google takeout most likely has nothing whatsoever to do with PRISM or any other NSA programme, why go through a clunky one-user-at-a-time batch process when you can be comfortably sitting right where the action is, where updates are incremental and where information is available when it happens instead of when you ask for it.

Push over pull any day for the NSA and the likes.
This really was/is the main sticking point around free software. The UX is awful until a designer comes along and fixes it.

Or ruin it...
NSA? Prism? Stop complaining and start doing something
Show HN: Want an idea for your startup? Generate it automatically here
Here is something I made for fun, after getting annoyed by hearing numerous ideas proposed by various people.

http://www.kidura.com/front_pages/misc_fun/
Those responses are eery close, and both Zuckerberg's and Page responses do not address a key question: Do their companies run queries over users data to answer questions that the state are willing to pay/force to get?

The value of the data inside Facebook would actually go down if it was transfer out of Facebook. Its much better if Facebook themselves would run the query (like they normally do with advertisement), and provide the NSA with either a summery or webbugs/custom code in form of targeted images (advertisement) sent to those NSA is interested about.

Copying massive data would not just be logistically hard, it would need to be constantly updated. The simplest answer is that "direct access" simply mean NSA provided queries that google/facebook run at "request". No need for backdoors.
Thanks for the idea. It is really nice, I am just afraid if buying a single font not a little to small for a gift...
Sadly, TextSecure and RedPhone are distributed on the Google Play platform, so, if you don't want to tie a Google account to your phone or use Android without the proprietary Google applications, you're out of luck. (They are not included in the free and open source f-droid repository due to disagreements with the author.)
What happens if one one assumes that the likes of the NSA can directly access one's computer and poke around at will?

For years Microsoft has been accused of building or allowing back doors in to windows. If that is true, none of these schemes will work, right?

For years now, I have just assumed that my computer is a government spy sitting on my desk. OK, paranoid, no real proof what so ever, and OTT. But, I feel it is wise to assume and act like that is true. Or, know the risk you are taking.

How to be secure on the internet? Don't use the internet.
wow - a rape analogy? Really?
I wonder if deactivating one's FB account triggers a copy to be sent to the NSA? The "Logic" being a panicked user trying to cover tracks.
The NSA has tons of data, but where is it keeping it all?
Dark Secrets A Louisiana Hurricane Horror Story
No. Sounds like an 80's CIA caper.
The threat is from government and collaborators. Some collaborators are probably lobbying to have government surveillance programs expanded because they think it will benefit their bottom line. Other collaborators may believe that privacy of citizens is of no or little importance and willingly cooperate. Companies with business models that debase privacy could be suspected of this. Then there are companies who genuinely may not want to cooperate at all and who may even care about privacy. Companies with a squeaky clean history on the privacy front.

Unfortunately, it is important that all collaborators be punished. Especially since the government is trying to expand its surveillance programs to include a wider range of companies, and per reports many companies are reluctant to sign up out of fear of public backlash. There needs to be that public backlash. There needs to be negative consequences for those companies that participate.

That being said, I'd like to clarify that I don't think all forms of cooperation with government investigations are inappropriate. Very narrow and specific requests in response to explicit subpoenas being an example of something I think must be tolerated. On the other hand, blanket requests and requests for data access that would enable government to independently explore the records of millions of American citizens is something that can't be tolerated. Efforts must be made to change such policies at the same time that efforts are made to penalize the companies that collaborate and make it possible.
ok lets go:

This is my pseudo google glass startup called "Hulioly" at
http://glass-apps.org

Hulioly is a hillarious startup that is a complete game changer. I founded Hulioly after realizing that there is an untapped 225252334 billion dollar opportunity in internet.

I can't tell you the details about our platform because we are currently in stealth mode, but we are the only player in internet which we will completely disrupt in 4 months. At Hulioly we believe that everyone deserves sex. Our product will bring together big data, social media and google glass to introduce synergies that will democratize, and revolutionize internet.

This idea is so potent yet so deceptively simple that it has the capacity to produce an unlimited amount of profit.

We haven't created our product yet, so we are looking a real ajax gangam to join our team so they can build it for us. This is a once in a lifetime opportunity for you to be a part of the next big thing. We have free food, unlimited vacation, generous equity compensation. Also each week we give you a new iwatch just for being amazing.

If know ajax and 'want in', just tweet me and you'll be on our uber game-changing, revolutionary, disruptive team in no time, helping us change the world!
Use linux?
Thanks for clarifying. So the following complaint about DPI does not make sense, given that a 50 inches wide screen with a resolution of 600 pixels per inch has 32000 pixels.
But Google said it denies taking part in PRISM...that denial could be a lie, but nothing so far has substantiated that.

The NYT article that so incensed Michael Arrington, for example, exclusively refers to the FISA procedure, which Google has more or less already admitted that they comply with (lawyered requests for specific individual/groups data).

The only part of the NYT article that sounds like the alarming scenario outlined in the PowerPoint slides is this:

http://www.nytimes.com/2013/06/08/technology/tech-companies-...

> In one recent instance, the National Security Agency sent an agent to a tech company’s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company’s server and remained at the site for several weeks to download data to an agency laptop

There's no mention that the company here is Google and there's really no reason to believe that it is Google (in this instance)...I mean, because if it was, then the procedure described here has vast implications about Google's software stack that would seem untenable for a company with Google's kind of infrastructure

(It's possible that the procedure described here is inaccurate, as it is third hand, but that only underscores the vagueness of this whole thing)
Good points - other things that mean something else in this light is the realname enforcing policy and the unification of Google accounts (that we got Google+ to blame for exclusively so far). Taking it further, I wonder what the information that Google's personalized search is based on, can be used for. It must be a good summary of your habits, interests etc., right?
Why on earth do you call out Skype? That's true of tons of services.
"I don't mind targeted surveillance against genuine suspected terrorists."

This kind of language bothers me - "suspected terrorist" requires no proof at all, while sounding authoritative (65% of Americans support the remote execution by drone of 'suspected terrorists').

I know roughly what you meant, of course, but where that line is drawn is a discussion that needs to be had. I'd say that with the level of surveillance that goes on, we are all suspected terrorists now.
I wouldn't be shocked if that happened. There was some other leak a while ago saying that FBI thinks you're "suspicious" if you don't have a Facebook account. That's the world we live in now.
Or they just put something upstream of the "server."

It's actually trivial if you really think about it.
Then you need to secure the OTR channel, i.e. authenticate the remote users; the same goes for using PGP-encrypted email – in both cases, it is almost impossible to securely authenticate someone who isn’t sitting next to you.
Contributing any sort of design to an open source project is often a horrible experience.

Probably explains why it rarely happens.
Wordpress Theme Search At Its Best
Skype was another one of the services mentioned. Microsoft was also the first company to start giving data this way to NSA, according to the leak, since 2007, and they signed up Skype to it almost immediately after they bought it.
The thing is, China is most definitely "attacking already."

Drawing up a list would be pretty light in comparison, though I'm not saying we're not also "attacking."
void CInGodsTimeDlg::OnStop()
{
int l,col;
LARGE_INTEGER count;
// char buf[128];

QueryPerformanceCounter(&count);
UpdateData();
switch (pick_mode) {
case pm_numbers:
m_num=(count.LowPart/DIVISOR)% m_max+1;
break;
case pm_words:
if (num_hash_entries) {
l=m_main.GetLength();
col=l-1;
while (col>0 && l!=0)
if (m_main.GetAt(col)==13)
break;
else
col--;
if (l-col>55)
m_main+="\r\n";
//	sprintf(buf,"\r\n% 010u ",count.LowPart/DIVISOR);
//	m_main+=buf;
m_num=(count.LowPart/DIVISOR)% num_hash_entries;
m_main+=word_list[m_num];
m_main+=" ";
m_num=1;
}
break;
}
UpdateData(FALSE);
}

----------------

Fucken niggers.

http://www.randomnumbers.info&#x2F;

5 digits 0-9

line 58650 in King james

22:8 And he discovered the covering of Judah, and thou didst look in
that day to the armour of the house of the forest.

22:9 Ye have seen also the breaches of the city of David, that they
are many: and ye gathered together the waters of the lower pool.

22:10 And ye have numbered the houses of Jerusalem, and the houses
have ye broken down to fortify the wall.

22:11 Ye made also a ditch between the two walls for the water of the
old pool: but ye have not looked unto the maker thereof, neither had
respect unto him that fashioned it long ago.

22:12 And in that day did the Lord GOD of hosts call to weeping, and
to mourning, and to baldness, and to girding with sackcloth: 22:13 And
behold joy and gladness, slaying oxen, and killing sheep, eating
flesh, and drinking wine: let us eat and drink; for to morrow we shall
die.

----

Niggers
Thanks! I'm a hopeless designer :(
David Byrne on anonymized data
“I recently read an article regarding the security of so-called “scrubbed” data. Netflix or some other company wanted to employ a third party to analyze some of their customers’ patterns of purchase — but as a precaution they removed (scrubbed) the customers’ names off the data. So theoretically, the people being analyzed were now abstract entities. However, out of curiosity they hired another company, to see if any of those unidentified customers could possibly be re-identified. It turned out they could. Not due to a fault of the scrubbing, or some security or software malfunction, but because other data and patterns of customer and citizen behavior were available online, and correlating these with the patterns of the anonymous customers led to conclude, beyond a reasonable doubt, the re-identification of many.”

http://journal.davidbyrne.com/2009/10/102409-internet-antichrist.html
It's more about seizing the moment of widespread outrage to effect change, rather than ho-humming like a jaded hipster.
Yep, it's amazing how many people start by assuming that their OS is safe... and there's no basis for this assumption, even without assuming intentional backdoors baked in, there are some many 0 day exploits for all the software we use daily that...

...heck, I'm not even 90% sure that compilers don't add backdoors to software (it's not paranoia... but with a 30 y o idea, you can imagine that people have had time to refine it to unimaginable subtlety :) http://cm.bell-labs.com/who/ken/trust.html)
Tern, Explained
You should be able to find the apps on other sources, and the nice thing about Android (and the "old" Windows) is that you can still install apps from other sources. That's becoming less and less the case with other operating systems, though.
Yep, first thing I also thought is "That's old!"
The Retroshare no-gui version is almost feature-complete. The no-gui version will allow all kinds of interfaces as can be imagined. The Android version is still under active development: https://github.com/G10h4ck/RetroShare-Android-Client
How To Keep Your Best Programmers
I am kind of surprised how many people on HN try to downplay the PRISM thing. The recent revelations and controversy directly affect the business prospects of any US firm that stores data.

A couple of months ago I was on an education business fair in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

I now wonder if next year, some will advertise that they don't even have a US subsidiary and are thus not under US jurisdiction.
Not unless the NYT report is completely wrong, and the Internet companies are lying very blatantly. By all accounts PRISM is a conduit for FISA requests and responses, each of which is still approved by Internet-company lawyers. If they were servicing extremely-broad FISAs like Verizon's "send us all your phone metadata" then the distinction would be academic, but both Google and the NYT seem clear that Google hasn't accepted anything on close to that scale.
Design thoughts on next-gen PKI for better privacy
And this summarizes everything that's wrong with the current ethos. We expect everything to be safe, and we expect everything to be easy. Nothing is above our comfort level and safety. Maybe the knife hasn't cut deep enough, or maybe we don't have the stamina to get off our couch. Either way, sad.
Would you mind sharing which font that is? Looks a bit like some form of Courier. Is it a specific zsh theme (oh-my-zsh), or custom? :)
I figure who better to ask for design feedback and to help discuss the technical details than the HN folks ;-) The basic idea is to create a a PKI which provides stable authentication across time as well as at a specific moment so that even if you manage to step into the middle you can't remove your surveillance without raising an alert.
The signing key for Gmail's certificate is a 1024-bit RSA key. That key size is simply not safe against an attacker like the NSA today, so we may as well assume they have the private key even if Google didn't voluntarily give it to them.

But while the signing key may allow them to impersonate Google in some circumstances, it doesn't really help decrypting passively recorded TLS traffic to the real Google. For that, they would need to break the ECDH key exchange, and if Google uses reasonable elliptic curve parameters, that's presumably much harder than factoring a 1024-bit RSA modulus, at least with known cryptanalytic techniques.
That is a problem to be solved then.
Credibility Crunch for Tech Firms over PRISM.
I don't think he meant challenging Google and Facebook in Court, but challenging the government and the Patriot Act and hew new FISA in Court.
Best way to quit smoking
Have you tried to change state however it absolutely was unsuccessful? Well, there ar definitely many ways to change state however some ways simply do not work on all! let's have a look at, what ar the foremost common ways of losing weight provided by on-line websites, advisors and health specialist? Well, I will list some for you. they're chiefly diet, meditating - that i do not extremely suppose works abundant, physically elbow grease (exercise for fitness and not chiefly on bodybuilding), etc. these days i'm here to debate and justify a number of the elemental ways that actually work for your weight loss plans.
This is the best explanation I've seen so far. It requires no one to lie. The Washington Post inferred too much from the evidence it had, but I'm thankful this debate has occurred. The NSA denies that it has broad access, the companies deny it, individuals at those companies also deny it. Obama denies it. All of them speak truthfully.

The EFF publishes a timeline of when companies decided to streamline their own access requests, which may well be perfectly truthful.
I think that's what screwed it all up, in the end: lack of symmetric bandwidth. Without symmetric bandwidth, everyone needs to talk to centralized services and servers in order to pass any data around larger than an email attachment. Those services and servers become power centers, which attract surveillance and corruption.

A really safe internet has to look more like BitTorrent and less like YouTube.
They should have at least remained silent. By issuing grossly misleading denials they look silly and dishonest. And yes, cowardly.

Had they said, "We do not comment on matters of national security," such would have been honest, careful, and truthful and it would have been darned hard to prosecute them or put them at risk for effectively revealing that the press was right.
This isn't reddit. It also isn't particularly relevant.
20 bit operations programmers should know
> But Google said it denies taking part in PRISM

Did it really? It seems that PRISM is the software support etc. to semi-automate the FISA procedure at the Internet companies. Google claimed never to have heard the term 'PRISM' but that could easily be true-but-insignificant.

(It's possible that the "PRISM" name is also being used by the NSA to cover old-fashioned wiretapping of emails etc., but that wouldn't involve the Internet companies as opposed to ISPs.)
You know, there's a conspiracy theory angle here.
A tactic I have observed for dealing with awkward leaks is to allow the speculation about the unknown aspects of the leak ramp up to extreme levels, then rebut the more ridiculous theories without addressing the sensible ones. Joe average reads the rebuttal, feels let down that the story wasn't quite as inflammatory as the hype had led him to believe, and moves on.

This PRISM business (of which there had been no hint before) is a massive one-up on the seriousness of the Verizon scandal, and its timing in relation to it is deeply suspicious. It wouldn't be too difficult for someone in the intelligence services to make a pithy PowerPoint presentation about how the NSA slurps data from all and sundry (what was it supposed to be for again? "Training"?) and fake a leak to a few newspapers.

I predict that this story will turn out to be a complete wash, and in the meantime everyone will have forgotten about the not-as-sexy but much-more-true Verizon leak.
>The government would go after Facebook as an entity when Zukerberg speaks out.

You honestly think the government is going to go after a multibillion dollar international corporation? Doing that is what gets the government into trouble, because the corporation has the resources to defend itself. And they're clearly not going to destroy Facebook and Google in any event -- can you imagine the public outrage, to say nothing of the economic damage?

Governments retain power through leverage. They don't actually have the power to destroy everyone, but they have the power to destroy one person, and the power to threaten everyone with the risk of being that one person. When the government is wrong, this relies on everyone being too afraid to do the right thing, and people not talking to each other and working together.

This is pretty basic stuff. If you stand up and no one else does, you die now. If no one stands up, you die later. If everyone stands up, you win. Which would you rather do?
Yes, you should do this. Mechanisms for authentication of OTR-chats is build into the usual plugins (exchanging a secret). It is not almost impossible - in doubt, just call him.
Also consider this. They have a 51% confidence that the target is foreigner.

In the case of gmail, "please send me a random 10 users' info, data, and emails" gives you over a 70% chance that any given one in that sample is a foreigner. With Facebook it is closer to 85%.

So think about that. It means the filters could deliberately overinclude Americans and still meet their standards.
Variation on the Platonic Beauty
Ah, yes, sorry about the tone. I didn't notice that you were replying instead of the original nsns; he was the one my ire and e.g. last sentence was directed towards.
It's not metadata, it's a social graph
https://plus.google.com/103808128853828210342/posts/Npop4ztUcrF
No, Romney was just the proper embodiment of current Republican ideology.