skysight-inc/HackerNews huggingface dataset:
You can trust that there are a lot more developer eyes on open source software than proprietary software. You personally may not be able to verify every piece of software you have, but if you run free/open software, you know it's theoretically possible to discover vulnerabilities, and that you'll find out eventually if those security holes are found. In the worst case, you can hire a security professional to personally audit a program that is particularly important to you or your business.

You have no such options with closed software.
It's really brave of you to speak so freely about a dead person. Maybe you and all of the other revisionist armchair historians can grab coffee after picking up your unemployment checks!
How much does Google know about you?
Or you did a good job in 2002.
Slicing text for reading
It's very simple: there would be mass panic if they showed how successful they've been. If they take down a terrorist plot every 8 months, this means that there'd be a continual cycle of racial profiling and panic if made public. Look how crazy and destructive the internet got after the Boston bombing. If the US government publicized successful terrorist takedowns, do you honestly think it would be any different?

One can't observe (as a US citizen) a lack of successes and estimate whether the program is working or not, because that information would be intentionally hidden. It's an unknown as to whether (1) there are more plots than we know of and (2) the program is working in capturing and preventing these plots, and they remain hidden to us after.
The EU commission is a bunch of hypocrites. I am an European and I am appalled by the lack of integrity of our politicians: they hand over data on flights, credit cards, SWIFT transactions to other countries and keep trying to pass ACTA in its various forms despite strong opposition of the EU population, they created their own mass-surveillance laws (active in many european countries) and then they pretend to be outraged at the mass-surveillance of the US they themselves have helped facilitate in its full breadth. Cretins!
I think you should change the title to "Is GitHub unknowingly racist?" That, in my humble opinion, will be a fair way to consider the case.
Hiring Developers: Slow Down to Speed Up
Two points

1. The US has killed many many more children in its retaliation for attacks than any so called 'terror' organization has. (http://www.policymic.com/articles/20884/is-america-like-adam...)

2. The fear of your children dying is the ultimate weapon for people to control you.

There is a strange dichotomy between the pride parents of soldiers have in their child's courage to defend liberty, and the 'do-anything-it-takes-to-protect-my-babies' mindset that seems to pervade the civilian population. One leads to people standing up, the other, cowering.
Look.. Life on Mars! Oh wait, no.

Look! Life on Mars! Ah, never mind.

Ad infinitum
This is a good talk. It's cool to see a brief history of CLU as given by Liskov herself. However, there's a problem I see recurring in our field, even from respected sages like Liskov: programmers are willing to establish and vocalize an opinion on technologies they don't understand (Python and Haskell in this case). Is that pervasive in other fields as well? Why is that?
Creative Dad Photoshops Daughter Into Funny Situations
Well that's a facile statement, since the EU is only 20 years old. Individual countries in Europe absolutely do have a record of torture, abduction, and secrecy in varying degrees. Are you completely forgetting the 20th century?
A rope stores a long string as a collection (binary tree) of shorter strings. Strings are stored contiguously in memory, so mutation (insertion, deletion, catenation, etc) often involves much copying of data, which could be problematic with long strings. Ropes avoid this problem, but have some additional code complexity and resource overhead associated with data fragmentation.
The issue is the lack of transparency of the laws/rules/etc. and the review and checks and balances problem.

This NSA infrastructure is sufficient for an extremely effective domestic spying network and the only thing stopping them from starting up such a program is the FISA court, where EVERYTHING IS COMPARTMENTALIZED. Do you see a problem with that?
I don't know who to believe anymore...
Indeed! I think the only reason Britain or France still don't have the same mass-surveillance systems in place is their lack of budgets. Otherwise I'm sure we wouldn't be better protected than the americans in the US. Although, the irony being that certainly the US knows more on us (europeans) than our own countries.
The referenced story: http://news.cnet.com/8301-13578_3-57588337-38/no-evidence-of...;

declan submitted his story https://news.ycombinator.com/item?id=5844091 but it languished.

It's a shame, because it's the first responsible piece of reporting I've seen on this mess. The media has been trolled by a Powerpoint brief from self-important USG bureaucrats.
Whereas we in the EU have our own dubious surveillance programmes, at least they are made by governments we can overthrow ourselves.

Also, European governments mostly grant us basic human rights, have no secret overseas prisons, no death penalty for "treason", no decade long imprisonments for whistle blowing or hacking, no secret military tribunals, no recent record of torture, almost no drones, small military, tiny intelligence budgets etc.
Identi.ca conversion to pump.io
The V2MOM Process: How SalesForce Went From Idea To A Billion Dollar Company
How is this brave or revisionist when most of the material I would cite was written when the guy was still alive? And I didn't exactly see any defamation suits? He didn't care because he was in a place where he didn't need to care. I'm not taking away from any of his genius, success, or vision at all. Stop with the patronizing tone.

Given all the nasty stuff we've seen Linus Torvalds write on public forums, should we say that Linus was absolutely a nice guy after he dies? That would absolutely be revisionist history. Speaking the truth would not take anything away from the amazing contributions Linus Torvalds has bestowed on this world, nor his self-evident genius.
I didn't feel shot at, and I agree with you that we can learn from the dead. Calling Steve an asshole at this point doesn't seem right to me. Another phrase comes to mind is "Let us now praise famous men," which Wikipedia tells me is from a passage in the Wisdom of Sirach (2nd century B.C.) that begins, "Let us now praise famous men, and our fathers that begat us." I better get off this kick because I have work to do! The wisdom of the ages is a fascinating subject though.
Drummond adds:

We cannot say this more clearly—the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box. Nor have we received blanket orders of the kind being discussed in the media. It is quite wrong to insinuate otherwise. We provide user data to governments only in accordance with the law. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. And we have taken the lead in being as transparent as possible about government requests for user information.

https://plus.google.com/+google/posts/TMh6gUVrwMq
I'd love to begin making small monthly payments to the EFF, but here's my hurdle: I don't like authorizing anybody (not even the EFF) to charge my VISA more than once. And I don't like having PayPal take a cut when the money's going to a charity.

In my home country, I do regular donations to charities by setting up an automated transfer in my bank, hence "pushing" the money. I prefer having nothing "pulled", even by such privacy oriented a group as the EFF. Is there any solution to this problem internationally? A monthly e-mail linking to a payment page (using VISA, for example) would count as a crude but satisfactory solution!
Tor's creation was funded by the US Navy. Presumably, it was made to allow US spies in hostile foreign countries to safely communicate home to the mothership.
All,

Can somebody compile Non-US alternatives for email, search,etc?

On top of my mind :
Search : yandex.com
Google Docs : zoho.com
Email : fastmail.fm (Paid)
Any centralized, aggregated data will attract both good and bad guys. The responsibility of safeguarding data also falls on individuals. We are also a party to the whole episode.
I'm sure if you have your bank mail them a check every month, they'll cash it.
The client chooses every node that is used. The client picks the three nodes, and then encrypts the traffic using each of those three nodes public keys in order. Then each node in turn peals off a layer of encryption and passes it on to the next node, which is the only node that is able to decrypt the next layer.
Also, pervasive NAT and dynamic IPs. David Reed mentioned somewhere that he'd argued against 32-bit IP addresses and lost.

There've been powerful incentives for software on servers; I think the above got in the way of p2p getting much of a foothold to develop its own advantages.
Yes, but it's still using the term "direct access", which we've seen is the antithesis of forthrightness.

Surveillance is tricky business and technology makes the boundaries of what's acceptable to reveal even trickier. It's true that the muddling of the Verizon/AT&T stories is being interwoven with this, which may not have helped. And the scope of the information requested falls well within acceptable procedure for "traditional" investigations I.E. who contacted whom at what hour on which day. But this isn't a traditional investigation anymore.

In essence, they tried to automate police footwork, which still doesn't fly with a lot of us.

https://www.eff.org/deeplinks/2013/06/why-metadata-matters
Is it a good idea to impose uniform code format for all developers?
I'm sure many people have said the same thing much more eloquently than I can, but what I find extra depressing in all this is that we all obviously want to take advantage of the possibilities that the Internet gives us, but while people are prosecuted right and left for sharing a song the government (any government) can do things on a scale which we can only dream of. We're all connected, but has it empowered us or has it made us into a bunch of sheep?

What happened to the government working for us, the people? Yes, I'm sure I'm naive, but still.

I don't see this getting better before it gets worse. Sorry.
hackers threaten the money of old white guys. they gotta get locked up.
Pay them far above market.
One of the governments primary jobs is protecting you from aggressors. You may not agree with the method a government uses but that doesn't change it's job description. So when they come for the terrorist they are pursuing a legitimate governmental role.

When they come for the whistleblower and illegal alien it becomes debatable whether they are pursuing a legitimate governmental role. It's very definitely an apples to oranges comparison there.
Google Chief Legal Officer:

"the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box" https://plus.google.com/+google/posts/TMh6gUVrwMq
If being gay is about feeling, how can anyone say that a person is born gay? You're not born with feelings, are you?
I've been working on a server that implements the Redis protocol and stores the data in LevelDB: https://github.com/cupcake/setdb
Perceptual diffs for front-end continuous deployment
Please consider signing up for recurring donations, rather than one-time, so they can better predict the amount of money they get, and also so you don't donate and then forget to for a couple of years.
Thanks -- I was feeling a little guilty about passing that on unchecked.
Yes. Why? Because depriving of technological capacity to do something solves no problem. We developers are rarely so unique snowflakes that what we do is unable to be reproduced by another person. And the government will be able to procure the technological know how.

So either you design your service from the start with irreversible untraceability, privacy protection etc (and not storing your users data in plain text) or you implement it when asked legally.

The government overreach is something that should be solved by law and not by technological means.

I would try to leak about the whole story though.

Also a government have legitimate interests in gathering and analyzing data - there are real crimes being plotted, committed and investigated.

What get everyone so worked up these two days was not the fact that the government agencies have ways to obtain data, but that there is little transparency and the data requests are way too broad. A single defiant developer won't change that.
What's funny is only China was smart enough to keep Sillicon Valley surveillance out of their country. Though it was only because they wanted to control the surveilance themselves.
That's one of the advantages of open source security tools: even the black hats need strong security. So long as you can reasonably examine, assess, and trust the source and methods, there's no problem with this.

The white hats have the added advantage that they can (generally) collaborate openly. Black hats have fewer and more constrained communications channels. Even in a regime in which personal liberties are constrained, white hats may be able to communicate openly pseudonymously or anonymously. The black hats, in order to preserve their mystique of power, and defections, _still_ generally have secrecy requirements.
That's one of the reasons Java ships its own; if some systems have different or absent system databases, Java's should still act the same as it does anywhere.
Believe in yourself and take reasonable steps (use your judgment to discern what's reasonable, including my post) and take adequate steps to ensure your privacy by investigating as much as you can.

Provided you're of sound mind, you're the only person who can't let you down.
Four ways to extract files from pcaps
Yes, we all know who will win in an arms race between me and google.
Yes, I read your previous excerpt and I've read this very post here before. Repeating it over and over (this is your 3rd post so far posting this link) doesn't make me believe it any more strongly.
I realise that I'm risking being contrary, but my question is serious.

How would I know that an app has had lots of developer eyes on it or not? It's crazy difficult to uncover the latest known security posture of open source software.

Finding out eventually is the exact same risk I take when I use proprietary software. It requires my trust. And it's theoretically just as possible to discover vulnerabilities in closed-source software (Windows, for example).
Solve a Need Yours
I first found out about V2MOM from a great post called "The #1 Mistake Entrepreneurs Make" by Michael Lazerow (Founder of Buddy Media, which sold to Salesforce for $689m):

http://www.linkedin.com/today/post/article/20130320211727-17...

Here's an interview with Benioff where he talks about the process & shares some insights: http://www.endeavor.org/blog/marc-benioff-keynote&#x2F;

Hopefully this info might help some of you with your startups, as it did with me.
Clojure Web Stack: Server Side HTML Generation
Outside the SaaS world, software often runs for much longer than the developer supported period - it's not rare for the software company to go bust way sooner than the software itself.
In a real world situation, I wouldn't assume that the NSA would just hand over evidence to the FBI unless it was pertinent to the NSA's mission. The two agencies are completely different and belong to different arms of the bureaucracy.

The NSA analyst's job is to root out foreign enemies (who sometimes are within U.S. borders). What does she gain if the FBI uses something she's collected under a super-secret system to prosecute someone on, let's say, on a grand larceny charge? The NSA doesn't get credit for that. On the other hand, she's on the hook in several ways...one, she has to do such sharing discreetly. Second, she has to deal with the FBI's requests for "just a little more info". And third, she has to depend on the FBI agent not fucking up and dragging her into court.

This is not to say that NSA/FBI sharing should be kosher...it's just pointing out that even if it is, bureaucratic barriers would impede it, and even if thhey dont, that would be the least of our worries...much more likely that the NSA goes overboard in its own investigation and snares those who should not be in the dragnet, which it can do without the FbBI's help
The article compares Redis to Cassandra which means comparing apples to oranges for their use case. It would have been meaningful if they explained why they chose Casssandra, instead of for example Hbase.
Facebook and Google have always been the least transparent imaginable AND they're both in damage control mode AND they're obviously under some DHS gag order. So why anyone would give any credence to a word they say is beyond me.
What sense of "directly" are they using?
When you plug an iPhone into Ubuntu you can access the app folders on the phone
Show HN: Easily add a NSA backdoor to your Rails app
... surely this isn't meant to happen, right?
An Engineer's Perspective on The Internship
Even a suspected terrorist deserves a trial. If they are guilty, if they are a terrorist, then they will be given the punishment they are due.

The problem with deciding that suspected terrorists don't deserve the same rights is that those rights are/should be inalienable. If we decided to start making exceptions, then those rights are no longer inalienable and it's just a matter of degree.

What is a terrorist but a murderer with a political agenda? So perhaps we shouldn't give murder suspects a trial either. And what about a suspect who's attempted to murder? Why give them a fair trial? And so on.

The degree of heinousness of the crime should determine the punishment, not whether the accused deserves a trial.
Yet you keep hanging on that they only mention "direct access" and how the denials are similar, it's not about what you believe to be true or not, it's about the things you say that aren't true - here is an example of a denial that does not only include "direct access" but all sorts of access as well.
Federal laws will overrule state laws every time in this case. The gov't will just claim national security/intelligence laws aren't covered by the 10th Amendment.

The only thing the states could do is pass a Constitutional amendment but that has never been done through state assemblies before.
You're ignoring that we spend a great deal of treasure and effort in minimizing road accidents and "gun deaths", and with quite a bit of success in both as measured in just that, especially when adjusted for population increase. We're spending so much ordinary people can't afford new cars (OK, there are environmental costs as well, and the $1,000? for a 5 mph bumper isn't for safety, really), and the current generation of the young is to an unprecedented degree avoiding them.

Therefore, why is our reaction to Islamic terrorism an out of line overreaction? I mean, any more than our vehicle safety one, or at least as that can be argued as an overreaction?

If, or more likely when, it gets to the point of nukes slagging our cities, I don't think the word "endure" will even vaguely apply. I would also hate to tell my friends who lost friends in 9/11 that that was something simply to be "endured", with obviously lots more to come.

Ask yourself if your desires are realistic. Would the American people allow such to pass? Would not a suppression of the reaction to attacks result in worse reactions when we finally do? It can be argued that our tolerance and "enduring" of al-Qaeda's attacks (http://en.wikipedia.org/wiki/Al-Qaeda#Attacks) that killed over 300 prior to 9/11 allowed the latter to occur, with our resulting "overreaction".
Nice, there is also xplico and tcpxtract, but the later hasn't been updated for a few years.
Eric Schmidt would be the last person I'd believe on matters related to privacy.

He's well-known for basically claiming that we're not entitled to any privacy ("if you don't want anyone to know blah blah ... ") and for later being a vindictive fool when CNET published some of his personal details found through Google.

Besides, he's not even CEO anymore, why would he know anything about highly confidential dealings with the NSA?
Well, not strictly cyber-warfare warfare. And military, not law enforcement; at least, military-like activities against non-state actors. (Ron Paul actually proposed this both as the response to 9-11 and the Somali Pirates...)

Nothing could go wrong with this :)
Google gave the Chinese gov direct access that's how they got hacked.
They don't share everything, for example when they spy on a foreign company in advance for a big RFE, they won't share. But they are most likely to share real threats, because they are being judged on what they share. Then you have the game of powers, like when Europe had to surrender plane passengers personal data. Being foreigner's data, they are perfectly game for every spilling or abuse since only US citizens are a political issue, and there is mostly no way to get the US Government accountable for any international treaty.
If they have an IMEI, camera, microphone, GPS, all the contents of your text messages, all your phone calls, all your mobile web browsing (this is the purpose of a cell carrier, no?) do you think it really matters if they have your Google account?
This paper was apparently written by an Army officer, not a defense contractor (although he may work in acquisitions).

Believe it or not, many people who work in government and the defense industry spend a lot of time thinking about 9/11. Not so outlandish that this would show up in their writing.
I could not agree with your "responsible reporting" remark any more. Quite frankly, I'm disappointed with the majority of those other articles making it to the front page of HN.
Also the phenomenal incompetency of our (British) gubbermint when it comes to buying any item of IT more elaborate than ordering an iPod from Amazon. One of the greatest defences we have against the encroachment of the state in the UK is the amiable ineptness of it at every stage.
Six Links Every Saturday
You can uncheck the box next to the gift options, so that you don't waste their time/money on sending you a gift.
No doubt it will happen anyways. But morally, I couldn't. And I'd hope that my protest, no matter how small, would be my way in participating in a conversation on change and help inspire outrage in others.
Doesn't a system like Tor prevent MITM attacks as long as you connect only to .onion sites? Isn't this solved too in I2P and Freenet?

Maybe the Web isn't the right tool because everything is in the open.
from my very basic understanding of EU privacy laws, the big win is that they treat everybody equally - the rules say what data you can retain, what data you can't, and that's it. What really scares me about all this FISA and PRISM stuff is that they treat foreigners as essentially non-persons. They at least make some effort at pretending there's a due process for american citizens, but if you're a foreigner with your data on a system owned by a US company, you literally have no rights at all.
The US secret services are also convenient scapegoats, our own government agencies can simply ask them for information on EU citizens that would be illegal to collect in the EU and they probably do so frequently.
I'm not sure that the states have any power here. If there's a federal law legalizing it, it doesn't matter what the state laws are. It's basically the reverse of the medical/legal marijuana scenario.