skysight-inc/HackerNews huggingface dataset:
"With DTLS-SRTP content interception will always be _possible_ to detect (e.g. by comparing session IDs) and when coupled with something like Persona (BrowserID) MITM becomes infesable."

I don't think this is correct.

1) interception is usually about passively recording something. It is totally possible for some party to intercept a DTLD-SRTP session without being noticed. The session would just be encrypted. So it depends on how much CPU power or knowledge about crypto or protocol vulnerabilities the attacker has to turn that intercepted encrypted session into something useable.

2) Persona does not prevent against MITM. It operates at a completely different level. At is basics it is just a mechanism to get a verified email address from a user.

You are correct about SDES and signaling servers. Unfortunately you always need someone in the middle because even in 2013 probably 99.9% of 'things' on the internet are behind NAT.

There are probably secure options to encrypt the SDES before it goes via the signaling server but nobody has really explored that fully.
I doubt it will disappear, but I certainly understand the desire to unionize. What might work better, would be a sort of guild. The aim would NOT be to engage in mob-style tactics like so many 20th-C American unions did. (That only works when there is a shortage of labor. The lobbyists probably tell their clients they've prevented that, but in reality it's because the internet.)

Rather, a guild that would work for our "profession" would be one that could refer coders with particular skills at particular levels, and then monitor the work closely enough to protect both coder and employer. Businesses with real work to do would pay a premium for that, but the guild would not take a cut directly. That way lies bureaucracy and tyranny, and besides all the Indian body shops already pretend to serve that market.

Rather, the guild would inspire those it helps to help it. It would certainly accept corporate donations, but since "decisions" would be kept to a minimum their influence would not be undue. Testing and education would be part of the mission (and that's how it could start), but so would basic community activities. Eventually a guild that offered health insurance could free its members from the grind of perpetual employment. (Someone whose kids will still be welcome at the doctor's if she takes a couple-month sabbatical is someone more in control of her career.) Those employers that don't need the assistance of the guild to get their software written wouldn't face any immoral pressure. However, if the guild becomes valued by many in the industry, auditors might be interested in why a particular company didn't use it.

Just a thought.
Behind The Scenes: Peregrine Falcon hunting Red Bull mountain biker
Good Visa Option for Startup Entrepreneurs: L-1 Visa
Reconciling PRISM claims
Glad you enjoyed. It was pretty frustrating getting started when you know how easy some of the things are to do in other languages but once I got into it it felt great. You definitely start thinking about them at a different level although parts of it felt pretty functional/mathematical to me.

The other thing I realize now is how much easier it is to get started now with StackOverflow and Google being available. I remember having to go through tutorials and demos that came with the software or read books to learn new languages. Now there are so many resources out there.
He said "as much as possible".
I would love to hear why "overlays uber alles" doesn't work for you (seriously, I'm interested).
I think it turns out not to be hard to resolve the A<->B rendezvous problem if you're willing to have an M that forwards packets.

I think a lot of crappy 1980s protocol architecture is based on a fear of forwarding packets that (to invoke a shorthand) Moore's Law has addressed for us.
One more character would have been sufficient...
You not to know I'm hiding anything at all.
Collaborative decision making kills collaboration
You can do either. This is our MVP and we didn't yet have a chance to write all the copy the way we wanted.

We're working on improving the site / product a lot, and will definitely talk about recycling. We're also considering a program where after 30 days are up, you send us the phone back and we'll get it shuffled around.
I suppose it's better late than never. Glad people start realizing this and seeing the scale of the iceberg. I hope the young generation will find value in his ideals and will not be put off by "swimming against the tide of conventional wisdom". After all, the hacker's virtue has always been... an unconventional wisdom :)
OK, so I have put together such a network. It's foolproof with NAT traversal and easy to use because I've integrated it into a portable OS. But I'm a do everything with netcat sort of guy and so I haven't written any sexy and compelling "apps" to run on it. Others would have to do that. My question is: What is the market demand for this? I mean, a few HN'ers say they want it. But that does not make a startup.
This phrase 'direct access' -- I wouldn't assume, if there exists something like PRISM, that it would have 'direct access' to anybody's servers. More likely, the data would be given from a company TO PRISM.

You could even argue that an API would not be 'direct access'
check out bitmessage
The idea that these people work inside the Microsoft campus is hilarious.
I'm really burying the lede on my crazy dream, because:

The great thing about overlay networks is you don't need anyone's permission to build them.

All you need is an app that really benefits from the advantages of an overlay network, some of which include:

* Point-to-multipoint or multipoint-multipoint delivery (ie, multicast)

* Logical addressing decoupled from network topology

* All points rendezvous between nodes that don't have inbound connectivity because of firewalls

I agree with you that it's unlikely anyone will be successful building this as a product that is simply "new Internet"; what I think is more likely is that people will starting having more and more Skype-like successes by ignoring the "rules" of IPv4 connectivity and routing around them in the "application layer"† like the brain damage they are.

† ... which is a stupid term that blinds people to how much power we have as developers
The Feds have direct taps into every major telecom carrier in the US. You can't fire off a search query to Google without the Feds technically being able to pick it up.

Access is trivial, volume is a much more interesting problem.
There is no way that this is just some nice interface for court ordered collections. Watch the Washington Post video with the (Pulitzer Prize) author Barton Gellman.

Gellman says that "We did hold back quite a bit from this story" and then later goes on to explain the reason the companies joined ... "The law does provide that they can give access and a secret surveillance court can make them give access, but in a situation that you have a clandestine program and a very rich and powerful component ... They don't want to litigate this with Facebook, they don't want a chance of it leaking ... Facebook also being a highly regulated industry, having all kinds of issues with privacy and whatever else doesn't want to antagonize the government, so they negotiate it. Now Apple took .. 5 years .. I don't know what happened, but Microsoft joined in 2007 and Apple didn't do it until the end of 2012."

Unless the author, Gellman, exaggerated the story it is very clear that this is well beyond FISA court ordered surveillance.

If Page's & Zuckerberg's denials are somewhat truthful it means there is a compromise in the traffic streams themselves.
I suspect they wanted to get in very quickly, but I think it might have made more sense to send two guys to wait for him to come out of his house rather than send 12 to kick in his door. I have limits as to how far I can argue their point. It does seem somewhat excessive. But you never know the details.
The leaked slide with inter-continental bandwidths has to be off by many orders of magnitude, if it's intended to be total bandwidth (this is the first infographic I found[1]; interestingly it's graphically the same as the one on the leaked slide).

Instead could it be describing intercepted bandwidth, leeching off of those pipes?

http://2.bp.blogspot.com/_F8MQ-8DbBQc/R7gSdBOntyI/AAAAAAAAAS...
It's really a nice tool to use with. It's as awesome as Alfred !!
The US was based on the ideas of a Constitutional Republic, not a Democracy.
Network dumps would seem unreasonably difficult to deal with considering that the provider has structured data and tools to deal with it.
> It sounds like this employee was not even aware that Google's "Transparency Report" specifically does not include the number of FISA orders that they have received

Are you concluding that from this statement?

> "I'm not sure what the details of this PRISM program are, but I can tell you that the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals -- things like search warrants. And we continue to stand firm against any attempts to do so broadly or without genuine, individualized suspicion, and publicize the results as much as possible in our Transparency Report."

He may be ignorant of that fact...however, that last statement, "as much as possible", would cover that. However, his assertion that "the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals" would still cover FISA, because FISA, as far as we know, is specifically for the targeted surveillance of individuals.

Moreover, FISA, as it applies to Americans, requires a court-approved warrant for that surveillance. So again, what the OP is claiming is non-contradictory, because FISA requests are both legal actions that target individuals that go through an approval process.

This is entirely different than what PRISM is alleged to be, which, well, we don't know exactly what it is, but involves the warrantless surveillance of Internet usage with the collaboration of Internet companies...currently, Google is outright denying being a part of that.

Some relevant links:
http://en.wikipedia.org/wiki/United_States_Foreign_Intellige...

http://www.huffingtonpost.com/2012/12/30/obama-fisa-warrantl...

Also worth noting, national security letters, which Google does oppose, are controversial because, among other things, they do not require a warrant. This is not the case with FISA and American citizens.
A more ethical group of prosecutors than we have (recruited, perhaps, among the sea pirates, slave traders, and drug kingpins of the world?), wouldn't make speculative statements about sentencing at all, much less to the media.
> Google has officially denied being a part of PRISM.

They have denied knowledge of the use of the word "PRISM" to describe anything that they are participating in. So, they've denied nothing in that regard. It just means PRISM is the NSA codename.
You are mistakenly inferring the wrong general principles from special cases that are well-known because they are exceptions to, rather than illustrations of, the generally-applicable rules.

The existence of these special cases demonstrates that a loss of the expectation privacy does not inherently occur when one entrusts another entity with some detail of their lives.

That expectation of privacy is created by the (well established at the time of the Constitution) common law lawyer/client privilege, it is not a generally applicable privilege that applies to commercial relationships and creates an expectation of privacy within those relationships. So, yes, there is an expectation of privacy here which has significance under the fourth amendment, but it is not one which extends to other business relationships like those between a telephone customer and their carrier.

The extent to which commercial relationships pervade our lives is, in my opinion, just cause to expand the boundaries of a reasonable expectation of privacy. The lack of transparency in how companies handle customer data, what data is retained, etc., especially for non-technical users, is further reason to codify clear rights to privacy instead of relying upon impenetrable common law precedent.
"Second, we provide user data to governments only in accordance with the law."

Would be much better if this were "only when required to by law".
And the Federal Reserve said there was no real estate bubble to worry about. And the banks were well capitalized.
> X server sends high level commands over the network and let the client render the requests.

AFAIK, that's not true most of the time nowadays, since most toolkits don't use X drawing primitives.
The app icon's a little creepy.
42...The universe and its ultimate fate, and our end.
And it's not like private sector jobs are necessarily much less repugnant... There are plenty of stories about Silicon Valley excesses, creepy big data projects, etc.
So imagine Larry Page or Mark Zuckerberg comes out and admits it. Do you think they end up in federal prison?
Tech companies, bristling, concede to government surveillance program
In this circumstance, police used to just detain the guy after he left for work, or after the whole family went out to eat. Very few houses are occupied 24 hours a day.

The problem with that policy was that police didn't get to shoot enough dogs.
> unreasonably difficult

All you have to do is read session cookies. Once you have that, you are done.
Pirate Bay cofounder accused of hacking Danish police database
Why is Snapchat better positioned to convert $100M into the next "mobile platform" than any other entity?
I was quoting and disagreeing with the grandparent comment...which I interpreted as implying that Google is a part of PRISM (which may actually be true, but that would be begging the question in this argument)...

But I do agree with the grandparent that PRISM, as described in the original Washington Post report and in the excerpted slides, do seem to allude to "an interface in which a NSA agent can access a subject's data at will"

Here's the Washington Post:

> There has been “continued exponential growth in tasking to Facebook and Skype,” according to the PRISM slides. With a few clicks and an affirmation that the subject is believed to be engaged in terrorism, espionage or nuclear proliferation, an analyst obtains full access to Facebook’s “extensive search and surveillance capabilities against the variety of online social networking services.”

http://www.washingtonpost.com/investigations/us-intelligence...
I find it fascinating that Matt Cutts didn't bother to address any of this in his defense of Google. Obama and James Clapper have both admitted to what is obviously Prism, a large scale spying program targeting Internet users and their data.

It rather makes it clear that Google is participating in espionage programs for the NSA. Supposedly, maybe, it isn't directed at Americans (har har).
the majority will stay using Facebook and Google, because they have advanced technology, they have worked hard to make the user experience mush better, and they give all of that for FREE. I believe that 80% of people don't care if some agency see what they do, because they don't do much, and they seek for the cheapest method to stay entertained.
For Google, it's obvious that it's leading the search technology on the internet, and a such leak won't make it stop spying on users, but for Facebook, and even its huge base of users, this leak can make it change its privacy policy if and only if it is threatened by a new social network (it's not easy but possible), it's a matter of money, people search for the cheapest and the better technology.
the rest of population which is 20% for me is the people who believe in the right of privacy and they are ready to make some sacrifices (pay money, or use less-tech encrypting methods).
in general, I think people will accept that by time, because if someone have the intention to be private he can, but if he just want to talk with his family, this is not important, and any agency haven't interest to spy on that.
Obama has acknowledged that federal law allows FedGov to obtain emails of non-citizens without a search warrant but through a court-overseen process. This is part of a 2008 law that we all know (if you've been paying attention) does this.

The president has not, however, confirmed that the news reports about "PRISM" are accurate. All he's done is summarized the law.
Says google
Good point. So you know how there are Ghost Writers? Would be a good idea to use a Ghost CEO? Someone tall and masculine with a deep voice that just sort of pretends to be CEO while the real one pretends to be his assistant but really runs the show? In all seriousness I think such a strategy would work out quite well.
Which statement are you referring to? I'm referring to the one that Larry Page issued this afternoon:

http://googleblog.blogspot.com/2013/06/what.html

> First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.

Is "any program" not broad enough?
Conceivably they could build out the address book/friends list features to create a persistent profile, and then all the other media content is temporary.
Essentially complete metadata is required for outsourced billing. AMDOCS openly acknowledges that they provide outsourced billing to a slew of major telcos across the world. Many of us have experience that this even occurs outside of the physical premises of the telco ("hosted billing"). That much I know to be true, but you are welcome to draw your own conclusions or remain skeptical.

The NSA interception thing is an additional concern, but given the European Parliament report in to Echelon from 2001, William Binney's recent reports from within the upper management of the NSA, the magnitude of their (black) budget, recent confirmatory comments by other LE parties, and the sheer magnitude of independently verifiable NSA construction projects in progress, it must be difficult to maintain much skepticism there.
https://www.eff.org/deeplinks/2011/10/victory-google-surrend...

http://mashable.com/2011/10/19/google-to-support-pseudonyms&...;
I had the same problem just now, when I clicked the download link. I went back and clicked it again and it worked fine the second time.
For a hopeful infinite and eternal, see the book: The Last Three Minutes: Conjectures About The Ultimate Fate Of The Universe, http://www.amazon.com/dp/0465038514,

Some free excerpt: http://www.questia.com/library/98211062/the-last-three-minut...
Both of you are correct. The Patriot Act Section 215 amended the FISA statutes.
TCP/IP is peer to peer, and IRC is built on top of TCP/IP. Maybe I'm just misunderstanding your proposal, but it seems like what you want to do is what we already have.
This denial is a lot stronger than Page's, which was full of weasel words. Unless Zunger is just lying, which somehow seems unlikely (forgive my naiveté), it'll be interesting to know how PRISM actually works. But I will say that his faith in his company sounds misplaced, since Google's more official denials are so weak.

edit: clarity
Yes there is an application for it.
http://colingourlay.github.io/deny-prism/?company=MyCompany....
The top couple of posts on Hacker News are about PRISM right now. On each post the first comment is about how similar the responses of each company are. It's almost as if there is a conspiracy to be conspiracy nuts on Hacker News.
I've worked with various privacy consulting groups on DLP and other security issues a lot. I can vouch for Minnesota Privacy Consultants and Navigate LLC as firms with a solid technical understanding.

The former works with some of the largest healthcare companies, and the latter is involved in the tech sector including network and encryption security companies like CipherCloud.
For example, consider this blog post: http://www.scottaaronson.com/blog/?p=63

Now ask yourself: how on Earth did the author consider the information about Turing's persecution relevant to the subject at hand?
2048 bits! Woohoo!
You could consider Codea: http://twolivesleft.com/Codea
Or the govt believes the program exists when it really doesn't ;)

and don't tell me that hasn't happened before.
His comments are actually the most insightful points I've seen about the discussion regarding PRISM:

I have my own suspicions -- which I won't go into here -- about what PRISM was actually about. I'll just say that there are ways to intercept people's Google, Facebook, etc., traffic in bulk without sticking any moles into the org -- or directly tapping their lines. You may find some interesting hints in the leaked PRISM slides [1], especially the second and fourth ones shown there. The subtleties of phrasing are important, I suspect, not because they were trying to be elliptical but because they reveal what was obvious to the people who were giving that presentation.

And like I said, I have both some reason to believe that there aren't such devices inside Google, and that the PRISM slides are actually talking about a somewhat different kind of data collection -- one that's done from outside the companies.﻿

Any ideas what he could be thinking?

1. http://www.washingtonpost.com/wp-srv/special/politics/prism-...
A trap about PHP random number
This is retarded. An 'RM' campaign as they call it, the way they are doing it, would be worthless on Reddit. It's a website made up of millions of users. /r/gaming has 3,244,936 subscribers as of writing this. A few guys sitting in a room down voting stuff, like the anonymous source claims to have seen, would be like a few guys standing in a river trying to form a damn.

And the people at Microsoft aren't utterly stupid. Why would they hire such an amateur PR firm that was so flippant with campaigns to manipulate other websites.

This entire article is laughably ridiculous.
I can't tell you want to believe, but maybe a place to start is: the world is a confusing place, full of miscommunication and gray areas. Why should we expect the world to be as it is in the movies, in which bad guys are obviously bad and that there is an "ending" in which things are clear?

For starters, I just re-skimmed the Washington Post report and noticed that it has since been amended:

> It is possible that the conflict between the PRISM slides and the company spokesmen is the result of imprecision on the part of the NSA author. In another classified report obtained by The Post, the arrangement is described as allowing “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” rather than directly to company servers.

edit: Here's the link: http://www.washingtonpost.com/investigations/us-intelligence...

I think I'm wrong that that was one of the actual changes since yesterday...either way, the Post is allowing for the possibility of a miscommunication/misinterpretation by its source. Business Insider also alleges of other hedging by the WaPo here: http://www.businessinsider.com/washington-post-updates-spyin...

At this moment in time, we still do not know two things: who the leaker is, beyond a "career intelligence officer" and the contents of this 41-slide presentation other than the 3 or 4 slides that the Post and the Guardian have published. The identity or motives of the leaker isn't necessary to know, but it's kind of problematic when we are missing context to the so-far published slides that explain the PRISM program. For example, it kind of changes things if the first two slides say "PROPOSAL" or the last slide says "APRIL FOOLS"
I must be doing something wrong but I can't see how to select an element or button by the letter over it's highlight. Ctrl+Letter doesn't do anything for me. From the README, that seemed to be the way to do it?