skysight-inc/HackerNews huggingface dataset:
Exactly. Even at the lowest transaction volumes MtGox charges 0.6%, so the operator can capture 15bps in each direction.

That said, customers still face risk that the operator could use the deposits for expenses, or for dividends. I'm reminded of Full Tilt Poker, where customers were told their funds were in segregated accounts, but the funds had actually been given to the directors.

The issue was undetectable until outflows outpaced inflows and the music stopped.
That's exactly how I operate Bridgewalker (I'm the founder). Everything is fully hedged, I'm not taking a gamble on the exchange rate.
The government is trying to label just about everybody as a terrorist or suspected terrorist and using this hyped up fear of terrorism to justify a growing police state.
Yeah, and before that was communists. I wonder what's next.
Ok, so the main part is that it is open source, and presumably one can inspect the code and compile it for one's self.

If so, then any government/military/intelligence concerns become irrelevant. Right?
That is the nature of disruption - it starts with imagining something contrary to the conventional wisdom. Anyway, there's no need to boycotte them, just let them live with latency in exchange for privacy. After all, the past dozen years have shown that US customers don't yet place much value on privacy.

Incidentally, the scale for disrupting the US's state sponsored dominance of the internet could readily be implemented at the state sponsored level in another country, and claims and disputes over access to markets made at the WTO level.

Among the BRIC's, Brazil and India are particularly well placed - neither has a massive security apparatus. Mexico by proximity is also positioned to serve the US from "offshore."
So for all of the conspiracy theorists out there. Ask yourself this. Why would a company who is actively colluding with the government fight over a prolonged period of time w/ that same gov to disclose how many requests for user data the gov makes?
If I understand it right, it doesn't offer deniability.

If you want a system with encryption and deniability, try Bitmessage.

https://bitmessage.org
Obviously. But the USA and Germany are light years apart on questions of user privacy.
I am a "victim" of nothing... yet.
Love in the time of surveillance: How to easily fix the surveillance state
Big deal. So we'll start getting the updates from IBM instead.

http://www.ibm.com/developerworks/java/jdk/dst/jtzu.html
Take a look at http://bower.io while you are at it.
Here's a section that seemed important to me:

One official likened the NSA's collection authority to a van full of sealed boxes that are delivered to the agency. A court order, similar to the one revealed by the Guardian, permits the transfer of custody of the "boxes." But the NSA needs something else, a specific purpose or investigation, in order to open a particular box. The chairman of the Senate intelligence committee, Sen. Dianne Feinstein, said the standard was "a reasonable, articulatable" suspicion, but did not go into details.

Legally, the government can ask companies for some of these records under a provision of the PATRIOT Act called the "business records provision." Initially, it did so without court cognizance. Now, the FISC signs off on every request.

Armed with what amounts to a rubber stamp court order, however, the NSA can collect and store trillions of bytes of electromagnetic detritus shaken off by American citizens. In the government's eyes, the data is simply moving from one place to another. It does not become, in the government's eyes, relevant or protected in any way unless and until it is subject to analysis. Analysis requires that second order.

So, the govt and NSA distinguish between 'having the data' (receiving a van full of boxes, in the metaphor above) and 'subjecting the data to analysis' (opening a box, in the metaphor). They have a broad order for having the data, but need more specific sign-off to process or analyse the data.

This differentiation between 'having data' and 'analysing data' is not one we'd generally make in the IT world - because if they already have the boxes in their possession, how do we know they are getting the right permission before they open the boxes? How is any oversight possible in that situation?
Honest question: What's the value of this service? It seems you seem to suffer with any volatility: the exchange rates would be a constant drain on your net worth. Without any volatility, the service basically does nothing.

There doesn't seem to be any benefit, other than maintaining a minimum or maximum balance on your account. Perhaps this is useful for merchants who want to accept BTC without the risk of holding an excessive amount of BTC. Hmm. I might have just answered my own question.
If I was the CIA/NSA I would definitely force Intel/AMDs hand to put a kill switch on the chip. That way if I was waging war with country, I first broadcast a special signal killing off all the CPUs I can. Then we launch our attack.

The kill switch could be anything:

1. Some particular frequency that causes the CPU to malfunction deliberately. Just a 1 bit malfunction is enough.
2. Something delivered via an OS update patch.
I have no optimism over the matter. I just believe in change. That your comparison of the US is to China, suggests how ripe the world of online services is for disruption - less oppressive than China is damnation by faint praise.
Just watched it. That's a hell of a movie. Thx for posting.
Good to know- I didn't know. Thanks.
It's based on freely available data in the first place, and I'm sure an Open Source option will pop up to replace it.

If it's truly "mission critical", then I don't see what's wrong with paying for the service.

Call me crazy, but I don't see this as being a big deal.

$0.02 (CDN)
Fuzzy Puzzles- Having My Baby
"the Internet outside the US is under heavy surveillance too, think of China and the Arabic world"

This is where a tragic lack of foresight comes in. In 40 years China will be the world's dominant nation. Do we want to be in that transition setting a good example or a bad example? Do we want to be setting high standards for restraint, privacy, and individual freedom, or do we want to be seen grabbing every privilege and advantage right to the bitter end?
Instagrad tackles student loan debt with crowdfunding platform for college
Is the Windows 8.1 Blue Update going to ship on August 1st?
Alvin Toffler already talked about this possibility in his 1993 book Future Wars
http://www.amazon.com/Future-Wars-Worlds-Dangerous-Flashpoin...;
Tor is funded (as in today, currently) by the US Government.
US surveillance revelations deepen European fears
...in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

There is a very simple reason why that is a marketing point, and any of those vendors would have been happy to expand on it, and probably do on their websites. That reason is that compliance with German law requires certification that all steps you take with data comply with German law, which is much easier to do with a vendor which exists in a jurisdiction that has similar data privacy laws, and is easiest if that vendor is German.

For a random example, see http://www.perspecsys.com/how-we-help/cloud-data-privacy/ger....

Now before you cheer Germany for this stance, stop and think. Normally HN is very supportive of anything that reduces red tape barriers to small startups trying to innovate. The kind of regulations that we're talking about both protect users, and make life a lot harder for startups.
Never Change What You Stand For
The WashPo has backed away [1] from the key claim of tech companies "knowingly" participating in PRISM. In addition, there's this paragraph that was added to the article after publication on page 2:

It is possible that the conflict between the PRISM slides and the company
spokesmen is the result of imprecision on the part of the NSA author.
In another classified report obtained by The Post, the arrangement
is described as allowing “collection managers [to send] content
tasking instructions directly to equipment installed at company-
controlled locations,” rather than directly to company servers.

I don't think slide 2 is relevant, though. The whole deck sounds like a presentation to senior govt officials who are not tech savvy at all, and is just introductory slide that reminds the audience, "The Internet is big and lots of the data flows through the US where we have legal powers." However, there are likely many more slides that were not been disclosed.

Fair point about the drop box denial.

[1] http://thenextweb.com/us/2013/06/07/wapost-backtracks-on-cla...;
I doubt this is really an issue. Maybe some knee jerk anti-American types might spew nonsense like this but Europeans with a little more sense and insight and who actually care about this stuff are well aware that:

1. By law all European telecom providers, including ISPs, are required to provide a backdoor for everything that goes on on their networks (the infamous Data Retention Directive)

and

2. All European security agencies cooperate quite willingly with their American counterparts. Some more so than others (the ones from the former Eastern Block are particularly notorious in this regard) so if an American three letter agency wants your data, it'll get it.
Interesting facts but third one wins.
1. Coffee is a psychoactive, which means high doses can make you see things….
2. Espresso in Italy is regulated by the government
3. This one takes the cake: In the ancient Arab culture there was only one way a woman could legally divorce: If her husband didn’t provide enough coffee.
Web Server packages for Raspberry Pi
There are technical papers on how to have anonymity preserved against questions to large data sets - read them.

The gist is that questions should only be possible about aggregate facts - virtually any question which can give fine grained information about the existence or facts of a single user with a high degree of accuracy can be used to strip away privacy.

Further, there's only so much privacy a dataset has. This means that there's a limited number of questions you can ask it and still expect people to maintain reasonable privacy. (Has a technical meaning in papers.)

So my advice on what to do now is simple: design your database such that it scrambles user data when it's entered in a way that horribly mangles questions about individuals, but preserves the distribution, hence answers about aggregate facts. (If you're looking at disease rates or similar, this should be sufficient.)

If this isn't possible, why not just ask people for private information? People are often willing to share, at least for a good cause.

The key point of all of this is that privacy in a data set must be regarded as a commodity: once it's used up, you have to move on to a new data set or you've given up all the privacy of your users. (Once the threshold is crossed, privacy is rapidly lost against malicious questions.)

Looking towards the future, some kind of holomorphic encryption scheme on the data set, effectively only allowing you to ask certain questions without destroying the data, and enforcing such policy at a technical level (unless you can manage to decrypt the data/sign your own programs/etc).
This might not be a problem, see discussion here: https://news.ycombinator.com/item?id=5845014
I noticed a pattern/relationship with squares and thought I'd share.
It's hard to comment speculations.

But fortunately, even if what you're saying was true you're still safe! Endpoint alone can't tell much about the origin of the connection :)
I cannot read it on this site, readable version on cryptome:

http://cryptome.org/2013/06/dhs-prism.pdf
I never understood why the system-wide timezone database, at least on UNIX-like systems, wasn't used by Java. Why does Java need its own timezone database/database format? Why do I need to install new timezone databases on my Linux system that runs Java? Why can't the Olsen tzinfo files be installed on systems where the OS provider doesn't provide them?
Not to take away from the greater import of this, or the issues of legacy code, but as noted in the Slashdot discussion, Joda Time (http://joda-time.sourceforge.net/) is a good replacement for the official time stuff.
Lazy geeks automate just about everything
>Seems to be a very good reason why persuasion based around "constitutionality" is not a waste of time.

Perhaps, but it's not a very good reason to engage in an argument with someone making positive claims about "constitutionality" (e.g., rayiner).

Personally, I'm disinclined to participate in a lie merely in the hopes of yielding a favorable outcome, particularly when doing so cedes the fundamental point of my position. I am content to simply note the lie.
In practice, yes. In theory, Tor does not protect against a global passive adversary, so if you believe that there exists an entity capable of observing all traffic on the net globally, and you have reason to believe you are a high-enough-value target for them, then you should not use Tor.
Can you expand on why one should jailbreak? Any other jailbroken app suggestions? I was under the impression that jailbreaking also opened you up to be hacked and made the phone less secure.
If they're actually following the "correct" way to implement tor routing, wouldn't they still be unable to determine the source / destination? I suppose if they're being shady, though, they could either route only to other known nodes they control, they could still track the traffic.
Tor is currently (as in, today, 2013) funded by the US government.

This is a different problem than the original US Navy development.

Your threat analysis should include this fact.
Yes, if you compare fingerprints, then the important point is to authenticate both sender and content of the message. ‘Common Secret’ authentication as it is supported by OTR with Skype as the channel to negotiate that secret won’t be any good, nor will Skype text chat be sufficient to authenticate the sender of the message.

If it absolutely has to be remote, I’d go for a combined audio/videocall on Skype where one reads out the fingerprint and holds up a (ideally hand-written) sign with it – though I’d still prefer IRL-authentication (plus it’s more fun! :)), and ‘only authenticate keys in real life’ looks like a helpful rule-of-thumb to me.
Oracle changed the distribution terms of TZUpdater from free (as in beer) to available only to paying customers at least half a year ago.

It should be noted, though, that this largely affects only users that for some reason can't update their JRE and are lagging behind the latest version. Oracle still provides up-to-date versions of the TZ data with the latest JRE.

It's not a big issue since one could use IBM's TZ updater tool or compile the TZ data from the raw Olson TZ database using javazic.jar available from OpenJDK.
I'm curious what you believe about the Boston bombing and 9/11. Do you think the threat of Islamic terrorism is fabricated?

I'm also curious what you think about American communism. American communists were instrumental in getting the Soviet Union the Bomb, thereby bring the world to the brink of destruction. They also leaked information from the top levels of government during WWII, helping to deliver millions to the rule of Soviet tyranny. The domestic communist threat was very real. Sorry to quote myself, but: https://news.ycombinator.com/item?id=5843702
It depends on the industry. There is no risk if I try out a new search engine as a consumer. But, if I'm building a phone application, there's a huge risk if I build it on a weak platform.
4) Twitter has no non-public data stored of any significance (or such a small amount that it is easy to get a dump once and then just delta from taps) and the realtime data is coming from Gnip or an optical tap.
And how will the author boycott the NSA's cloud tech?
I don't think you can do more than just doing what you do. You can aware customers on the front-end that they arn't supposed to save any data on your system they are afraid of sharing. I can understand this is difficult from an ethical perspective but I think that as long as you arn't actually stealing data or participating in systems like PRISM you should just be fine.
Code, not laws.

Most foreign governments are just as bad, just with fewer resources and often with less explicit protections for privacy.

The ultimate solution would be to only use cloud servers which make verifiable technical claims about security and privacy to the level you require; otherwise, boycott the cloud.

I'm personally fine with Twitter as a publishing platform (and essentially treat my dm as "stuff which is too spammy for even an at reply".)

Facebook kind of skirts the line. It is really useful as both a way to get newsfeed updates and a messaging system. In the long run, I'd really need something like OTR to continue using messages.

My email is too private for me to want it on a cloud service without serious technical controls. No one offers this yet, so I self-host.

IM with OTR is ok for privacy, but sucks for traffic analysis still, and there are serious problems with OTR and mobile/multi client, still.

My password manager is too sensitive to live on public servers even with crypto, since I can't audit every single update to the package thoroughly enough. Same goes with "secure notes" (safe combos, etc). A belt and suspenders approach of both using crypto and maintaining access control on the file is about the best I can do so far; something like an HSM in the future.

Cellphones and voice (and presence/location) are the sacrifice I hate the most (along with finance, I guess). If I had a way to get analog one-way pager notifications of incoming messages and a wifi-tunneling tablet, I'd consider ditching cellphone entirely. This would be a moderately big deal to develop, though.

Ultimately anonymous ecash (chaumian blinded tokens or Zerocoin or something else) is the solution to financial privacy (probably not straight Bitcoin, since there will be a jihad against mixes, and without mixes, Bitcoin privacy is horrible.)
"but the truth of the matter is that the entire Western world owes the very foundation of its modern beliefs to the US Constitution, in my opinion."

What are those 'modern beliefs' then? Modern democracy, philosophy and human rights are not American products, but European, starting with ancient Greece, further expanded during the Renaissance and the reformations after the 2 world wars.

The fact that America is so young allowed them to choose from many of the time's political ideas. Saying what you said is like saying 'all smartphone users owe Samsung for the user experience, because they created the Galaxy S4'.
This is key - Tor's purpose is to help you be anonymous. It does not give you confidentiality; for this you need additional tools (such as SSL).
If you boycot US cloud, you surely will come into contact with it and therefore have your info stored by US tech companies. Ex. I live in Slovakia and I send an email from XYZ email service to someone who uses Gmail, does that not fall into the US cloud spider web?
> Steve Jobs

De mortuis nil nisi bonum dicendum est (“Of the dead nothing but good is to be said”)
You did say you thought Tor was suspected of being compromised.
PDF and TeX sources of this paper: https://svn.torproject.org/svn/projects/design-paper/tor-des...
Maybe it will force Google (and others) to at least add OTR and ZRTP to Hangouts (enabled by default), for chats and video, and "one-click" local encryption for Google drive, to make it easy for everyone to use storage encryption (it will probably need to use a plugin).

But even then this will only solve the chatting and storage problem (somewhat), but not the Gmail problem. Even with local encryption available as one-click, it seems very unlikely more than 1% of the users would use it, because they'd need to send the key to their friends, and that's just too cumbersome. And if only so few use it, then it's as good as useless, and Google still can't be fully trusted for e-mails (thanks to the US government).

What I'd like to see Google do now, is become very pro-active about this, and to implement measures like this to "give the privacy control back to the people". Then maybe, just maybe, I'll begin to trust Google again.

But I'm not holding my breath. I doubt it's illegal for them to do all of this, but especially if there's a legal grey area here to make it easy for their customers to encrypt stuff locally, I don't see them bothering to fight for this. The only way they might do it if there's a significant threat to their business, much like SOPA was.

That's why I'm hoping the theory put forward by the author will become reality, and this NSA story will hurt US companies' bottomlines badly, and their international relationships, because only then we'll have true competition in privacy.

It's also probably the only way to convince the government to stop doing it to this extent, because from what I've noticed they listen a lot more to money and lobbying than to citizen outrage.
Isn't the data encrypted? How can even another friend see what's within the encrypted data?

This makes it another reason to use Bitmessage instead.
Maybe that's why the giant communication company Huawei is pushing so hard to get into Canada.
Here in Denmark, use of Google services is extremely common, even in companies and universities. Lots of people are slowly migrating everything to Google Docs and Gmail, latency notwithstanding. There is some worry that this is de-facto watering down rules around things like privacy of student data, since that data is now ending up on services that don't implement European data-protection rules.

Gmail was disqualified from the bidding to provide a hosted email solution for the university I work at, for that reason, but Google services are nonetheless pretty widely used by individuals, even for official purposes. The contract eventually went to Microsoft's Office 365, which claims to comply with EU data-protection best practices (I believe the servers are also physically hosted in Europe): http://office.microsoft.com/en-us/business/office-365-trust-...

I would guess that the promise is not particularly solid if the U.S. government wants to siphon off data from Microsoft, though. In practice I think it does provide some protection, but mostly against commercial use of the data: Microsoft has contractually agreed to certain rules about data-mining and data-sharing that Google hasn't.
I agree never change what you stand for but to figure out what you stand for is lot harder than people think. People change, ideas change, law change and situations change. Things i stood for six years ago are different than things i stand for today.
And effectively becomes official in Java 8 (or rather, JSR-310 from the same creator does).
My understanding is that being single threaded and assuming that every operation will complete very quickly is how Redis sidesteps a lot of complexity around atomicity and transactions. This is probably why swap as an option was quickly removed.
Good to know Fastmail location for me, too. In recent weeks, I was considering Fastmail over Gmail and upon receiving the NSA news, I was more inclined to make the switch.
>I enjoy how your response is not to engage with any of Rayiner's actual arguments

True, though in precisely the same way his response was not to engage with any of Spooner's actual arguments. I am perfectly willing to yield every one of rayiner's positive claims; they only provide more fodder for the rejection of state legitimacy on normative grounds.
Is Prism going to harm US tech exports?