skysight-inc/HackerNews huggingface dataset:
Read these "Bugs, Caveats, Side Notes" published on the Onion Browser app's web site:

Major iOS SDK Limitation: Websites using HTML5 <video> tags will leak <video>-related DNS queries and data transfer outside of Tor. This includes YouTube, Vimeo, and any website using iOS-compatible HTML5 video. This is a behavior of the embedded QuickTime player and there is currently no known workaround. (h/t to josyw.)

iOS SDK Limitation: Javascript cannot be disabled in the `UIWebView`, so script-based detection may identify your device even if User-Agent Spoofing is enabled.
iOS SDK Limitation: Related to above, the HTML5 Geolocation API cannot be disabled. The browser will ask you for permission to access your location if a website asks for it via the HTML5 Geolocation API. If you allow this, then said website will (obviously) know your actual current location.

That doesn't sound remotely safe to me.
you can implement a rope as a 2-3 finger tree of string literals. i wrote a java implementation of 2-3 finger trees a few months ago and implemented both ropes of bytes and ropes of chars (rope backed by finger tree of java Strings here: https://github.com/jeffplaisance/fingertree/blob/master/src/...).
We don't distribute our apps on f-droid because we feel it's insecure, and because it doesn't provide the features we need to develop stable and secure software.

However, we are willing to distribute our apps outside of the Play Store, but we need the following things first:

* A built in crash reporting solution with a web interface that allows us to visualize crashes and sort by app version, device type, etc. This is essential for producing stable software.

* A built in statistics gathering solution with a web interface that allows us to visualize aggregate numbers on device type, android version, and carriers for our users. This has been crucial in shaping support and development direction.

* A built in auto-update solution. Fully automatic upgrades won't be possible outside of Play Store, but we at least need something that will annoy the hell out of users until they upgrade. This is necessary for ensuring that new security features and bug fixes can be propagated quickly.

* A build system that allows us to easily turn these features on and off for Play and non-Play builds. Gradle should make this easier.

If you're interested in seeing Open Whisper Systems apps distributed outside of the Play Store, we'd welcome your contributions.
The point of posting it multiple times is to make an attempt at unwinding some of the damage done by countless misreports.
I think that here the approach is very wise: every time you have a problem involving a big amount of data, Redis may be costly, since it stores data in memory. Sometimes this is unavoidable, for instance I may see Twitter switching from Redis to another in-memory store to cache timelines, but hardly to something using disk. So it is very legit to say, I'm running a number of hosts since my memory requirements are high, let's try a cheaper on disk solution.

However that said it is also true that memory starts to be seriously cheap, and the real limit may be to run stuff on EC2 or similar platforms.

So sometimes the cost of RAM is a virtual cost associated with the platform you are running your services in, compared to the actual cost of that amount of memory.
Not a big deal - blown out of proportion.

As one slashdotter put it:

"IBM provides free access to the Olson database updates:

http://www.ibm.com/developerworks/java/jdk/dst/jtzu.html

Was this post even necessary?"
Fortunately the same principles of physics and mathematics apply to both me and Google (and the #3 or #4 most powerful/smart organization, NSA). I trust science a lot more than I trust either every member of every organization to obey the law, or the law to remain both public and supportive of my interests.
This was my initial assumption, that Prism referred to fiber optic prisms that are used to duplicate data with zero interference.

These can be installed at the trunk level with virtually no one knowing about it (maybe a couple of on site managers). They can handle massive data and pipe it directly to the NSA. The problem of course is you're dealing with raw data which isn't nearly as easy to work with then if you had direct access to internals.

These are already installed on every major backbone so I also don't see why they would bother to involve anyone, so there must be more to it.

ps. It would be nice if another whistleblower came out with the data on optic splitters and how the NSA uses them.
> An attack on a root ca can no longer reveal keys useful in eavesdropping on key exchange, but it could reveal keys useful for carrying out a man in the middle attack

This is already the case - if you compromise a CA you can sign certificates for any domain you'd like, enabling you to pull off active MitM attacks, but you can't passively eavesdrop anything. Private keys are not registered with CAs; rather, public keys are submitted to get signed.

While the CA system majorly sucks, and needs to be fixed, I don't think it's the answer to mass surveillance, at least in the US. Even if the NSA could sign any certificate they wanted, it seems extremely difficult to pull off active MitM attacks for every connection across the entire Internet. An easier approach is to attack the endpoints (Google, Facebook, etc.) which they're allegedly already doing with PRISM. SSL/TLS can't protect against that.
Science isn't just some magical box that you press a button on and get definitive answers out of, it's a process. Sometimes it's frustrating to watch that process narrow in on answers, but that's the nature of discovery. So far as I know there's only ever been one serious claim for life on Mars (the Alan Hills Mars meteorite claim from the 90s).

What has been happening recently has been more and more evidence about the conditions of ancient Mars, especially in relation to the long-term presence of water. We've known for a long time that Mars has had liquid water on it in the past, what we haven't known is how much and for how long and under what conditions. We've known more recently that Mars still contains a substantial amount of sub-surface water ice over much of its area. And we've learned more recently that Mars appears to have had sufficient water to form long-lived lakes and rivers, long enough to allow the formation of both rounded river rocks and pebbles as well as conglomerate rocks made up of those but also hydrate minerals that can only form in conditions of near neutral pH and low salinity.

These are big discoveries, even though from a certain perspective they may seem like yet another "water on Mars!" story. These discoveries are painting a picture of ancient Mars that was not just occasionally wet or perhaps a hellscape Mars covered with brackish or boiling lakes but an almost familiar Mars with lakes and rivers that would be nearly drinkable for humans and that lasted millions of years at least. Certainly conditions that lots of Earth-bound life would find it quite easy to live in. And that provides the tantalizing hope that perhaps some form of life arose on Mars and survived for a time and perhaps lives still in some sheltered underground areas. It's not evidence or proof of life, it's the hint of a possibility. But again, that's the way science works. You narrow down possibilities and provide hints for further investigations.
NSA's Verizon surveillance: how the White House tramples our constitution
Sqlite-winrt (The SQLite WinRT wrapper)
Except that in the case of google they have said that they only do that on a person-by-person basis, and that PRISM is apparently a wholesale affair.

There just simply is no tie-in between google checkout and PRISM as the article alleges as far as I can see.
Source for a JavaScript compiler implemented in the D programming language:

https://github.com/DigitalMars/DMDScript
The problem with PGP is that friction is in every message you send. For every email you have to make the decision about encrypting the message and entering your passphrase. It's a hassle.

The reason I recommend Bitmessage is because after overcoming the friction of installing it, it's frictionless. You don't have to remember passphrases or anything. It also has advantages over PGP-encrypted email like deniability, built-in spam minimization, broadcast messages (like Twitter), chan boards, etc.
IT magazines/blogs
I'm looking to publish an article on the theme Security, Safety and Privacy. I am willing to write on any subject within this theme.

It's however my first time publishing any articles and I do not know how to get a publisher. I was hoping someone with experience could give some tips.

Any tips are greatly appreciated!
"Statements from the U.S. government that the monitoring was not aimed at U.S. citizens but only against persons outside the United States do not reassure me at all." I couldn't agree more. It's no fun when they state in such a clear way that we're second-class users, whose rights aren't so important after all.
It's actually not that trivial, if you really think about it.
Good timing, Coursera (Cryptography I course)
Newly published PRISM slide details collections methods
https://news.ycombinator.com/item?id=5843241
The Wearable, Implantable, Personalized Future of Medicine
Is there any reason why that approach wouldn't work on X? I read a few of the articles on it and seems like it could be implemented in X if somebody spent the time writing it.
Nope, according to a new tweet today by Glenn Greenwald (who broke the story): Allow me to quote from the NSA document we just published defining PRISM: "COLLECTION DIRECTLY FROM THE SERVERS"

https://twitter.com/ggreenwald/status/343421926057861121
I wish one of these networks would take off, be it GNUnet, OneSwarm, I2P, freenet or any other, I don't care.

The thing is, performance must be at least decent if the authors of these protocols want people to start using them.
Never Eat Alone mashup
Home Depot sells shovels.

Sometimes bad guys kill people and use the shovels from Home Depot to bury the bodies.

There was this really great Zombie movie from 1985, Return of the Living Dead, that took place in a funeral home. I'm not going to give any spoilers, but you really need to see it.

Shovels mean something else in light of this discovery. Sorry Home Depot, I think your shovels have been co-opted.
The whole hierarchy of SpiderMonkey strings is laid out in this comment in the code:

http://mxr.mozilla.org/mozilla-central/source/js/src/vm/Stri...
For the desktop:

- Tor

- Bitmessage

Bitmessage is specially interesting because it's not only encrypted and private, it actually solves the problem of spam and offers 3 kinds of messaging under the same interface: email-like, broadcast messages ala Twitter and chan boards.
>What's funny is only China was smart enough to keep Sillicon Valley surveillance out of their country. Though it was only because they wanted to control the surveilance themselves.

I wouldn't call it "only".

That's a very important distinction.

It means that on the internet, they can be a (more) sovereign state -- not depended on third countries for their internet services and life.
By US clouds, it's meant "clouds owned/run by US companies". Most of them have datacenters in Europe.
For the desktop: Tor and Bitmessage.
No, I wouldn't. And I would publicize the fact that I was asked to. It's easy to pretend that you should just go along with something because someone else will take over anyway, but nothing will ever happen if no one stands up and refuses.
http://www.tonido.com/blog/index.php/2008/12/21/cloud-comput...

http://www.tonido.com/blog/index.php/2010/06/19/pioneering-p...

The articles in this blog are few years old. But makes much more sense in current context.
That's what the leak said [1]. Are they not supposed to report it? I'd rather they did, made a big wave about it, and then we can find out if it's really true, or the slide is fabricated or whatever (seems unlikely).

[1] http://static.guim.co.uk/sys-images/Guardian/Pix/pictures/20...
i2p is quite decent. torrents often exceed 100 kilobytes/s which to me IS fast for lazy downloads.

ajax probably won't ever be fun but I could not care less about that. :D
You can donate through Flattr, too: https://flattr.com/profile/EFF
Well done guys! Quite an achievement turning a site for so-called smart people into one dumber than the Drudge Report in only two days.
Dao: Otionally typed, concurrent, portable language for scripting and computing
I don't want to start a flame war with you, but in lieu of repeating what others have already said to you regarding the "direct access" quote (I'm not "hanging on" btw, I have read the other reports as well), I'll just leave this here.

https://news.ycombinator.com/item?id=5836420
You can boycott traveling to the US, what a lot of people are doing because they don't want a pat-down.
Filedrop for iOS Makes Sharing Files Easy
A brief summary:

* Nowadays, we have the concept of interfaces to achieve modularity and local reasoning

* Liskov's initial contribution: partition global variables, require functions to only use variables in their partition or call functions in other partitions.

* Use data abstraction as a methodology (later on, use object orientation as the target of that methodology)

* She created CLU to communicate some of these abstractions to programmers: 1. Procedures are attached to types, not objects, 2. Parametric polymorphism: if quantification is needed, use structural subtyping, essentially, 3. For loops: use iterators with state stored on the stack (generators)

* When looking at object orientation in this context, she found that inheritance was widely used, both for interface/implementation and for type hierarchies. In both cases, semantics are important, even if two objects implement the same methods by name/types. Came up with Liskov substitution principle.

* Trends today: one of the issues with e.g. Java, C# is that they're not great for beginners who are forced to work around crufty abstractions (public static void main) without having the experience to know how to generally use those abstractions. On the other hand, Python is great for beginners but (according to Liskov) doesn't have great data abstraction for large-scale software engineering.

* Some perceived tradeoffs in a language that is good for both beginners and experts: 1. Ease of use vs expressive power, 2. Readability vs writeability (Liskov is worried about too much focus on the latter), 3. Modularity and abstraction, 4. Powerful abstraction matters, 5. State matters (see below)

* Finally, for massively parallel computers: how to do programming methodology?

That's what I thought to write down. I also thought to take a more precise transcript of her comments on Haskell:

> My final thing, which is in some sense aimed at Haskell, is that state matters. So, mostly computer programs are about managing state. And, although I am very sympathetic with the desire to keep most of your program immutable, because it's much easier to reason about correctness if you aren't doing modifications, a major part of your program is going to be concerned with state, and it has to be done in a simple way. It can't be complicated, it can't be hard to understand.

State is one of the most important (and sometimes annoying) things you deal with in Haskell when writing large programs. However, is it really better to sweep it under the rug and muddy semantics in the name of simplicity? One might merely just be pushing essential complexity to where it is harder to reason about.
Nobody said they have access to Google servers. We are worried about what data google to sending them (by whatever means).
U.S. and China Pledge New Model of Cooperation
This is why they throw out all of this. They know a certain amount of people will just have to disassociate with the situation. I just assume it is happening. I think there are other ways we can help foster a safe environment though, without all of these controls and spying.
He never claimed you weren't entitled to any privacy. Have you even read or seen his original words?

Would you like Larry Page to detail this for you? or Matt Cutts? Who will you believe?
21st Century Problems are statistical, not deterministic like radio, flight
This place turned into r/conspiracy.
Apparently neither Eric Schmidt nor the Cheif Legal counsel for Google have sufficient security clearance to know whether or not they're involved in Prism.
Hey Eric! How's the Bilderberg conference going? Is the food good? Have you guys picked the next president yet?
The problem is "access to private data" as and when required. The problem is NOT "back door access" or any other such term whatever the hell it means. I see carefully worded statements by Internet firms without any evidence.
Why the NSA Prism Program Could Kill U.S. Tech Companies
If I take out a warrant against someone, and they then deliver the data on that person from the servers at Google rather than the user's device, what would you call it?

I would call it 'directly from the servers'. It's likely used to distinguish client vs server side. Not the actual technical mechanism.
Drummond and Page said

Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

Now that could conceivably be a bald lie - or I suppose they could just conceivably have lost awareness of what their FISA/NSL/warrant-handling lawyers were approving, to a spectacular extent - but otherwise they aren't handling any Verizon-scale FISA warrants. However, you're right: there's a big grey area between Verizon-scale "megawarrants" and the "specific orders about individuals" the tech companies say they process. NYT said "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms" while the tech companies largely reasserted that they only process "specific orders about individuals". It seems that only one source can be accurate here.

BTW I assume that Verizon wasn't really just forced into handing over all its metadata: there was probably a bit of a gentleman's agreement in the government producing an omnibus FISA order and Verizon agreeing not to contest its legality. Everyone spends less time processing FISA orders, the government gets all the metadata it wants, and Verizon gets a sicknote to cover it legally.
There are two axis that seem to matter, by my way of thinking, whether this business is conducted via carrier pigeons or fiber optic cables.

1. What is the process.

What requests come from the government. What government entities make those requests. What entities within the internet companies process those requests. What parts of the request handling are done by humans with decision-making authority vs what parts are handled by machines or by humans following a rigid script. In either case, what policy drives those decisions. What proportion of the requested information is given or denied.

2. What is the speed and scale of the process

How quickly are these requests fulfilled. How much data comes back from a request. What proportion of this data is relevant to the target and the investigation vs “incidental”. How many requests are there per month or per year. How much data is gathered per month or per year.

Side-issues not covered above:

Is the access “direct”. Is there a “back door”. Is access given to “servers”. Is access given to a “network”. Is there a “beam splitter”. Is the government provided with a private or secret “key”.

There are many ways to construct such a system, and there are many ways to describe it (nevermind flat-out lie about it) by carefully parsing these side-issues. What matters is not the implementation details but the effect.
It's not out of faith in Google or Facebook, it's that they have put up a reasonably testable defense rather than what they could've done, which is to remain mostly silent. Moreover, the very size and complexity that most people distrust them for also means that their cooperation with any government function is going to involve a lot of moving parts...it's not likely to be the case that Zuckerberg can lie about something and be sure that those involved all stick to the script.

So given that, I think it's worthwhile to actually test their assertion (I.e. not rush to judgment) rather than patting ourselves on the back with the logical fallacies of:

* "Well, the reports about Facebook and Google must be true because it comes from a group that is itself evil and who I would normally not believe" (the enemy of my enemy is my friend)

* "Well, what else would you expect an obviously evil entity to say after being accused of evil acts?" (circular reasoning).

Again, it's not because Google and Facebook are poor disenfranchised groups that must be sympathized with, but because it feels a little dishonest to subject them to the same kind of inescapable logical trap that our government has used to go after and prosecute suspected enemies of the state

Just out of curiosity...can you really not imagine a less transparent corporation than either Google or Facebook?
ObjP: Python - Objective-C Bridge via Code Generation
"It's not as described in the histrionics in the Washington Post or the
Guardian," the person said. "None of it's true. It's a very formalized
legal process that companies are obliged to do."

Please, please can we know about this "formalized legal process"?
Help Reach Goal: SunWater - Affordable Solar Powered Pumps for Poor Farmers
Whether you trust Eric or not has zero to do with if you trust CNet's claim that "The National Security Agency has not obtained direct access to the systems of Apple, Google, Facebook, and other major Internet companies, CNET has learned."

Inferring he is no longer CEO and might not know about these matters is just an informal fallacy and has zero to do with whether or not Google, Facebook, etc. is telling the truth on the matter. FWIW, I believe them when they say they aren't giving direct access to their servers to the government. That doesn't mean they aren't, and I'm willing to listen to any substantial claims that they are.

I don't trust the government to always do the right thing when poking around in our business, but I'm also not going to run around like a chicken with my head cut off when everyone gets their underwear in a knot over leaks like these.
Party like its 1999!

http://www.heise.de/tp/artikel/5/5263/1.html
If I'd want to keep $20 worth of bitcoins (or gold or dog poop) - I'd just keep $20 stashed away and when ready - would buy the beloved security at it's current market rate.

Why would I need extra middleman's service for that until actually ready to convert dollars to commodity?
The U.S. is awesome. I bet there is literally a handful of countries your average HN-er would rather live in than the U.S., and before the economic liberalization of Europe in the 1990's, it was probably less than that. Our prosperity has been supported by an incredibly stable government, one that is, 224 years after its founding, freer than it ever has been (read up on the Alien and Sedition Acts).

It's easy to take what we have for granted, but it's important to maintain perspective. The cause of the republic is not served by those who declare it hopelessly broken and disengage. In the light of historical perspective, you realize that there have been many times in the past when the government was more corrupt than it is now, when society was less free than it is now, and that's a liberating thought because it means that the trend of government does not point inevitably towards corruption and repression.
"broke the story" is a very generous description of the original, sensationalistic, poorly supported, hype bait (the powerpoint article).