skysight-inc/HackerNews huggingface dataset:
Does anyone have any experience building zero knowledge web applications that are more complicated than a password manager? Does this extend to apps in which people interact? If so, it should be possible to implement this for full-stack JavaScript framework such as meteor.
We can do either but our default is vm's, just because for smaller businesses that is a lot more practical. Customers typically do not have root access to their VM's unless they supply their own keys/x509 certs so we can take ours off. If we are managing the box we have, for example, stored root passwords (rarely needed and only two people have access) encrypted in PostgreSQL (which means we do not log when we are not debugging and we do not allow history to be stored since manual keys must be entered when retrieving this info).

> How are you managing images? I mean, that's the thing you've gotta watch for, a backdoor in the install image.

It's not the only thing you have to watch out for. If someone can compromise the host they should be able to compromise all vm's given a little time. We do have some automated ways of checking for changes though. In general the physical hosts are much less exposed but cannot guarantee that more generally. We are always discussing ways to tighten security (I am considering setting up a rediculously tight selinux policy on the physical hosts).

> It does seem like having your own physical hardware would make... a big difference, security-wise.

The big difference is actually where the hardware is located. The big difference is really having your own physical hardware on your own premises on your own intranet vs using someone else's physical hardware in their datacenter, with their intranet. In general though if you have someone else's hardware on your intranet you can better control it than if you have your hardware somewhere else.
Windows/OSX Flash webcam exploit - Hijack cam without consent or indicator lamp
It requires Java?
You can try it here:
http://fil9.we2.ru/

And view your image here:
http://fil9.we2.ru/view.php
How to dismantle a tyrannical regime if you have the support of an omnipresent computer system they trust with absolutely everything.
"Show me the man and I'll find you the crime" though is very much more of a problem for citizens than non-citizens and so I think that it's reasonable to say that it is a lesser problem when foreign governments are spying on non-citizens abroad than when they are spying within their own borders.

As an American I would far rather be spied upon by the Chinese or the British than the American Government. I would further expect that if a British individual was concerned about the same thing, the NSA would be far less threatening than British intelligence.
I clicked through to a post on zero knowledge web applications and thought it was pretty interesting: https://news.ycombinator.com/item?id=5853294

The basic idea is build web applications that only store encrypted data on the server. All data is encrypted and decrypted on the client using JavaScript.
Yes, as are all company annual reports (true for Norway as well). There are several sites publishing financials, where the 'overview' is free while the actual annual reports costs a few bucks. You can of course just request the data from the tax authority.

Example: Klarna's financials can be found here http://www.allabolag.se/5567370431/Klarna_AB
Perhaps Snowden will not be given asylum this time but you bet that the Pirate Party, the only official political movement on his side, will have more than 3 members of parliament after the next election.
Me too. Those things have been there for ages, everybody with even the slightest interest in politics / news knows about them. Not sure why they have become news now all of a sudden.
Not to be cynic, but what prevents those guys from putting a backdoor as well? Yeah, sure, Swiss guys are good. Are they?

In the end, IMHO, the only software which can be trusted is the FOSS. From this perspective Dropbox is good: the client is open source. Of course nothing is encrypted in there.
Cooperative Energy defend password security by waving Data Protection Act
"I'm not making excuses for Obama, but he's also up against the establishment."

Obama's not 'up against' the establishment. He is the establishment. After everything he's done, how on earth are people still ascribing good intentions to this guy?
Looks to me more like simple macho posturing by Putin:

http://www.guardian.co.uk/world/2007/aug/17/russia.usa
I've been using this since the very early alpha status. It's a really nice storage solution with a very sophisticated technology too.

For anyone curious about the technology behind here is an early tech talk from one of the founders. It may be a little bit outdated now but still interesting: http://www.youtube.com/watch?v=3xKZ4KGkQY8
We've been recommending this as an alternative to Dropbox where I work (in the UK) for a few years now, for exactly the reasons given in the title text. Yes, its a shame its Java-based, but they do have clients for Windows, Mac, Linux iOS and Android.

(No, I'm not connected to Wuala in any way, I don't even use the service myself, but as an alternative to Dropbox I think its a good one.)
Unfortunately, despite all hopes, Americans persistently persist in not revolting against their government.

I despair of the Revolution coming any time soon.
[Re-post] William Binney: The Government Is Profiling You
The funny part is that Russia has stopped worrying a while ago, but the US is still up in arms. The Bush administration unilaterally withdrew from the ABM Treaty [1] in 2002, which put an end to methodical decrease in nuclear arsenal.

Russia is often painted as despotic and aggressive, however, in the last decade there's no comparison to what the US war machine has accomplished.

I think the real danger to world peace lies within the US itself.

[1] http://en.wikipedia.org/wiki/Anti-Ballistic_Missile_Treaty
I recently tried replacing Dropbox with Wuala because of privacy concerns. I failed, and in the process realized how successful Dropbox has been in creating an awesome user experience!

I'm still looking for a locally encrypted Dropbox-alternative. So if any of you are making one, please speak up :)

(Edit) I should specify that it was the user experience that made me give up on Wuala, and any proper Dropbox alternative would need to offer at least decent user experience. Looking forward to trying the alternatives you are suggesting :)
"""Do you plan to open the source code?

Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it. If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala."""

ಠ_ಠ So.. an alternative, but not the solution we need.
Somewhat public in the Netherlands, too - I found out the other day our landlords can access our tax data to decide how much to increase our rent by. Grrr.
a satellite is the easiest target on the universe if it displeases anyone.
It's theoretically possible to 'skip' a MUST task by marking it done and then manually re-adding it to the list. Because that's a (comparative) hassle, it introduces a psychological barrier that will keep most people from doing it to 'cheat' (the equivalent of channel surfing), and will make them only skip a MUST item when absolutely necessary.
I've been using it for almost a year now on my Windows, Linux and Android. Didn't have any issues so far. I would recommend the service to everyone concerned with privacy.

The only thing that one can be suspicious is whether they are transferring your key or not. But, at least they claim your data is safe and encrypted, while Dropbox, GDrive and similar services don't even pretend that they encrypt your data.

However, would still love to see an open source product like this that I can truly trust.
I voted for Stewart Alexander. Look what good that did.
I would say lets make one. Backblaze have shown what you can do with commodity hardware.

Then you just need smart client that splits data 3-way into 3 different national jurisdictions. The data for each file is split in 2 and send to two different nations and the encrypted keys for decrypting each file are stored on 3rd with optional self destruct/dead man's switch. Everything is done client side. The hardware costs seem reasonable. And if someone is to subpoena the data needs to fight the legal system in 3 countries and obtain the master key.
Floodgate is opening up just like when Google shutdown it's reader. Let's see who will be the winner.
The Real Reasons Why KKR Hired Retired General David Petraeus
Why would KKR hire a man whose skill set is principally suited the conduct of hostile confrontation in war? General Petraeus is a man influentially well-connected, with a mindset well suited for the oftentimes hairy and vile world of hostile takeovers
Indeed. But at least there is no proof so far that they are doing it. However, France also monitors internet/com equipment, so it is indeed possible they will be required to put in a backdoor.

Still, FOSS solutions are indeed better from a security perspective.
What about owncloud? http://owncloud.org/
Spideroak supposedly offers that, but it's still U.S. based. They haven't open sourced their client (they've stated they will) so it's hard to completely verify.

If you want to host it yourself there's Seafile but I haven't seen any in-depth review of it and it's Chinese-based (if that's a problem [for you]).
OCaml from the very beginning
A back-door in where, exactly?
Spy & CounterSpy - Spy school for the rest of us
> And it's "its".. "It's" is a conjunction. "Its" is possessive.

"It's" is a contraction, Brainius.
Being paranoid with Ruby gems
I can't recreate this. See http://jsbin.com/agitez/1/quiet, open dev tools, preserve the log, click the link, following page does not reload.
There are 25 theories because each one works on a different set of assumptions. As economists can't work with lab experiments, they have to go with lots assumptions using complicated statistical tools.

They can't ask businesses because if you go that deep you can't abstract away any useful info. You will get very detailed stuff that nobody will care about. Most of the times people want a petty theory that can be summarized in 10 words (read all the keynesian BS on this).

As for the MBA's. Start ups are picky, very picky. They want you to have a github profile, to have a phd, to be a god in what you do. This is mainly resource driven, but that's the fact. Thus, don't come telling me that start up culture is closer to workers because I will call 100 times BS on this. I have never seen a start up giving chances to somebody that does not have god skills, or somebody with a profile that does not involve years of coding or CS. On the other hand, my company took me straight from business school and is giving me the chance to grow from almost nothing (as I did not study finance).

Let's not generalize.
On my "somebody should create this, and I might eventually" list is an open source, P2P, optionally server-backed, encrypted Dropbox replacement.

Bittorrent's Sync almost gets there, but isn't open source. I haven't really looked at it, but ownCloud might do what I want.
PRISM Whistleblower — Edward Snowden in his own words
Check out Bittorrent Sync, http://labs.bittorrent.com/experiments/sync.html
Love this. I have nothing but utter hate for MBA's.
Despite thorough researches and testing, I have never been able to find a good alternative to Dropbox in term of seamless synchronisation of my files, and accessibility across all the platforms I use.

To secure my data, I just use BoxCryptor. It creates an encrypted volume within my Dropbox. It is free for non commercial use.
Immagine a net of people sharing Dropbox accounts where encrypted data is stored, and a decentralized encrypted network for handling the meta-data.

Wouldn't that be nice?

At this point: gpg keys shared among chains of trust. Need the file X? DHT consulted says the file is stored in accounts Y, Z and W (plus at your home - we don't want users to kill our files, right?). Take the file, decrypt it.
I heard ownsync is really buggy. Havent tried it though.
Good find! From the article: "In another move with cold war overtones, Russia took the BBC's Russian-language FM broadcasts off the air. The Moscow distributor of the broadcasts said the programmes were "foreign propaganda."

Makes me think if the US project to place a rocket-shield in Central Europe has anything to do with Russia re-activating it's cold war methods.
An OS security architecture for the Linux kernel:
https://en.wikipedia.org/wiki/FLASK
The only people allowed to proliferate these weapons are of course NATO. It's only reasonable. :\
Problem with Wuala is that you can't access your data when you are offline, unlike DropBox, which stores an unencrypted version on your harddisk.
Indeed it depends on their willingness to make a backdoor, US companies don't have that luxury anymore ...
NSA's New Data Center & Supercomputer Aim To Crack World's Strongest Encryption
If the fact that these nukes are stored in the Netherlands is kept from the public in general, and only leaks out every now and then, they must not be meant to make the population feel safer. They're probably just there as part of concessions made after WW2, where the USA wanted to extend it's reach into eastern Europe.
Create Something Every Day
This shouldn't be half as funny as it is. It shouldn't be funny at all.

Then again, a little bit of gallows humor is always in order when facing these things.
From this perspective, tarsnap is even better - http://www.tarsnap.com/bugbounty.html
First the people need to be made aware about how serious this is and why their privacy matters. Then, people will have to get on the streets for demonstrations and overwhelm their representatives with emails and phone calls asking to do something about it. Similar to how SOPA/PIPA protests were carried out.
I was thinking about dynamic languages and IDEs. And before you rush to any other conclusions, I've written a big part of one of the latter.
If you're concerned about your personal data, and not so much about targeted attacks against you, I'd say stay with Dropbox and just use EncFS.

You can do this on Linux (and presumably OS X, as well) fairly easily.

On Windows, there is a single-developer port of EncFS, which from what I've heard works fairly well: http://members.ferrara.linux.it/freddy77/encfs.html

A quick search turns up a guide which (at first glance) seems fairly comprehensive on how to set this up if you're unfamiliar with the way EncFS works:
http://www.howtogeek.com/121737/how-to-encrypt-cloud-storage...

With that said, if you're worried about any highly confidential data, potential for watermarking attacks or plausible deniability, this is not the right solution for you.

If you're looking for a way to protect your data from dragnet surveillance, your provider, or low-level law enforcement interception, this is a great drop-in solution.
Have a look at BitTorrent Sync: http://labs.bittorrent.com/experiments/sync.html

One advantage is that there's no third-party storage of data involved.
Oh, you mean a bit like this?

"He found he was unable to print out a boarding pass […] when he approached ticket agents, they were blocked from producing a boarding pass for him without first calling a Secure Flight number at the Department of Homeland Security. […] ticket agents told him he was on a federal watchlist."

http://www.wired.com/threatlevel/2010/11/hacker-border-searc...

If it's not automated now it will be in a few years.
Resize the window.
Cablegate pretty much confirmed the (until then assumed) storage of US nuclear weapons in Kleine Brogel, Belgium.
+1.

I'd like to know more about this. Working on a encrypted FOSS alternative to conventional storage would totally be a perfect side project
The closed source binary blob?
Wuala is great, but the short summary is a bit misleading. There is a real risk of government agencies forcing LaCie to push you a client update that removes encryption, in an older version of their T&C / product info, this was mentioned explicitly.
Buy RV and park it in front of company... :-)
It's also worth noting that Google said in 2007 that if the FRA snoop law is passed, they will locate their servers outside Sweden. They placed them in Finland instead.

Doesn't really help when almost all international Internet traffic from/to Finland goes through Sweden...
And to elect who? Someone who most likely voted for that IAH to start with?
> "If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala."

A non-answer if I've ever seen one.

What about someone who applies for a job at Wuala, gets rejected, but still wants to look at the source code?
Lessons I Learned from Selling My Web Design Agency
RedHat/Fedora[1] do not enable elliptic curves in their openssl for "legal" reasons.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=319901
Why not? Like him or not, this is definitely in line with the libertarian position.
Don't open source it. Just give read and build for personal use permission. That should be enough.

I don't think that I will be able to trust secure trough obscurity solution.
It's from Lacie, so no thank you. I bought a Lacie drive and proceeded to copy all my stuff onto it. Before I could get comfortable with it (so within the first six months of purchase) and before I backed up my stuff, the drive failed. I contacted Lacie about it and they proceeded to try and sell me a service whereby they'd recover my data for €300. That would've brought my total spend on the drive up to around £400. I begged and pleaded with them, pointed out how unsavoury such a business practice was and all to no avail. The drive has just been sitting down since with the data unrecovered. Personal memories, music, films and professional data too. I've tried to recover the data but that didn't work and I honestly feel ripped off. As a result, I've vowed to never do business with Lacie again and to warn everyone of how unscrupulous they are. Beware of Lacie and their subsidiaries.
I am using FF 20.0 on Ubuntu 10.04.
Project Goals for "Open Panel" (a frontdoor to the backdoor)
And that's the only use case that bothers you?
Yup.

“As of November 2009, Belgium, Germany, Italy, the Netherlands and Turkey are still hosting U.S. nuclear weapons as part of NATO's nuclear sharing policy. Canada hosted weapons until 1984, and Greece until 2001. The United Kingdom also received U.S. tactical nuclear weapons such as nuclear artillery and Lance missiles until 1992, despite the UK being a nuclear weapons state in its own right; these were mainly deployed in Germany. In peace time, the nuclear weapons stored in non-nuclear countries are guarded by U.S. soldiers; the codes required for detonating them are under American control.”

http://en.wikipedia.org/wiki/Nuclear_sharing

Also, let’s not forget the US has 2,150 active warheads in total; the vast majority of those are located on American soil.
Hong Kong Baffled by Snowden’s Hideout
I'd say that culture is a much more powerful agent of change than traditional political work
could ever be.

Politicians can act as scribes and put down into legislation a part of the cultural ethos,
but they don't do much in the way of inspiring that ethos in the first place.

Practice what you preach, call bullshit by its' name.
that's what an economic disaster does to you. the US will withdraw from Europe as well once their money runs out.
Yes, we hope so. But that is up to the icelandic people and whether or not they care.
TCP state transition diagram
The question was whether or not it refreshed the browser without user interaction. Resizing is an interaction
I also don't buy the whole premise of US government - bad, EU governments - good.

When push comes to shove, governments everywhere will have no qualms about invading people's privacies en masse.

Human nature is the same everywhere. Power corrupts everywhere.
To play devils advocate, if I had connections in Hong Kong and was attempting to gain footing there, I would not want to volunteer information regarding my connections where it would be widely published in the media.

I don't think that's the case here, however we really don't have any concrete evidence either way.

As far as law enforcement goes, you're spot on, physical distance is the least of anyone's concerns. The first consideration for law enforcement would probably be "How willingly will this jurisdiction work with us?"
I can remember the Cold War rhetoric quite clearly - we were told that the Soviet tank armies were poised to pour through the Fulda Gap and drag us all of to Gulags.

Meanwhile, the Soviets lived in terror of a nuclear first strike by the West, which they expected at any time and that would utterly destroy their country.

My understanding is that it was Ronald Reagan, of all people, who realised that inflamatory rhetoric ("Evil Empire") is a bad idea when you are facing an opponent who is terrified that you are going to attack them - which the Soviets were (with some justification). Reagan deserves a lot of credit for helping end the Cold War - but it was largely achieved by discussion rather than threats.

I really hope we don't begin that stupendous silliness all over again.
Kodak’s Problem Child
Appington is hiring generalist developers
We improve user experience in mobile apps by playing relevant contextual voice prompts, using voice actors not synthesis. This leads to happier users who stick around – and might buy stuff, which makes the developers happy. We are expanding and looking for generalist developers who can contribute in areas such as app code, content delivery, analytics, programmatic rules for prompts, and web dashboards.

http://blog.appington.com/2013/06/10/looking-for-generalist-engineers/
Yep, what MindTwister says https://github.com/jakearchibald/request-quest/blob/master/w...
Interesting that most of the well known UK events don't get a mention. HN London is Europe's largest regular tech event for example.

Side-point: I've been to LeWeb a few times and I have yet to meet a single person who felt the cost was justified.
Arrogance and lack of transparency by Telecom Companies in India
How about Dropbox + TrueCrypt + Automount? Files are decrypted in memory, files you need to share you can keep in unencrypted format.
The ownCloud sync client for OS X pins one cpu core to 100% usage on my fairly new i7 mbp, which effectively drains the battery quite quickly if you don't notice.

Then it also seems to do a full scan of teh entire folder each time it sync's, if you then have for example your iPhoto library (usually a few GBs) there, the sync process will consume lots of CPU and tend to be out of date across devices.
I'm not a security expert neither do I understand cryptography hence the question: I assume they are not using the original password to encrypt data. They are generating a symmetric encryption key and encrypt it with the original password, storing it along with the encrypted data on their servers. The question is how secure the encryption on symmetric key? What if it is easily brutfocable?
I used Wuala for couple of years, when it was free and allowed earning a much larger quota by sharing own drive space to host other user's data. I used it to keep around 100GB of my personal data. Used to be good while it lasted. Encrypted, distributed, redundant. Then LaCie bought it and turned it into a Dropbox clone. Now I use AeroFS, also tried TorrentSync. Both a roughly equal. I just felt lazy changing from already running and tuned AeroFS to anything else. If you have 24x7 homeserver at home it is very hard to justify paying for storage at dropbox or skydrive or google. I built my homeserver on the latest Atom, so it is frugal (~10W) and completely silent (no fan, SSD). It's dualcore 2.1GHz and has enough grunt for simultaneous NAS, torrents, and plays 1080p mkv to the attached TV. No place for Wuala in this arrangement anymore.
Way to be opportunistic!
We were looking at using AeroFS with our own servers, but it doesn't appear to support encryption on the server. I may be wrong about this?