skysight-inc/HackerNews huggingface dataset:
They have to set up impersonating SSL certs for every connection they want to MITM. While there'd clearly be value in them inserting or subverting network hops between "the great unwashed" and gmail/facebook/aim servers, there's very little chance the NSA have access to hops along the path between my (Australian) adsl connection and my vps (located in Australia).

For internal (or routed through) US traffic - while Verizon's lack of interest in protecting customer data is probably shared by major backbone providers - I _strongly_ doubt even the NSA has enough gear hanging off backbones to actively MITM any significant proportion of the firehose that'd represent. Even the AT&T "secret room" probably doesn't house enough gear to be able to create fake(signed)certs and MITM every SSL connection for millions or more simultaneous users browsing every https site under the sun.

Having said that, I'd bet good money the _do_ target specific SSL traffic - has anyone checked the SSL connections to TOR entry and exit points recently? That'd be one spectacularly obvious path to try "speculative MITM attacks".
I didn't have time to dig for really accurate numbers, but Microsoft's Xbox sales, which might include revenue from game developers as well as hardware, was about $9.6B for FY 2012. (http://www.microsoft.com/Investor/EarningsAndFinancials/Earn...)

IBM's system hardware revenue for FY 2012 was $17.6B. (http://www.ibm.com/annualreport/2012/bin/assets/2012_ibm_ann... page 30). IBM also manufactures components and licenses hardware designs, such as the CPUs used in the PS3 and Xbox 360.

Microsoft is still not as big a hardware player even compared to an IBM that has sold off a good chunk of their hardware manufacturing.
College for All: Sebastian Thrun, Udacity
Yet a phone call that takes a staffer's actual time probably is 1000x more effective than a form email that are easily ignored because it requires so little effort to actually generate.

If the most you can be bothered with is typing in your name and hitting send, why would any Congress member even believe you'll bother to vote in the next election? Or donate? Or convince other people to vote for their opponent?
The Surest Sign Yet That Apple TV Will Be a Gaming Console
I have. I got a form letter in response.

There's some irony there.
How does this look on your iPhone btw? Should have parallax and use the accelerometer:
http://dl.dropboxusercontent.com/u/2220075/ios7/lax.html
(didn't create this)
That may be, for lack of a better word, muscle memory/reflex for some people. I found out last semester, when I wrote out lecture notes on an ipad that there are many words I literally forgot how to spell. I can type them, and I can write them with a pen, but writing with a stylus is different enough that it took several seconds of concentration before I could write it down. I wouldn't be surprised if there are words or phrases at I always capitalize.
A little UI feedback if anybody from GitHub is listening:

When you click and hold to move the map, and you scroll the mouse all the way off the map, the map acts like you are continuing to hold the mouse button down, even if you let go of the mouse button. When you return the mouse to the map, it acts like the button is still pressed and the map sticks to the pointer...for which you have to click again to get out.

This is unexpected behavior, especially if you are trying to scroll through more than one screen with repetitive mouse drags. The map scrolling should maintain the same behavior of the mouse button hold even if you scroll off the map.
ITC calls for import ban against Samsung, rejects Google's flip-flop arguments
In the first week, sure. But as time goes on, used game prices drop much faster than new game prices.
Simple explanation of the original error -- the person who put together the slide deck wasn't exactly a dev on the technology itself.

It does call into doubt the credibility of Snowden's OPINIONS about the scope of NSA technology and procedures.

The technology error -- or more precisely the lack of rapid correction -- isn't one of Greenwald's finer moments, but in general he's done such an awesome job on this issue that I give him a pass on that blunder.
Is this thing hidden behind the steaming mountain of bs?
And by the way -- $20 million budget always meant PRISM was only a small part of the whole. Not realizing that was actually a dumber error on Greenwald's part than him taking "direct access" at face value.
This is an interesting argument.

I could see a rule something like the following: in case of an unplanned pregnancy, the woman must inform the man within the first trimester that she is pregnant, and obtain a written (and perhaps notarized) agreement from him to the effect that he is willing to pay child support. If she doesn't tell him or he doesn't sign the agreement, she will be unable to legally compel him to pay. If she tells him and he doesn't sign, now she knows what to expect, in time to abort the pregnancy if that is her choice.

Probably very few men would sign such an agreement, but the few who did would probably be relatively easy to collect from.
Would love to know the methodology used to gather and verify the data for each site?
15", yet 1366x768 display? That's exactly the kind of crap I'm ditching ThinkPad for doing.
It's from my tool that I've been developing. You can see how the diffing works at

https://www.youtube.com/watch?v=fi7GvcW1NKA

Unfortunately I don't show you how to switch to the side by side view. To do this, you just click on the view toggle button at the top left corner of the diff window.
I use Blobs to instantiate workers in one of my side projects, and it has always made me wonder: Why isn't the option to instantiate a web worker using inline code built in to the browser APIs?
> The presumption, I think, is that users will scroll to read previous messages and the contrast will be fine where they are reading.

That's a wrong-headed and frankly stupid presumption on Apple's part, if true. You're arguing to make the top half of the messages screen unreadable (or at least more difficult to read) in the name of a gimmicky gradient effect?

> If you really think Apple hasn't considered the idea that some photos will have lighter colors I don't know what to tell you.

They haven't in the beta. Unless you set the image to be basically all white (in which the overlaying text turns black) the text remains white. Even on the default "live" teal background the text is hard to read. Hopefully this will change in the release, but considering promo shots show the lock screen as it is now, I'm not hopeful.

> If you want to criticize iOS 7 you can do better than conjuring up things that would only be true if Apple literally had zero design skills.

Wait, so you are saying that if Apple didn't employ "good" designers, his criticisms about the new UI would be valid, but since they do, his criticisms are baseless? Please go ahead and defend that logic, should be good for a laugh.
I wish pastebin had a mobile interface. It's almost impossible to read on the iPhone 5 screen.
<prejudice>I think most of the whiner's are American's with a high sense of entitlement</prejudice>. Personally, I'm just gonna quietly switch to PS4.

I think MS's thinking is a bit ahead of its time, and possibly a bit too Americanized. USA and a lot of other countries have cheap, reliablish Internet. The onliny model will be OK for them.

But there are still a lot of places that have XBox's that have expensive + useless Internet. Like where I live.

I'm moving from XBox 360 to PS4 because, as it is on the 360, I get a "Can't connect to XBox live" message about once an hour. If I went to XBox4, I'm assuming it'd be more annoying.

I bought the computer/console and the software; I expect it to work for me, not to police me, not to try to advertise to me, just do what I paid for.
PRISM doesn't matter that much, anyway - the NSA doesn't need a workflow automation system in place to send DDG or Amazon a NSL or a FISA order.
What do you mean? Google App Engine is business as usual.
I was a dev lead at xbox when they first implemented "Games on Demand" or direct purchase and digital download of full games. My team implemented the feature on xbox.com back in 2009 I think.

As I recall it, the main reason we didn't do a wholesale switch over to digital distribution was because that would have upset the retailers who sell games. We relied on these same retailers to sell our xbox consoles. We were afraid that if we took a way the game revenue they would stop selling xboxes. We thought it would be best to make the transition gradual. So we took the first step back in 2009. This appears to be another step.
It's a nice touch that the hackers are wearing ski-masks and frantically typing beneath a flickering light. Cute.
If you think those are viable sources of results, then by all means include them.
I mean the scope of the already requested data, not of the data they could potentially request.

It's indeed very sketchy that the NSA asks for the metadata of all the Verizon customers.
5 Free Startup PR Tools To Start Using Right Now
I would... but it's much easier to just complain on HN.
Governments and corporations are just agglomerations of persons, who act with varying ethical standards. Treating them as monolithic entities leads on astray into all sorts of fallacies.

As for my own ethical position, I think the US needs a constitutional amendment that creates an explicit right to privacy, rather than an inferred one. But I also think the head of the executive branch is bound to serve conflicting imperatives regarding defensive issues, and that it's foolish to expect government actors to tie their hands hands in fulfilling that mandate.
I like using graphviz for visualizing existing code and data. I write a script to generate the .dot file, maybe tweak it a little, and render with graphviz. I've used this for our data model, ER diagrams, jar dependencies, brew package dependencies, etc.

For class diagrams, I have a little python script that takes a language like:

Foo -> Bar
Bar *--1 Baz

Foo
- name : String
- flag : boolean

And turns it into a diagram. (gist: https://gist.github.com/dunhamsteve/5274411 )
Rails 4.0 and Ruby 2.0 docs for the OS X Dictionary
resonator--
Aflac is pretty cool. That duck has serious swag.
Ad-Free Lyrics From Your Terminal
Don't believe the title. Even the URL reveals that this is just a visualization of Google Trends, which changes at less than real-time relative to individual searches.

Correct, non-misleading title would be: "Nice Visualization of Google Trends"
We'll still be paying the same for games - this just means more profit goes into the executives and the shareholders pockets.

We're getting boiled just like that poor old frog. Turn the water up slow enough and he'll never notice.
oh. lol.
What is skeuomorphism? (Mimicking real world objects in Design)
Doesn't apt verify the signature of packages before it installs them? If so, then the new domain owner shouldn't be able to do anything malicious because (s)he cannot sign the packages.
Girl travels 16 hours to save wounded eye
I suggested the City of Chicago use Github because it is the only place to put open data that both (a) allows contributions back to the dataset (pull requests) and (b) allows for community feedback (issues and comments).

It's by no means ideal (the building footprints dataset is hidden behind a 2GB compressed JSON blob) but it's still useful and a step in the right direction.

It's still aimed squarely at developers using the data, though. Asking a "normal citizen" to submit a pull request is still a pretty big ask.
Well, to me this hints that Mr. Putin has a good sense of humor! He and his friends must have had quite a fun time last week.
For what its worth, the double punch Wednesdays was confirmed to me my a MS friend.
"Terrorist and black-hat hacker Duncan Bayne was arrested yesterday after posting his bombing plot on a forum for hackers. Lawmakers state that he never would have been caught without the aid of PRISM, and drafted new legislature allowing body scans at entrances to legacy systems. Next up: why gay marriage is going to destroy traditional families and why you should be concerned exclusively with preventing it and not care about, say, the Fourth Amendment."
i always make ddg my default... but then ill just use google for a sec and forget to change my search back to ddg and then without noticing ill be using google for the next week.

.... so my project for the weekend is to make a firefox extension that resets your search default every X hours/days.
I know my parents are going to die, but I'm still going to be sad when it happens.
So? Old, poorly-maintained systems have all sorts of issues. Not working with newer browsers is just one of them. Consider these possibilities:

- Maintenance and support costs are notably higher than they would be with a newer system. It is worth noting that, technically speaking, Microsoft hasn't stopped supporting Windows XP. They're just raising the price and requiring a bespoke service agreement for XP support.

- Not working with newer browsers means not working with smartphones and tablets. A company could be passing up opportunities to improve productivity with mobile devices.

- It may be difficult or (practically) impossible to scale an old, brittle system with the needs of the business, especially if the old system has issues with newer hardware.

- It may not interoperate well with newer systems in the organization, foreclosing opportunities to offer valuable products and/or services.

And so on. Letting parts of your IT infrastructure bitrot has long-term consequences and companies should realize that when they make IT decisions.
The article makes the point that it is insufficient to use good crypto algorithms / implementations. You must also use it correctly.

"A component can only be secure under certain well-defined circumstances, not for any use that happens to look similar."
...and you trust Chrome? Not even Chromium, but... Chrome. Google makes Chrome, you know.
Have you seen the ! queries on DuckDuckGo? If you add !g to a search, it redirects you to Google. !i goes to Google Image search. I guess there are others.
I'd say it's still pretty risky to leave this source enabled.

The behaviour shown at http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg is what a user would see if the entire repository (including the Release.gpg file) were swapped out.

Unfortunately a decent percentage of the people using debian-multimedia.org likely never imported the signing keys for the original repository at all, and wouldn't notice that the key ID had changed.

Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common and likely to be ignored by a good portion of the user base.

In the past even very savvy folks (Defcon attendees) have fallen afoul of accepting dodgy package updates: http://seclists.org/fulldisclosure/2011/Aug/76

Edit: I recalled hearing that they'd Mitm'd Debian / Ubuntu updates but now I can't find that specific factoid again, so perhaps take the Defcon thing with a grain of salt.
It really only took me about a week to get used to DuckDuckGo, and now using Google just feels wrong.
Are you speaking about linode or digitalocean?
And I don't even care about people's (clearly reasonable) belief that NSA had put into place an overreaching and possibly unlawful domestic surveillance system.

My problem is with people who appear convicted of the idea that Google's leadership are conspiring with NSA to deceive its customers, or that NSA is employing exotic and outrageous methods (like optical signal intercepts --- it's right there in the name Prism!), or that Palantir is somehow involved in Google-related surveillance, or that NSA is "disappearing" people... the list goes on and on.

I have a problem with the idea of conversations on HN reifying speculation that Google or Facebook are defrauding their customers; I also have a problem with bullshit stories clouding the very real problems we do have with overreaching surveillance.
Hold on just a second. Room 641A ring a bell?

http://en.m.wikipedia.org/wiki/Room_641A

All the pennies (and beam splitters) have yet to drop. I would be shocked if the NSA wasn't coupling company cooperation with direct packet inspection/backbone wiretapping. They could even use the FISA requests as training data under some scenarios to help reverse engineer protocols.

You really want to bet that there is nothing more to see here, that more Room 641As don't exist? As for "conspiracy-theoretic-nonsense", a hidden conspiracy to wiretap hundreds of millions of Americans (derided as a "myth" by the NSA lawyer Rajesh De and lied about in front of Congress by Clapper) was just revealed -- because a man risked his life and freedom to leak the first FISA order in 35 years. Given that senior government officials are actually admitting in realtime to past untruths, it might be a good idea to be a wee bit less credulous when it comes to our government overlords.
A hash is a crypto primitive, it's not what you use for that. If you want to store a password, you use a KDF. If you want to fake-sign, you use an HMAC with a secret. You don't use a hash, just like you don't use plain AES to encrypt a file.
The story they ran does not reliably attribute claims about surveillance to the NSA slides, but adds its own speculative claims and, later in the story, blurs the line between what the document is claiming and what the Guardian believes to be fact.
Ouya tries to crash E3, feuds with ESA
Agreed. I didn't actually intend any snark. The fact is, the URL was easier to remember for me than the blog link or Google query one, so that's why I used it as I was running out the door. I considered changing it later but haven't had any time. :-P

Thanks for not judging me. :)

PS. Despite everything I still don't think Stormpulse is a success yet. I'll let you know in a couple years. :)
And further, why the issue is how they have access to my private correspondence without a warrant rather than the fact they have access to my private correspondence without a warrant?
That's not how it works. I don't need to know how precisely the NSA "slurps up all the data" to challenge a specific claim the Guardian made about the degree of discretion NSA has in obtaining data from Google or Facebook.
Hi lifeguard, thank you for your answer.

0. What do you mean? Update always Ubuntu, Apache and MySQl, for example?
3. Don't understand this :(
1, 2, 4 & 5: Yes :)
Snowden has claimed that the US is clandestinely tapping into foreign backbones, is it so hard to imagine they aren't doing it domestically?
We would all die because the terrorists are the most powerful force known to man.
I want to bet that NSA does not have direct access to Google and Facebook servers. I don't have an opinion about NSA's influence over telcos (in fact, I expect you & I agree about the extent to which NSA exerts undue influence over telcos).
The only thing stopping me from making this switch is that doing arithmetic in the url bar stops working... I use that quite a bit. Is this some deep integration with chrome or can it be made to work with ddg as well?
No snark intended. Just lazy, sry.
First Six Months with Storify
Say what? Clandestine foreign signals intelligence is NSA's charter; it's the entire reason the agency exists. It does not follow logically that because NSA is executing its duties to its lawful charter, it must also be exceeding its authority domestically.
Phi has an end
DDG is a nice search engine for simple research, but I don't use it as much for its search purpose as for its !bang utility.

Being able to search on almost any website by adding a simple keyword is a real plus and I will go even further and say that sometimes it accelerates the search process (say you know you want to search on wikipedia for instance).

However, I have to admit that most of the times I end up searching on google :)
Multi-threaded JavaScript sounds so dreamy
Ask HN: What's the deal with Boxer (iOS email app)?
For reference: http://getboxer.com/

I'm an American living in China, and last night I received a notification from Boxer saying that I needed to upgrade to continue accessing my Exchange account and to continue using 2+ accounts (http://d.pr/i/ffwY). The price: RMB 2.99, or about 48 cents USD. I knew this isn't possible, but it's what was advertised. I clicked to pay, and of course that number jumped to $2.99 USD, or about RMB 18.30. (http://d.pr/i/lWar)

If a company is accidentally offering an upgrade at RMB 2.99 to Chinese customers, should they honor it, even if it's in error?

Moreover, should users even be paying for this upgrade? Boxer is running a "Get the $4.99 USD version of Boxer for free" campaign (http://d.pr/i/SwGN). Moreover, when you get in on this special offer, the iTunes download page makes no mention of this actually being a trial version, nor does it state a paid upgrade is necessary when Exchange is mentioned (http://d.pr/i/U5Kg)(http://d.pr/i/KjTO).

Is this bait-and-switch, or has the strategy involved with in-app purchasing changed the definition of "free?"

I know a lot of you are in start-ups and are developers of some of my favorite apps so I'm curious about your ideas on the subject (from a business perspective) and advice (from the customer perspective).
MS lockin starts with Active Directory and Exchange. There are basically no competitors for AD, and few credible competitors for Exchange.

From there they jump to the products you mention. Sharepoint is terrible for building websites, but recognizes and uses AD permissions out of the box. So does Office. So does Lync. Etc.
Not only that, but "extreme" is a moving target. "Normal" in today's environment might well be considered "extreme" by whoever holds power ten years from today.
Individualised FISC orders are required. http://www.govtrack.us/congress/bills/110/hr6304/text (Or more precisely, FISC review and approval of individualised FISA 702 orders are required - the court doesn't actually issue 702 orders.) That's almost the only protection non-resident aliens have under FISA and the jurisprudence that upholds FISA, but the protection is there. It could be undermined by issuing millions of FAA 702 orders or one FAA 702 order covering millions of people, but we have reasonable assurance that this hasn't happened (yet) https://news.ycombinator.com/item?id=5865717 .
"I have nothing to hide" is the wrong way to think about surveillance
Correct; H(H(secret) || message) just scrambles the secret, but doesn't change the MAC construction.
OK, in light of the Snowden reveal, how is it that none of the press seemed to find this revelation and link it with everything else, and report it? A former FBI counter-terrorism guy went on CNN, and admitted that they have everything, including content, over a month ago.

http://dailycaller.com/2013/06/13/do-americans-love-big-brot...

http://webcache.googleusercontent.com/search?q=cache:http://...
CenturyLink Acquring AppFog To Move Into PAAS market
For one thing, you're incurring one more SHA1 invocation than you need; for another, you're clumsily duplicating HMAC, which has other security features (albeit not hugely practical ones). But the core feature of HMAC is indeed hashing the secret separately from the message.
I don't think the American government is unusual in this regard.
They do do "upstream collection", it says so in the released slides. However they also do "direct collection" from the webapp companies ("You Should Use Both"), so it doesn't provide SV with plausible deniability.
Use AlfredApp for arithmetic ;)
Smile Hackers Can Silently Access Your Webcam Right Through The Browser (Again)
Purdue students face felony charges for B&E, keylogging profs, changing grades
DDG actually uses a handful of search engines (including Bing), though I think that Yahoo! is the primary source.
You don't have to trust it. You can sniff 100% of the traffic coming out of your own computer. You can even configure a firewall to block all traffic to Google's netblocks.