skysight-inc/HackerNews huggingface dataset:
Not quite. Having someone's private SSL key doesn't necessarily let you read the contents of their SSL traffic due to forward secrecy. It does let you sign messages as if you were them, or MITM their traffic.

http://en.wikipedia.org/wiki/Secure_Socket_Layer

For instance, on HN, Chrome is currently doing this:

Your connection to news.ycombinator.com is encrypted with 128-bit encryption.

The connection uses TLS 1.2.

The connection is encrypted using AES_128_CBC, with SHA256 for message
authentication and ECDHE_RSA as the key exchange mechanism.

Using ECDHE_RSA, my browser and HN's server will agree upon a key to use for encryption using AES128 in CBC mode. Now in order to read what the server sends me and what I send to the server, you need to break the crypto:

1. Brute force the 128 bit key. This is.. probably not going to happen?

2. Via a weakness in the AES128 algorithm or implementation, you can simplify a brute force into feasibility (AFAIK, no such attack currently exists).

3. Via a passive attack on ECDHE_RSA, you could potentially guess the shared key efficiently and decipher our communications (AFAIK, no such attack currently exists).

So it's not quite as simple as recording encrypted information and obtaining the SSL keys. You need the server to actively remember the keys used for every encrypted connection, and obtain those, too. Or MITM everything and record the unencrypted data.
Do they expire? Previousy IE VMs from Microsoft were only valid for ~90 days or something and required re-downloading (and then re-configuring all settings which was pita).
It's become kind of a nascent movement to start writing and using these systems for new application domains. Here's one for node.js: http://noflojs.org/
Glad to see them succeeding, but personally the privacy of my web searches doesn't bother me - as long as they aren't being passed along with personally identifying information. I'm far more worried about emails, messaging, video, storage etc.

Can someone explain to me (or point me in the direction of something that explains) what Google and Bing store in terms of tracking when you are not logged in?

Obviously you can use VPNs or TOR to be really safe, but do you need to go that far if you want an untracked search on Google and Bing?
Their UI is actually just a wrapper around their API, so while I haven't used Azure, I believe the answer to this is yes. Microsoft also publishes Node/javascript bindings to their API.
Here's how you avert a terrorist attack:

1) Find some idiot talking about how he'd like to blow something up on his phone

2) Approach idiot, try to sell him explosives

3) If he's dumb enough to say "ok" out loud at any point, then slap on the cuffs, you foiled a terrorist attack, you're officially a hero.

It's a numbers game.
Frankly it sounds more likely to me that this was a poor attempt at social engineering rather than a genuine contact from the NSA.

Seems like you could really play this NSA stuff up in social engineering attack, especially if you were willing to put some work into it. Imagine grabbbing the NSA logo off their website, and make some fancy looking, seemingly authentic laminated plastic ID cards, then show up at someone's office asking for data/access/etc. and claiming to be from the NSA. Even hand then a "National Security Letter" and carefully explain the gag order to them, and let them know that doing so much as picking up the phone to call anybody else to ask about cooperating could result in them being jailed. Subtly hint that "jailed" might mean "disappeared to Guantanamo".

Since everybody knows that the NSA is kinda "in the shadows" and lots of people have heard of NSL's and gag orders by now, I imagine you could get a lot of people to go along with this. Especially if you had two big, physically imposing guys in nice suits to play the roles.

(edit: I am, in this case, mainly talking about inside the USA, where NSL's have authority, etc.)
Email, however, would not be encrypted. As Google is one of the largest cloud email providers, this could provide a lot of information for the NSA. But I'm not sure Steve Gibson was correct in his assessment. Looking at that final PowerPoint slide from the PRISM deck, it seems that upstream tapping was occurring, but also mentioned PRISM as a separate program. It could be that PRISM was a related router tapping technology or something else entirely.
MySpace deletes hundreds of thousands of blogs without warning
Facebook Hashtags: #Theyarehere
And often MS people would forget to upload updated VM.
Damnit... at least it's Friday, right?
> With this release, can we immediately start using version 3?

You should stick with 2.7 As mentioned in your linked blog post, porting Flask to Python 3 wasn't the issue. The issue is the other libraries which you will use to build your web application which aren't on Python 3 yet. You can try to build a unified code base(runs on both 2.7 and 3) http://lucumr.pocoo.org/2013/5/21/porting-to-python-3-redux/
El Economista.
I mean, really... when Vladimir Putin is defending your domestic surveillance and spying programs, don't you think that's a good sign that things have gone a bit off the rails?
If I knew it at one point, I've forgotten it.

Do you happen to know of any coding standards documents for large projects using Scala?
Heavy filtering... no typos ;)
I've never found UML useful for diagraming an entire application. However, I don't know if this is a fault in UML or a problem with the application architecture. Applications tend to get large and disjointed. They solve multiple problem sets and consist of several different layers. When we try to take a complex system and put it into a UML diagram things get really hairy fast.

UML is more useful when it is used for diagramming the components of systems. This practice also promotes the practice of identifying and decoupling system components. When complex problems or unfamiliar patterns emerge, UML is indispensable.

Still the biggest issues I've observed with UML adoption are: 1) A lack of tools developers want to use. 2) As developers become familiar with the codebase (you know, by writing it...) they begin to think it's self explanatory tedious documentation efforts like UML are unnecessary.
I think that Greenwald should've been more skeptical, regardless of how technical savvy he may or may not be. Look at the slide in question...in any other organization, that slide would be interpreted as a slide aimed at the newbies/idiots in a company...it pretty much literally says, using brightly colored bubbles: "Hey people, remember that we have two systems for collecting data, so please use both of them. We even gave one of them an easy-to-remember acronym"

Isn't it possible that a slide written for newbies (within NSA, or those who work with the NSA) might have also been written by someone who is not an all-star in technical communication?
Wait, people actually read the Terms of Service?
Well there are two types of young nerds - those who use open source and those who use cracked commercial software. It's only natural that the first type doesn't usually end employed by MS.
The Discover Meteor book is great; I highly recommend it. However, if you are looking for free tutorials, Stephan Hocchaus put together a nice compilation of the resources out there here - http://yauh.de/articles/376/best-learning-resources-for-mete...
Fair enough, but if they were large enough to require that sort of privilege separation, then the entire post would make a lot less sense. Furthermore, I think the target audience has the same demographics; relatively small companies where the development team is also the production team.

Thanks for the reference to data masking; it should be more common.
True. And although there is a process to convert VirtualPC images to work with other formats, which I did (on OSX), however it was a major pain in the ass. Frankly, I love the new model. MS deserves to be denigrated when they do bad, and they certainly have a mountain of web-karma to countermand, but they did good in this respect and deserve to be praised for it.
Beyond distributed and decentralized: what is a federated network?
Maybe they should just recognize the fact that the web has won and nobody cares about X any more, and implement a window system that runs in the web browser, and run the web browser in full screen direct access mode as the only top level application. I mean, now that we have HTML and WebGL and Canvas, who needs X11's neanderthal rendering model?

I'm kinda surprised that nobody's written an X server in JavaScript yet (not that it's what I'm proposing above, just that people love to do crazy useless things like that).
Ugh, how do they thing the timing of releasing this webpage is appropriate, with the NSA scandal, and people are worried more than ever about their data being harvested? Or has it been around for a while?
On landlines the call isn't finished until the caller hangs up. This allows features such as "call waiting" to work: the receiver flashes the hook in a certain way to switch to the other call. If flashing the hook would disconnect the call, "call waiting" wouldn't work.
I think it's fair to say "religion X causes honor killings" if and only if X's teachings encourage them (by explicitly saying there's no spiritual punishment for them, for example). It's also fair to say that "religion X doesn't cause honor killings" if there's no correlation between religion X and honor killings. I agree that correlation on its own is never enough.

So: do the teachings of those with a mantle of religion-X authority, on average, encourage or discourage honor killings? This is not a question we should avoid asking just because we want to be nice.

I don't see any evidence that Sam Harris has got this wrong.

Good point about being nice vs. reaching a permanent accommodation.
Sadly that's not always a strictly pedantic point. Even besides Bush v. Gore, it also has led to the concept of "Battleground States" which I find abhorrent to a proper republic.
For VMWare Fusion, not VMWare Workstation, I believe, as Workstation doesn't have an OSX version, and as others have said, their license doesn't allow for running a VM on non-Apple hardware.
I would take POST data, and plug it into a templating system (like Django's), which is using something like LaTeX to define the basic properties of the document and populating with data and logic from Django.

Basically a mix of two markups in one file. Meh, there's probably a better way to do that.
Naah, only good people get to rise to the top of the US politics. They would never abuse your data.
Looks promising, Thanks!
2 seconds can be a lifetime in this business. At least in Sweden one of the stock exchange offers server space in the same machine hall as the exchange. To minimize the physical distance.
A lie gets halfway around the world before the truth gets its pants on. This story made it 1/3rd up the front page; stories based on the most extreme possible interpretation of what seems to be Greenwald's own extreme interpretation of a slide deck covered the entire front page for days. Remember when "direct access" meant Palantir was a third party doing the actual collection? Just look at their name! Remember when all of Facebook and Google and Yahoo's denials looked "suspiciously similar"?

Someone on Twitter (sorry) said that Google and Facebook "looked like angels" compared to Verizon. That sounds about right to me, too. But what incentive do they have to do that when their reward is conspiracy-theoretic nonsense about how NSA has their TLS keys and 3rd party contractors are used to keep them from "lying" when they say NSA has no direct access?
I think mixing of people from different social circle is going to happen to any social network which aims to be the default communication tool for the whole of earth. What I am pissed off more about Facebook is the loads of advertisements which keep showing up in my feed. That I find to be unacceptable. There have got to be other business models.
Regardless of what prism is, if it's a reasonable system with oversight and consequences for those abusing their power, why is it secret?

There's nothing necessarily wrong with something like PRISM (especially since we don't even know what it is), but the choice about whether it's right or wrong belongs to the people as a whole, most certainly not to a few people happened to have grabbed that power.

What's the point of democracy and accountability if it's unclear what people are accountable for nor what you're voting on? This kind of system should never ever have been introduced in secrecy.
Jesus christ, I was wrong about that: https://github.com/tnkd/javascript-x-server

Is there a rule 34 about things that shouldn't be written in JavaScript being written in JavaScript?
SMTP is inherently insecure which is why you are not supposed to use e-mail for confidential information. But SSL will still protect almost every other Google property from Search to Hangouts.

Although your post did bring up another question that I never thought about. Does Google even "send" email when it goes from one Gmail user to another? That could theoretically all be handled internally, but it never crossed my mind that they wouldn't use SMTP.
You can install Windows XP anywhere, but I think JunkDNA was referring specifically to the distributed VMs for testing IE, which in the past were always VHDs.
Very true. The "pedantic" is misleading.
If the NSA could crack SSL encryption (and why not, they are code-breakers first), or if they could simply acquire the keys (from the ssl providers, from google, from whomever), would they let you know?

If you were in their shoes, had immunity, guys with guns, and billions of dollars, would you not find the weakest link and exploit it? For saving the children from terrorists, of course.
Redhat Discloses RHEL Roadmap (GNOME Defaults to Classic Mode)
That does seem to preclude dragnet requests. But what is google going to do when the NSA asks for all the mail from "foo@gmail.com"? Is NSA going to give some justification for why the need access?

Now what happens if the NSA issues thousands of those requests? They are not broad, they are for specific people.

As to following proper procedure, it appears rather strongly that secret procedures allows the NSA to request a hell of a lot legally and may not provide much safeguard for preventing abuse. We don't know because the procedures are secret.

Again, the companies in question appear to have little choice in the matter and that probably absolves them of a lot, but that doesn't mean the situation is ok from the view of what they were compeled to do.
The computer begat large scale information systems. Eventually, it brought open large scale information systems. What's more important, having people volunteer to go to a village in Africa and build some wind turbines in a poor energy deficient village, or providing free plans for villagers to do it themselves using local or very low cost materials?

That's a complex question in its abstract form, and I don't believe it always yields the same answer when applied specifically.
I'm about to start a new project and had the usual nodejs + mongo skeleton set up and ready to go. After reading the comments here, I will definitely be giving rethink a try. It just feels like rethink is headed in the right direction, whereas mongo is slowing down (maybe focusing on enterprise / profitability stuff instead of features and fixes?). just my 2 cents...
Thanks for you thoughts I do appreciate.

"There's actually a lot of Google employees who post around the web"

The overwhelming amount of people that would need help don't see or know who these people are.

I don't even know who these people are and I've been on the web since before there was a google. I know your name because I've seen it so many times in and around the "domain" business.

"then I think the answer is probably related to the scale of the web. Remember that Google gets billions of searches a day. There's also ~250M domains on the web."

Hence the problem. Google has tremendous power and is extremely profitable but isn't able to take care of all the people that it serves or touches. As a result people frequently feel they have gotten, for lack of a better way to put it "the shaft".

"That's why we look for scalable methods of communication, e.g. our webmaster console or webmaster videos."

One of those "scalable" methods has to be the ecosystem that serves the same function as the ecosystem surrounding Microsoft. The ubiquitous "tech guy" who you pay to figure it all out. Adwords is a good example. Easier to pay someone to do that that knows the lay of the land than to watch and learn yourself using the mass of info you need to know to do ad buys the right way.
Because they made it nearly impossible by only releasing half the code, not releasing any installer build, and only releasing parts of the build system.
Intro to JS Web Workers
At least you guys made the coolest mil-spec fun-loving totenkopf badges:

http://www.mymilitaria.it/Liste_02/images/x_mas_bregonzio_1....
I do not see how there is any cDNA involved in a plant that has modified genes.

Are you assuming that the plant is infected with a retrovirus?

A genome with a modified gene is not cDNA, and I'm not sure how to parse your comment so I'm basically trying to see if there was an error in your comment or an error in my reading of it.
13 Reasons Why Your Brain Craves Infographics [HTML 5]
In another words the entire discourse is about rhetoric and not about truth, apparently because the public can't handle the truth and the terrorists will use the truth to destroy our civilization -- dozens of terrorists... You know as compared to the needs and rights of 300 million Americans, I think this is perfectly reasonable. They even through in a little Red hate mongering to justify their case.
So true. On the other hand it would be insider if the company hired third party to collect information. It's s thin line but I think your'e right.
How about: 1. Use your technical skills to built something of value. 2. Use a small part of the inevitable monetary reward to pay Dropbox.
Some organizations don't allow it by company policy, regardless of whether it can be installed.
> Should they be keeping track of all newly-passed (and rescinded) laws, as well?

Largely, no, because it would be a spectacular waste of their time. Why? Because the regulations are usually microscopically focused on class of actors that (a) know they exist, and (b) have a vested interest in staying current.

Moxie Marlinspike's example of the undersized lobster rule is especially telling in how it goes against the very point he was attempting to make. On the enforcement side, this particular regulation likely affects fewer than 10,000 people in the entire country -- that is, people fishing commercially for lobsters. The public interest it serves is that fisheries are subject to the tragedy of the commons[1], and must be regulated to preserve these public goods. It's basically the equivalent of that little tag on your mattress that says "ILLEGAL TO RESELL" -- people joke about getting arrested for this. No, it's targeted at the vanishingly small number of people that sell mattresses commercially.

[1] http://en.wikipedia.org/wiki/Tragedy_of_the_commons

EDIT: Also, just a note -- laws are passed by Congress. Regulations are promulgated by agencies that have been delegated some task or authority from Congress ("we don't have time to draft/debate/vote on every little piece of trivia regarding airplane part advisories or what plants are on the invasive species list or what next year's technical specifications for automobile safety are -- FAA, USDA, NTSB, you guys have the experts and scientists, so here's your authority, now go and figure out the details and make it happen")
The great irony is I ended up hacking legal VMs. At least they're better about it now.
WWDC Parties Tonight? 
Are there any good WWDC parties tonight? The Scrbid party last night was pretty wild.
F12, browser mode: IE9 ;)
"Microsoft engineer" on Xbox1
Interesting article. Another take on federation would be the one espoused by the folks who created the WS-Federation spec. Their whitepaper (linked from the Wikipedia Page[1]) is an interesting read.

[1]: http://en.wikipedia.org/wiki/WS-Federation
Per the blog post listed from modern.ie, the IE6 VMs expire after 90 days and the others become crippled after 90 days. Sounds like more of the same.

http://blog.reybango.com/2013/02/04/making-internet-explorer...
In my (admittedly limited undergraduate-level) work with it, it seemed like so many of these anybody-can-program-just-use-icons-yeah! programming environments, which are super productive as long as (1) you know where all the buttons and knobs are (seemed like I spent ages looking for the right icon, wishing I could just type a line of code instead) and (2) you don't want to stray off the path assumed by the environment's designers (in which case the thing feels exponentially byzantine).
I prefer "slightly tannic, with notes of tobacco and new oak".
That may be true. However, the giant elephant in the room is the Utah data center.

This is a data center designed to, supposedly, store data on the scale of a yottabyte. I only say "a" yottabyte, because to assume even slightly greater than that is sheer lunacy.

That is freaking massive. If you took all terrorist cells and all terrorist activity for the history of terrorism and terrorist activity, you would not even touch a fraction of a percent utilization. We're talking rain drops in the ocean.

There is no way the NSA is merely watching the bad guys here. The data center is a few magnitudes too large for such a task.

I would assume right now they are merely recording all data, in hopes that one day they will have technology to quickly crack encryption. However, even without knowing what is said (the content), the metadata of connections gives plenty of information on what people are doing.
They have access to IP+time, your search query, and cookies for correlation to other requests. It's valuable information and Google openly documents that they are keeping and using it, along with anything else you leak to them: http://www.google.com/policies/privacy/

IP+time is enough to get your personal identity information from your ISP (physical location of the endpoint, billing information), I have no idea if Google's relationship with ISPs is good enough to buy that or if it's only available to cops.
You can't just assert that it exists. You'd have to show that it exists.
Universal Paid Sick Leave Reduces Spread of Flu, According to Pitt Simulation
Hackintoshes are great... if you're content never to update :/
It sounds like they need training and skilled labor, not hackers.

Could a bunch of hackers get together and say "I know, lets roll Yet Another(tm) online training service to teach these doctors how to use and maintain complex medical equipment that we know nothing about!"? Sure, a bunch of hackers could say such a thing. But is the real problem here really a lack of technology for online training?

If you really want to attack this problem, you would talk with the donors that donated the equipment in the first place and work on allocating the donations in a more sensible manner. That could be as simple as prioritizing donations to teaching hospitals and using some of the donation money to attract and retain skilled teachers instead of just using it all on equipment.
Based on the leaked PRISM presentation, they could send your search log to NSA, and NSA can identify you based on your IP address that your ISP provides.