skysight-inc/HackerNews huggingface dataset:
> These "serious cryptographers" really never seem to deliver usable solutions

When people say a crypto product is "broken" they have several different meanings.

Ignoring one-time-pads every crypto system can be, in theory, broken by brute force. The time taken to do the brute forcing might be billions of years, but in theory it's possible. This is the edge of what we currently know about math.

Anything that can be cracked quicker than brute forcing is regarded as broken, even if that attack is still not feasible. A crypto-system that takes 100 billion billion years to brute force, but 10 billion billion years with some other attack is still regarded as broken. At that point people would tend to stop working on that algorithm and move onto something else, or they'd try to improve that crack and see if it can be combined to make something feasible. Don't forget that the bad guys keep their secrets secret. You will not know if they can break your product.

This can be frustrating for people developing software. "But wait, no-one can actually use that flaw to break the crypto, so it's still secure, right?" Well, not really.

And then that algorithm, the math, has to be turned into code. This is hard because you need to know what the language is doing, what the compiler is doing, what the hardware is doing. Any flaws in the algorithm could be magnified by implementation as software.

Just as an example of people keeping secrets: Diffie and Hellman invented a practical key exchange in 1976; it had been independently invented -and kept secret- in 1974 by Ellis, Cocks, and Williamson at GCHQ. GCHQ made this public in 1997. Even though key exchange was in use by very many people all over the world it was kept secret for about 25 years.

Clifford Cocks invented RSA a few years before Rivest Shamir and Adelman did. (Not only did he do it before them, but because he wasn't in the building he did it in his head. (He wasn't allowed to write anything down.) He had to go to sleep and hope that he still remembered it in the morning.) And, again, even though RSA was in use daily by very many people GCHQ still kept it secret until 1997, about 25 years.

> Cryptocat managed to bring cryptography to the masses

No, it really didn't. CryptoCat gave people a false sense of security. CryptoCat gave people the illusion of secrecy. Cryptocat didn't give people a usable safe product.

> usually no "serious cryptographers" have managed with the same thing.

The cryptocat developers would do far more good by using their knowledge to make existing tested products easier to use.

You appear to be ignoring PGP / GPG; SSL, etc, which are used by many people.
KiTTY - A PuTTY Fork
The Snowden Case
eh, I've said that many times. I've even said it on HN.
I'm not surprised by this news at all. The technical means have been there for years and years.

Have you thought through the implications of this? To me capturing and storing all the information we generate is really dangerous, and there's no way I'd want a log of everything in my life to be accessible to my secret service, my government, police, and the secret services of anyone they might wish to share it with (in particular the NSA) in secret and without my permission.

You've carefully avoided stating an opinion on these actions of our security services, but presented it as a fait accompli that we may as well just live with. I disagree. They've lied to us about what they were collecting (everything) and lied to us about what it is for (terror). I see no reason to trust any assurances or controls which are introduced on access, and the only way to stop abuse is to stop collection.

It appears they're not yet at the point where they can store all information indefinitely, but that point will arrive soon, and I think we should stop them before it does. I don't even trust the current politicians and police with this information on every citizen, let alone any conceivable politician who might come to power in the next few centuries.

IMHO we should have strong protections banning outright the collection and collation of this sort of material except where there are reasons to be believe someone is a serious criminal (violence, fraud, terror), with judicial oversight, for a limited time, with the data deleted after the trial. Just as the police are not allowed to demand DNA samples from entire populations in order to solve a crime, security services should not be allowed to store our every move and thought in the name of defending liberty, it makes a mockery of the concepts they claim to be protecting, and is extremely dangerous in the long term.
I have seen it. I am a middling programmer at best. I guess I need to step it up.
Tabulous.js - A jQuery tabs module for todays web
Thanks! Glad to hear you like the offer.

Unfortunately we don't have a English or German site yet. But we do plan to launch our English site later this year. I hope we'll see you then! :)

/Jonathan Gabor, Product Manager at Cloud Royale
And for what, with surveillance like this, how is there still crime and terrorism?

either it's ineffective
or they're overselling the capabilities
or they're more interested in dissidents, and judging by the way activists and whistle blowers are being treated, i suspect this is the real reason these systems exist.

EDIT: Or there's some other threat none of us know about and these systems are working perfectly at keeping us all safe... but that's a long shot.
Troll.programmer? Placeholder forgotten there? How.the guy email.ended there in first place?

EDIT: whooo! I write a question, downvote-fest!!!

For context, I was the first comment, and I was genuinely curious. But thanks for the downvotes and no reply.
> Doing is always good.

Until the government cracks the crypto used for your messages and locks you up for life.
Why searches like youtube work very differently/bad on mobile devices?
So why do searches like youtube and google work very differently/bad on mobile devices? If I search for example a song on my iphone on youtube, I often cant find the official song in first few pages of results, but its always the first result on computer.
ODesk vs Elance: Why It’s a Battle YOU Won’t Win
iPhony
What?

Alt-3 works just fine me on a UK Mac for making a #. I have made no tweaks.
You've carefully avoided stating an opinion on these actions of our security services, but presented it as a fait accompli that we may as well just live with

You want my opinion? I agree: it's very dangerous for the state to have detailed information about an individual's life. The potential for abuse is enormous.
Elsewhere: "Cryptocat Passes Security Audit With Flying Colors". "It’s no secret that there was a lot of celebration here at Cryptocat over these results. Completely passing an audit with zero weaknesses or vulnerabilities is a rare event even for very high-profile software. This is perhaps Cryptocat’s greatest achievement yet."
I think you're splitting hairs here, and you understand what the intent of my statement was, but I'll take your point about my choice of words.

I agree there are certainly exceptions, but most corporations put profit above all else, and if they don't, then as you say, the executives or the board will be fired and replaced with people who will.

"Legal obligation" may have been inaccurate wording, perhaps "structurally obligated" or "internally compelled" then?

In the end, it's the same outcome..
These slides are not nearly as clear-cut as you imply:

http://www.techdirt.com/articles/20130701/00444723675/newly-...
Thank you. I find that information far more interesting than whether you are surprised by surveillance, but perhaps that's just me.
Show HN: Yes Slash No. Deploy a Yes / No website. Fast.
But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" and "unqualified".

This is the entire problem. Funnily enough, I imagine the original implementers of the major crypto libraries we use today and take for granted would probably equally be called "idiots" and "losers" if judged by today's internet crypto heroes.

The crypto community is flat out toxic. You ain't gonna see progress from anywhere until the situation changes.
Would you mind elaborating on these problems? I assume all of the 'Oh's mean it is broken?
On a certain level they would be right to complain. Tarsnap has a flaw: buses.

The problem is that Tarsnap is one person. If Colin dies suddenly (in the sysadmin world, the primary cause of theoretical death is buses), you have a problem. Say your account is down to €10 and you have 100G of data stored in there when when the #10 express mows down Colin. You might not be able to get it back since you can't top up your account now unless your method of payment is fully automated on his side.

Looking over his website, I don't see if there is a Colin-backup plan anywhere. There should be. Until then Tarsnap should be one of your backup systems - not the only one.
His "jerks" point still stands though. You just called him insane because he made a couple of careful wrong assumptions and tried to verify them.

Yes, crypto is serious stuff. Yes, people should be warned about insecure security products. No, you don't have to be a jerk while doing that. See for example jdiez17's reply for what I think would be an effective and persuasive approach.
He's not mischaracterizing the way crypto software is developed. You are.
We need to stop being so blasé about the way countries spy on each other and the general public. No, it's not anything new. Yes, spies spy, that's their job. But it shouldn't be their job.
SnapKeys Adds A Second Software Keyboard To Its Qwerty-Attacking Arsenal
Relatedly, does it use Square's "Cloud Saves" (ho ho ho)? I've got the square version, but it was largely unplayable because you when the cloud servers are down / timing out (as was the case 9 times out of 10), the load / save functionality would be disabled (can't even load or save local files :-/). And then after playing for ~20 hours, the game decided to overwrite my save file with a cloud backup from ~19 hours ago...
Windows of Opportunities with Gold, could this be true?
Maybe the FBI was just using some discretion. Afterall, they're not supposed to be the dept of pre-crime.

It's interesting news for sure, but using this to bash the FBI seems especially one-sided.

Had the actors in this story been different, I think the reaction would be different. Had LulzSec planned to attack some company but never did, and then they all went to prison for that, but it turns out it was just a bunch of people trying to impress each other with grand ideas, where would we stand on that story?
All countries spy.

USA, UK, France and the rest of the top produce. The rest buys.
I can't imagine a world where the unsophisticated "consumer who wants a solid, fast browser that just works" doesn't just use the default browser that comes bundled with the OS. Safari and IE are more than capable to fill that role these days.
Why commission only sales does not work for startups
Creating a Minimal-Footprint WebAPI Project with VS 2012 and ASP.NET MVC 4
How Exercise Can Calm Anxiety
Just like with small countries acting as offshore tax havens, is there a case for setting up a lot of cloud services in countries that neither have the technical capability or simply do not care what data is stored with them?
Of course on the way there data pass through routers of at least one country that siphons the information and using satellite internet connection is costly :(.
GPUs are great for array processing. Not all workloads fit that model. That's why computers still come with a CPU.
Income Tax Department Seized Rs 2,500 crore from four trucks in Mumbai
No, you didn't miss anything. I just felt the thread had drifted more than you appear to feel. ;-)
Do they have IPv6?
Well, yeah, in the end it all comes down to who you're willing to trust. So it's everyone's personal choice.

Personally, the only "web company" I'm willing to trust, is Mozilla. And that's probably the result of the fact that they're not-for-profit. And that fact eliminates a great deal of potential for corruption.
So Zynga was originally going to call the game "Themepark" but Eric already had that domain, and so they changed it to "Coasterville"?
Thats around US dolloar 450 million thats incredible Indian corrruption
Gesture Writing
Still waiting for a proper HD rerelease - fans have already hacked the game to load high-res character models / sprites / menus / etc; but it looks silly with 1080p characters wandering round a 320p world :(

How hard can it be to re-render an already-created CG scene with a few more pixels?
The connection between science, spirituality and emotion always make me think of Carl Sagan - largely as I was exposed to Cosmos at an early and impressionable age. In the "Demon-Haunted World" he says:

“Science is not only compatible with spirituality; it is a profound source of spirituality. When we recognize our place in an immensity of light‐years and in the passage of ages, when we grasp the intricacy, beauty, and subtlety of life, then that soaring feeling, that sense of elation and humility combined, is surely spiritual. So are our emotions in the presence of great art or music or literature, or acts of exemplary selfless courage such as those of Mohandas Gandhi or Martin Luther King, Jr. The notion that science and spirituality are somehow mutually exclusive does a disservice to both.”
Was this leaked by Snowden? If so, it might explain why France blocked the Bolivian president's plane from using French airspace.
Not entirely irrelevant. From what I've read, downloading directly from the Play Store has been taken care of. That probably also means the Play Store / Play Services verifier for sideloaded apps is checking for this exploit.

That being said people who use other app stores and don't have Play Services (e.g. Kindle Fires, Chinese devices, etc.) probably have some legitimate room for concern (at least until those stores are in the loop and are taking countermeasures). Of course that's nowhere near 99% of Android devices, but why let the facts get in the way of a good headline?
Ok, so it seems this thing that we call free society is rapidly going off the rails. In addition to GCHQ and this crap from France, Netzpolitik.org recently dug up some interesting info on the publically known activities of the German secret services, which include tapping sea cables[1] and listening in on 5% of DECIX traffic[2].

So we now know for a fact that, while the general populace was blissfully disinterested and the techie crowd was mostly playing with its new toys, the intelligence community started building an all-encompassing global surveillance infrastructure. If we don't manage to pull off a roll-back now, our children or grandchildren will live in an actual science fiction dystopia.

My feeling is that we have a very small chance to achieve a roll-back in (continental) Europe, because the uncovered actions of secret services here are much more at odds with the societal consensus on the accepted powers of the executive. For the big five prospects are IMO more bleak.

[1] http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...
[2] http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...
GNOME 3 is a perfect, and very recent, example of what you're describing.

It was open source programmers who made GNOME 2 and earlier a successful, usable desktop environment. These were very technical users who created software that generally worked well for their purposes, but incidentally also worked well for other, less-technical users, too.

Yet at some point, we saw the number of "designers" and "UI experts" start to grow, and eventually overwhelm the number of programmers. The "make it usable by everyone" mantra took over, but without the skill and sensibility we saw from programmers alone.

The end result has been GNOME 3. At best, it can be considered one of the worst open source disasters of all time. Its designer-driven development process and subsequent lack of usability and quality has alienated many programmers. These are exactly the kind of people who shouldn't be alienated, because they did things right in the first place. Aside from a few odd cases here and there, GNOME 3 is generally hated by anyone who uses his or her computer to do real work.

And what you say about seeking alternatives, or even creating them, is very true. KDE and Xfce benefited immensely from the GNOME 3 debacle, accepting many of the talented and valuable GNOME "refugees". MATE and Cinnamon have been born to try to fix the problem, as well.

GNOME 3 isn't the only example. Firefox is another good example, and obviously quite relevant to Opera. It has been systematically dumbed-down basically every release starting with Firefox 4, which has rendered it far less useful than it once was, causing many advanced users to abandon it.

Opera does indeed appear to be following this same path, unfortunately. Opera 15 has the same feeling that GNOME 3 does, in that it is a regression from the previous versions. Discarding so many things that make Opera 12 and earlier such a great browser just isn't a good way forward.
This is great. Do you have a waiting list so that we get informed when you start allowing international registrations?
We've also had a lot of traffic to https://starthq.com/apps/?q=reader as people look for Reader alternatives. Google should do this more often.
I do much the same thing with two Evernote notebooks called "App ideas" and "App ideas feasible". Every new idea, no matter how silly, goes first into "App ideas" and later into "App ideas feasible". It's also interesting when something moves from the feasible list to the former.
One of our former presidents, Mitterand in the 80ies, used intelligence services to eavedrop phone conversations for his own needs.
You'd think people would revolt, but more recently in order to operate the "three strikes" law and HADOPI they delegated the monitoring of P2P/Interenet trafic (in order to check for IP rights violations) to a private company.
We have laws about the privacy of communications too (like paper mail), but strangely nobody seem to realize they plainly apply to electronic communications.
I really don't like it but I can't shake off my smug European sense of being weirded out when I read about how atheists are seemingly treated in America.

Is it really as bad as it's made out in this article or on Reddit? Do your neighbours really get into your hair because you don't have a faith?
Allow the results to speak for themselves.
Graeme Obree says all bikes are the same - just different paint jobs.
The lost [meaning of the] art[?] of trolling.
The hardest part of this to read for me isn't the vulnerability, but rather:

2011 Passwords: BPKDF2-HMAC-SHA1 with 1000 iterations
2011 Passwords: BPKDF2-HMAC-SHA1 with 600 iterations
2011 768 bit RSA
2011 512 bit RSA
2011 600 bit RSA
2011 1280 bit RSA
2011 1024 bit RSA
2011 1048 bit RSA
2011 1536/1152 bit RSA (Chrome/other)
2011 1536/1024 bit RSA (Chrome/other)
2011 "3072 bit" D-H
2011 "3072 bit" D-H
2011 "4096 bit" D-H
2012 ECC Curve25519

(edited for clarity)

Major red flag. The difference between symmetric-keyed password-based encryption, RSA, Diffie-Hellman and ECC (presuming ECDH?) isn't minor; it isn't a feature-level distinction. These are radically different designs. I'm not sure I've ever seen a system as popular as this so quickly take a tour of so much of cryptography. How could anyone have any kind of grip on the safety of a system that fundamentally changes its crypto constructions so often?

A lesson here: if you have to implement cryptography --- and you and your users would be much better off if you didn't, and rather relied on a standard implementation like PGP --- do one thing and stick with it. Think of it like being a little kid lost in a shopping mall. Don't make it harder to get found.
Quite hard, because all the backgrounds are bitmaps. It's an unfortunate era for that - Final Fantasy X looks fantastic on a modern system, because it can be rerendered at higher resolution.
Alt-3 for # working fine here (in the UK). You might have non-standard shortcuts set up in System Prefs > Mission Control or an odd keyboard layout installed.
Being CEO Sucks
We redid the Moto X ad à la française
Independence Day is a universal concept. This is how we do it in France :)
Critical Vulnerability in Cryptocat
This is the most important take-away. They're not just incompetent at crypto, they're incompetent at programming.

And they don't understand that they don't understand programming.
Note that, assuming the security model proposed by cryptocat, every time it's broken a few hundred peaceful protesters against a brutal regime end up against the wall. The brutal regime obviously doesn't bother to tell the world to stop using the software in question.

(In reality, it's not that bad because quite a lot of people distrust cryptocat. Still, "patch and move on" doesn't cut it for critical software, which almost all crypto software is.)
If the FFX/FFX-2 remake will sell, i'm sure they also do VII.

The problem with these remakes is that the original assets are in crappy resolutions so they'll basically have to remake everything. And that takes time. And Square is not exactly known as being a efficient company.....
Crytpocat have now posted a reply:

https://blog.crypto.cat/2013/07/new-critical-vulnerability-i...
I stand by the GP. It's really not that hard for federal employees to transfer: what's hard is getting on board. It's largely done online, so your friends can check it out.

https://www.usajobs.gov/
I think you're being unfair by painting them all with the same brush. But there is definitely a 'tone' in that community that I find very off-putting.

This thread was interesting - tptacek seems like a nice enough guy - he's very helpful here and certainly knowledgeable, and generally pleasant to interact with:

https://news.ycombinator.com/item?id=5776111

I agree with you that the "don't do that" attitude seems a bit... binary. Who decides who gets to do what? At what point does it become 'ok' to do crypto stuff? What kind of crypto stuff? Putting together pieces like SSL and GPG? Writing crypto libraries? New crypto algorithms? I'm mostly a believer in leaving the latter to people who have demonstrable competence in the field, but lots of people need to put together pieces in some way and the "don't do that" attitude does not really solve that problem.
Show HN: My iOS pet project app
Today my pet project app "iLearn: English" (https://itunes.apple.com/app/ilearn-english/id624466757) was released. I developed this app with the intention of helping my wife to learn English.
Some of those unsophisticated consumers are still using Windows XP (or Android Gingerbread or ...).
Because I like the comfort of familiarity, and hate change or surprises? It's a reasonably common personality trait among programmers (I can put a medical label on it if you want). When I first saw it I spent a while trying to figure out what was wrong with my browser.

Ultimately I don't see why that matters though; understanding why it's bothering me isn't going to make it not bother me.
The game seems hosted on a themepark.zynga.com subdomain, so yeah.
The best way for you to be useful to the world is to be a good child to your parents, spouse to your partner, parent to your child, and friend to your friends. You don't have to embark on some quixotic 'save the world' quest to be useful - just taking care of the basics is huge. Many many many people mess this up, including many of the ones who think they're off saving the world.

Right now you're trying to learn skills that will make you economically secure - which will make it far easier for you to be a good child to your parents, spouse to your partner, parent to your child, and friend to your friends. In other words, you're doing exactly the right thing. Carry on with it.