skysight-inc/HackerNews huggingface dataset:
To rephrase, the article seems written from the idea that the journalists have found some innovative change in how the law was applied by the FISC. But it's not really innovative since the journalists didn't understand the reason why 'relevant' in this context would not be the same 'relevant' from the Supreme Court case they were discussing. They are trying to play law and messed it up, must like the first time I used Python I messed it up because I didn't realize that it's pointers, pointers everywehre.

So PRISM and all the rest may very well be bullshit, but it will be because it's actually bullshit and not because (in this case) some reporters have spotted some glaring bright-line change instituted by a panel of 12 judges.

The risk with these types of arguments is that the technically skilled opponent points out the flaw in your reasoning and derails the whole thing, even though your overall point may have actually been valid.

In this case, the government can go 'No conspiracy here, the reporters didn't understand that the definition of relevance for these cases comes from <whatever case law>, so all hunky-dory now, eh. Oh look, Egypt!'
Its kinda nice of a list thanks :)
I'd add here.com as proprietary maps. Its actually pretty good. yes its proprietary - but even having proprietary alternatives is good.

oh also gallery3 should probably be in there.
エルメス  が日本一安い！ エルメス 専門店 激安販売エルメス 財布/アクセサリー
エルメス 正規品のみを国内正規取扱店の価格よりお安く販売しています。エルメス 財布/アクセサリー商品幅広く取り扱っています。全国迅速発送で送料無料です！！！
Not really. Both PS4 and XBox One pretty much sport near off the shelf PC CPUs and GPUs. They're a lot closer to a PC architecture wise than a Wii U is. Well the Xbox One is a little harder to program for since it doesn't have unified memory.
Indeed. To quote myself in another reply:

> Although proprietary software may be easier for a government to compel to be modified to add tracking, it still runs the risk of being noticed in most reasonable cases, and there is in fact no evidence that any Western government is doing any such thing. It does increase the chance that you are being tracked due to incompetence, but I don't think this is particularly likely for such well-known software.
It's not just the errors that were made though. I mean, ignoring the off-by-one error:

repeat
byte250 = randomSalsaByte()
until byte250 <= 250

I am not sure what sort of code-review process they had in place if someone saw that and thought "Yup, brilliant. Ship it." I am sure we have all written code like that at one point in our lives, but code that is shipping to the general public?
Thanks for the explanation, definitely an interesting routine and the performance numbers he touts in the blog post make it something I'd definitely look to test on my own
It is possible to send data along with other data so that it's reaaally hard to find. Also, they don't need to send data all the time, but rather activate this mode on request, say when a person using this browser is a suspect for some reason and govt needs to track his every move on the internet. This would make detecting of such a functionality virtually impossible, because it'd be turned off most of the time for most people.
It varies wildly depending on exactly where you are and how much money you're spending, from "not available except via satellite" up to "widespread wifi."

Economic development is extremely uneven in South America compared to the US or Europe. If you're in a $2,000 a night luxury hotel in Buenos Aires, it's likely that it'll have adequate wifi hooked up to broadband. If you're in a $10 a night hostel in a rural area, you'll be lucky to be able to stand in line to check your e-mail on a shared 15 year old Dell with a CRT on a dialup modem.

Another complication is that even in many of the places with adequate broadband, access to locally hosted sites is reasonably fast, but there are very few overseas pipes leading out of the country. Hitting US or Europe based sites will usually be much slower than hitting an in-country site.
> Why does everyone want to tie significant amounts of their lifetime earnings into physical property that historically has had very low appreciation in value?

I've tied a significant amount of my lifetime earnings into dining out and purchasing music and I can assure you that neither of those has much of a resale value, especially the former.

I've never understood this crazy, if not outright insane obsession with maximizing appreciation value. It's like people have forgotten that we make money so that we can spend it making ourselves happy.
Maybe at a high level, but OLAP involves precomputing aggregations and bit indexes. It's a pretty different beast.

OLAP is very rarely under real-time constraints and, when it is, it tends to push the heavy lifting out to OLTP.
Pac Man’s split screen bug analyzed and fixed (2011)
Does it? That's not how I read it, but I'm not a Constitutional Lawyer. Here's the full clause

"The Senators and Representatives shall receive a Compensation for their Services, to be ascertained by Law, and paid out of the Treasury of the United States. They shall in all Cases, except Treason, Felony and Breach of the Peace, be privileged from Arrest during their Attendance at the Session of their respective Houses, and in going to and returning from the same; and for any Speech or Debate in either House, they shall not be questioned in any other Place."

I guess the semicolon can be interpreted in two ways, although I interpret the Speech or Debate clause as being only after the semicolon; the use of "and for any..." also does not seem to exclude felonies. Logically the clause would also seem to lose any bite it might have if things the legislature declared a felony were then excluded from Speech or Debate. But again, IANACL.
I don't think you or I, or even Google knows the total set of their options, but we can sit here and come up with some alternatives.

>Only at the cost of not providing the service that users want, which includes such things as fast, full-text email search,

e2e encryption is completely compatible with fast, full-text email search. There are several companies that currently offer such services, that is webbased, fast searchable email, that is e2e encrypted such that no plaintext arrives on the server side (unfortunately I am under an NDA or I would tell you more but you can read the papers if you like). Stuff like this: http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-...
It's not just databases it's search engines as well.

I think gmail probably loses some enterprise clients because they don't do this, but I expect "enterprise level" features like this from gmail in ~2-3 years by my guess. Probably sooner due to the nosedive in trust they just took.

Google has a monopoly on new email account creation so they don't need to innovate to get new customers (hell android locks everyone in). It isn't outlandish to suggest that they could have chosen to innovate and done what has been in the research literature for some time now. Secure e2e encrypted cloud email.

>recovering accounts after passwords (and other security tokens, if any) have been lost.

Have you tried to get gmail accounts back because I know people that have lost all their email. Are they better at this now (maybe they are, I hope so)? Even with this as a requirement, it is achievable. The user's client just sends a copy of the key to a foreign key escrow service that will unlock their account if anything happens once they prove they are who they say they are with various forms of ID and proofs of knowledge. Paranoid users can elect not to do this. Or ask people in your circles that you have marked as trusted to attest to your identity. You could do some clever threshold cryptography with your closest family and friends.

They big trick is making money off ads while not learning about the contents of the email. One way could be a bounded leakage strategy whereby the encryption scheme allows some ad matches without giving up more than one or two popular words per email.

All of this is a sideshow though. The NSA wasn't going to throw the Google execs in jail for not towing the line. Google is an extremely powerful company with a strong lobby in Washington. Not to mention that just pressing the charges would be a major embarrassment for the NSA. Twitter fought and won. Likely they just offered Google some nice contracts with the US government.
You seem to be assuming that tracking only happens either through incompetence or government mandate? Companies also track users to make money. Just today there was the news that twitter is starting to track its users, for example (at least it is opt-out).
To emulate the way that blockquotes show up in most webpages nowadays (offset to the right with a border-left of some sort). I'll note that mutt accepts '|' as a quote character in addition to '>' (for highlighting purposes). If you look through my post history, you'll see that I'm not 100% consistent. Sometimes I use '>'.
Is there anything wrong with that? If the Kenyan Shilling is as important as they describe in the article, then why should they have to be stuck with a second rate symbol using latin letters? Do you think the Euro should just use $ or EU$ or something else that doesn't convey the fact that the euro is not called the Euro dollar, but has its own name?

One of the reasons I like using OS X is that, from what I can tell, 99.99% of developers don't have to worry about this stuff. They let the system handle text and font rendering, and when the new Kenyan Shilling symbol is adopted, their apps will render it without having to do any work.
Chrome's sync service also features client side encryption. [1]

[1] https://support.google.com/chrome/answer/1181035?hl=en
Thank you for expressing it so eloquently.
It is possible. However, considering that it would only take one person being exceptionally curious with IDA, one employee to blow the whistle (the source is still "open" to a fairly large number of people, and a backdoor is far harder to hide than passive collection of existing data), or one slipup to cause a massive amount of PR damage, and this has never occurred, nor does the Snowden leak suggest this is happening, I personally consider this claim extremely improbable. YMMV.
I love these kind of "articles." I wonder who gigaom has money riding on?
You should probably read the original research paper if you're curious: http://arxiv.org/abs/1209.2137
I call that thing a nubbin. I don't even know why.
Microsoft banned Google, VMware, Salesforce employees from WPC 2013
>>It's just not clear what happened here

Do you mean that the statue or intention of congress was unclear or that it doesn't matter whether it is an article III court or not?

There is a tremendous amount of evidence that congress intended the FISC to be an article III court. Objections were raised specifically on the basis that it would extend the judiciary into policy making or not be a constitutional valid subject for an article III court.

Several courts since the 1980s have considered the claim that it is not an article III court and have rejected the argument every time it has been raised. (see United States V. Megahey or the second circuit appeal)

I think it is an important question for a couple reasons:

1) the minimization procedures that the court must approve are an extension of the warrant power that the court is granted to satisfy the fourth amendment.

2) the warrant power itself is generally understood to require a judge where a warrant is required in the first place(see keith 1972). Of course, there are cases where it is possible that an independent officer(not a judge) can satisfy this requirement but it is difficult to see how judicial oversight can be excluded in this case.

3) congress intended (by the committee reports) that judicial oversight was the only valid means by which the executive could be checked. Simply requiring documents wasn't enough for congress.

EDIT: reply to below

I understand the requirement that the constitution sets out for judges to apply to them specifically and not to any individual court. Thus temporary courts or tribunals(composed of judges that were appointed to other courts) can act as a proper article III court.

In terms of the subject matter of article III courts the constitution says that: "The judicial Power shall extend to all Cases, in Law and Equity, arising under this Constitution, the Laws of the United States, and Treaties made, or which shall be made, under their Authority;" I don't think it requires that every court necessarily can consider all cases that the judicial power is entitled to hear; it only acts as to set out what the maximum subject matter that a federal court can consider. There are other courts like the FISC/FISCR that also have limited subject matter jurisdiction under statute such as the United States Court of International Trade that only hears customs cases yet it also an article III court.
Technologically it's really only a matter of time before storage gets to a point where keeping months of coninuous 1080p video isn't a big deal, it'll fit on a square cm and cost a pittance.

But that's not the scary part.

The scary part comes later, due to massive increases in computing power. Imagine a world where, say, computers with terabytes of RAM and thousands of high performance cores are run of the mill server systems. And then it's not just a matter of people storing data but analyzing it, and collating it, deeper than we think is even remotely conceivable today.

Face recognition, voice recognition, biometrics, kinematics, writing style, and of course metadata will make public an astounding amount of information. A video of a random group of strangers will be trivial to index and identify every individual through the above techniques. A shockingly detailed account of everyone's lives, where they've been, who they've met, what they've purchased, and so on will be determinable using, eventually, relatively little cost in computing power.

Here's an example, let's say there are only a handful of pictures or videos from inside your apartment, imagine if every book on your shelf, every knick knack, every belonging was automatically identified and indexed. It's a world that rapidly spins away from any sort of world we're comfortable or familiar with but we probably won't figure out how to deal with it until well after we've been subjected to the worst abuses and invasions of privacy.
Our great cosmic motion
Although it relies on Mega and Chrome, neither of which is recommended in the article, http://www.nimbusvid.com streams encrypted videos from your private cloud storage in your browser.

No other service does this and it allows you to have the convenience of the cloud and video streaming while maintaining the privacy that you would get by viewing videos on your local computer.

As far as I know it is one of the few examples of a (client-side) web app based on encrypted cloud storage. (I would like to know other examples, I don't know any).

(I am the author)
I'm more surprised that Mint is being suggested at all in this. Considering how ridiculous this list is in the first place, the 'curator' should have noted that Mint, by default, installs search engines that are partnered with Mint[1].

Even more surprising is that BSD just got a cursory mention. You may as well switch to OpenBSD if you're going to switch to a majority of these alternatives.

[1] http://www.linuxmint.com/searchengines.php
Hi, I'm one of the team members who has worked on this project. If you have any questions, I'd be happy to answer them.

There was another thread on HN about Immersion a few days ago [1]. Do check to see if any questions you have were already discussed there.

Thanks!

[1]: https://news.ycombinator.com/item?id=5994203
> Since the 70s seemly all mass vacinations related to H1N1 caused more damage than the disease itself.

Do you really think anyone will believe that if you don't give us a source?

The 2009 H1N1 pandemic alone killed between 151,700 and 575,400 people[1]. CDC estimates that in USA alone, 11,690 died and 257,000 ended up in hospitals[2]. I can't find any source that brings vaccine deaths to anywhere close to that.

1. http://www.thelancet.com/journals/laninf/article/PIIS1473-30...

2. http://www.cdc.gov/h1n1flu/vaccination/public/vaccination_qa...
JavaScript currying with the curry library
I keep seeing articles about Go where Python developers seem to be shocked to discover that interpreted dynamically typed languages are very slow. This wasn't obvious from the get-go? Practically anything not disk bound will be many, many times faster in C++ or whatever.
Help me understand how Congress can create an inferior federal court that isn't subject to the rules of Article III? Doesn't an Article III court require appointment by the President, confirmation by the Senate, lifetime tenure, and power over all cases arising under the Constitution?

Thanks for Megahey! Reading now.
How does Google create one of the most carefully guarded TLS connections? Should other sites model their implementation?
Tracking in client-side software that occurs to make money is typically described in privacy policies, and a browser adding additional tracking would likely cause an uproar. While Firefox may provide a better default regarding sync, there is a difference between saying "stop using Chrome" and "enable client-side encryption".
By controlling both sides of the connection, and by investing in people like Adam Langley. And yes, other sites should. Not "control both sides of the connection", which is unrealistic, but in modeling their server configurations on Google's so they can take maximal advantage of Chrome's TLS features.
One difference is API e.g. for compressing an array of integers in Java, you say int[] compress(int[] toCompress) i.e. it natively works or Java's int[]. While it's true that the layout of data in memory could be re-interpreted as a byte array, you avoid cumbersome casting (which, by itself, might incur cost in languages like Java where you can't just party on memory via pointers).

Another difference is that a custom algorithm for compressing integers might gain speed/compression efficiency from exploiting statistical properties of integers e.g. it's a safe bet that in most cases the highest byte of an int is 0 (i.e. integers are are small).

Or in many cases a delta encoding is very effective (i.e. {5, 10, 15} => {5, 5, 5} which is easily encoded with run-length encoding).

Of course if integers are randomly and uniformly distributed they are just as un-compressible as random, uniform distribution of bytes, but in many real-life uses of integer arrays that is not true.
> None of the proprietary browsers will track you

By default Chrome sends the text you type in the location bar to Google. I am not sure but they may also use visited urls to source the crawler.
Just FYI, in case you weren't aware of this:

When you log out you have the option of deleting all of your metadata, and we also provide you with the link to revoke Immersion's access to Gmail.
>Python somehow magically slices unicode strings without chopping characters in half.

You need a byte offset to slice a string, and it's impossible to convert from a Unicode rune offset to a byte offset without parsing the entire string up until that point. I'm not all that familiar with Python, but if the language works as you implied, it is basically doing this behind the scenes in common string processing tasks:

1. The user uses some kind of pattern matching function or whatever to find where they want to split the string. Python returns a rune index.
2. The user tells Python to go split apart that string along a rune index. It promptly begins parsing the string all over again until it finds the right byte boundaries.
3. The language then actually creates the new string in between the byte boundaries.

Sure, a Python implementation could statically optimize this, but... why should it have to in the first place? That's fucking stupid and should be considered a language bug when it could be doing this:

1. User pattern matches blah blah blah and gets a byte index.
2. User tells their sane language to split the string apart at the byte index and it just does so.

>I know real programmers keep the byte boundaries for all the chars in all their strings in their head at all times

When the hell would you have to remember the byte or rune boundaries for characters in the first place? Why would you be slicing up a string with magic number indices? If you're getting indices from pattern matching functions, you shouldn't care whether they're in bytes or bits or nibbles, you should just be passing them on to your language's split routines (or whatever else you wanted to do). Unless, of course, you're the one actually writing low-level string processing routines, in which case rune offsets are far less useful than byte offsets for the reason explained above.

This Python "feature" seems to exist entirely to keep newbies from getting confused when they attempt to slice up strings in their REPL, for I cannot fathom a reason why anyone would write "s[1:4]" in production code. IIRC, Python was designed for pedagogy, so I'm not surprised that it would take on such a pointless implementation cost just to spare teachers from explaining why "s[1:4] gave me question marks"
Maybe I'm missing something, but I find C#'s async/await much more intuitive (not having written any C# and currently working on a pet project using promises with Node and Q).

My issue with promises is that I find myself working around the API/language when I actually want synchronous code. My app calls a JSON API and then writes the results to three tables (in sequence). In "normal", blocking code:

results = getResults(); writeTable1(results.foo); writeTable2(results.bar); writeTable3(results.baz);

Using Node and Q:

db.load().then(()-> setupDB(db)).then(()-> collectData(db)).done()

In which setupDB() returns a chain of three promises and collectData, which loops through the results and attach a new promise to the chain in order to return a chain of `n` promises.

Are these just growing pains of learning a new paradigm or am I using the wrong tool for the job?

Can someone point me to any projects that actually use promises?
You are running the chi-square against the claimed distribution of the RNG, not against another RNG. Which is just about enough to use the RNG for simulating dice rolls ( sometimes, if the players are not too passionate). RNG can have a lot more subtile flaws, for example the RNGs from the ANSI C rand() with the suggested parameters lie in just a few thousand planes, if you construct points in some vector space out of the random numbers. ( That is bad, if you want to run Monte Carlo integration, because your error estimate improves, but not the accuracy of the result.)

So even for simulation you can have rather subtle effects, even though there you get bitten just by bad luck. The task for cryptographically secure random number generators is actually quite a bit harder, because a attacker tries to exploit any weakness in your RNG, but your tests do only tell you which specific attacks do not work.
There isn't much of a thought process. I opened an issue arguing for a more focused and defined modus operandi, but as it stands, the site is a community generated list.
I would absolutely not state, free of context, "you can always rent out your house instead of selling it." The context was being priced out of the market, in addition to the the mobile employment caveat (which I agree is a big if, but if your job is tied to the region and you can't afford to live there you're boned regardless).
Bay Area Housing is Still Pretty Crazy
Yes, I've been using it with a web service as a backup, but having it embedded in an app makes for a super fast and responsive city/state lookup on devices with potentially flaky connections.
Dropmysite is making website backups even safer with new monitor tool
I wonder - if you took in aggregate the time people spent complaining about Cryptocat could a more secure alternative have already been built? :-)

Anyway, I really enjoyed this article. Informative, interesting, and free of snark.