skysight-inc/HackerNews huggingface dataset:
They are not encrypted at all. Tor provides anonymity (nobody can say where the captured traffic comes from), not encryption (nobody can read my trafic). You should use independent encryption inside Tor.

I2P is similar to Tor, but encrypted AFAIK.
Create and Deploy Your Erlang / Cowboy Application on Heroku in 30 Minutes
Hmm, CALEA is really not the right law to be referencing. CALEA generally applies to wiretaps and specifically derives from telephony surveillance and is more relevant—and worrying—to a Twilio or SendHub, rather then DDG.

It's more likely to be a portion of the PATRIOT Act (Sec. 215 and possibly 217, h/t to Marcy Wheeler for the education here: http://www.aclu.org/free-speech-national-security-technology... and http://cyber.law.harvard.edu/privacy/Introduction%20to%20Mod...) or the specific update to it (Protect America Act of 2007, FISA Amendments Acts of 2008 and most recently 2012) to bring the warrantless wiretapping scandal back into "compliance," and seemingly updating PATRIOT for the current round of surveillance, which was likely reauthorized Dec '12.

Now, the FBI recently floated a trial balloon of what we're calling CALEA II, but that's focused more on compelling the providers of in-browser chat products to create backdoors for surveillance: https://www.cdt.org/files/pdfs/CALEAII-techreport.pdf It's not current law yet, and we're fighting to prevent the proposal from becoming law.

It's a point of precision that doesn't detract from the author's main point.

Just as an update, the legal debate is continuing over both the NSLs themselves and their related gag orders: http://www.networkworld.com/community/blog/fbis-national-sec... I'm not sure how or where this case escalated to, but the last time a court declared the gag order to be unconstitutional, it took an act of Congress to reauthorize it, which will be a difficult sell right now.

For a final note, here's a counter by the DoJ about how I'm wrong, for whatever that's worth: http://www.justice.gov/archive/ll/subs/add_myths.htm

And for full disclosure: I consult with Center for Democracy and Technology (CDT) on reforming Electronic Communications Privacy Act (ECPA) of 1986, which is a similar but not directly related issue.
Your opinion sure is.
"There are plenty of people outraged by the substance of what has been leaked who also don't like the idea of ... a 30 year old person stuck in a Russian airport who has appointed himself the ultimate arbiter of what is leakworthy and what is not, what programs are legal and good and which are illegal and evil."

Of course such determinations should be left to the professionals, our Supreme Leader, the oh-so-popular Congress and the stalwart defenders of liberty and justice: the Courts -- which are all so trustworthy, moral, and competent.. and who would never hide anything under the pretense of "national security" to cover their own asses, to grab more wealth and power, or keep the public from knowing of atrocities and crimes they, their buddies or their lackeys have commited.
Ditto. I first encountered "grok" in the early 1990s. I read Stranger in a Strange Land for the first time this year.
I think that your advice is itself pretty bad advice.

It is theoretically possible to hire someone like what you describe, but it seems vanishingly unlikely and much more likely to cause damage.

As many others have pointed out, each business is unique, and the fact that the OP has reached the level of success they've reached is proof that they have a fairly solid management team already. Most likely, they are falling prey to impostor's syndrome - "one of these days someone will discover I'm a fraud and don't deserve all this success".

The cure for that is not to give in to the impostor's syndrome, but to reject it by observing the simple evidence that someone who builds a $10m business in 2 years is clearly very talented and skilled.

Ultimately, if the OP doesn't want to run this business anymore, they could just sell it. But if they want to keep running it, there's no way to abdicate to some "adult supervision" that will magically make all the problems go away. It will just replace the problems with a different set of problems, specific to the new hire.

A better approach if the OP wants to keep running this company is to build some good relationships with mentors who can help the OP grow into the role.
There's three underlying issues here that drive these decisions:

1) Legal and financial risk, the adult industry sees a vast amount of fraudulent transactions. That's the primary reason that most financial institutions won't deal with it, but there are specialist payment providers who will.

2) Ethical reasons. Many companies won't work with tobacco, alcohol, gambling, porn and other vice industries because it doesn't fit with their corporate objectives.

3) Marketing reasons. Even if a company doesn't intrinsically oppose vice businesses, being involved can clearly impact public perception of the business. This is a much bigger deal if you're running a multisided business like a social network or an app store because it can cause your entire business to shift because of the feedback loop.
Well, this dualism is used to communicate important distinction: single value vs. multiple values, so streams return futures in the places where it is absolutely meaningful to do so e.g. first element of a stream can be obviously viewed as a one element stream but it is also a Future because it is at most one value.
Yes - for example this is done by /etc/init.d/urandom on Debian and Ubuntu systems.
It's a form of art. A bunch of people doing harmless consensual acts digging that deeply into your psyche actually makes it very strong and effective art.

Classifying something as porn or obscene is a personal decision that each individual makes.
What you're looking for is a mentor, not a hire. You need someone who's been around the block to give you pointers and illuminate your blind spots. You're clearly doing very, very well already and should be proud of it. Don't let yourself feel like an impostor. You're not. You've earned your success.
I did a year of Python. There are good and bad things with everything. Python was OK, the learning curve the first few weeks/months is really well planned.

I prefer Perl given a competent team. Mostly because of the CPAN Testers and because it is fun.

Bad with Python are details like e.g. no real one-liners. I also think there is something rotten with the language culture that e.g. results in lots and lots of language war trolls from 19-karma accounts on HN...
"...what are they going to do? Put Ballmer or Larry Page in prison for not obeying them?"

Sure, why not? It may sound ludicrous but do you really think it's beyond the realm of possibility? You should look up stories about the CEO of Qwest and what he claims happened to him when he said no to the NSA (in 2007) [1].

[1] http://www.businessinsider.com/the-story-of-joseph-nacchio-a...
This "blog" has one post and was specifically started to bash DDG.

I don't use the duck (yet?) but to me it looks like an attempt at black PR.

Even if the duck doesn't give full anonymity, I would still prefer it to Google - the new leaked slides revealed that NSA has direct access to Google, whereas with ddg, they'd have to snoop upstream.
All the people reproducing themselves at replacement rate in your society (religious people) say that porn interferes with their social patterns.
Twitter supports Do Not Track
Have you seen PDFjs ? (Javascript PDF reader from Moz)
Going with the "get good consultants/coaches" - if the coaches/consultants are good, and a good fit, then see if you can bring them on board.

Traditional "interview and put in place" hiring strategies are built around the needs of traditional large organisations with massive amounts of existing organisational momentum and plenty of time to recover from mistakes or retrain duff hires.

Small fast-moving companies don't have those advantages, and shouldn't hire that way. You're obviously innovative - don't forget to apply that creativity to your business processes.
38ª Conferência Anual Sobre Fundações Profundas
There are plenty of reputable lawyers, especially with the ACLU, who have been fighting in public courts against this secret parallel court structure.

Early on, claims were simply thrown out due to "state secrets," presented in sealed folders only to the judge. Over time, the lawyers and organizations gained experience (a la Minesweeper) and got more substantive rejections from judges. The first win was with Nicholas Merrill, about five years in, though it took another three or four years for the gag order preventing him from talking about it to also be lifted: http://www.aclu.org/national-security/doe-v-holder and http://www.wired.com/threatlevel/2010/08/nsl-gag-order-lifte...

So speaking with those sorts of lawyers? Who have won fights against this secret system through a public court of law? Yep, those exist.

Keep in mind, those we disagree with within the federal government aren't malicious or evil. They think they're protecting us, and they think they're acting lawfully. It's therefore reasonable to me that they see themselves as bound by the legal system because otherwise, how can they think of themselves as acting lawfully? And as much as the legal system has been stacked in their favor, when they lose, they likely abide by those rulings against them. At least, that's my read out of how much effort those folks put into (successfully) updating the law to reauthorize their behavior when we get a rare win.

Now, our take is that the legal system has been grossly abused to carve out all of their current authority on surveillance. But that's where I think they're coming from.
can anyone point to a link that explains X.509
s shortcomings? I'd really like to read up on that but can't find any sane info.
What is weird about that?
IP refers to anything that is a product of intellect, it doesn't make judgements about whether something is high brow or not.
All these arguments could apply just as well to Japan, which has an obesity rate far, far lower than the US.
> I presume you feel the same way about the female equivalent of porn...

You mean, porn?
Do you have any real data to back up your first claim?
Just assume anything that you type is public. Thats to say, even if you don't post it online the physical manifestation of you typing on a keyboard may not be secure.
Interesting talk that was linked to from the guide http://www.youtube.com/watch?v=HHoJ9pQ0cn8
One other thing about the quote from Matt Mackall referenced in the mail archive above. I was the original author of the Linux /dev/random code, and many years ago, I let him take over when I didn't have the time to keep up with the maintenance duties.

This is the first that I heard that he had resigned over the RDRAND getting used directly, and I track LKML discussions, especially on topics such as file systems and random number generators, pretty closely. What I suspect happened is someone pushed this patch to Linus without going through him, and he got annoyed and just stopped work.

What happened about 18 months ago was some researchers approached us about the deficiencies hey found documented at http://factorable.net. It when then that I discovered that Matt Mackall had resigned (although the MAINTINERS file still listed him as the maintainer --- normally when people resign in a huff they send a patch to remove themselves from the MAINTAINERS file). So at that point, I took over the maintenance duties.

It was at that point that I changed things so that RDRAND was only used directly for non-critical items, and started addressing how to gather as much entropy as possible for those platforms which do not have RDRAND --- which in fact was the bigger deal, and right now, probably the far greater set of problems.

That leads me to another important point --- don't get too focused on RDRAND. Yes, it's something we need to be concerned about, but there are many different ways people can screw up security, and not all of them require active collusion with the NSA.

For example, there are several years worth of HP printers where it's possible to push an unsigned firmware load to said printers over the network, at which point said printer could be sending copies of everything sent to it back to the NSA or the FBI. This would require no collusion between HP and the US government --- just the incompetence of HP firmware engineers. Could the NSA or the FBI be exploiting such a hole? I'd actually argue that given the FBI's mission, it would be malpractice for them not to develop such a trojan'ed firmware load. Hopefully they would only be using it after getting a search warrant, but if such a hole exists, and their mission is to get the bad guys, subject to US laws and the US constitution, I have no problem with them trying to create such exploits. Of course, I do blame HP for making it be possible to create such an exploit in the first place, and so we need to hold manufacturers accountable.

So we need to be vigilant, and worry about auditing all of the potential attack surfaces, and not just worry about one particular place where Intel might have colluded with the NSA. There are lots of other places where collusion is not required; just simple carelessness and incompetence by software engineers....
It's Sunday, so submissions need less attention to make it to the front page.

HN is not just tech, it's for articles which are "deeply interesting".

This article is interesting because it shows how hard it is for one area of business to exist even though it's legal, and a normal part of everyday life for many (most?) people.

US attitudes to sex have a dampening effect on WWW, affecting sites that have nothing to do with the US. Regular, softer, sites face weird prohibitions. Meanwhile, American porn (often deeply unpleasant) is pervasive and causing some nations to introduce nationwide mandatory filtering.
Google glass was mentioned in the article.
I was looking for some server-side framework for also handing HTTP requests and REST calls
My question was for /dev/random. The main problem RdRand solves is quantity: obtaining a lot of random bits per second. Even if they were produced in a way that somebody knows possible weaknesses, mixing them with something cryptographically strong where we control the seed we'd preserve quite a high throughput. I know that there is /dev/urandom which can often be good enough, but I know that too much applications in fact prefer to use /dev/random so making /dev/random robust has sense.

I see Ted Ts'o commented too, and as I understand, having RdRand is still much better compared to having the platforms without it. There's a lot more to care about than is RdRand "perfect" and once you have something like RdRand you can use it safely enough, compared to not having anything.
Megafilter does oook nice. However, I have at least two problems with this software:

1) According to the installation instructions root access (sudo) is need because it will be installed in a directory that is writable by root only. If megafilter is truly meant as a single-user app it should let me install it in any directory of my liking.

2) Megafilter listens on 0.0.0.0 instead of localhost, and so is accessible to anyone on the Internet who happens to guess its port (yes, I know I can require a password, but still…).

A settings file would be nice.

If megafilter is interupted by a system reboot or a ^C, does it save a state file from which it can resume? Or does it start from scratch next time I start the app?

Cheers.

PS: Concerns are posted as issues on github.
> There are plenty of people outraged by the substance of what has been leaked who also don't like the idea of a) great harm coming to the country or government or legit intelligence operations, or b) a 30 year old person stuck in a Russian airport who has appointed himself the ultimate arbiter of what is leakworthy and what is not, what programs are legal and good and which are illegal and evil.

Oh please, there's enough outrage to go around for a whistleblower publishing stuff that most foreign intelligence services already knew and suspected, and even if it weren't that way still accted accordingly as though was real, but God let the public know, lest they know how tight the chain is.

It is extremely unlikely those documents have anything of strategic value for other nations; it is almost absolutely certain they are important for the public.
If the company is based in the US or the servers are in the US, then yes of course.
Yeah, who here is interested in articles about startups, the internet giants, VC funding, etc?
I find the whole concept of the app questionable in usefulness.

We had actually thought about building something very similar a couple years ago, as at first thought seems like something that would be really useful, but found once we broke it down to the times it would be used it didn't seem as compelling.

There's a bunch of these apps out there now, and most also marry the feature of 'live positioning / updating' , which is still cubersome. It seems like it's actually showing there's probably a much bigger need for a good live themeing solution than anything.
Yes, I think you'll find the UN is pushing for that worldwide. It's not the UN per se, but mostly the OIC (who think nothing is wrong with stealing children to rape them, but "hate speech", that's a problem). Although I can fully understand why a bunch of islamic dictators feel the need to suppress the truth, and punish any "hate" speech harshly. They certainly do so in their own countries. Europe somehow thinks it's a good idea to oblige.

Interesting titbit "Vlad Dracul", the real one, king of Wallacia, is one of those children stolen under muslim law. Didn't work out to well for the thieves, or for anybody else for that matter. (ref: https://en.wikipedia.org/wiki/Vlad_the_Impaler#Life_in_Edirn... )
They said former spy contractor, which is accurate. Fugitive is accurate. So, how exactly do you infer an angle from this?
True, but I'm sure we can hack it:

"Individual Athlete - Time needed to complete the event, competition or performance, not to exceed 5 years

Individual Athlete –Increments of up to 5 years in order to continue or complete the event, competition or performance.

Total stay is limited to 10 years."

http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b...
> b) a 30 year old person stuck in a Russian airport who has appointed himself the ultimate arbiter of what is leakworthy and what is not, what programs are legal and good and which are illegal and evil.

No, he's not the ultimate arbiter, that's what the US government tried to be, in secret, until Snowden stepped up. And others with access are free to step up as well.
Surely there is some crank website documenting all the newspapers that have been driven out of business by federal pressure.

The major newspapers play silly access games, but just throwing out speculation that they are getting pressured is pointless.
legitimize != legalize
That seems very unlikely to be true in the US. There are far more very strongly religious people here than there are strongly religious people, and a considerably larger percentage of religious people than feminists are anti-porn.
That's a perfectly valid opinion, but if you RTFA you'll find that the headline is poorly written: it's about sex-related content, not porn.

Hookup apps and dildonics are not porn.
Ring.js – Multiple Inheritance in JavaScript
DDG searches are delivered over HTTPS. It doesn't matter if the NSA can siphon off DDG traffic.
Ask HN: How much do you spend monthly on services?
This question is mainly targeted at freelancers and people who build their own applications/products.

How much on average do you spend on services such as email marketing, analytics, exception tracking, hosting, etc. each month?

If possible please say where you are from, since expenses in US will be probably very different than expenses in India :)
To your second point. Aren't the corporate objectives of all US companies to make a shitload of money for their shareholders? If so, they should be jumping on all those businesses like horny teenagers, because those businesses make a lot of money.
Personally, I prefer the Securing Debian Manual http://www.debian.org/doc/manuals/securing-debian-howto/

Nitpick; "shred" is a better alternative to "srm", since "shred" is always installed.
I am the author. I did start that blog just for that post. I have never blogged before in any substantial way, but the naivete of comments from the CEO of DDG and the fact that users reading articles like in The Guardian might be misled into believe they are protected from NSA monitoring by DDG, motivated me to blog. No black PR. I don't work for any other search engine company, I am an American working for a small software company in Tokyo, Japan.
Uh, RdRand is definitely a pseudo random number generator. The question is about whether it's cryptographically secure or not, or more specifically, whether it can be or is backdoored.
I agree wholeheartedly, and, in fact, this idea is becoming mainstream among both psychologists as well as regular people. Neurologically it works almost identically to any other physical addiction with much the same results. More information at [1], [2], and [3].

There's a reason we have these "archaic" views on sex, and it's more than religious dogma; although, every mainstream religion prohibits the hook-up culture these startups are advocating. In addition to the risk of disease, we seem to be happiest when we treat sex as a very intimate act between people that care deeply for one another rather than simply the casual social act described by Huxley's Brave New World.

[1] http://yourbrainonporn.com

[2] http://www.yourbrainrebalanced.com/index.php?board=1.0

[3] http://reddit.com/r/nofap
Well, yes. But let's get back to the point of the original post in this thread.

There are two problems: 1) we can't trust the networks that our data travels over and 2) we can't trust US-based companies with our data. The first problem is fairly easily dealt with (encrypt and authenticate), while the second one is much worse. A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company.
There is no such thing as "too much" whistle blowing.
Sure, you can mix more data into the entropy pool just by writing to /dev/urandom. This won't update the entropy estimate though - to do that, you can use the the RNDADDENTROPY ioctl to add data along with the number of bits of entropy you want credited for that data (for this you need to be root, though).
Workers fired in privacy breach at L.A. hospital popular with stars
You can consider the precise workings of the brain to be known and dull when you can build one from scratch, in the lab, without reference to the normal process of human-organ production.
Check out http://kivy.org/
The problem is cultural rather than anything else. I always thought the UK was sexually repressed, and then I experienced the US. As a European you learn fast - never discuss religion, politics or sex with an American. It's a cultural constraint that stems from a government influenced by religion, which paints sex as dirty. Indecent exposure? Social construct, rooted in religion.

Fix that and porn and prostitution take their legitimate place in a balanced society.
>If the main idea is crap, then there's no "art" that can save it. That's like saying "there can be artful snuff films".

hang on, sir/madam. who the hell are you to judge what is art and what is not? perhaps you would like to be in the censorship and regulation department that will decide whether or not something is art and whether or not something is of "value"? how do you decide whether something has "value"? the amount of smugness is quite astonishing. what "value" do you create? why do you exist?
This is correct. The easiest path for the NSA is simply a FISA court order. The whole cert thing is an interesting academic exercise, but probably completely unnecessary.