skysight-inc/HackerNews huggingface dataset:
> However, we're clearly seeing that what used to be "tinfoil hat people" are right now just sensible people, so then you have to distinguish the really tinfoil hat people from the previous bunch, and so on. It's a moving target.

Well, no. There's a difference between the people who said, for many years, that GCHQ / NSA are monitoring all communications and the people who said that GCHQ / NSA are monitoring all their communications. People deny this, but there is a big difference between "collecting the content" and "collecting the content then grepping it for your contributions to that content".

> For the average person, the only choice right now is to carry on or not.

I am genuinely baffled by the responses to the snowdon "revelations". i) They're not new ii) They've been included in routine risk assessment for years.

What do you have that you want to protect, and who are you protecting it from? If you're protecting your teen-angst poetry from your classmates you can carry on as normal. If you're protecting a stash of images of child sexual abuse from law enforcement you need to continually assess your encryption and secrecy methods. If you're protecting plans to destroy America from a well funded government agency you need to worry about everything. But that's always been the case.

There are so many other, easier, attacks than a weakened pool of entropy so it's a shame that people are being distracted by this. Don't get me wrong, I don't like RdRand and I'd prefer it if it was open and transparent, but there's so many other weak steps that people could be fixing before they get to RdRand.
Sit a Geiger counter next to a jar of Brazil nuts, and time events? You would need a way of testing the Geiger counter, but that should be possible. Alternatively, buy one at surplus from a university laboratory. If they're any good, they would have already noticed it misbehaving.
Not insofar as a vigilante is defined as a non-governmental actor working to change the government. If you don't trust the process and that set of possible people who act outside it, you don't trust anyone or thing at all. You can hold this position in any particular case, but not as a general rule, at least if you want to be able to act coherently in these types of situations.
Re hardware AES such output can certainly be bit-by-bit compared with a pure software implementation, so we can be much more certain that it does exactly what it says.

But I also think we shouldn't worry much about RdRand, see my other comment here.
http://criminal.findlaw.com/criminal-procedure/what-is-a-jur...
Would you want police brutality trials decided by a jury of cops?
Exactly that's what I would recommend. The only catch is what if you're just starting out and don't have 1000 fans?
Daniel, I wasn't making a political point. I was making an engineering point. I'm not interested in this leg of the conversation and think that injecting politics into this discussion will consume the thread with chaff that will make it harder for people to understand how crypto and hardware work, which is a shame.
Woah, this is seriously cool stuff. I wonder how far off it is from general readiness?
So what if you can bit-by-bit compare its outputs? How do you know it isn't leaking key information via a side channel?

The argument that you can "bit-by-bit compare outputs" is an argument that AES cores can't be backdoored in any setting.
I guess we need to look for the buzzword "push" rather than "realtime" now-a-days. At least, that's closer to how I use "realtime", rather than 5 minutes mechanical polling.

"Sure, realtime-nazi, but what would you suggest?"

Personally I feel up to 30 seconds is acceptable, but I rely more on the underlying method of delivery (push/long poll for change vs. polling and comparing for change). In close comparison to the definition here: https://en.wikipedia.org/wiki/Real-time_web

> receive information as soon as it is published by its authors, rather than requiring that they or their software check a source periodically

For a consensus, see http://stackoverflow.com/tags/real-time/info and/or http://stackoverflow.com/a/5286985

Or am I wrong? What is a better label for what wikipedia defines as realtime-web?
Unfortunately, what you list as required recording equipment is barely enough for a demo, let alone finished track. A good recording mic for vocals is about £2K, good converters will set you back as much.

>> Also the advice on recording yourself isn't great

It's borderline terrible, in fact. It's the same one as "build your website on your own, there are plenty of PHP tutorials on the internet, how hard can it be?".
West Bank Solar Clinic
Agreed. The study is actually deceptive because they're drawing conclusions that aren't supported by their own results. My conclusion: bad science.
Oh, nearly forgotten about it. HP promise to mass produce Memristor in 2013, and then push back to 2014.

Wasn't it suppose to COMPLETELY revolutionise the way we do computing? Why haven't we heard more about it?
I've been reading the EWD archives the last few months. I'm coming to find Djikstra to be a role model. I think I would do almost anything to have two hours of his undivided attention today.
The Harbour Project (cross-platform xBase compiler)
I inadvertently spawned this discussion by pointing out that many open source security projects like Linux, OpenSSL, GnuTLS, libgcrypt, dm-crypt, etc. all depend on closed-source crypto implementations [1]. This was followed by one of the Linux guys saying he quit the project over RdRand [2].

Everyone seems to be missing the point: RdRand is the least of your worries. If you can't trust the CPU, you can't trust it to multiply correctly, much less perform crypto.

If a CPU maker or OEM wanted to be evil, they wouldn't even need to bother backdooring the hardware. SMM or microcode updates would be much easier to compromise.

[1] https://mailman.stanford.edu/pipermail/liberationtech/2013-J...

[2] https://mailman.stanford.edu/pipermail/liberationtech/2013-J...
I wish some of the biggest country should mandate all router and ISP to have IPv6 by 201x.

Otherwise we are just not getting anywhere.
Well, find an agent that likes what you do and willing to bet some money on you... like... wait! A record company!
How The Sharing Econonomy May Create A New Asset Class
You are assuming the nominal output is the only output.

This is a software perspective:

output_block = aes(input block)

This is a hardware perspective:

output_block, cpu_state = aes(input block, cpu_state)

…but the CPU only gives you the output_block. The cpu_state is a hidden global. Goodness knows what it's leaking.
In the video, the author moves a block of code by:
1. going to the start of the code block
2. changing mode to visual
3. moving to the end of the block
4. deleting the block
5. moving to the insertion point
6. inserting the delete buffer

I'd like to suggest that using absolute line numbers shortens this considerably. For example

:43,48m63

removes lines 43 to 48 and inserts them after line 63 regardless of the current cursor position (no need to move cursor).

Not saying relative line numbers are bad, just, there's a quicker way, at least for the demo use case.
> Why don't we apply free market principles to law enforcement, fire services, and utilities?

Some utilities are starting to do this actually. Where I live Gas is provided by multiple servicers who setup contracts with the gas provided(sort of like a commodities market). There's been some talk about doing something similar with water as there's been some serious corruption uncovered with water billing in my area. Some fire departments are a combination of private and volunteer efforts. There's not many issues with this AFAIK. I used to live in a town like this and no one ever complained. Regarding the police, for better or worse, they are more or less treated as part of the judicial branch of government. I don't think many people would argue the police(as it exists today) should be private. That said, the system as it exists today is corrupt and resembles more of a military than a group dedicated to "protecting and serving." There are private police types in Texas and AFAIK, it works fine. Same goes for private bounty hunters.

That said, most of the above aren't for profit services, so it's hard to compare them with medical, which is an industry that must sustain a profit to progress. When governments become profit centers, you will have problems. Considering the problems we have now with medical, less regulation around competition would certainly be a good thing. For example, I should be able to call and get prices for common services so that I can compare doctors. Not my employer(nor the government) should be allowed to provide me with subsidized insurance(except in welfare cases). I should be able to buy insurance from a provider anywhere in the country. I should be able to negotiate rates on my own behalf instead of the insurance provider doing it for me. Insurance providers should not get preferential treatment from doctors and/or hospitals. Fix these and things will get better. There will still be issues, but at least the market would be more efficient and prices would start going down.
Even if RdRand is a plot by the NSA it seems quite illogical to think that this is the first time they've collaborated with Intel so why are these people still using Intel chips at all?

It kind of sucks that RdRand is hard to verify as a user but it's no smoking gun either so it's not a great sell if you are trying to warn other people about the risks of backdoored hardware too.
Populistic bullshit meant to grab attention, not science.

A coherer is not a metal-metal contact.

I am too lazy to elaborate, but some people in the comment section of the article already pointed out some of the more obvious issues.
People just like to have a scapegoat for their health problems: MSG, gluten, GMO, etc. Better to blame the big bad corporation for making you fat than the fact that you like to eat lots of sugary shit and don't do any exercise.
Indianapolis Public Schools For Failing to Protect Gay Student
In Search of a Greater Barrier
The fact that you can ridiculously misinterpret the two most important studies in a field does not make them invalid.
Are there any free market industries in the US?

Free market is a theoretical model. One could say how well or how close it describes a specific situation (an industry, a region or country, and so on). But saying that something "is" or "is not" a free market is just a shortcut and may be a little misleading.
Are we talking about attacks on the bits of the message or about the penetration? I'm just pointing to the different level of potential problems. If somebody would blindly trust RdRand and it is actually not random (it's just a thought experiment, I don't believe that myself, and I know that Linux doesn't blindly trust it!) he can produce encrypted bits which could be easier to decode as they are. There's no such chance for AES instructions, which are trivially certain to match software implementations.
He hasn't been exiled.
My 2-cents: highlighting and extracting my notes is fundamental for me. The best PDF readers that I have found are:

OSX: Skim (with an honourably mention to DevonThink)
iPad: PDFExpress
Yes - I was thinking about the outsourcing part as I have friend who did exactly that and again without the record label in between. If you don't have good connections though its hard to tell who is good and who is bad - so gaining some knowledge about every aspect is essential to make proper decisions or choose proper people to help you.
Actually, all this proves is that some people on HN are idiots who can't be bothered to read the actual study. Remove the last two words of your title and your post would be technically correct (i.e the same title as the news article).

Male rats fed HFCS did have more weight gain than rats fed only chow. However there was no difference between rats fed HFCS and rats fed sucrose over the long-term. Please actually read the study and look at Table 1.
See Julian Morrison's comment upthread. If you don't trust Intel, don't kid yourself; you can't use their CPUs for crypto at all.
Shouldn't you wait until, at least, 2014 before you mock them?
How do you expect to get the nonce across the network without the NSA getting it?
Thomas, I honestly don't understand what you mean.

I think perhaps you're suggesting separating the idea of information leakage from talking about those willing to exploit it. That's fine, but it's going to be really difficult to have a long technical conversation about things that might or might not happen without having any person/entity/organization to be doing them. It would be like telling a story without having characters in it. If I understand you correctly, you'd like this to be way too abstract to have much traction with anybody. By all means break out Alice and Bob and have a go at it. But I'm not sure I understand you.

I was also not trying to make a political point. I was simply trying to say that if you want to use the term "tinfoil hat people", then acknowledge that the term is a moving target based on a world of contextual information that keeps changing. That's all.
At the very least, deciders chosen by a government elected by the people, whatever value that has, is of more value than a single self-chosen person who happened to have the correct level of access and skills to access more documents than he was supposed to.
LaunchRock - Set up a "Launching Soon" page in minutes
Lets say you pay 10$ for Spotify and you only listen to my music for a whole month then Rihanna, Lady Gaga and Beyonce will get 99.999999% of your 10$. Its because all the money, be it advertisement or subscriptions is thrown in a huge bucket and divided by play count. It will take you a looooong loooong time to get even one single dollar out of this model.
> Until and unless he is granted a pardon or some other form of immunity from prosecution, it seems that Snowden's best interest ...

Isn't that the rub? The rational action on Obama's part would be to pardon him, just to get him back. Instead, he is vindictively pursuing him across the globe and devoting resources that seem absolutely disproportionate to what was revealed.
CHP Framework
Work a real job and live frugally putting your savings towards your dream job. That's how most startups get launched.
Google doesn't really pay tax on most of its world wide income

In other news, Guinness also does not pay taxes to the US for beer sold in Ireland. It only pays taxes on profits made from beer sales in the US. Those green fiends!

I know it's shocking, but there is a world outside America, and the US government does not get to collect taxes on all of it.
Who was arguing for 128-bit DES? Wikipedia says IBM wanted 64.
You absolutely don't need to spend thousands on mics, pres and AD converters to get good recordings, there's plenty of top quality options that are much more affordable. I'd put money on 95% of the music listening population not being able to tell the difference between a £2k mic and a £500 one in blind tests.

Obviously you'd have to be willing to put an exorbitant amount of time into getting good, but that's another issue.
I think you're missing a key point. Yes, you can test AES at one moment in time. But when you're talking backdoors, they aren't necessarily active all the time.

Backdoors could wait for a specific trigger from outside input. I've been referring to these as "sleeper cell" attacks. For example, you could have a malicious memory module that alters its own contents when it sees a specific value and exploits the system in place.
I am pretty much saturated with free music from the many netlabels and happy "amateur" musicians who release music because they make music for music's sake, not money. If somebody wants recommendations, name a genre and I will see if I can drop some links. There is a lot of negative prejudice against free music which is a real shame.
I just watched your demo video, it looks amazing. I am going to signup, I have been looking for a good JavaScript resource and so glad I found it!
Yii 1.1.14 release candidate is available
In case you miss the link in the upper right, his EWD manuscript archive is here:

http://www.cs.utexas.edu/~EWD/welcome.html
Yes and no. First of all there are no real indie labels. If a label gets successful enough a major label will come by and make it a sub division. Even the labels with the best intentions need to get their money back at some point the market for them is the same as for everybody. If you are in the right niche at the right time there are of course exceptions - but well these are exceptions
Show HN: Git bar graphs in the terminal
You haven't been paying attention recently at all, have you?
I've always found it difficult to communicate IPv6 addresses over the telephone, or type them in manually, when compared to IPv4. IPv6 does have abbreviation built in, but "2001:db8::ff00:42:8329" ("2001:0db8:0000:0000:0000:ff00:0042:8329") is still much more difficult to use than, say, 69.135.54.4.

Has anyone created an easier way to communicate IPv6 addresses, or is this something we'll have to learn to live with?
No, by his account, and more importantly the recording, which I've listened to in full, the "police"---actually a dispatcher, who's instructions have no force of law whatsoever--- said "you don't need to do that" after Zimmerman got out of his vehicle after he said Martin started running. You can tell by the ambient noise he then stopped, that he did follow the advice.

Again by his account, while returning to his vehicle he was confronted by Martin, who said the first and also hostile words, and not even the prosecution claimed that Zimmerman initiated force, the affidavit strangely changes to the passive voice, "Zimmerman confronted Martin and a struggle ensued".

It comes down to who's use of lethal force was justified; I find it bizarre you don't think getting your face pounded, as confirmed by an eye witness, and getting your head bashed into concrete, also confirmed by photos and the physician's assistant who attended to him, isn't sufficiently lethal force to allow a reply of lethal force in legitimate self-defense.

That isn't even going into Zimmerman's claim that when Martin realized Z had a gun, he said he was going to kill him and reached for it.
I follow this Twitter account and it helps me discover him more - https://twitter.com/DijkstraQuotes
Meh. Simply making the default pool larger would go a long way towards moving systems out of a desperate situation. With that done there would be a lot less reason to short circuit it and go RdRand only.

No one is concerned about RdRand as a contributing source— with other genuine source of randomness RdRand isn't likely a back door once mixed in.
There is a real physical device with a real application and that is called Resistive RAM (RRAM). Then there is a phenomenological mathematical model of a two terminal device.

In 2005 some guy from HP wrote a highly publicized paper where he tried to assign the model to the device and called it memristor.

There are a couple of issues with this:

1) The model is not physics based and is therefore not suitable to accurately describe the device operation.

2) The device existed even before the crude memristor model was attached to it. The memristor model did not help the application of RRAM in any way, it only publicized it in a way that made many people misunderstand its origins and application.

3) Research and development of RRAM is at an all-time high right now. Most semiconductor conferences have several sessions dedicated to this device, not the memristor. Actually there has been tremendous progress in RRAM. Toshiba/Sandisk made a 32Gbit prototype device and there are demonstrators of microcontrollers using RRAM. The only thing preventing market introduction right now is the momentum that flash has.

edit: HP is all talk. They have not shown anything in term of practical application yet. I don't understand how they are supposed to have a product any time.
Ask HN Google and MS employees: Have any of you resigned on principle?
Given the deeply troubling revelations that have been in the news recently, it's become all but undeniable that Google and Microsoft are spying on their users.

So, I'm curious to know whether any Google or Microsoft employees have resigned on principle?

There are lots of Google and MS employees on HN, so it would be interesting to know if there are any among you who consider what your companies (and perhaps you directly) are doing to be objectionable enough to resign.

If you stay, is it because you see nothing wrong with what what your company does? Do you consider spying on your users to be ok? Or do you think it wrong but consider your paycheck or the technical challenges, toys, perks, and prestige that these companies to be more important than your ethics?

Or maybe you think it has nothing to do with you? Or that you have no choice and you're just following orders?

Such an attitude would be curious, because it's not like there's any shortage of demand for people who've worked for companies as prestigious as Google or MS. You could probably have virtually any job at any company you like. Yet some (many? most? all?) of you choose to stay employed with these spy firms. Why?

Do you know of a single person who's resigned from Google or MS (or any other company involved in spying on its users) who's resigned on principle?
DARPA'S ATLAS Robot Needs A Brain
A minimalist photo organizer (screen cast)
Sorry I don't see the relevance of CPU having any hidden global state in the thought experiment I've addressed. If all I give you is a PGP file made on the Intel CPU you simply don't have access to the global state of my CPU and I can be sure that I'd get exactly the same file up to the last bit using non-Intel CPU starting from the same inputs (including same 'seeds'). So I can actually be absolutely sure in AES instructions for any scenario where I only give you the results of encryption.
This more about non-human intelligence than about IPv6. I was hoping Cerf would go into why IPv6 is better for the "internet of things" or "interspecies Internet" than IPv4. Also, maybe an explanation in layman's terms why IPv4 won't scale further, even with the workarounds that are currently in use.
I have always hated the campaign by CRA for HFCS like this https://www.youtube.com/watch?v=lQ-ByUx552s
I am working on securing virtual machines against physical attacks (which yes, does sound impossible). Our approach requires code changes on the hypervisor level, which currently rules outs Amazon but is viable for bare-metal cloud providers. It also requires some specific CPU features and a TPM.
That's what DNS is for.
do you wear anything else? or is that it? I am shopping around for these things to see what all the fuss is about.
Wasn't Fitbit hit by this issue shortly after the launch few year ago? You'd think others would've learned from that unfortunate incident.
we've not visited argentina for years so we must be due a trip. if/when we do i'll ping you and you can give me that back during a meal at some nice restaurant...
I too immediately thought this statement was a misstep in Greenwald's otherwise discriminating journalism. The possibilities you outlined detail exactly why, but I would add a fourth, if somewhat far-fetched, circumstance to your list.

(4) Snowden has verified knowledge of an imminent death threat from the USG and is using Greenwald to convey awareness of his "dead man's switch" for his own protection. Employing Greenwald as a channel for this message, as opposed to himself, gives him some cover legally and won't further alienate Snowden from the public who might see him as blackmailing the United States if he were to outright state this in say, a new video interview.
The one problem with this article: citing The Beatles as a group that won big in the business. Not true at all. The Beatles were terribly mismanaged, their manager sold the rights to songs for pennies or even gave them away. Money troubles inspired the song "You Never Give Me Your Money."
Backing up a web server to S3 with Duplicity