skysight-inc/HackerNews huggingface dataset:
I think you hit the nail right on the head. "Encryption" at a low level, like using AES to encrypt a block of data, is pretty easy. But you need a lot more than that to build an encryption system like a secure communications channel. Each individual part is relatively easy to get right, but putting them all together offers a lot of opportunity for attackers to find a way to exploit the system.
Lots of enterprise setups have complicated RBAC/ACL/audit setups where sysadmins/DBAs are only given the bare minimum permissions necessary to complete their required roles. I seem to recall an article from a while back about Google changing some policies after a sysadmin was found to be accessing private user data, to require additional oversight/signoff, or maybe even active observation. Unfortunately, I can't find the article I saw it in, so I may be mistaken.

Technical measures and policies can go some of the way, but I think protecting against a motivated internal attacker with some level of elevated permissions is going to be a tough thing to achieve.
The EFF has Bruce Schneier...
I agree that we shouldn't expect it.

Not expecting it is not the same as not wanting it - and the demise of <blink> is an expression of wants - or rather want nots.
It had already happened: http://www.wired.com/threatlevel/2010/09/google-spy/

Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats.

David Barksdale, 27, was fired in July after he reportedly accessed the communications of at least four minors with Google accounts, spying on Google Voice call logs, chat transcripts and contact lists, according to Gawker, which broke the story Wednesday.

Google has acknowledged that it fired Barksdale for violating company privacy policy, and acknowledged that it was the second such incident of its kind at the company.
I'm preparing a large project using Arduino that will need to be running on battery power for long periods of time. I haven't attempted anything like this before, but everywhere I read tells me that Arduino is not power efficient at all, and people have to get creative to conserve power. I guess such is the way of low-end microprocessors, something we take for granted in power powerful machines.
Why Work Loneliness Isn’t Just a Personal Problem, and What to Do About It
Don't you have any savings?

If you can't afford mortgage repayments and savings, you are living above your means

I plan to always have enough savings for 1 year+ of unemployment
There's a reason the NRA can do what they do: Guns are a >$30B/year industry.

http://www.businessweek.com/articles/2013-03-14/the-nras-cor...
Show HN: Picktoread, A Google reader alternative
Sometimes crypto libraries have bugs, but it's also easy to use them incorrectly, especially if you don't have an good understanding of cryptography.

For example, a common mistake is to assume that by encrypting something, attackers can no longer change it. Or perhaps you'll use your standard equality operation to check whether a decrypted string matches some value, without thinking about timing attacks. Or maybe you'll just use AES in ECB mode.
When wearable tech makes you smarter -- by zapping your brain
I did pay in advance for few years but I wont ask for a refund, I will consider it as a donation for those legal battles.
The NRA actually does stand up for privacy: of its members, anyway. You've probably heard of those stances being used against the NRA sometimes, for example, when they've fought to prevent the Feds to deny gun rights to people who have been placed on terrorism-related suspicions list (which, by some reports, was as inaccurate as the no-fly lists).

If you hate the NRA, it's easy to paint this political stance as nothing but a move of pure-gun-lust...however, such stances set precedent for other privacy related rights. To put it another way, just because the ACLU defends pornographers, it doesn't mean the ACLU is doing it purely out of love for pornography.

edit: In any case, there will never be a "NRA for Privacy". Pause and think about it. What does the average person experience in terms of privacy invasion? Not too much, and not at a constant clip. Would that average person be able to discern between heavy privacy protections versus some privacy protections, on a daily basis? Not really, you mostly only know your privacy is being invaded when it's too late.

Compare that with how your life as a gun owner changes if, say, conceal and carry is revoked. Or AR15 rifles are banned. You experience that immediately.

Also, good luck getting celebrities on board. They are used to having their privacy violated as a matter of routine. For them to experience a real change in privacy would involve infringing on certain First Amendment rights (look up the difference between public and private figures)
> Public nudity is mere morals.

So are laws against killing people, theft, and beating animals.

I'm always dismayed at people who think that the "good" ethical norms that they like are somehow scientific, universally agreed upon, and absolute, whereas the "bad" ethical norms that other people have are merely cultural, subjective, and contingent.

We could do worse than to require a few years of ethical theory as a precondition to graduating high school.
>A machine can't laugh at your embarrassing confession. Nor can a machine talk about your letter to its friends.

To its friends at the NSA? I beg to differ.
That's a cool idea. I'm totally gonna do that :)
I guess the main problem is that encryption is foreign to most of us (myself included). It's hard to understand what is safe from what isn't.

It's also very hard to figure out if your encryption is bugged or not. I guess that for most us, once your method returns a hash, you expect that everything is secure.

On a side note, I wonder how many people on HN would claim to know the inside out of encryptions. (Not the difference between SHA1/MD5/bcrypt but the actual math behind derivations and how they work)
Numbers, facts, anything. Please substantiate your comment, instead of adding nothing but snark to the discussion. Here, i'll start: http://www.nytimes.com/2008/04/23/world/americas/23iht-23pri...
Although I really hope that nobody would label Estonia (or any other EU country) as '3rd world' country now.
In its majestic equality, the law forbids rich and poor alike to sleep under bridges, beg in the streets and steal loaves of bread.

http://en.wikiquote.org/wiki/Anatole_France
What about relocating to South America? Perhaps Bolivia? Bolivia is _really_ pissed about USA ... I know as I live here.
Interestingly, one of his major themes is that powerful people and institutions are themselves driven by various "conspiracy theories," neuroses, and fiction.

In this post, he describes how the MI5 and other spy organizations need ideological support from authors like Le Carre.

In "The Power of Nightmares," this is also the primary theme, but focused on the mythical and paranoid ideology that drives the "War on Terror."

So, Curtis is maybe not a conspiracy theorist, but a conspiracy theory theorist... I see him as something like a humanist: he wants to the reveal the "humanity" (pettiness, confusion, imagination) of powerful actors which present themselves as serious.
If you want an idea of what the imagination can fill in when someone is in a swimming costume look up "bubbling"; the examples here will show you how it works:

http://gizmodo.com/5627807/bubbling-tricks-your-mind-to-make...

Link is technically safe for work but looks NSFW (that being the entire point of the illusion)
My Dream Workplace Culture
> engines might always be done in C/C++ simply because it
> gives them the ability to easily make bindings to the
> majority of languages

Just like C++, it will be possible to expose a C-compatible interface to Rust code that will allow any language that can call into C to call into a library written in Rust. See http://brson.github.io/2013/03/10/embedding-rust-in-ruby/ for a rather dated proof-of-concept, or http://bluishcoder.co.nz/2013/08/08/linking_and_calling_rust... for something more recent.
"Can we call it a police state now?"

I saw the question on Reddit after a different revelation last month. I feel like we're going to ask that question more and more.

I can only hope more and more of us are inspired, as Snowden was by Levinson (Lavabit's CEO) and many of us have been by both of them, and we act to protect ourselves and constrain our governments from overreaching to where they can't help repeating the disasters of previous overreaching governments.
Libraries don't have to be a thing of the past - just look at Melbourne's
Also, encryption is all about maths, so there are hundreds of ways to do just about anything, different parameters, different algorithms with different tradeoffs about speed, performance, resistance to attacks, data bandwidth, etc. etc.
So I don't think a library with the kind of interface you describe would be very useful. But I do think it would be great to have a library that allows us to configure encryption based on requirements instead of technicalities.
Building a panopticon: The evolution of the NSA’s XKeyscore
ovh?
What if Steve Jobs was Happy and Balanced?
30,000 projects started within 48 hours of Windows Phone App Studio release
Startups and others come together to host Teen Tech Camp in Durham
he risked his life in in the way that he may be placed in jail for a while. I don't think anyone is suggesting that he may be killed over a destroyed server.
What kind of impact do these changes make? Instead of 24 hours or less can you get a week or two out of the batteries?
Mesh Networks for Freedom and Privacy
The idea that it's easier for a private entity to abuse a system like this than a government is laughable.
Exactly what I was thinking. Once you see significantly unethical behavior, sirens should go off in your head. Get the hell out of there.
This is the guy that did an expenses paid tech talk where one of the big sponsors is heavily involved in the gambling industry, and then proceeded to publicly bitch out another speaker for doing a talk on technical hurdles of some kind of sports betting platform because betting companies are evil. Can't really have any less respect for someones opinion or thoughts when they are so ill-mannered and hypocritical.
That's exactly why LavaBit shut down, looks like they were forced to do that.
Aldi pays really really well. Graduates get paid 50k GBP(80k USD) straight away, everywhere in the UK
No ads is already free. Just you IMPAP or POP3. You are still tracked, but there are no ads.
Obama Lied, This is an Impeachable Offense.
Reevive.me: Give your project a second chance
Vital Elements of the Product Design Process (Ryan Singer)
Snowden: "Google, Facebook, Microsoft, Yahoo, Apple, and the rest of our internet titans must ask themselves why they aren't fighting for our interests the same way".

Indeed, they must. Your move Google, Facebook, Microsoft, Yahoo and Apple.
"I just totally don't understand this attitude. Code isn't money. I'm not diminishing you by reading your code. And, as the last 30 years of blazing success in open source software has shown, the benefits of the open-source ecosystem are far from abstract. They're the foundation of everything we do."

Code is money. Some people are developing products not just frameworks. Some people are paid for developing open-source stuff while others do this as a hobby. It's a personal choice. Open-source is not the only way and it's not the best. There is still no open-source project that would match Photoshop, Windows, MS Office in quality.
Senior Android Developer wanted - The App Business, London
The App Business is a specialist app software company. We work with big brands to help them create business-transforming software experiences, across smartphones, tablets, desktop, social media, even TVs - wherever the audience is.

The company is driven by the belief that software is eating the world and that people are now turning to ‘apps’ to navigate their daily lives, at work, at home and everywhere in between.​

This poses huge opportunities for brands as well as significant structural challenges that we believe traditional digital agencies are not set-up to take-on.

That’s why we built The App Business from the ground up, inspired by three years working into Steve Jobs helping launch the iPhone, App Store and hundreds of apps.

We are now looking for Senior Android Engineer to join our expanding team at The App Business.

If The App Business sounds like the sort of unique challenge that matches your ambitions or you are interested in further details then please get in touch with kara@theappbusiness.com

Must be legal to work within the EU
> sometimes with a small embedded scripting language, mainly Lua, which uses GC

Note that Lua 5.1 and later use an incremental GC, which is friendlier for latency-sensitive workloads.
"John" has a Wikipedia page which mentions the government contract that was awarded. The government was unhappy about work performed under the contract.

It also was trivial to find that page.
Simply invoking some sort of "encrypt" library is easy, it's everything else that's hard, and you have to get it perfect.

- Simply encrypting your message as indicated will not protect you from replay attacks. Someone could record your message and re-transmit.

- Simply encrypting your message will not assure that the contents haven't been modified, someone could patiently sit in the middle poking bits to see what happens.

- Most encryption schemes will require you to choose a block cypher, doing so requires some knowledge of the options and the data you're sending. Some handle large amounts of data poorly, others fail when you send identical messages.

- Most encryption schemes will require you to initialize them with truly random data, both an early version of Netscape, and Debian messed something up and provided far less entropy than they appeared. Relying on /dev/urandom on a machine that's just booted, or otherwise faulty entropy providers is fatal.

- Attackers can record your data and play with it forever, so even if a mistake or attack isn't revealed for years, they can still go back and decrypt your data. I believe the NSA broke the Russian's use of a One Time Pad because they re-used pages years later.

- Simply encrypting data doesn't provide assurances that you're communicating with the system you think you are, the initial contact is still tricky.

So there's more to it than a single function call.
I actually don't think we even need zero.rs anymore. Its purpose was to provide noop implementations for all the "lang items" that the compiler expects to find in the stdlib. However, post-0.7 the compiler no longer requires a lang item to be provided unless you actually use a feature that requires it.

For an example, see the code at https://github.com/doublec/rust-from-c-example , which is fully runtimeless.
I did - Island is german name. Happens from time to time that I mix languages.
Is this really legal?
Nope, that Eve can intercept a copy of GPG-encrypted mail and extract plaintext To, From, Title, time, with some luck also some info about sender's IP and software, plus all info that is in recipient's and possibly sender's public key (this usually covers full, true name, work, approximate location and alternative e-mails, often also a photo). What you mention is an orthogonal problem.
Malcolm Gladwell is a fool. Curtis is better, though far from flawless.
The only comparable person in terms of documentary is perhaps Jonathan Meades.
Tell HN: thank you (+ a 50% discount during 3 months on my new SaaS)
Since I've been on HN (2009), I learned quite a lot on a large range of topics, and I'm very grateful to everyone here for this.

This pushed me to ship and ship more projects out there; earlier, side-projects like hackerbooks.com (which I'm going to open-source), and more recently my first SaaS offering (https://www.wisecashhq.com, cash flow forecasting for freelancers and SBOs).

For my birthday (the 11th) and as a way to say thank you, I'd like to offer a discount for a limited period and duration.

=> use coupon THANKYOUHN before the 12th to enjoy a 50% discount during 3 months.

Thank you!
The only real "weakness" is theft/loss of your wallet and keys. Bitcoin is like cash in that respect, but with unique new properties. It's easier to hide and move, but it can be stolen remotely (unlike paper bills). This is a problem and we all are working on different ways to decrease risks. E.g. by having multi-party authorization, "cold storage" (e.g. keys printed on paper), 3rd party services ("banks"), hardware wallets.

Not real issues:

- "No authentication for IP transfers" - not an issue, no one uses it. If you need to authenticate payment address, either get it over HTTPS, or use upcoming (in 0.9) payment API (same principle as with HTTPS, but without HTTP) or any other way that reduces risks of spoofing payment address.

- "Energy Consumption" - not an issue. Miners spend as much energy as profitable for them, just like anyone else on the planet. Visa datacenters also consume energy. Who decides how much energy spending is "too much" if everyone spends what they can afford?

- "Illegal content in the block chain" - not an issue with Bitcoin, but an external arbitrary threat created by feds. Same applies to unencrypted WiFi connection or someone sending a well-hidden picture in email attachment to you. Also: users are not required to store the blockchain. If you don't like a threat of "illegal content", use lightweight client to keep your keys only.

- "Breaking the cryptography" - does not uniquely apply to Bitcoin comparing to, say, PayPal or bank wires. If some algorithm becomes weak, Bitcoin can be upgraded just like your bank's SSL certificate can be.

- "Double-spending with 51% attack" is getting less economically viable with every single day as more people mine, use or simply know about Bitcoin. Also, it does not affect all the users, but only those with whom attacker transacts. And if that happens once, people would start sending expensive transactions directly to miners they trust to mitigate the issue.

- "Coin destruction" is not a problem for society. Everyone's money gets more valuable when you lose yours. Divisibility is enough for a long time to come and can be increased on many levels, inside and outside Bitcoin core protocol. Lost/stolen wallet issue is covered above already.
Clickable: https://www.wisecashhq.com/
http://www.bonkersworld.net/google-reads-your-email/?
> Even if the data can be secured from being read, there is proof that one computer talked to another computer about something. That's often enough "evidence".

Tor/i2p mostly solve that problem.

> Frankly I don't see how the internet can be secure. AFAIK, it never was.

"internet" is not secure, but you can build secure communications over insecure transports as long as you are able to do initial key-exchange somehow securely (ie. face-to-face meeting). Something like OTR with Tor hidden services is very secure.
Why, because you think that foreign governments are going to respect your privacy more?

Ha.
I know what I'm going to use it for.

I work on an open source project and I've just submitted a patch. Tomorrow, I'm travelling to go spend a week with my parents, away from home. I don't plan on taking my laptop with me, but I want to follow up on my patch. Reviews are probably going to ask for minor changes.

Basically, I can see myself using something like this when I'm on the move. I'm not a big fan of dragging my laptop with me everywhere I go...
>> the threat of global conflict in this day and age has dimished but the cold war mentality has persisted.

I couldn't agree more. I think a large part this mindset may be due to the large govt organizations whose many employees and contractors make a living on there being an enemy to defend against. It's the whole “It is difficult to get a man to understand something, when his salary depends upon his not understanding it!” thing, taken to an organizational level...

it's also possible the spies (and their stories) who really do know whats going on, and are doing the job they are supposed to, are the ones (and the threats) we will never know about... Also, I see spying as just another type of arms race. If we stop, but country xy keeps doing it and has better information, if/when things go downhill, we're up shit creek without a paddle. Weapons can be powerful, but Knowledge is Power, don't ever forget that.
You mean: Your move Larry, Mark, Steve, Merissa and Tim.

In the end the base unit of society is still the human, no matter how many layers we place around them.
I have seen more than one great developer with SO score < 1000. Some people like to code rather than browsing SO.
I have written spiders and test tools that perform , inject and test in the very same way. There must be a plethora of prior implemenation out there.
Interesting to see talk about what is legal and what is not.
Think about this: Everything Hitler did in the Nazi Germany was legal.

How a bout a law that tracking or stalking on the internet is the same as in person, therefore illegal and punishable for everyone?
> I don't now if the Rust compiler is smart enough to
> optimize the tuple creation away

I'm sure it can. LLVM is a really, really good backend.
The problem is that people really love guns.

People only like privacy as an optional concept; what they really like is sharing their personal information with strangers on the internet.
There's also:
https://www.cotse.net/
What makes you think that Director of the CIA would have particularly secure e-mail setup?
With this api you can get the list of lost and found dogs and put the fetched data where you want.
For example you can add this data in your web page like a small banner.
In this way every visitors could know the list of dogs of their zone
and the FSF!
I thought the point of encryption was that the end result is supposed to be indistinguishable from noise.
Wrong. The NRA is a powerhouse because they have the money to continue to persuade Americans to care about guns and the 2nd Amendment within their twisted, absolutist interpretation of it.
This is not entirely correct.

For your SSH example, pubkey authentication has a bit of a learning to to set up but then makes ongoing use far easier.

For networked file systems, at work we have a common shared drive (H:) and a private shared drive (J:). The private drive is clearly more secure as people who shouldn't have access can't even see the files, but it's also much easier to use as you don't have to sort thru tons of other people's old crap.
I do use that on Windows. But I find white pages intolerable at night and so it is not enough to change them to off white.
Drag and Drop Upload to Imgur
External Storage for Android Tablets
Take a sabbatical and come to Nairobi for a few months. Spend some time coding, some time meeting new people, and some time doing a walkabout: adam@kili.io
By that analogy so called secure email providers would receive plain letters and put those into envelopes before handing them to you, and conversely ripping your envelopes open before sending out your mails. Because the rest of the world doesn't know how to use envelopes.
Interesting to see talk about what is legal and what is not. Think about this: Everything Hitler did in the Nazi Germany was legal.

How about a law that classifies tracking or stalking on the internet is the same as in person, therefore illegal?
I guess the obvious question to this post is:

What are you doing on your own checklist? Those are some pretty extremist notions.

If part of your hiring criteria was to exclude anyone who had worked for a contractor or directly for a government organization, I doubt many people would want to work for you. Not because they had violated your criteria, either.
Or, the end of days is upon us.
Building a Better Gemfile
Friday is Webday Issue #6 (link collection for web developers and designers)