skysight-inc/HackerNews huggingface dataset:
This whole post is a mess. Someone distributes an exploit via a popular hosting provider for onion sites (and it's curious why anyone with a serious interest in privacy would outsource onion site hosting anyway) and suddenly Tor is damaged? There's a link to a paper that claims people can do things you're not supposed to be able to do with onion sites, but I don't see how that's relevant -- this post is conflating at least a few things.

So here's what I can grok from it:

* "Freedom Hosting" founder has been arrested; presumably, many people were using "Freedom Hosting" to host onion sites (is this where "half of all Tor sites compromised" comes from?). No charges listed, article slightly hints at child pornography charges.

* Someone, presumably the FBI, has set up an exploit to be distributed through Freedom Hosting sites that will phone home and reveal your non-Tor IP address (solution: seven proxies). "Freedom Hosting" founder was probably coerced into allowing distribution of this exploit.

* Author claims that said exploit only affects Firefox >= 17 on Windows.

* There's a link to a paper about possible problems with hidden services, which is apparently not relevant to any of this other than the fact that there was just a shakedown on a big onion site provider.

I'm flagging this article because it is utterly incoherent and the headline is sensationalist. There is no evidence of a fundamental flaw in Tor being related to any of the events mentioned. Hopefully someone will write a comprehensible piece soon and put it out there.
You have to remember what we mean by 'size': there are four things in the set {ball, kite, hat, glove} because we can line them up one-to-one with {1, 2, 3, 4}. For an infinite set, they're the same 'size' if we can line up everything in one set with everything in the other.

For a bigger circle and a smaller circle, consider lines through their mutual center (if you line them up concentrically). You can take a ray from the center out to the first circle, and then out to the second circle, and this will line up all the points exactly one-to-one between the two circles. There are no points on the outer circle which don't get hit by some ray, so it can't be 'bigger'.

For the set [1, 2] versus [1, 10], you just use the function f(x) = 9 * (x - 1) + 1 to map everything from the first set to the second. There's nothing in [1, 10] that f doesn't map to, so it can't be 'bigger'.

What's really interesting is that there are as many even integers as integers at all - you just multiply everything by two, and you line them up one-to-one!

(Hint: the definition of being infinite is that you have a proper subset of yourself that's the same 'size'. That's why we get this weird behavior... infinity is nothing like the counting numbers we're used to!)
Hi. Original poster here. I have amended the line in the post to make clear that the "useless" claim was not intended to apply to all of Khan's videos; only to the decimal ones.

As for motives, I would invite you to read deeper on the blog to get a sense of what motivates my work. See especially the "Talking Math with Your Kids" series, where you will find the following sentiment expressed in multiple ways:

"But I don’t want Griffin and Tabitha‘s mathematical educations to depend on better telling. I want them to explore and to wonder. I want them to commit to their ideas and see what the consequences of those ideas are, and to revise their thinking when their present ideas are not good enough to explain what’s going on in the world.

And what I want for my own children is no different from what I want for my students, and no different from what I want for all children.

There is a place for good, mathematically correct explanations. I want kids to experience those when they’re the right move.

More importantly, I want them to learn to think for themselves."
Previous discussion of arrest: https://news.ycombinator.com/item?id=6154493

Previous discussion of malicious Javascript: https://news.ycombinator.com/item?id=6154246
We have seen that the premium on ideas is going down - it is all boiling down to execution slowly. Our experience with Firespotting has shown that people are increasingly sharing good quality ideas.
Background image for developers doesn't work
I didn't know that. It plugs a hole in the targeted surveillance programs, at the expense of all prepaid users.

The target demographics for prepaid is mostly kids and teens, poor people, and people concerned about their privacy, split between sensitized geeks, unfaithful lovers and criminals.

For the first two demographics cheap monthly plans are now emerging (in France, Free offers two hours of talk and infinite SMS for 2€ per month and unlimited talk, SMS and 3GB of data for 20€ per month).

It sucks for the last three.

On a slightly related topic, in demonstrations, people caught without a cell phone during an ID check often end up arrested for "administrative reasons".
Has appending the phrase "Get over yourself" to an argument ever accomplished anything useful?
i suspect it was seen as a useful tool to bash communism. it was useful, and so promoted.
The Old Reader will stay open thanks to an unnamed ‘corporate entity’
Thank you, I didn't know it. Any source for this claim (so I could dig deeper)?
The iPhone Dock Bed
Themestrap: Lightweight Theme Kit for Bootstrap 3
It's not really 0-day: since it only affects Firefox 17, it was apparently fixed long ago. But see this comment regarding why it may be of interest to lots of TOR users:

https://news.ycombinator.com/item?id=6156779
"Behind paywall, but someone at Khan Academy is an NCTM member, right? Right? If not, shoot me a note. We’ll get a copy to you."

If I was supervising the way the NCTM goes about the dissemination of information via the internet I'd have serious concerns and would be pointing out some concrete and important gaps in their use of modern technology.
Change in Wikipedia article of Edward Snowden coming from IP of US Senate
Yes. These systems weren't disabled, they were broken.

Not trying to be a buzkill, but I fail to see how it's funny. So you can break an old - undoubtedly unpatched - win xp box that people use to print boarding passes. Congrats.
Nice looking guilloche escapement train with complication, but for very long term durability, I'd back the Jura's molecular biologists certifying DNA's proven reliability.
The USA has never not been at war against somebody or something in living memory, counting the cold war and the drug war.

If you'll let it off the leash entirely in "wartime", well, then the leash was never there.
Thanks for the thorough response here. You wrote, "Our recent push to improve our math content hasn't yet touched the decimals exercises but it will soon." But Mr. Khan posted a video of a new decimal exercise just last week, which is what prompted the post. I get that everything can't be perfect right away. Somebody at KA has been working on decimals instruction in the past year, so it was frustrating to see that this instruction was not substantively changed. I look forward to the more robust content to come.
Take a look to the Atmosphere Framework: http://www.ncolomer.net/2012/03/cometwebsocket-introducing-t...
We developed an easy way to email and collaboratively view CT or MRI studies. http://www.claripacs.com.
I run a gitolite server and git-on-dropbox setup both multi user. I find the maintenance of ssh keys a pain. I collaberate with 4 universities outside my country, and people upgrade their computers and lose their keys all the time. If its a smallish, ad hoc, non-security concious project, I go Dropbox by default now.
Its not bitten me yet (1 year, maybe 10 projects)
For comparing the number of reals in 1-2 and 1-10, consider this function:

f(x) = 9x - 8

This maps 1-2 into 1-10. So in what way can we say that 1-10 contains more numbers, if you can make a one-to-one map? There is no number in 1-10 that this function (inverted, of course) cannot produce a unique equivalent in 1-2.
Nice walkthrough and +1 for using Creedence Clearwater Revival lyrics for the landing page copy! :)
Are you so sure the government is opposed to the public in this?
Would not a better way to do this be to take the spammer's approach? Spam has gotten to be quite good at sounding realistic. It's also normally quite naive. But instead of emailing real people, just setup a vast network of bot addresses that all mail each other in realistic ways. The content of the messages can be algorithmically generated to appear like nefarious conversations.

I'd love to see NSA and FBI members burning money and time tracking down spam bots.
Thanks omgmog, it was playing up a little, that is fixed now :D
The quote in the article claims that the exploit affects 17 and higher, only on NT-based platforms.

Furthermore, Tor Browser Bundle disallows JavaScript by default, and one should be cautious while allowing execution of arbitrary client-side code whilst intent on keeping their direct IP address secret. You have to take at least a couple of steps to be affected by this bug.

EDIT: The author has updated the OP and now claims that he believes Firefox 17 is the only affected version. His language is ambiguous such that it is unclear whether the exploit only affects Windows or if the code distributed by FH is simply not attempting to exploit any non-Windows environments (perhaps they were trying to get specific players).
Ah, you believe that Marxism is a macro economic theory?
Understood.
Am I the only one who is f*cking tired of FBI and other violence based organizations using pedophilia as their excuse to raid and bust people ?

Think of the children! Yes .. a good front to make it so that they can just bust anything using SWAT forces.

Is pedophilia such a big problem? Really ? I would like to see one study about pedophilia and the problems it creates, instead of what the problems that NSA and FBI are facing when people start encrypting their traffic and we actually have some freedom of speech in some areas.
I have to agree with this, for sure.
Amazing how one word can change the tone of an entire article. Though this seems slightly different from the actual article: http://en.wikipedia.org/wiki/Edward_Snowden
Uhm, so where exactly does the FBI/NSA come in?

As of now there is some guy stating that some hoster has been pwnd and uploaded some JS that expoloited something that might be FF17 that might have been shipped with the tor browser bundle.

Why exactly does he thing FBI/NSA is involved?
If he has the exploit code why didn't he upload it?

Lots of conclusions based on assumptions. As of now I'd think it's more likely someone just pwnd the largest TOR hidden host provider, uploaded a sploit that will affect most of the users (tor browser bundle) and called it a day.

Sure there MIGHT be some GOV/whatever involvment. But wouldn't it be time to wait with such accusations until we got some actual proof? Not even uploading the alleged exploit doesn't really help his position.

I would think that since about 60% of TOR projects funding comes from the .gov[0], that they have an incencitive to keep it online. I could imagine they have some nodes for which they wouldn't want to reveal the physical location. I don't know warhead controllers or something. Of course that only works if the're are enough nodes involved so you can hide yourself. That's why I think this might not have been a .gov action.

[0] https://www.torproject.org/about/findoc/2012-TorProject-Annu...
> Well, it was a lot of data, so he passed it to an organization that supposedly had people who could sift through it and post the relevant stuff in redacted form. Unfortunately, those people screwed up and published the encryption key for the unredacted data.

That is exactly what was illegal. When Manning couldn't be bothered to even choose what data to leak or not he lost the ability to claim any kind of moral high ground over what happened to it. Unless he personally knew and could trust everyone with access in the WikiLeaks organization he had no way of even truly knowing what would happen if he leaked data that was dangerous to the U.S. or other people.

That's not just a theoretical tweak either; WikiLeaks has had at least two major instances of insiders in the news that don't fully agree with Assange, including the one of their higher-ups, Daniel Domscheit-Berg.

Additionally, whether a leak has been published is completely orthogonal to the question of whether that leak was discriminate. You're right that it's hard to tell that Snowden's leaks are discriminate until the extent of them has been published, but it's at least possible that Snowden chose each leaked briefing judiciously and precisely.
Open source webmail: mailpile
Again, that is irrelevant for this case, where the guys racing are out on the street with its curbs, lamp posts, uneven paving, manholes, etc, and where they choose to be on the same 'track' as people who aren't volunteering to be in such a racing condition, and who aren't all, at the moment, physically or mentally prepared for it (in many cases, they aren't even capable of being physically and mentally prepared for it. Not everyone is born a racing driver, and those that are, grow old, too)

Formula one is relatively safe nowadays because all cars are safe, the drivers have superhuman driving ability, are physically prepared, and wear safety gear, because the circuits are smooth and without things you can hit that will kill you, and because medical assistance is close by when needed.
Given that the NSA and it's sister organisations are now being squeezed, politically, what do you think their response will be?

Of course, the proper, professional and legitimate response is to sit back and to let the democratic process run it's course. We all hope and trust that this is what will happen.

However, given the resources at their disposal, it is not too difficult to speculate about what they might do (or be tempted to do) to secure their budget and to maintain their surveillance capabilities.

Similarly, after the current round of outrage and media attention has died down, what do you think that they will do to prevent something like this from happening again?

Beyond measures to prevent further leaks (that we already know they are considering) ... how might the technology that underpins tools such as Prism and XKeyScore be used to manipulate public opinion, to neutralise or mitigate the impact of those espousing hostile opinions, and to promote and spread a friendly point of view?

I am specifically thinking of man-in-the-middle attacks to manipulate messages and web-pages in-flight, to implement a sort of third-party hell-ban attack on activists and commentators. Is this possible without the collusion of the publisher?
Question.. if an offshore VPS provider has servers in the U.S. can the offshore VPS's be taken for search and seizure by U.S. Government simply because part of their business operates within U.S. borders?
> found no way to dissuade the student that 0.35 was bigger than 0.4, no matter what we tried.

Out of curiosity, assuming you tried a number line, do you remember why that didn't work?
It's a good suggestion but his evident premise that "licensed teachers" uniformly do better is either extremely naive or speaks to an agenda on his part.
10 Quirky Camera Designs from Digital Photography’s Past
For us foreigners, knowing that America has strong democratic roots, it is obvious (and worrying) that the majority of american citizens actually agree with that.
The author never explained how the contents of that paper were related to the js attack on freedomhost users. It just seemed like an aside about the security of the Tor network in general. Since they (allegedly) found the guy running freedomhosting, maybe they were using those cookies to do a traffic correlation attack to find the host?
The browser provides much more control over what's happening than executing the code directly on the OS. You can block JavaScript, you can easily analyze the executed source code before you allow its execution, you can manipulate the page as you see fit, you can use extensions to alter your experience in many other ways, and you get the browser's default security sandboxing stuff that prevents it from accessing external domains, your filesystem, or otherwise interrupting non-browsing related tasks.

It'd be crazy to download a full local client for something as shady as SilkRoad or many other hidden services. The browser is the safest place for that kind of thing.
Little restraint in military surplus giveaways
Ah, is the article written for other platforms who want to emulate Android in automatically limiting Hotspots on mobile plans? Then it makes sense.
That's true. But the problem is that this particular failing goes essentially all the way to the top.

There was a massive pressure to get people with Manning's skills into the military jobs that required clearances. This was such that even the process of getting a clearance got oursourced to contractors (witness the furor around the company that handled Snowden's screening).

Even if Manning's immediate supervisor had tried to get him stripped of his clearance for any of the many "red flags", his supervisor would simply have got in trouble instead for doing something to get rid of a warm body in a seat that needed filled.
The Paradox of Self-Amendment:  A Study of Law, Logic, Omnipotence, and Change
TBB does not disallow javascript by default. In fact they recommend you do not disable javascript because it makes your browser fingerprint more traceable.
I was thinking a new English lect, or a form of ebonics is needed that incorporates "bad" words that set off filters. Once that becomes the vernacular it will be very difficult to figure out what's useful and what's not. To be forced to do this however is stupid. Legitimate intelligence is still reasonable. But we're so far beyond that that it has come to this.
Regarding DNSSEC, it should be noted that ECDSA was specified in April 2012 (RFC 6605) and resolver support started with Unbound 1.4.17 (May 2012) and BIND 9.9.2 (Oct 2012). So this was very recent and the percentage of resolvers on the Internet which have already upgraded to an ECDSA-enabled release is so small that it is absolutely pointless to use ECDSA with DNSSEC now. Most of the resolvers won't recognize the algorithm and will treat the zone contents as unsigned.

Regarding OpenSSL, I tested ECC with S/MIME in 2009 and it turned out to be unsupported. Just tried it again with 1.0.1e and it's still not supported. It works for TLS but the problem is that vendors ship outdated releases: Debian stable comes with 1.0.1 which is good, RHEL comes with 1.0.0 which is not so good (no TLS 1.2), SLES comes with 0.9.8j (even in the recently release SLES 11 SP3) which is very bad.

So support for ECC is still very disappointing and far away from being usable in production.
Wow. I cannot imagine how much chaos this could cause.
In this particular case, the exercise is one that we've had since November 2011. This week we made a push to have videos created whenever an exercise doesn't have an accompanying explanation, which is why that video was created specifically for exercise.

Reviewing content of the exercises is a separate and important task which is ongoing – as you point out, the exercise itself has a few problems and we'll be sure to revisit its content in the coming months. Thanks for your useful criticism.

(And sorry for not responding yet directly on your blog or to you on Twitter – it was on my to-do list but as I opened Hacker News this morning, I felt the need to comment here, as response speed is key on a site like this.)
The tech industry has been complicit in this, and I think how the Democrat party resonates with them can be summarized as such:

> What you can control cannot hurt you.

I think this explains why those in the tech industry either stand firmly and resolutely with the government (and firmly belonging to the Democrat party), or their political allegiance follows along Libertarian lines because such statements instill a strong sense of anxiety and trepidation.
Whois of the IP adress 156.33.241.5: http://whois.urih.com/record/156.33.241.5/
And here's the same shot a few years later after the earthquake. Just devastating: http://archive.org/details/tmp_50168
They can use the non-Javascript interface to set up IMAP/POP3 and then just use a POP client - no Javascript required.
I have another real life anecdote of my own. My younger brother and I grew up more or less under the same conditions barring our individual personalities. Yet he is way smarter than me, he is about to finish college in two years, while I just got into college this season. I don't even know how well I will do, I might fail this semester who knows. We have already had two very different life trajectories and they might diverge further, even though we are brothers.

Some decades ago the per capita income of South Korea was on par with some of the poorest nations in the world. Today South Korea is a rich nation. Japan was devastated after the WWII, but it experienced an economic miracle afterwards. China was an under achiever in the last century, but in the next decades it will become a superpower. We can talk all day about how equal we are, but not everyone thrives equally, even under the best of conditions.

I can not but held the believe that among individuals, families, nations and ethnic groups, there are innate differences. Differences that are deeply rooted within our genes, we're all thinking beings but not everyone can be Newton, I sure can't. Of course you may beg to differ with me, after all individuals tend to distort the reality to their views. I might have a distorted view of reality, though I doubt it.
Which is a mistake, and this shows why. Javascript should be default-off everywhere, and then if there's a Tor site you trust (oxymoron if I've ever heard one) then you enable Javascript.
With a sufficiently advanced language (scala), fully static typing is exactly what I as a programmer want - it gives me a lightweight way to make assertions about my values everywhere in my program, which makes debugging a lot easier. The fact that values can change type in Javascript or Ruby I find to be a disadvantage.
A robot with an operator is still a robot.
You mean the code snippets? That's the default styling that comes with Octopress[1], which the author is using for their blog.

[1] http://octopress.org/
Why do people get so intensely attracted to Ayn Rand's philosophy, even if for just a short time? Because it resonates with their attempting to understanding of the world.

The necessary social systems that interlink us all have become overly complex and maladapted in their treatment of individual people, and by stepping back from "must" and asking "why" one begins to see this everywhere. But the only blessed means of change is democracy, and nuanced intellect doesn't win mob consensus - vague feel-something arguments do.

So the idea of taking one's ball and going home becomes very attractive - even if it's just a single croquet ball - because it's the final option available to avoid supporting the broken game. And morally, systems should be setup to make this base case as easy as possible, even if it initially increases costs for the remaining players, for if the system is truly beneficial then it is still in most people's interest to participate.

But the mob has no concern for individuals, so our social systems lack this capability. Going against the grain is tiresome and unproductive, so most people eventually conform to what is demanded of them. And once you've given in, you're likely to stop dwelling on the faults of the systems you support and instead view them in a positive light for what they do accomplish.