skysight-inc/HackerNews huggingface dataset:
Goldfish mines various sources (incl. Crunchbase and developer focussed sites such as StackOverflow and GitHub) whereas Crunchbase takes a wiki approach.
...and expert guidance is by no means guaranteed at a university (even the good ones).
It doesn't really matter that much that the NSA spies on the whole world. I care a lot less that other governments watch me than my own government.

Other governments can watch all day, but they don't yield serious power over me.
There is no post.
This prevalence of piracy, I think, is as much due to HBO's famously terrible availability outside of TV[1] as it is the show's success.

[1] http://theoatmeal.com/comics/game_of_thrones
SO has become an invaluable resource for me. I generally program alone and I don't have someone with experience with X at the ready to ask questions when I run into bullshit. And it's often faster to google a common task then check the relevant api docs as needed than to start the search in api docs. I also tend to do new unfamiliar tasks a lot and draw heavily on other peoples experience to accelerate me.

If your a senior programmer thats been working in a narrow domain and technology stack for years, it may seem amateur to rely on heavily on google/SO. But it could be an indication of their ability to leverage the internet to quickly learn new technology/how to do various tasks.
Here are some other throwaway email address providers that might work as alternatives to mailinator.[1][2][3][4][5][6]

If anyone has any experience with any of these and could comment on how they compare to mailinator, that would be very useful.

[1] - http://10minutemail.com/10MinuteMail/index.html

[2] - https://anonbox.net/

[3] - http://anonymouse.org/anonemail.html

[4] - http://trash-mail.com/

[5] - http://www.dispostable.com/

[6] - https://www.silentsender.com/
Tumblr almost certainly had other options – another bidder or possible bridge/follow-on funding.
Persona is basically just public-key cryptography, but with a nice interface on top.

What you're really doing when you sign in to your identity provider is getting a certificate, signed by them, and containing a serialized public key (from a keypair generated and stored in your browser).

What you're really doing when "signing in" to a Persona-enabled site is sending them the certificate and a signed assertion, and letting them check all the signatures (public key in the certificate verifies the signature on the assertion, and the provider's public key is obtained to verify the signature on the certificate).

The only entity involved in this who needs to get a password from you is the identity provider, and password auth isn't required for that; it's just an easy and common way to do it. Sites you log into using Persona never ask for, see, or store a password for you.

The certificates are transient (they expire within 24 hours). The assertions generated by your browser are transient (they expire within 5 minutes). The keypairs generated and stored by your browser can be transient (you don't need to use the same keypair each time you sign in to your identity provider), and are tied to a specific email address and browser instance.

The whole thing is also designed to be decentralized. For most people, for now, Mozilla is the identity provider, but you can run your own (relatively easy) or use a trusted third-party provider. All that matters in a provider is that it speaks the protocol.

This means that comparing Persona to "password authentication" or "two-factor auth" is not really a useful question; your provider can use any mechanism you both agree on to verify you and give you a certificate. Though the immediate big win is, of course, that if there's a password involved, only the provider ever handles it, so you don't have to worry about a bunch of sites' password-storage practices, and you may not even have to worry about your provider's (if your provider doesn't use passwords to verify you).

The provider also doesn't know what sites you're signing in to with Persona; they don't receive the assertion from the site you sign into, they just provide a copy of their public key so the site can complete verification.
I don't understand what benefit a site gains from blocking Mailinator?
I Will be using a Lemp (Linux engine-x Mangodb Php) Stack instead of Lamp Stack , I will be using memcache for cacheing
The article doesn't mention the diagnosis of "Personality disorder". This is a difficult and controversial diagnosis, but it's important for this kind of article.

We'll hear about people who don't take their meds (this thread has such comments) but these people aren't the main problem. People with a probable diagnosis of PD are the problem.

Some numbers from the mostly rural UK county of Gloucestershire:

Population is roughly 800,000 people. There are about 4,500 people on the books of specialist MH services at any time. There are about 2,000 people with a probably psychotic illness. There are about 2,500 people with a probably mood disorder. There are between 20,000 and 30,000 people with a probable personality disorder.

Looking at the psychotic and mood disorders, and putting it very simply, you hospitalise for a short time while you stabilise the illness and sort out the meds. Then you release the patient back to the community with intense support from community workers (daily, weekly, monthly visits). You give an easy route back into services when these people need it. You also provide vocational support - help people back into work and to integrate back into society.

Now look at what happens to people with a personality disorder. There's no real treatment. This used to mean they were specifically excluded from treatment - turned away from specialist MH services. That doesn't happen anymore, but there's not much that can be done. And behaviours are often much closer to "bad" than "mad", and so criminal justice is involved a lot more than MH services.

Here's a harrowing Grauniad article (http://www.theguardian.com/society/2008/mar/30/prisonsandpro...) (contains description of self harm and suicidal behaviour)

> On the day Diane Kent set herself on fire in her cell at Low Newton prison, County Durham, two months ago, she had already tried to hang herself twice and asked a prison officer to take away her lighter because she was scared of harming herself. According to incomplete prison records, her request was refused.

This woman's burns were so severe she was kept in a medically induced coma for 5 weeks.

Women who attempt suicide by arson are sometimes put in prison (http://www.oxfordmail.co.uk/news/8389188.Woman_locked_up_for...) for endangering life.

Here's another example, again traumatic reading. (http://www.theguardian.com/society/2008/feb/03/prisonsandpro...)

And this is in the UK where we have much better services than the US. God only knows what it's like over there.
Simon Wilby
Simon Wilby has once been a victim of these negative slurs and it took him quite some time to redeem himself. Because of this turn of events he came up with an application that will help innocent people protect themselves from all the dirty politics of internet marketing.
In ad sales lingo, 'brand' is pay per view or sponsorship advertising. These people will be looking after the big clients, think music labels, movie studios, TV networks...
As a general point... isnt spam something worth putting up with in order to get secure email? If there is too much spam, obscuring the legit emails, couldn't the client end filter that out?

Frankly, to take and extreme, if I were reliant on secure email for my life, spam would be the very least of my problems.

As a totally random thought, is there no way to use spam to hide and secure legit email?
Lasers boost space communications
Not a question, but a pet peeve. You have a typo on your homepage. Search for 'synchronziation'.

Also, please don't have text that looks like a hyperlink if it's not (even if it is a placeholder), specially if you then have hyperlinks that look the same.

Other than that, good luck on the project. It seems promising.
No. But I believe copyright and patent laws should be refactored based on their contribution to society, not the individual copyright or patent holders.

* The purpose of copyright is to encourage creation of more works of art than would happen without it. In return, the rest of society agrees to grant the author a limited-time exclusive right for the work. Shorter (10-15 year) copyright terms should be sufficient to make a profit from a book/movie/software. After that, the authors can publish new or updated works to continue making money. There is no way the Disney corporation's copyright on Mickey Mouse character is still encouraging the long dead Walt Disney to produce more artworks.

* The purpose of patents is to encourage both more invention, and detailed publication the methods than would happen without it. In return, the rest of society agrees to grant the inventor a limited-time exclusive right to use the invention. Patents which are obvious, or patents whose methods can be determined by looking at the final product or outcome do not bring value to the society in that transaction.
I'm very excited to see this. I've been using KeePass2 on Linux and it's a pain to sync with my Android phone. I tried setting up OwnCloud to share the key file but even using that causes too much friction for me to be willing to frequently sync.

In your FAQ you say:

> "What do I get when I fund you?
Once the software is ready, you will get unlock codes for the mobile versions for the amount you funded. As a special appreciation for being an early customer, these codes not expire and will unlock the mobile versions for life."

But you don't specify a price for the mobile versions. Also, will the mobile versions be GPL'ed?

Very happy to see you take Bitcoin as a funding option.
Does it support the keepass db format?
If they want to get you they're gonna get you. The point is that takes a lot more work than the analyst sitting at his desk typing in friggin Google searches on your Gmail.
A slashdot commenter put this up a few weeks ago, it's worthwhile viewing for an hour - you can get an idea of what the providers are going through. There's a good interview with an archive.org employee around who also received one, and tried to resist in his capacity as a librarian.

https://www.youtube.com/watch?v=C25EkdWLU1k
Ask HN: do you trust your "secure email" now?
After Lavabit and SilentCircle shutdown (the first said "better shutdown than give 'em access")...do you trust the other "secure email" providers?
it's actually not on my nexus 4 and 7. which is why I made the comment.
the web apps I make with angularjs do.

also this isn't about direct access to hardware buttons. hitting the system back button on android devices while a web view is in focus is the same as :
window.location.back()
I would think the harder platforms are the consoles: they often come with their own compilers that only support C and C++.
I don't think a degree is necessary; certainly not necessary in the same sense that you would want your brain surgeon to have graduated from medical school.

I think there are two separate problems here, though - one in which a particular individual is being assessed for his or her aptitude, and one where dozens or hundreds of applicants for a particular position must be evaluated on the basis of limited information, often from a pool of even more candidates.

A degree by itself is not a terribly reliable proxy for capability or potential, but better proxies are harder to scale and apply to many more people. Companies like degrees because they're an easy, lazy way to (at least in the minds of HR people) establish a competency baseline, and if it's true that most companies would rather have false negatives than false positives, it's easy to see why a degree would be "required" in a lot of cases. Hopefully that will change in the future.
Retroactive law for warrantless wiretapping, I am aware of. What other laws can you add to that list?
YouTube founders take on Vine and Instagram with MixBit video app
And if the other side happens to be self-hosted as well or an provider based outside the US?
Don't want to point the finger at anyone but...
https://twitter.com/paultyma/status/361849144161218561
It can be possible to write the runtime for a language that requires one in the language itself, as long as the runtime is only necessary for part of the language. Then, the runtime would merely have restrict itself to the parts that don't require a runtime.
Lavabit was Snowden's email provider.
New Botnet Campaign 'Fort Disco' Brute-Forcing Thousands of WordPress, Joomla
Can we just agree that university isn't the only method of learning?

You either have the knowledge/skills or you don't.
Bill believes Africa needs malaria treatment and other health and social issues addressed above all. Perhaps so but Google's Loon project will bring 3G to those needing access to better education and a better connection to markets even in remote areas not served by the wired Internet. And lolcats. The resulting economic benefit will do much for the health of Africans as well.

Besides, Loon isn't just for Africa. It will cover parts of South America, Australia, New Zealand. The recent NPR or Marketplace interview looking at Loon revealed an impressive project.
I don't think 'any news is good news' applies to secure services providers. It will not make other offerings more appealing. Why bother with a provider that has to resort to this kind of behaviour to protect its customers?
never trust anyone! :)
What advantages over 1password does your application give ?
What are you protecting, and who are you protecting it against?
volatile is not a hint, it's a requirement. You couldn't control hardware without it (compiler: "you're only writing this variable, never reading it. I'll skip those writes to speed things up". Programmer: "why isn't my program writing anything to this I/O port?")
You want a citation for what is essentially a thought?

Actually, I suppose one could simply link back to the post its self, since is this the most reliable expression of that thought available.
It's funny I think that's one of the primary results of the internet. I think of movie and music production, software, bitcoin, bittorrent and so on. I would argue they have been decentralised by the internet.
I think centralised services are against the 'spirit of the internet'.
Type 1337, view the comments.
Top 3 Lavabit alternatives
Yep, as an added bonus you stop financing the US war and terror machine.
Don't mean to ad-homeniem, but this was written by Jordan Poulton - the Apprentice UK finalist that was ousted for failing to comply with the competition's rules (read: lying).

http://metro.co.uk/2013/07/10/the-apprentice-candidate-jorda...
Hi, it's mentioned in the FAQ, little bit further down.

The mobile versions will be somewhere between $5 and $10. As a perk for funding Bluepass, whatever the price turns out to be, your version will include unlimited free upgrades.

The source of the mobile versions will be available, but for the success of a project, a recurring revenue stream is required to maintain them. The mobile platforms change a lot, and there are not many examples of open source projects that can successfully provide productized versions for these mass market consumer platforms. That is why I cannot commit at this point that the license will allow redistribution on an app store. This means it would not be an OSI style license.
I've got EncFS encrypted filesystems on Dropbox, BTSync, GoogleDrive, and Jottacloud (a non-US based cloud storage provider). It's been working fine over the last month or so of testing. In MacOSX, I've got both EncFS over FUSE and the commercial BoxCryptor packaged version happly working together. I've got Ubuntu 9 & 12.04LTS, ARCH Linux on a RaspberryPi, and iOS on my phone and iPad all syncing some or all of those EncFS containers and successfully reading/writing them. I haven't tried, but I have no reason to doubt BoxCryptor will happily read/write those filesystems on Windows and Android.

One thing I particularly like about this setup, is that I can have encrypted data synced to a machine that doesn't have the decryption key (or even software) on it – my media server and a machine at work are "backing up" all that data without it being "exposed" even if a machine and disks get stolen/confiscated.

This is different to a truecrypt volume, in that the files are still discrete:

[Bigs-MacBook-Pro:~/Dropbox/BoxCryptor-DB.bc] bigiain% ls -l
total 7544
-rw-r--r--@ 1 bigiain admin 625 12 Jun 10:59 !IMPORTANT BoxCryptor Information.txt
-rw-r--r--@ 1 bigiain admin 0 12 Jun 11:07 Hmz6h72bplJbH1
drwxr-xr-x@ 3 bigiain admin 102 12 Jul 18:01 QY7,wBj6mQwGV7OyD3Qbll8
drwxr-xr-x 50 bigiain admin 1700 23 Jul 22:21 WoVrJB-gyKVMm0
-rw-r--r--@ 1 bigiain admin 3840262 6 Aug 09:40 Z8,UY5cp7Ux491OckZ9yXM2
-rw-r--r--@ 1 bigiain admin 15364 7 Aug 21:25 nMrARYb-KDbdDj2

individual files can get synced as the change, without needing to re-sync the entire volume. On the downside, that means I leak some metadata, file sizes and modification dates, but not names or contents. I also lose the tryecrypt option of hidden volumes, but perhaps that's a plus in that they wont hit me with the $5 wrench insisting that there's _another_ password - even if there isn't…
He might not want to relocate.

It's risky to relocate the servers in another country. You will have to obey the other country's laws, but the US gov will still claim jurisdiction if the staff and/or owner is in the US. The US will even claim jurisdiction as soon as you use a ".com" domain [1]

Of course the hosting nation will also claim jurisdiction. So relocating your servers to one country while staying in another will expose you to two national laws as well as any international agreements between these nations.

[1] Richard O’Dwyer, a UK citizen who ran a UK-based web site, was facing extradition to the U.S. because he used a .com domain. - http://www.theguardian.com/law/2011/jun/17/student-file-shar...
At this point it does not. But a feature to import a keepass DB into the Bluepass native format is in the plan.
Since when did the American government care about things being outside the US?
Apologies about it being so long
Canada is green simply because nobody familiar with Canada's security politics and policies has chimed in yet and there does not seem to be any evidence of foul play that is visible from an outsider's perspective.

Cooperative with U.S. interests is generally assumed by almost any country - this map is more about the (hopeful) safety of your servers in data centers in different countries.
Yes, I think the only way to solve that problem is that the providers fully open source their client code and that the client code is built and proofed by the users.

Still, an example where such open source existed and still the result was completely broken crypto for two years is http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166

Good security is damn hard.
Hi, COO here. Thanks for your feedback. Coincidentally, we have a mobile-optimized version being finished off shortly! We agree that a native app would be great. More on that in the coming months.
Nomenclature matters, I hate the term "coder" what was wrong with programmer or software engineer?.

What you call yourself has an impact on how people assess your skills (I know it shouldn't matter but it does).

If someone is called a software engineer that brings to mind a conscientious programmer who writes clear maintainable code that meets the spec however when someone is called a coder I visualise someone who vomits PHP into an editor intermingled with HTML and CSS in a form of code injection bingo.
I would argue that a CS degree will make finding that first developer role a lot easier. You should also be more prepared for it. After 5+ years of experience it becomes a lot less relevant, and yes there are lots of people that have got a developer job without degrees but I think it takes a lot of dedication and sometimes a bit of luck.

Although as this article claims, £50000 is indeed hard to justify.
It allows multiple (equivalent) definitions from different translation units to coexist in the same program. That's the only actual meaning attached to it by the standard.
Best easter egg ever! Is that new?
Good story, with the moral that in business there's no such thing as friends, but I have a minor quibble - there's no mention of "hex." I guess it's there for the cool title and standing in for programming.
I actually think there just might be.

While it seems like sending an email might be lower friction I find in reality mails get lost, sent to the wrong people, they don't get checked etc.

Having a simple way to keep everyone on the same page at a fixed location you can bookmark seems good to me.
skip is bigger now! the iso views are done using mapnik, the tiling library used by CartoDB. So it is just a pretty simple style option, building-height: somevalue
A New Category of Web Forms
Although if they had received a FISA subpoena, isn't that what they would be obliged to say?
FWIW, I think the browser plugins that 1Password implements are the "killer feature" - it notices you registering/logging-in to most websites, and prompts you to save the password. This reduces enormously the temptation to "just use an easy-to-remember reused-everywhere" password - I can randomly mash keys and have it automatically remember 25+ char passwords for me.

That _rocks_.
Didn't Chicago do something like this recently too? Or was that just streets?
As someone who is a big supporter of Firefox Sync [0]:

What will this provide me over Firefox Sync, which has a built in encryption layer on their (admittedly cloud) service? I can pull their code and host my own Firefox sync server, and someone has written a special PHP-based version for inclusion into OwnCloud. So, what is so special here except the use of buzzword P2P? (See next question below.)

How will you do to P2P without some kind of centralized bootstrapping service with the prevalence of NAT and people who do not know how to port-forward? (I just saw the Github repos, so I will examine this myself in a bit.)

UPDATE: It would appear you are using mDNS and/or Zeroconf [1] to handle this? I am still not sure how this will ease the NAT and/or syncing over public Internet.

Why should I trust you? What have you done other than this project? Not to be increasingly blunt, but you are not the Mozilla Foundation and your Github repos do not show much other than work on co-routines and AD service wrappers. That is useful to me, but I would like to see more security work and knowledge of crypto libraries if I trust you with password manager code. What else do you work on? Your blog does not show me too much, and I cannot find much mention of you to warrant 60,000 USD for such a project. I am correct in seeing you a Marketing/Product Manager? Sorry to be harsh, but honestly I think most of HN would be worried about these points.

UPDATE: Ok, maybe I was a little too harsh; you do seem to have some more experience than I had previously estimated, given some Googling and your Linkedin profile, if legit. [2]

[0] http://docs.services.mozilla.com/sync/
[1] https://github.com/geertj/bluepass/blob/master/bluepass/loca...
[2] it.linkedin.com/in/geertj
A good developer can write her own framework. Tailord to the needs of the project.

But most people aren't good developers. :)
Moment.js - parsine, validate, manipulate, and format dates
I am sure there a lot of very smart people with great programming skills and without a degree. However at least in Germany I see another problem: Almost every job ad for a programming positition starts with "Computer science or related degree required". Without a degree you are just filtered out by the Human Resources Department that doesn't know anything about programming at all. They are just checking formalities and doing buzzword matching. You won't even get to an interview or get an opportunity to prove your skills. :-(
I will trust Lavabit if they reopen.
except for "that is why we are acting now" and the rest of the text, yes