skysight-inc/HackerNews huggingface dataset:
This is satire, right?

"A plaintext file requires a special tool, called a text editor, to change its content."

"I recommend notepad.exe or pico. Linux hackers may use WINE to run notepad.exe." [rofl]

EDIT: I think it's just the author's sense of humor, not actually satire.
Or we could build technology that doesn't cause people to crash cars when using it. Such technology would also have the benefit of being nicer and easier to use than looking down at a phone while driving.

Trying to lock users out is doomed to fail. Many solutions would have a "snooze button" effect where people might be more distracted by the additional effort to get around the lock. Others might end up being far too restrictive (what about passengers? people in buses or trains? people in emergency situations?).

Technology is also only a small part of distracted driving. It's still perfectly legal for me to eat a Big Mac and fries while having a heated debate with passengers and adjusting the car stereo while driving. We ought to build (1) a culture that strongly discourages this, and (2) cars that build in safety features (driver alertness detection, etc) while reducing the attention requirements of the driver (automatic collision avoidance, self-driving cars...)
The NSA Is Breaking Most Encryption on the Internet
No, we don't know that either. For all we know, we could have BQP = P: today, we don't know any algorithm in P to factor integers, but that's not a proof that it doesn't exist. If we had such a proof, as mcpherrinm points out this would directly lead to a proof that P != NP (since we DO know that factoring is in NP).

Also, I don't mean to pile on, but this wasn't what you were trying to say in the paragraph I quoted: in that paragraph, you said that we just had to pick problems outside BQP to make cryptography work despite quantum computers. I don't know if that's what you had in mind, but for such an algorithm to be tractable, it should at least be in NP (nobody with a deterministic computer wants to spend an exponential amount of time establishing an SSL connection): so the mathematical statement is whether NP \ BQP is non-empty. Did I miss something?
<tinfoilhat>I bet an exploit was found that through operating a certain number of clients Tor's anonymity or hidden services can be compromised</tinfoilhat>
Working with robots: Our friends electric
Please support your local libraries and local bookstores. I hope libraries are never turned into historic relics.
There is some precedent for the NSA backdoors in commercial VPNs ...

http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_...

Backdoors were found in the devices/software sold to many governments, used by embassies and consulates all over the world.
Irrelevant. How valuable is the work you do? You could go around 'pitching' your window washing services and land 5 out of 100 potential clients but you still aren't getting more than a few bucks per wash.
Show HN: Heybill - Automatically Fetch Your Invoices From The Command Line
I remember when their president responded to another controversial payment freeze: http://brown-moses.blogspot.dk/2013/05/paypal-effectively-de....

Definitely interesting to see the higher-ups insert themselves like this, but I honestly don't think the temperature between users and PayPal is going to remain at subzero.
That's an interesting anti-pirating technique... Demonstrate how to crack your own licensing, while at the same time adding a backdoor to make users conflate the two. Obviously, all cracked versions of his software have backdoors in them...

Except his attack is valid against all unsigned binaries... even his own. He could be distributing a backdoor and not even be aware of it...
It must have been something else that broke it, not the key size. Android Browser definitely supports 2048-bit RSA certs. Maybe a root cert was absent from the browser (GoDaddy would be using a different root for 2048-bit certs?). Or maybe intermediate certs were missing in the certificate path. It sounds like your engineer did not spend much time trying to figure out what aspect of SSL/X.509 was actually causing the problem.
The hidden service is a tor node itself and there are no exit nodes involved. As long as there is other traffic passing through the nodes involved an observer can't tell which traffic is for a HS. Maybe :)
Some even lend e-book readers so people can access their lent e-books.
Others have pointed this out but: "BeeLine Reader is a patent pending technology" Well, there goes any respect I might have had for this. It is not obvious in every respect, but this is such a basic idea, trying to control it for 20 years while people perhaps find it useful and build this feature everywhere is absolutely destructive. I hope their patent is rejected.

FWIW, I liked it.
My startup creates software for use in penetration tests and red team assessments. I distribute backdoors and I'm quite aware of it. :)

I wrote this post to show how to use my software to backdoor a pirated copy of my software.
The US actually does not know the specific documents that Snowden took, or how much he took, because he was able to bypass their security. This is suspected to be the reason that Miranda was detained in the UK.
Perhaps. But the problem is that we don't actually know any specific way that NIST could have selected malicious ECC constants. So the problem is that whatever bad property they might have selected for may also exist in your randomly selected ones.
I better go cancel my Netflix subscription.
Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him:

"Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."

There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.
What is not being said is "Which if any of the CAs have been compromised?" There is this ongoing conversation of "Use HTTPS" (as one of the defense mechanisms) but there is been very little discussion from what I have seen around the scenario where CAs have been compromised/backdoor'ed.
Right, so you go on Wikipedia and implement RSA. You understand every single thing you do.

Oops. You forgot padding. Because of some strange identity that applies to the simple math you just implemented straight from the textbook, all your encrypted data can be trivially decrypted.
Maybe, not sure.

If I were looking at things, I'd backtrace from sites of interest. If your computer connected to a broad number of websites, and sufficient numbers of fishy websites - and other computers did likewise - then yeah, the false positives would be too great. But just increasing traffic through the network doesn't necessarily do that, at least as far as I understand it.
The author's claim is weakened slightly by the fact that Sean and Hiten were two of the people involved in coining the term (as he acknowledges) and Noah has used that term to describe himself and what he does. :P

The more interesting thing to me, honestly, is how quickly and why the term took off, rather than these definitional arguments about whether it's "BS" or not. There was about a year between the term being coined and it taking off.

The ironic thing is that all these "growth hacking is BS" just fan the flame more. Now we get to root for our favorite sports team!
How do you figure? Visa sees a piece of every card transaction involving a visa card.
I guess this makes NSAKEY[0] probably the NSA's.

[0] http://en.wikipedia.org/wiki/NSAKEY
Well I finally know what octane means.
If they're really trying to keep it secret, not even the NSA rank and file will know. It's all mostly need to know anyway.
The Most Interesting Programmer in the World
New Imaging Technique Shows Surgeons Where Tumors End And Brains Begin
It seems like providing a tor service to forward traffic after a delay would help disrupt traffic analysis, too.
I only have linux machines, but yes, I'm sure it works on Linux.
Don't get why this post was being downvoted when I saw it. Trademark allows for similarly-named companies in different businesses. The point is to prevent confusion, not cause a land-rush to monopolize common words.
Why would you expect a lawless organization like this to actually pay you?

It might just be easier for them to say "Thanks, but we already knew that, and by the way that's ultra classified so we'll give you the option of a clean suicide."
Happy Birthday, Voyager 1
You're right. That's why I'm introducing a bill to make it illegal to have a conversation without a certified government agent (or authorized private contractor) present. To improve citizen's security, a rider on the bill will also make it illegal to talk about, write about, or represent in interpretive dance the existence of those agents.

:-/
Well it doesn't help that all those pits have asbestos in them -- but that's not the project's fault. That would have to have been cleaned up eventually anyway.

It's the same problem the US has IMO: no one wants to support grand, forward-looking projects that are going to take longer than a term in office. That's why poor NASA has its funding yoyo-ed around a 4-year presidential election cycle, and can't ever follow through on the bigger projects anymore.
Tim's response: http://www.flickr.com/photos/timferriss/9684046788/
eBook lending licenses as brokered by the companies that provide this service to libraries (e.g. Overdrive) usually restrict the number of "copies" of an eBook that can be loaned at one time, and patrons often have to put themselves on waiting lists for books the same as they would have to for a checked out physical book. Obtaining additional available "copies" for popular eBooks is functionally the same as the library buying extra copies of a physical book.
I could see people licensing this as a mode in apps, that is ... you hit a button and all the text changes to use this color mode to allow you read through things faster. Then you can turn it off if you want to read things a bit more leisurely ... and yes, it did speed up my reading, not sure if that's a placebo effect or actual.
Unless it's SHA3, but thankfully that wasn't designed by them.
This is really funny - but the content shows the author's dedication to teaching (and learning) penetration techniques, even when it involves his own software. I would imagine that losing potential customers isn't a concern because the kind of people buying this software (generally) wouldn't run pirated versions. So instead, it makes a cool demo. Very cool, raffi.
It just so happens Facebook owns Parse ... so no bias in his statement either.. even if it could otherwise be genuine.
Getting started with Git: The fundamentals
Let's be clear...there is precisely nothing that has been revealed that indicates that the NSA has some ahead of the curve ability to compromise underlying cryptographic technology (see: http://www.schneier.com/blog/archives/2013/09/the_nsa_is_bre...). This is social engineering...they got the companies involved to backdoor their own products. And if they own your end points...well...

All I can think of is only use open code on open hardware (including the disk drives) done by folks whom the US or other cooperating governments don't have leverage against (psst...no, the answer is not OpenBSD). I don't think that exists.
It does matter if the NSA is actively sabotaging our cryptosystems. If people are making mistakes we can solve the problem as a community by improving the techniques we use to develop, document, and test cryptosystems. If we are dealing with people who are deliberately weakening our cryptosystems, it will be harder to push better techniques because our adversary will push back against them, or sabotage the techniques themselves.
Hey, how does the backup system work for you? I'm wondering if this would be a good thing to set up, in addition to my Flickr account.
Anyone Thirsty
Tim Ferriss's response to "The Whole Food Fallacy"
Not to mention that you give third parties a fighting chance for representation with your preferential voting system.

That's a really clever appropriations bit in your Constitution. I've often thought that the US needs some sort of Kevin Bacon Law -- all the measures within a bill have to be related to each other with only a few degrees of separation. No more banning internet poker in a port security bill! (https://en.wikipedia.org/wiki/SAFE_Port_Act)
The issuing bank and the acquiring bank generally split that, with about 1% or so going to each.
> Now I also have a cache for when GitHub goes down (all the time.)

Isn't the `.git` a cache for when github goes down? Git keeps all of your history inside your repository; you don't need network access to do anything.
With Swype and similar programs, passphrases are pretty easy to enter.
Why Are You Not Dead Yet? Life expectancy doubled in the past 150 years
About 5 of the "30 days of logos" ones.
Assuming there aren't any Indians writing password-cracking software...
I forked ChromeView, and then the more time I spent with the Chromium build and codebase, I realized the content shell was a better starting point, so I created a similar project that uses different chromium artifacts as a base: https://github.com/davisford/android-chromium-view; scrolling has no issues at all. There are a few quirks, and myself and a few other people are discovering them and finding ways around them -- since we all want to use Chromium for our various projects.
Sounds like Linus has some explaining to do...
Sorry, wrong link!

http://www.mazeware.com/games/html5/m7/supercanvaskart.html
The percentage that Visa charges should be much lower than what Stripe / Braintree charge. Visa can afford to stay in business at a fraction of a percent because they make it up in Volume.
This isn't 100% true. The majority of that is the native shared library and binary resources. These could be hosted centrally and loaded from an APK. It isn't totally necessary to package them in an APK.
Without the acquisition culture, many of these companies would never exist or be able to raise the funds to grow to the point where they could have so many happy customers in the first place.
I totally disagree with this sentiment (respectfully, of course). If you know the numbers it will bias your experience. You need to try it for yourself and determine on an individual level if your comprehension/speed suffers, improves or stays the same.
That's true. It all boils down to whether you have more information than the adversary. By default, you have both a password and a biometric; with the biotoken strategy, authentication requires both. If you lose your password (eg. password database being compromised, doesn't require local access), only your biometric can protect you. With biotokens, the idea is that if the biotoken fingerprint database is compromised, the adversary can't get any useful representation of your fingerprint, even if they have your password. Sure, as you say, you can lose your fingerprint if your attacker tails you at the coffee shop to lift it from the glass table or your discarded coffee mug ("local access"). But now the adversary has all the information that you do -- your password and your biometric -- so you're doomed no matter what.

Boult and Scheirer, the author of the above paper, gave a great tutorial about these kinds of privacy/security issues at 2011's International Joint Conference on Biometrics (IJCB), if you're interested about learning more. Both happen to be my former advisors too ;)

Tutorial:
http://www.securics.com/~walter/IJCB2011/

Slides, "Part I: An Overview of Issues Related to Biometric Privacy and Security"
http://www.securics.com/~walter/IJCB2011/IJCB11-tutorial-par...
"Part II: A Survey of Template Protection Technologies"
http://www.securics.com/~walter/IJCB2011/ijcb-survey-templat...
What does this post have to do with the topic? Why do we care what you've read over the past year? No one cares and you're not that special. Other people read too.
Correct me if I'm wrong, but I think that the interface presented in the video won't become a primary tool for engineers. I believe that mouse+keyboard have two significant advantages: they allow to do more things at once and provide more precision (movement, measurement etc.), which is crucial in CAD I believe. I can imagine that adding voice commands ("Move object X 1mm left") could be helpful in that matter, but doubt if it would be sufficient for any more complex task.
Forgive me if I don't open a PDF from a .ru domain. (and yes, I know how silly that response is)
> harder resistance when gov comes calling with inappropriate requests

Not at all, now such laws going to be established across the world in order to "bring us in line with international law." Broad-sweeping and baseless surveillance is going to be called "nothing new" and "widely utilized for the benefit of law enforcement."

This is another effect of globalization -- if one government gets an advantage over another due to lax privacy laws then the rest have to follow suit.

The NSA's bottom line is this: If China has a Great Firewall and we can't have one, then we must have the capability to decrypt everything.
>The average Android app is already a UI nightmare that feels foreign to the system, I don't see how HTML is going to be somehow worse

Well, it's gonna be worse by being even more foreign, feeling even more foreign (what's with custom components re-created for HTML5) and slower.

Actually, it's not a hypothetical: you can already check "wrapped in native" HTML5 apps and proper native apps, and the former do feel inferior, unless the developers have put tons of effort in them (and still, they are not able to do cpu-intensive things that native apps do, from live video filters to audio stuff).

Of course that might still be OK for simple apps, todo lists, glorified web clients, etc. But those are not what will drive mobile forward, it's just the lowest common denominator.
Retry failure modes seem to be a recurrent theme in networking, see e.g. http://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse

Instead of hacking relays to prioritize one botnet version over another, they should properly implement rate-limiting algorithms like exponential backoff in case of failure.
I thought that was the case as well, however the documentation [0][1] I read indicated otherwise. I didn't do an exhaustive search after reading those, however, so it's possible. If so, I'm surprised. I'd expect the documentation to make it explicitly clear since their are legal and bandwidth implications to acting as a Tor node (though for non exit nodes, the legal ones are small).

Regardless, even if the hidden service is a node itself, a passive observer can still do traffic correlation attacks. It just requires more resources.

[0]https://www.torproject.org/docs/hidden-services.html.en
[1]https://www.torproject.org/docs/tor-hidden-service.html.en
>Burning Man is not a communist utopia.

No, it's a BS hipster fest.

>I wanted him to experience the city and to experience gifting because I thought it would make him grow as a person and the world better off as a result

Takes naivety to a whole new level.
Nanomsg: The big picture
I really wish that I could mod this up a LOT ... even with TOR exit nodes + HTTPS, there's still a really good chance of things not being secure...
Here is an interesting startup idea that may be a step towards a solution.

Setup an organization that gives a tick of approval similar to ISO quality standards but for NSA Free software. It would involve selling your logo to business that meet a defined list of processes and practices to harden their software against 3rd party spying and security flaws.

Then you can preform audits and sell your logo on a yearly basis to businesses around the globe.
I can. You can submit your site for review, it seems they mis-flag lots of sites.
Nexus 7/Chrome doesn't work.
Why don't you get an emulator? Or try browserstack.com.
Do you know the news?
Good means of exercising damage control...

"The cracked versions are backdoored! Use official release to be safe."
I find his advice to be spot on and I see proof of it every day. People still use 'Password1' as the key to their AES-256 bit encrypted file system.

You don't have to be a mathematician to attack AES-256, you just need to know humans and do some password analysis.
Please, please, please fix the cupcake photo's color temp. http://mediagoblin.org/images/home_goblin.png
http://mediagoblin.org/images/tour/cupcake_discussion-scaled...
Ask this about autism and see what kind of "caregivers" are out there. Or, if you as a parent could not get services for your DS or autistic child, would you get a lighter sentence for the all-too-common DS and autistic murders out there? [The press treats caregiver originated murders gingerly too.] Autistic rights groups follow these developments painstakingly, often in dread of what the wider public incorrectly assumes from these very basic studies.[I hate science sensationalism with a passion.]
Actually, that's where the name came from!
Which, presumably, would not stop people filing chargebacks if Mailpile fails to deliver on their promises.
Test (ignore)
google.com Lorem ipsum dolor sit amet, consectetur adipis bit.ly/ihoj?hi=883ojcing elit. Nam lobortis, lacus quis feugiat hendrerit,http://google.com/hi sem lorem posuere mauris, at hendrerit mauris urna a dolor. Proin viverra augue bit.ly ut sem a wut.org liquet, eget scelerisque augue consectetur. Quisque felis nisi, pretium BIT.ly/ihoj?hi=883ojcing iaculis tincidunt quis, porttitor (google.com) a dui. Nulla hello@google.com test@hello.google.com lobortis luctus urna non dapibus. Nul[google.test.net]lam ullamcorper elit dolor, id semper diam pretium at. Sed et sapien purus. Fusce eleifend nunc id massa venenatis blandit. Pellentesque quis orci at turpis suscipit scelerisque sed ut lorem. google.com
The security model of meshnets always seemed to me to be very similar to the original internet. I.e., to the extent there is any, the endpoints are responsible for providing it for themselves.
2048 bit RSA is usually described as roughly equivalent in security margin to a 112 bit symmetric key, and 3072 bit RSA to be 128 bit symmetric equivalent.
In the case of Tor, the objective is to obtain a valid circuit relatively quickly so I feel that even exponential backoff would need a low max time to be practical.
SHA3 (Keccak) is also a cryptographic hash function, and should not be used for encryption.
I like spreeder:

http://www.spreeder.com/

Set the chunk size to three for best effect. Just gradually increase it each time, and also try using it occasionally with the speed far too fast. You'll get used to subvocalizing less, and reading multiple words at once.

Of course, for complex texts like the ones you read, it's natural to read much slower. I read 600 WPM for most internet articles, but I'm sure I wouldn't read plato that fast, nor as continuously.
No, it's not really adding that much traffic apparently, just using resources to create connections that are very well utilized.
But what does that have to do with the relative security of DLP vs EC?
Just needed a post to test some things on... please ignore this
Not sure how you can stop that error, but you can run "Ctrl-L" or ":redraw" in vim to fix your layout.
Yep, I'm ashamed I didn't make the connection last week when I signed up for a PPTP VPN. They've been broken for a while now.
Systems that generate their own DH parameters have to negotiate them, which adds mechanism and thus potential vulnerabilities. NIST publishes standard groups for systems to use to avoid that problem.

I'm certainly not claiming that conventional DLP is more complicated than ECC, though.