skysight-inc/HackerNews huggingface dataset:
I assumed it was that and that case is puzzling but benign as the algorithm is much too slow to be chosen compared to the alternatives[1]. As far as anyone can tell this wasn't their best work:

If this story leaves you confused, join the club. I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it. And it makes no sense from a backwards-compatibility perspective: Swapping one random-number generator for another is easy.

[1] http://www.schneier.com/essay-198.html
TLS/SSL has a whole bunch of options that are negotiated between client and server to find one that they can both accept. I speculate that some of these may be badly broken by the NSA but the exact ones haven't been revealed so we don't know which ones need taking off the table.

Is there anything unusual about the cipher options offered by NSA/GCHQ servers? Or any recent changes at The NYTimes or Guardian's servers.
IPhone 5S And iPhone 5C Release
Now we need a human way to write Ruby in Python.
Well, if they found a constructive proof, that is.
AFAICT as a developer writing an app that uses the new background fetch stuff, it's also disabled if the user explicitly closes the app.

As a user aware of this behavior I'm a big fan of it, but I suspect it's going to be the source of some support headaches.
How to remain secure against NSA surveillance
Seems random, what is the mission of the bot and who is behind it or is this for rent?
No, Patrick just got finished explaining how people who do pre-order business with Paypal could have reasonably been expected to know what Paypal was going to do.
Snoops can identify Tor users given enough time, experts say
I've read literature and New Republic this isn't literature!
I barely read man pages and read a ton of literature. It's written poorly and couldn't keep my interest. It's funny, because the idea of a desert island is really interesting to me. Somehow this guy made it dull and annoying.
Why couldn't you prosecute, if you found out? I assume theft is still theft, even if done by a government employee.
PayPal Has a Crowdfunding Problem
For one thing I agree it's totally unnecessary. I also think that people who're not familiar with regex should stay away from them as far as possible. Or at least get some understanding on how regex is implemented, learning about finite automata is very helpful to the understanding of regex.
Yes. Knuth rather famously provides solutions to many of the exercises.
You can also reduce line transition errors by increasing font size and line spacing. The font in the "What is it" paragraph is, to my eyes, too small and tightly spaced to be easily readable (perhaps purposefully, to demonstrate their value).
Or the next MLK...
30 Days for This? (Yahoo new logo)
I read far too much of it, but not the entirety. It was a chore to read as far as I did, and I probably should've stopped sooner.
Well, it's not that simple, is it? Generally speaking, the public key algorithm used in SSL is used to protect the private key that is used to protect the data:

1) Site sends public key certificate to browser.
2) Browser verifies certificate against in-browser store.
3) Browser extracts public key from certificate.
4) Browser generates symmetric/private key.
5) Browser encrypts that symmetric key with the site's public key.
6) Browser sends encrypted symmetric key to site.
7) Site decrypts symmetric key with its private key (the one associated with its public key certificate)
8) Site and browser encrypt and decrypt data using the privately shared symmetric key.

If I break the public key algorithm(s) used in SSL, I break all of that. But we think that's tough (as in NP hard).

If I break SSL itself (find flaws in negotiation, etc.) I might be able to break all of that. That's been done a few times (SSL v1.0 is garbage; v2.0 is borked; v3.0 a little broken; only TLS 1.2 is borkless, so far. As far as we know.

If I break the symmetric algorithm(s), then I can get at the data without breaking SSL itself. But we think that's tough, too. As far as we know.

If any of the software used in any of the above is borked, then usable attack vectors may be exist. Or not. We don't know until we find them.

It's a complex box of moving parts with many potential attack vectors, many potential vulnerabilities, etc.

Who really knows if the NSA might have found a multi-vector, multi-vulnerability attack that allows them to get at a lot of encrypted data without having broken all of any one of those things.

It's purest speculation until someone with a sufficient clearance and sufficient need-to-know decides to speak out, and even then it would remain unconfirmed.
This is all theoretical, but you could use decentralized services/protocols that would eliminate such an opportunity.
IIRC, the article only mentioned the "dumbed down" version now in casinos being beaten by pros.

The earlier part of the article (when it was full strength and in testing) has no mention of it being beaten.
Thanks for that insider perspective, that will be useful to hackers attacking the space.

An approach would be completely abstract the process. I believe the ownership model is a completely broken process that's pushed by the nefarious banks (It's easy for them to just conjure up money from thin air and indebt us for 30 years - reserve banking. This is the root cause for the relentlessly growing, but almost entirely useless, home ownership industry).

Hotel 2.0 revolution is needed. Airbnb, but with professional, heavily computerized, management of much larger property portfolios.
Imagine this is proved in France, this would add some weight to the investigation and case against the US, esp if they can prove personal encryptyed information was stolen!

http://www.reuters.com/article/2013/08/28/us-usa-security-fr...
What's in a name? Perhaps your intended targets. Can't wait to see Project Auschwitz.
I have the Yoga 13, and I liked the tablet configuration option a lot. I'd use it more if there were more nice Windows 8 Metro apps, but I imagine that'll come with time.
Driver support for my Sony Duo 13 (a very similar machine to OP) is awful. Ditto for the Ubuntu touchscreen experience.

I've given up running Ubuntu natively and just run it in virtualbox, instead. Unfortunately I think it'll be a couple of years before Ubuntu has caught up with the current transition to touch interfaces.
The strength of open source lies in the number of eyes with access to the code.

Perhaps I lack the wherewithal to identify security vulnerabilities in deployed code, but there's a good chance that there are others who are able to spot said vulns.
The problem isn't that they're working to break encryption. The problem is that they're maliciously inserting backdoors and subverting crypto-research and publication, which puts all of our security at risk. (Not to mention runs counter to their stated mission)
Out of humor and a bit of worry, I had previously posed a conspiracy theory that the NSA/etc. had undermined (coerced, compromised, whatever) the Internet's certificate authorities. I no longer am comfortable dismissing it as silly humor. I worry that such a theory has about equal parts merit as not.

I now want viable open source web-of-trust encryption for the web as soon as possible.
When did "troll" come to mean blunt, vitriolic abuse?

Yes, I know, "language changes and evolves, yada yada yada". I'm curious about this particular usage, which seems to be something that got picked up and amplified by mainstream-media (who seem strikingly ignorant of Internet history), and what to do about the possible loss of the more traditional (and more subtle and rich) meaning of the word among long-time 'Net users.
It would be so damaging for Intel or AMD if a credible leak revealed they had backdoors built in, is it this really conceivable?
Hope he doesn't try to prove his point like the other guy did with Zucker's account.
Not exactly. Bitcoin enables multi signature transactions, so power rests not only with the escrow service, but also with the parties involved. There can also be more than one dispute mediator involved, as to maintain a balance.

For the delivery of real world goods you can write small scripts in the tx that monitor tracking numbers, have time locks, and the like as to maintain more control over the flow of money. Bitcoin is trustless, but only to an extent. Just like anything there will be point of failures, but Bitcoin minimizes them to a large extent and brings with it the opportunity to distribute power among many third parties, not just one.

I won't even bother answering you last question though, because I'm sure you realize how ridiculous that sounds in the context of this thread. Namely, if MailPile only accepted Bitcoin this would have never happened.
I am not sure about federal jobs but do they have age limits (maximum)? If yes, then I am guessing it must be in the settings.
It's definitely great knowing that our government is willing and able to commit pretty serious industrial espionage, and if anyone tries to do anything about it, hey, we have nukes too. Don't worry everyone, we're the good guys! We promise to send you some foreign aid after you've come to terms with your subjugation. /s
No, it can be a long time between a verbal and a written, because the verbal offer doesn't contain all the compensation details and requires final sign off from whoever makes those decisions. In almost all the corporate jobs I've gotten, I got a verbal offer relatively quickly, but the formal, signed offer letter came a long time (anywhere from a week to a month) later because it required the signature of VP or someone similar.

Re travel: I meant that the candidate has to travel, and the interviews have to be scheduled with the pool of interviewers. The minimum time for this is generally a week, but usually it takes longer. Interviews are a significant / immovable commitment and interviewers are required to give notice if they can't make it several days ahead, which means they have to be scheduled well before that.
Suns' Frye says he has been cleared to return
Unless this is attack on the anonymity of TOR rather than the speed.
One of the vulnerabilities was already discovered by researchers in 2007: http://rump2007.cr.yp.to/15-shumow.pdf

At the time, it wasn't clear if this was a deliberate backdoor or an accident, but it was proven that there there was a possibility that there was a secret key that would allow someone to predict future values of a pseudo random number generator based on previous values. Now it looks pretty clear that it was a deliberate backdoor.

This really reduces trust in US based cryptographic standards. And US based cryptographic hardware, as they mention in the article that they convinced hardware manufacturers to insert backdoors for hardware shipped overseas.
I read the disclaimer and then clicked it anyways...
It means there are two choices for America's participation in the global internet: decryption capabilities or America's Great Firewall.

The statement implies that in the absence of "strong decryption programs" then there would be only restricted access to and use of cyberspace. I'm sure the intelligence leadership in the US Government look at China's Great Firewall with both trepidation and admiration.
Chrome has had that particular feature for just as long (look for "Create Application Launcher" in the menu; or right-click a regular chrome app, set its presentation to "Window", and click "Create Shortcuts".) This is a separate feature, about creating apps that don't appear to be "from" the web.
Technical solutions to cultural problems often seem to result in arms races of various sorts. In part this has to do with the natural difference between actual and perceived problems and the constraints of technology.

"[W]hen a phone is moving, don't permit it to accomplish certain tasks." That sounds like a simple and efective enough solution until you're a passenger. Then it becomes a nuisance, some pain point to be hacked around.
Python's re.VERBOSE let you write [1]

a = re.compile(r"""\d + # the integral part
\. # the decimal point
\d * # some fractional digits""", re.X)

Instead of

a = re.compile(r"\d+\.\d*")

But that is as far as it goes for me. From that point, masking REGEX with additional layer of 10's of functions is not a wise move.

[1] http://docs.python.org/2/library/re.html#re.VERBOSE
Prosecuting would require contacting an authority that would be willing to take the case, and would also require going public with the fact that one of your "trusted" employees had invalidated your security systems, potentially opening you up to untold amounts of liability from customers who may believe their security has been compromised.

Go ahead, call the cops and media. I hope you have a ton of money on hand and some jewelry stashed away in various locations before you do so.
Perhaps ... but the resolution on the macbook air models is getting more and more conspicuously behind the times.

We were disappointed when there was no macbook air with retina two years ago, when the first retina screens were released. Now it's 2.5 years after that 2012 WWDC and ... same old same old ...
The backdoors are already there...

http://www.techspot.com/news/41643-intels-sandy-bridge-proce...
Is it harder to sneak in junk in open source projects? I'm reminded of Ken Thompson's Turing Award lecture, "Reflections on Trusting Trust". http://cm.bell-labs.com/who/ken/trust.html

Could someone add a backdoor to git that hides backdoors from showing up in git? Could gcc be backdoored to add backdoors to arbitrary software? How likely is it that NSA has a few zero-days lying around they could use to hack into the servers that host git or gcc or any other tool you rely on? What if they had agents among the committers and maintainers of these projects?

Security against a well-armed, well-funded, well-organized, secretive adversary is hard.
Chrome is a resource hog. I don't want that on my phone, which barely lasts 4 hours idling in my pocket. Thanks but no thanks. On my Mac, Chrome with 20 open tabs is always using most of my memory and CPU.
Good question. So, we will implement some payment processors by default, and obviously we are choosing the ones that do not let chargebacks.
On the other hand, as the server has both your payment details and your Bitcoin details, the exchange happens automatically when the match is produced, so there is no fraud possible :)
This is actually the only place where I see a future for Dart.
Accents? Yeah, I have three for English alone and switch between them depending on the other person I’m talking with. I’d also argue that, as a non-native speaker, personal identity is not part of your product.

Accent-free speech is like chemical-free food, but some accents come with connotations and should be deployed judiciously.
I love the idea of showcasing simple web apps (your notes app is really cool). Is the value you provide that you will provide a framework for taking my simple html app, and layering a user system on it so people can buy it from you/me? Just a tad confused on that point, but overall I really like the idea.
I think maybe I know one of possible causes.

When you have to struggle with problems too much (solve driver problems that happen due to buggy hardware, fix software crashes that happen due to original author doing some insane pointer juggling, and so on), you may as well end up genuinely hating when others do things in a way that doesn't seem proper to you.

Particularly, I'm guilty of such reactions, although I try to refrain from commenting unless I'm on one of "feel free to blow off some steam" discussion sites (which HN isn't).
> Quantom computing cannot break all of crypto.

Correct (except for the spelling of "Quantum").

> Anything based on P!=NP is believed to be secure against quantom computing, and there are several encryption methods backed by P!=NP

Incorrect, well mostly. The deal is that there are problems that can be done in "polynomial time" (how long it takes is not exponential in the size of they key) for a normal computer (or person); the set of these is called "P", the ones that CANNOT be done on polynomial time is "NP". And there are problems that can be done in "polynomial time" (with reasonable limits on errors) by a quantum computer; the set of these is called "BQP". If P = BQP it would mean that quantum computers can (in reasonable time) solve all the same problems that classical computers can. But in fact, P is a subset of BQP: there are problems that are "hard" for classical computers but "easy" for quantum computers.

An example of this is factoring numbers. Shor's algorithm is a way to factor numbers using a quantum computer and it runs in polynomial time. Now it isn't practical today: the biggest quantum computers in existence are hard put to factor the number "10", much less some 40-digit monstrosity. But computers only get better.

Fortunately, there are problems which are NOT in BQP -- problems that are hard even for quantum computers. And these are the ones you want (not those in NP) if you want to stymie a quantum computer.

For more details, see http://www.scottaaronson.com/papers/bqpph.pdf or frankly ANYTHING written by Scott Aaronson (http://www.scottaaronson.com/blog/).
But the article submitted is in no way literature. It'd be one thing if the disjointed, rambling style served the content... but in this context, such a writing style is unnecessary at best and distracting at worst. Rhyming couplets in dactylic hexameter are similarly beautiful and 'literary', but that doesn't make them an appropriate vehicle for long-form essays, as well.

And frankly, the style isn't very good to begin with. It feels inflated and cloying, like a freshman essay in strong need of an editor. But even if it were an exemplar of its style, I'd still hold it to be unnecessary here.
Steven,

Thank you for your response.

I am glad to see that there are comparable capabilities in the modern Windows world and will dig into the WMI side of things next time Windows admin tasks come up.
Offer: I will screen your resume for free as a Googler would
I get a bunch of questions about Google on Quora. A lot of these questions are from prospects who are trying to learn more about the tech giant and are considering applying there. My career has benefited from a lot of generous help from others so since I have a bit of free time, I wanted to give back a little.

So I’m promising to screen non-technical resumes to the first 15 people who send me their resumes exactly as I would if I was at Google (or any similar big tech company). Please e-mail at sbhadra.mail+screen@gmail.com

More details on rules and my credentials are at my blog here: http://saikatbhadra.tumblr.com/post/60381093547/offer-i-will-screen-your-resume-for-free-as-a-googler
Please. No more of this saying it's the US, or the NSA.

It's not correct, it misses the point, and the only thing it accomplishes is distracting people from the truth.

We built a communication system that is highly vulnerable to corporations and governments tracking our every move, thought, acquaintance, and opinion. The list of players that are ready and willing to take advantage of this system is very long, and includes virtually every government on the planet.

One of the many lessons we learned so far is that governments outrank corporations. That is, no matter what your fear of the corporate world, governments can always make each corporation give them the data, then combine all the data from multiple sources. This makes governments a danger that is an order of magnitude greater than other parties.

But it's not just a government story. This is a problem with the technology itself. Ever since the first web tracking code was written, people have wanted to track every tiny thing you do online. This is just the chickens coming home to roost. The NSA is the tiniest tip of the iceberg.

The US did nothing unusual, except have citizens ready to stand up and identify the problem for what it is. Don't make the mistake of nationalizing a problem that has nothing to do with nations. If you don't understand the problem, how can you possibly have a chance at forming a solution?
Yup, I totally agree. And I don't think people should stop criticizing at all, I think it's a valuable thing to do and is part of bringing about the change we want to see. I just wish there was less overblown under-researched clickbaity criticism.
Holy hell is that nerd cartoon crap and sales patter off-putting. Get a designer, stat.
Stylus support is a good point, but you could also just use a good mouse to perform complex 'mousing'.
We don't really need to ask individual engineers. A lot of this stuff is public knowledge and documented, as required by law, it just seems like nobody has bothered looking.

http://www.cisco.com/web/about/security/intelligence/05_11_n...
http://www.nsa.gov/ia/_files/routers/C4-040R-02.pdf

There are protocols designed and published as part of the security infrastructure. Whether these protocols are used for good or evil, is really up to who has setup and configured the hardware. The bottom line is that you can't Luddite your way back into the golden age of the Internet.

In fact, in a lot of ways, the NSA is just cooping technology that businesses and black hats were already using. Do you think that only the NSA knows how to do deep packet scanning or protocol pattern matching?
Not true. Regexes have been around for a long time and there are a few standards -- POSIX basic, POSIX extended, and PCRE. Any language/tool worth its salt these days will follow one of these three implementations (usually it's PCRE as it's the most complete). It's usually older tools like awk, vim, find, etc. that have their own quirks -- they were created before these standards existed and so they generally follow extended regex but then introduce their own syntax for certain concepts (in vim, for instance, \<...\> does the same thing as \b...\b in PCRE).
Very cool. I like the standalone "start_of_line" more than the start("some string").
Yes it does. Eye fatigue takes much longer to set in one a high dpi display. The productivity benefits of giving a high dpi display are probable more meaningful than those of giving an i7 instead of an i3 (for word users).
The worrying part is the "etc" part of your sentence, namely that all federal agencies in the US Government now have unrestricted access to encrypted communications. The DEA and the IRS are only the tip of the iceberg.

If one government agency has your data then the rest of them do too.
Show HN: Apps for Chrome OS/App Launcher for web services that don't have them
The Creepy Signal: the competing problems of privacy, anonymity, and identity