skysight-inc/HackerNews huggingface dataset:
The NSA is a schizophrenic organization. It is tasked with two opposing goals:

- To eavesdrop on the communications of foreign entities.

- To protect our own government from foreign entities that are doing the same.

It is the latter directive that has provided SELinux and AES.
Show HN: I made an interactive map to endorse candidates for NYC mayor
Low Price Shop Sells Sac Vanessa Bruno
Our Store sells low-cost, high quality, simple sense light Sac Vanessa Bruno, Thanks For Visiting Our Cabas Vanessa Bruno Solde Fashion Organization.Facile échanges et de retours!
> The NSA seems to be really divided between SIGINT and COMSEC.

Anybody care to guess which group was responsible for the FUBAR that gave Snowden the keys to the kingdom?
It would be good to see which books they have before signing up. I like the idea though a little expensive.
Elon Musk Shows Off His Crazy Iron Man-Inspired 3D Modeling Setup
The Friend Of A Friend Project
Regular expressions were very invented to avoid this. Because this works fine only as long your regular expressions are small and few.

Once that fact changes you will find yourself writing and staring at walls of text.

You will do this enough number of times, then only hope that you have a more succinct and powerful way of expressing such a idiom, you will do all that only to realize using regular expressions are the only way to solving a range problems which it was designed to solve.

The easiest analogy I can give you math. Prior to manipulation of symbols, math was pretty much text. The whole of math looked paragraphs of puzzles and word play. Worked fine when you want to do small things like postulates, axioms and a few things derived from that. To move a higher level of abstraction and interplay of concepts we had to get into symbols.

This is something similar.
The problem is, what industry with deep pockets would support EFF policies? For instance, the NRA is supported by firearms manufacturers but the EFF is opposed by copyright trolls like Hollywood.
It's optional but highly recommended. I've spent a lot of time in the Stripe docs over the last couple weeks building my new project integrating Stripe.
Yeah man, these dev friendly API companies are awesome. Stripe, Shirts.io, EasyPost (https://www.easypost.com) Loving them all.
You could use a computer that doesn't try to run arbitrary programs from the USB stick for a start.
Teen Helicopter Enthusiast Slices Own Head With Toy Chopper, Dies
The money isn't the issue. The issue is that once you disclose the algorithm, your continued existence can then only represent future nation-state levels of liability.
There's nothing at all opposing about those goals. They're both natural by products of expertise in signals intelligence and cryptanalysis, and skill breaking security helps provide more secure systems by subjecting them to more sophisticated attacks.
Just as a clarification, NSA doesn't set those standards. Agencies like NIST set AES and SHA3 through open worldwide competitions. These standards then become parts of larger compliance guidelines like FIPS (Federal Information Protection Standard I think) that govern how the USG should protect its data.
Am I the only one who sees all that complexity and yearns for a Tesla? (3 moving parts.)
Looking at the numbers and making some estimates...

$10 billion in transactions probably turns into about 1% in fees, so we'll say revenue is about $100 million. Being generous, let's say they are running on a 30% margin. That would put profits around $30 million a year.

That's pretty good, but when you look at that number it would be a 10 year payback period at $300 million. At $1 billion, that is a 30 year payback period.

Given the $69 million in outside funding, I'm sure they are pushing for a 10x return, so $690 is probably the ballpark of the asking price. They are probably asking for $1 billion in hopes of a counter around $750 million.

If I were a company looking to acquire a merchant services provider, I would look at the cost of acquiring that $10 billion a year in transaction volume. Is it less than $1 billion? Probably. That is probably why MasterCard built this: https://www.simplify.com/commerce/ instead of dropping $1 billion to buy stripe or Braintree.

If you didn't have a big strategic need, the right price for Braintree is probably more like $200-300 million. Braintree won't sell at that valuation because they have raised too much money and it wouldn't be a big enough return.

I could see PayPal buying Braintree, just for some of the more developer focused company culture, but I don't see why Square would buy them.

My guess is Square and Stripe end up merging at some point. It almost feels inevitable.
Thank you for a thorough reply. IMHO, these bugs do not differ in severity or frequency when compared other closed source software vendors or from open source projects.

The iCloud aspect does bother me quite a bit though, particularly when combined with likely NSA backdoors.
I like this a lot, but unfortunately going to various news sites (NY Times, Slashdot, etc) it seems like the bookmarklet failed or complained it wasn't designed for the home page (in cases where it wasn't a home page).
Stephen King recently rewrote the Gunslinger (first dark tower book) by mostly deleting the florid "serial adjective abuse". He goes into it in detail in the forward. The result isn't Hemingway, but it is more readable, and actually feels richer as more is left for your brain to fill in.
AC Repairman's Daughter
SHA3 was a contest run by NIST, known to its friends by its other name, NSA.
Story behind my SXSW 2014 submission
Please read and vote.
Seriously! What's wrong with "The Techno Freedom Party" or something like that? If only these party leaders would spend 5 minutes reading about how to effectively market themselves to voters, they'd realize how politically suicidal they've been by giving themselves a party name that sounds like a practical joke. I think they'd be surprised how many people would get behind them & their policies if they stopped preaching to the choir and made an effort to appeal to the voters who don't already know about them.
I have a friend who interned with the NSA in high school. Although what he did is classified, he was allowed to say that his work got published internally.
NIST has like 2 cryptographers, doesn't it? The real guidance at NIST comes from NSA. If you think NSA is backdooring Suite B crypto, you can't trust NIST.
Yes, that's the speculation, that they've been doing this, and that's not a new speculation either. At least on the keys, cables, and 0-days (and some folks believe Windows has been backdoored for a very long time). Backdooring, as noted, is a tricky problem for all parties if found. Even with Windows, I'd expect various people inside Microsoft could verify with independent builds. (If they compile the bootloader or crypto.dll and use a disassembly tool and the output is functionally different from what's on the ISO...)

But if there's solid evidence, why don't they publish it? If they really have broken into Google, then publish the details. I'm sure Google would like to know, too. If they've backdoored Windows, Office, VLC, whatever - same thing. Or are we talking more stuff like "we knew Debian couldn't generate keys properly"?

If it's just stating that the NSA possesses heavy offensive capabilities, well, yeah, you'd expect that. Actual evidence of an NSA-backdoored common software or hardware would be a major story. (Not saying it's not possible, just speculating gets us no where.) If Schneier and Greenwald want to be taken seriously, then step up and speak out. Generic "the NSA is powerful" isn't much help.
The problem with it being swapped to disk is that it means the decrypted form of your key (you're storing it encrypted by a passphrase, right?) is now persisting while your computer is off, which exposes it to more threats (someone images your disk when you take your computer in for repair).

Timing attacks would certainly be harder if you're never signing anything in a situation the attacker controls, but I'm leery about claiming nothing could be done.
Nothing actionable in this post. If they said "OpenSSL is backdoored, don't use it!" then great. But, "Some software somewhere has a security hole in it", is pretty unhelpful.
While this post doesn't strike me as particularly credible, the ties between Wikileaks and the Kremlin bear some investigation. Assange chose to host a talk show on RT, which is a mouthpiece of the Kremlin. One wonders to what extent Assange, in his opposition to the United States, has allowed himself to be used by a regime that is considerably less progressive and democratic than the Obama administration.
Linkbait-y title. I'd hardly call that a "toy" -- as I suspected, it's a professional grade remote control helicopter; article says it costs about $2,000. I don't know the size of the engine but it's definitely large enough to cost you some fingers if you screw up.
Somehow, I think foreign organisations have always known or at least suspected and taken appropriate measures to guard against NSA/GHCB/Echelon/ASIO whatever evesdropping. Even terrorist organisations. Its just the you and me everyday saps that have just found out. And there's not much we can do about it.
Totally relevant since all that extra time needs to be paid for or people wouldn't go into the business.
I've got a copy of his book. I thought I'd never get around to it, but now I wonder. And I wonder if having purchased from Amazon means I'm now on some list at Fort Meade.

Maybe there should be some canon of crypto fundamentals, and everyone ought to buy a set, as protest / funding for research / "I'm Spartacus"!

Though at this point, I also wonder if he needs to publish a list of some kind of hash of the pages' images, so readers can verify the NSA hasn't been borking it at the printer.
"BTW, Just read that O2 UK are blocking VPN traffic....."

Where does it say that? I can't find it
It sure feels like a bit of hyperbole, but that said, it seems that ssh was mentioned in the documents.

Still curious what the vectors might be, or if higher level insecure bit depths might be to blame.
As we'd expect other other governments and possibly corporations to have. Find someone with access to whatever, perhaps with foreign relatives, offer them a world of money, problem solved. Or groom and plant someone. Corporate espionage exists, doesn't it?
Compromise the CA (and possibly the pinned certs) and the keys to the bank are yours. No need to spend all that pesky time crunching numbers, factoring etc.

The most frightening thing to this is there is no good, widespread alternative...
Ask HN: How many HNers use encryption?
It's been several months since the NSA scandals leaked. Since then, how many of you have adopted encryption, or continued using encryption from previous times? Also, do you still use Gmail or have you switched to private, local hosting?

Be honest and vote once.
Encrypted e-mail (PGP or S/MIME)
Encrypted IM
Private mail server hosting
Azam has a great youtube channel...

http://www.youtube.com/user/azamsharp
Considering what we've learned, anyone's definition of "appropriate measures" has probably changed.
The sick thing about this is that they named the two programs Edgehill [0] and Bullrun [1] after early battles fought in civil wars. I can't see how they will be able to maintain that this is still about terrorism or espionage from other countries. It seems to be nothing other than state-sponsored violence against citizens of the world; the bulk infringement of our right to privacy.

And did the whole security industry really not know what was going on? That's hard to believe. In general, I feel like my trust in the ecosystem has just been nuked from orbit.

Clearly a lot needs to be done to fix this. What kind of non-violent protest works? What kind of civil disobedience works? What are the best organic ways of organising people without getting shut-down? Do we have technology that is still secure, even if CAs are broken or even if hardware is backdoored?

[0] http://en.wikipedia.org/wiki/Battle_of_Edgehill

[1] http://en.wikipedia.org/wiki/First_Battle_of_Bull_Run
>>What man would thinks so little of himself, what he is working on and the intelligence of the people he is meeting with to think that the main reason funding did or didn’t happen was based on an outfit!?!

I love this line. I'm a guy, and I find it disturbing how much weight some women put into their looks.

I'll give a simple message: most men I know don't give a two flying hoots about how you look as long as you aren't north of 250 pounds and don't wear enough makeup to supply a circus.

We really don't care. We don't find looks like that attractive. We forget what you wore last night and if asked, we honestly don't know or don't care if your ass looks fat in those pants. We know you have a closet full of clothes and 15 pairs of shoes, but we couldn't recount how a single item looks.

So what do we find attractive? Stand up tall, smile, and tell a good story or joke. Shine and be happy to own such a wonderful spirit in a wonderful body. We aren't as visual as the media makes us out to be once we are past 19 years old.

I've come to the conclusion that women pay far more attention to how other women look and dress, makeup, and look good to impress each other. The guy just thinks you are beautiful and wants to know you because you are, by the shear nature of your body and person, a beautiful and attractive being. Unfortunately, this message will be lost in the ether of the internet and forgotten, never reaching the women who need to read it the most.

I'm over 30. The most wonderful day of my life was when I woke up one day, looked around, and found nearly every woman on earth attractive in her own way. Just don't stress about it girls: if you spent nearly the time studying, socializing, and working hard as you glamming up, you'd be very far ahead any guy you will ever meet in your life. Time is the most precious resource you have, and wasting time on looks is the largest and mostly costly sink I've observed.
>All other things the same, a dual clutch is not much faster than a properly-operated manually-clutched gearbox

Formula One drivers in the early 90s were the only ones really able to come close, with shift times between 150 and 200ms. The average person is more around 300 - 400ms when shifting aggressively. You can be faster than 300 - 400ms, but not with 100% consistency, especially on downshifts, and especially with some transmissions with odd clutch engagement points or shift levers that require more deliberate effort.

A modern DCT, like Porsche's 2nd generation PDK, has a shift time of 150ms. Porsche's 3rd generations are even faster -- the PDK-S in the new GT3 is 100ms. The version in the 918 Spyder is 50ms. All of these are perfectly rev-matched, every time.

I've driven many tremendously good manual transmissions. However, generation two PDK is good enough that after four test drives (two with a 6-speed, two with PDK + Sport Chrono) I've actually decided to order my Cayman S with PDK since it's unquestionably better. The only thing I wish is it had the "burnout/donut mode" of the 3rd gen.
I took a sci-fi writing class from Haldeman in college. He was great.
In one of the articles linked from this one, the one on how to protect yourself, he says:

"Prefer symmetric cryptography over public-key cryptography."

I always thought asymmetric and public key was safer, so could someone clue me in on this?
True enough. It has only become schizophrenic lately because it is now eavesdropping on domestic communication as well.
I read it as an interesting mix of conspiracy theory and potential counter intelligence ties. It certainly raises a couple of questions that are worth exploring. It will be interesting to see how things play out.
Actual quote from the CTO of a company that makes some security-related software (it's a major selling point) for a specific sector. They probably have over a hundred million people using this stuff day-to-day, indirectly, and hundreds of direct, large customers. Security bypass can easily cost hundreds of thousands a month.

I had found a backdoor in their platform, so I asked if they had such basic holes, how they managed to write a large C-based app securely. Like, buffer overflows, for example.

CTO/head of development replied: "Buffer overflows? Probably not an issue, unless the network is really fast." Cringe.
In theory, that would work. In practice, you need to be careful, because you can screw up.
You can factor the prime numbers in a list of arbitrary large primes and composites too[1].

[1] http://en.wikipedia.org/wiki/Primality_test#Fast_determinist...
If this is real, confession to a murder is good. It offers closure to the family of the bereaved.

However, confession to advertise, before doing it to the police, is bad. It cheapens the worth of the life of the person that's killed. He's expecting backlash because he deserves it; in doing so, he's reducing the value of life.

I can only hope that in the end, good comes out of this.
A big pet peeve of mine has been the trend to forgo black fonts for lower contrast grey, and it appears this developer is doing that as well (#333 instead of #000 when "Off" is selected). My hunch is that low contrast text (I've even seen medium grey on light grey!) comes from designing on a fantastic display with 100%+ color gamut and great accuracy and viewing angles. Take a phone/tablet/laptop with an average (lousy) LCD into a brightly lit room (or God forbid, outside) and the contrast goes in the toilet. Is black on white that hard?

The other problem I see (mostly on Chrome) is that headings are anti-aliased, but the body text is not. The difference is subtle, but still noticeable.
Whew, nothing to worry about! All you need is massive publicity for paypal to do the right thing.

Missteps create opportunity - e.g. does stripe facilitate crowd-source payments?
No, but I think Bruce Schneier, who apparently is now also working with the Snowden documents (though not on this particular document), provides good insight:

https://www.schneier.com/essay-446.html

Both the OP and Schneier refer to Snowden's claim that cryptography is mathematically sound, and so Schneier extrapolates that even if the NSA made a mathematical breakthrough, lengthening the keys should mitigate that risk.

The main meaty detail that the OP offers is the example of the 2007 cryptographic standard that NSa backdoored before touting it...however, Schneier notes that that risk was discovered by outsiders and the implementation was terrible anyway (it's not clear if the standard was ever widely used).

Other than that, the OP doesnt seem to have specifics that werent already assumed or known...e.g. How the NSA works with third party providers, breaks into insecure servers, and is trying hard to compromise SSL...
You are probably confusing ES spec with DOM spec, if not, at least I cannot find anything in ES spec even remotely related to how anything built on top would have to be asynchronous.
C-shaped Tube is Easy Alternative to Gastric Bypass Surgery
Drones Are Now Delivering Packages In One Chinese City
Unfortunately the technical details are layered underneath a bunch of fudging to make them layman-readable. Schneier doesn't even describe the attacks, just says that they're not mathematical. One would expect that this means the NSA has access to most if not all accepted SSL authorities and generates keys which they can utilize to sniff a connection at will. This is pretty much obvious, and any intelligence agency that HASN'T "compromised" SSL by gaining access to the master keys is probably very incompetent indeed.

That said, does someone have a brief rundown of the details from a technical perspective, so I don't have to read through several long news articles mostly filled with elementary explanations of basic concepts?
I owe Richard Stallman one big huge apology. I'm truly grateful for Free Software (free as in freedom. You know, that thing the USA used to stand for) because it seems to be the only alternative right now. Microsoft and Apple can never be trusted again, ever.

Sorry Richard. You were right. Thank you for your unwavering commitment to freedom.
Your first point is right on. In the early days, Linden Lab's executives always said that SL would eventually be 100% open source, client and server, like the Web (and Linden Lab would just be one of the hosting providers). But they never open-sourced the server code, so people who thought SL would become "something like the Web" (i.e. not controlled by any one company) became disillusioned. I'd definitely put myself in that camp.

Your second point explains you, but not why the population at large (most of which is not doing anything creative at work) prefers to paint by numbers when not at work.
To anyone reading the comments before the article like I did: the title is misleading. A person was not killed on video to promote a startup. The article is about a video of a man confessing killing someone, and the man is using the video to promote his startup.
AU political party names were very confusing for me; the Liberal party is politically conservative, and both parties are more liberal than the US. =P

AU successfully managed to de-militarize its police force? The US needs to use you guys as a case study! However, I suspect that you were only able to do that because of your very low tolerance for firearms violence, as evidenced by the near-complete disarmament of your civilian population via that massive buyback program & subsequent legislation after the Port Arthur massacre. I wouldn't be surprised if US citizens like the idea of a militarized police, ready to respond with overwhelming force to whatever movie-plot terrorists happen to pop up.
Blizzard games are down
Note that SELinux isn't crypto - it's code to implement mandatory access control, which is just regular bitbashing that any software engineer is completely qualified to audit.