skysight-inc/HackerNews huggingface dataset:
It sounds an awful lot like that's the one the New York times was describing. Can you think of any other standard that was published in 2006 by NIST which two Microsoft researchers discovered a flaw in in 2007? That sounds exactly like Dual_EC_DRBG

> Simultaneously, the N.S.A. has been deliberately weakening the international encryption standards adopted by developers. One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.

> Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology, the United States’ encryption standards body, and later by the International Organization for Standardization, which has 163 countries as members.

> Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”

> “Eventually, N.S.A. became the sole editor,” the memo says.

Now, that may not have been an effective technique, as you point out it's so slow that no one is ever going to use it, and this vulnerability was discovered not long after it was published.

So, that's obviously not a vulnerability that they are actively exploiting. If they are actively exploiting a vulnerability that they introduced, it must be something else. It wasn't clear from the article that that's actually the case; it may be that the vulnerabilities they are exploiting are ones they've found, not introduced deliberately.

But it does appear to be an example of a vulnerability that they were able to get standardized, in the hopes of being able to exploit it. Until now, it has been only speculation that it was a deliberate vulnerability, but it now seems clear that it was.
Yes, you can.

Your opponent has 1352 different hand combinations. Assume he is playing the Nash equilibrium strategy. Make the perfect plays based on this. If he plays worse than the Nash equilibrium strategy, you beat him. If he plays perfectly, you tie.

Assuming your opponent plays perfectly works in chess. Chess programs are stronger than the best humans now.
So the Feds mandate data security, e.g. HIPAA, and then actively subvert our ability to achieve that security.
Scientists confirm existence of largest single volcano on Earth
Wow .... so SSH is broken? Wow ....
I set this up after my first child was born so that my wife and I, along with all of the other family members could post pictures and videos of our daughter (and our family) on a machine I control. When someone babysits her and takes pictures/videos they too can post them.

This serves us in many ways. For instance, we have all of the pictures in one place, not spread over many services depending on where family members post them -- although some family members also post to facebook :( For the grandmothers and grandfathers we just give them the url instead of trying to explain a YouTube channel to them. They know how urls work, not how YouTube works.

This also serves as a backup. The server is hosted outside our apartment so the pictures we put there can be easily fetched in case something happens to our apartment (and computers - but this can also be fixed with a backup server, this is a side effect).

Basically, family album in one place -- no matter who the photographer is (and backup).
What do you mean by, "freak out?"
Neither of those apply to SSL 3.0, do they?
No, you will tie or beat all strategies because your opponents will make huge mistakes like calling when you are almost never bluffing and folding when you are frequently bluffing.
New Geo Library for Amazon DynamoDB
Combined with node-toobusy, pausing READ events sounds perfect, but I can't figure out how to do that. Can you explain?
I think we know very well which encryption has been foiled by the NSA. This is not speculation, but quasi-certainty: 1024-bit RSA.

- Crytographers all acknowledge 1024-bit RSA is dead [1].

- Attack cost 10 years ago was estimated to be a few million USD to build a device able to crack a 1024-bit key every 12 months [2].

- "Much of" the "secure" HTTPS websites use such weak key sizes [3].

- NSA had a budget of 10.8 billion USD in 2013.

Drawing a conclusion is not very hard.

[1] http://arstechnica.com/uncategorized/2007/05/researchers-307...
[2] http://www.cs.tau.ac.il/~tromer/twirl/
[3] https://www.eff.org/pages/howto-using-ssl-observatory-cloud
Isn't that the point? The author does more than just describe Dave's rambling brand of monologue; he translates that experience perfectly in the writing style.
Ask HN: Growth Hacking for a Physical Product vs App/E-Commerce
While launching a product, I've been studying the rules of marketing online and customer acquisition, inbound marketing and growth hacking methods. However, most of this work concerns services (which I'm sure you all know of) like AirBnB, AppSumo, etc. I'm trying to apply these methods to launching a physical project. Any thoughts on different approaches that worked for these companies that may be applied specifically for physical products?
Was that really a seriously considered plan? I don't see how that would ever be a suitable /dev/random replacement. Obviously it works for /dev/urandom, but it should be added to the entropy pool for /dev/random at most.
It seems like the main complaints are that:

- It's iPhone only. This will, of course, change. They have to launch somewhere first.

- We already have public libraries and Overdrive. Sure, they are out there but they don't solve the problem that Oyster does. If you just want to flip through a bunch of books and see what you feel like reading, your current options are to go to a physical bookstore or library or hope Amazon or Google Books has enough to satisfy you in their limited previews. Imagine that as you're reading a book, you come across a reference another and being able to easily jump to the reference with no hassles like putting the book on hold (as is almost always the case on Overdrive) or reaching a check out limit or having to get in the car and go find a hard copy. Even the Kindle lenders library heavily restricts the number of books you can use at once. Having the full text of an ever-growing library at your fingertips is, if using Spotify is a close enough parallel, something that can't be fully appreciated until it's experienced.

- Price. If you usually buy at least one book a month and you can assume you'll probably do that indefinitely then it makes sense to instead start paying Oyster (or similar) indefinitely to get not one book a month, but all the books.

- Authors don't get paid. I think it's to early to say whether this will work out for authors or not. We don't know the business model. If it doesn't work for authors and publishers, they'll stop using it and Oyster will have to change their business model. In fact, this is the biggest risk as I see it. Netflix started with a good catalog and, for awhile, had a great catalog of movies. Now they're losing content and having to create their own, most of which I have no interest in. If publishers were to fall out of love with Oyster, Oyster's value would be severely diminished so they'll have to do what it takes to keep publishers (and hopefully by extension, authors) happy. One thing to consider, and maybe this is not as common as I'm guessing, but there are so many times where I've read a Kindle book and decided to buy a paper version to give the book a physical presence in my house. For certain authors, this could mean getting paid twice when people read their books.
Telzio offers recording of phone calls
Can you expand a bit on chrome's anti-surveilance capabilities?
Show HN: Sell personalized music to your fans
My favorite is when Sibel Edmonds approached them with a source that was saying the judges themselves are dirty and compromised (largely via the prism-esque programs) and the ACLU told her to basically not rock the boat and leave the judges alone...
son of bitches!
I've take a look at half the article so far and still can't find a single specific example of a "backdoor".

The entire thing seems hand-wavy.
The American people are only now beginning to understand what is going on thanks to Snowden's leaks.
It makes sense if "the US" = "the NSA". Stuff's been encrypted, for the NSA to continue to have access, they've gotta break it.
... Did you read the article? He addresses this directly.
Google? HN Search?

These weren't small incidents. You can find plenty of information on them.
I think you misunderstand it's actually a free add-on limited to 30 minutes of retention at 5 minute intervals. The paid version has 1 minute intervals with unlimited retention.

Edit: the parent has since stealth edited their comment.
Writing Quick Code in C++, Quickly | GoingNative 2013 | Channel 9
Yes, I think they are all Australian colloquilisms. A few I didn't know, but it didn't bother me. I thought "ding dong" and "yip yapping" were fairly obvious anyway, and words like "Sheila" would be known to you if you know a tiny bit about Australian culture.
I understand, but from the soylent webpage:

"What if you never had to worry about food again?

For many people, on many occasions, food is a hassle, especially when trying to eat well. Suppose we had a default meal that was the nutritional equivalent of water: cheap, healthy, convenient and ubiquitous. Soylent will be personalized for different body types and customizable based on individual goals. It allows one to enjoy the health benefits of a well balanced diet with less effort and cost."

That's very different than things like Ensure, where they talk about how it's an adjunct to regular eating.

They're making the claim that food can be entirely replaced by Soylent.
They seem to follow the 'tradition' of thinkpads ruining otherwise perfectly speced and highly priced laptops with a terrible screen, just so they can upmarket enthusiasts later with the $3000 model.
> "Project Bullrun deals with NSA's abilities to defeat the encryption used in specific network communication technologies. Bullrun involves multiple sources, all of which are extremely sensitive." The document reveals that the agency has capabilities against widely used online protocols, such as HTTPS, voice-over-IP and Secure Sockets Layer (SSL), used to protect online shopping and banking.

Wonder what this means?
Link: http://online.wsj.com/article/SB1000087239639044361580457804...
How to estimate task duration
You mean ability to push back _technologically_ against the NSA, right? This sort of article makes you think you can't beat the NSA tech, they will outsmart you.

What this sort of article does to me (unlike you, I make no claims to know what the article was 'meant' to do, other than report the news) is make it clear that we need to push back against the NSA _politically_ to win, make what they are doing illegal, change the gag order laws, etc. We aren't going to beat them technologically, but (for those of in the U.S.), it's theoretically a democracy, we can tell them to stop.

I've seen that argument made before, several times, in essays linked to on HN. It's a political problem, not a tech problem, that the NSA can force corporations to install back doors and give the NSA the keys.
Ever heard about presumption of innocence? Just because you have physical capability to do something, does not give right to spy on you. Now if there is clear evidence that you are predisposed to do something, then you go to the judge and get a warrant for surveillance. And no, expectation of privacy by using strong encryption is not any kind of evidence, it is matter of personal choice/preference.
There's 1352 card combinations, many more flops, many more turns, many more rivers and also 1352 combinations for your opponent too and 3 actions per round of betting

There's more poker situations than amount of atoms in the universe
Sure. I think we agree. If "it" is a crypto weakness they are actually exploiting, "it" is not Dual-EC DRBG.
C++14: Through the Looking Glass | GoingNative 2013 | Channel 9
I don't mean that dismissively.
How can you determine that it has better UX from a screenshot?
Saw that too. Thanks!
Amazon’s ‘mountain of margin’ in cloud services: over 80% profit
Microsoft to do away with "Nokia" and "Lumia" branding
After reading this essay by Bruce Schneier, I was reminded of advice I have given on Hacker News before. Schneier writes, "Dismantling the surveillance state won't be easy. Has any country that engaged in mass surveillance of its own citizens voluntarily given up that capability? Has any mass surveillance country avoided becoming totalitarian? Whatever happens, we're going to be breaking new ground."

Rolling back a surveillance state and establishing a government with more protection of individual liberties is something that has been done before. I have seen it done. I related at greater length here on HN my experiences living in a surveillance state that included government assassins to eliminate political opponents at home and abroad.[1] Getting rid of such a regime is not easy, but it is possible. It takes courage, and it takes unity among the courageous people making up the freedom movement.

I remind my freedom-loving friends here on Hacker News that there are resources to help you if you really want to be an idealistic but hard-headed freedom-fighter. If you are mobilizing an effective popular movement for more freedom wherever you live, I suggest you read deeply in the publications of the Albert Einstein Institution,[2] which are compiled by advisers who have helped bring about democratic transitions in various parts of the world. Not all of those movements have succeeded yet, but I bet on their long-term success in China, Russia, Saudi Arabia, Iran, North Korea, Afghanistan, and wherever freedom is scarce. Remember that the transition from dictatorship to democracy described in the Albert Einstein Institution publications is an actual historical process with recent examples around the world that we can all learn from. Practice courage and practice collective action.

[1] https://news.ycombinator.com/item?id=5985720

[2] http://www.aeinstein.org/organizationsde07.html
Thank you for that, and I hope that the people who keep arguing "if you can't trust your hardware, you can't trust anything, so we may as well just blindly trust the hardware" keep this in mind.

A bug deliberately introduced in an AES instruction, or in general purpose instructions that detects crypto operations and leaks information somehow, is much, much harder to implement and hide than a pseudo-random number generator that passes all tests that you apply to it, but produces predictable output for someone who knows some secret key.
They pin certificates, so that a CA compromise that would enable MITM attack by the global passive adversary would be detectable (and in fact that mechanism has already been used to detect CA compromises.)
"Intelligence officials asked the Guardian, New York Times and ProPublica not to publish this article, saying that it might prompt foreign targets to switch to new forms of encryption or communications that would be harder to collect or read.

The three organisations removed some specific facts but decided to publish the story because of the value of a public debate about government actions that weaken the most powerful tools for protecting the privacy of internet users in the US and worldwide."

Was there a fuller version of this article available to the public at some point?
Because there are no legitimate chargebacks if a gamble falls through. The presale risk is gone.
Here is the website for his OS: http://www.templeos.org/ (redirected from losethos.com)

It's common knowledge that losethos is a schizophrenic.
>CA Service Requests

Take one wild guess at what that means.
19-year-old in New York City killed by RC helicopter
I read it more as "vitalism is false, therefore, assertions against Soylent via vitalism are false," which seems good. I didn't read it as "therefore Soylent is good" but rather as "therefore this criticism of Soylent is invalid."

We may have just read this differently.

> I havent seen anyone making metaphysical objections to Soylent

I think the title of the article, about 'whole foods,' is a mixture between metaphysics and the more common charge, epistemic.
Another note I've learned on higher octane gas: in areas prone to freezing temperatures (I live in the northern Midwest), 87 octane will, during winter, have ethanol added into the mix as an anti-freeze. This is commonly called the "winter blend", and is federally regulated to only be on the market during certain times. The ethanol has lower energy density than gasoline, and can hurt your mileage. Higher octane gas does not have extra ethanol added in. So there's a benefit to using midgrade or premium in cold weather.
As is usually the case with an article in the mainstream media, the most interesting part is what isn't in it. If much Internet traffic is vulnerable to the NSA (and to the UK's GCHQ), doesn't that imply that much Internet traffic is also vulnerable to other governments? Such as, oh, say, China and Russia?
I was skeptical, I took the test, it said I was 23% faster on the fiction, so as much as I think it looks a little ugly, if it really is that much faster, then it's worth it and clever.
> In effect, facing the N.S.A.’s relentless advance, [Lavabit] surrendered

I disagree with this characterization. Surrendering to the NSA would be Google/Facebook/Microsoft's approach of unconditional cooperation. Lavabit's refusal to work with the NSA -- even though apparently the only alternative was shutting down their business or going to jail -- is more along the lines of a scorched earth retreat (destroying your own stuff when you can't hold the line).
http://underhanded.xcott.com/ <-- a contest all about sneaking bad behavior into code without being noticed

You can't rely on a backdoor looking like this:

if(!strcmp(username, "secretagentman")) { … }
> You're presuming that all reads occur after the system has quiesced.

It sure looked like they did, but maybe I misread the code.

> This is not always the case.

Even if that weren't the case, you might check out the probabilities on your birthday problem. What you've got is effectively a calendar with 100 million days (microseconds in the benchmark's 100 seconds) and 5 people (5 writes to the same record). You've managed to end up with those 5 people sharing a birthday well over 1% of the time.

> I'm just trying to keep folks honest about what their systems actually provide

I appreciate that you've found an interesting corner case that I'd not considered.

Actually, it's not that I hadn't considered it. When creating client side timestamps I do tend to think about this scenario, but with server side timestamps, I tend to think of it much like I think of collisions on Type 1 UUID's, but in truth the probabilities are higher.

I do think Cassandra ought to consider either a) using Type 1 UUID or similar strategies to make the risk of these collisions all but ridiculous or b) when resolving ties in the timestamps on cells by choosing a winning node or thread or something other than the value in the cell, but rather tied to the update operation. That would avoid this scenario in a fashion more fitting with the rest of the semantics of the system.

> give them tools to analyze those constraints

I think unfortunately in this case the analysis of those constraints is flawed.
Technically, the US is a republic. Though all states choose to elect representatives via a democratic process, it's not a strict requirement. This is reflected in the culture in washington as well, where representatives are more working for state and corporate interests than individuals.
Wow...Lesson #1 is SOOO on-point. I think that is what is missing from the free-to-paid conversion narrative.

The only people that will convert from free to paid is those that have received value. SaaS apps need to start paying attention to the 'value indicators', and provide an upgrade path on that - rather than a time limit.

This is one of the reasons that companies that charge per transaction are so awesome - because the only time you pay, is when you make money (which is the implicit value there).

This concept needs to be blown into a blog post - I just may do it - because this is so important and so easy to miss.

Your conversion rate may suck, not because your product sucks....but because your internal value metrics suck. You aren't measuring the right thing.
That's probably the point: Beeline makes it easier to read more text on a small screen. Increasing font size and line spacing doesn't work well on a smartphone, much less a smartwatch.
This doesn't make sense. It can't be. Why would cryptography be subject to export regulations then? If we follow this logic, you would think export barriers would have been brought down decades ago and use of NSA cryptography highly encouraged worldwide.
Malcolm Gladwell is Underrated
The American political process has four stages: money primary, party primary, general election, and lobbying. The will of the public often doesn't get expressed into policy because:

1. By the time the average citizen can play a role in the process, the remaining choices agree on many if not most important issues (see Obama vs. Romney).

2. Even if the public elects an official who promises certain policies, they can always be swayed later by lobbying (see Obama on privacy).
If what the US and UK are doing "undermines the fabric" of the Internet, what about what China and Russia are doing? Should we not bother worrying about them because we just expect them to be evil?
Some popular browsers still do not support newer versions. We tried turning this on with a newer, more secure key and ended up having downtime for some customers.
I think the key to understanding this is to remember that it was written by the NSA for the understanding of the NSA, or other highly authorized eyeballs in the government.

In many government documents, use of the name "U.S." is shorthand for the U.S. national government, not the entirety of the nation. Sometimes it is even shorthand for the particular agency that authored the document (since, in theory, they represent and act on behalf of the entire nation).

So what this internal NSA document most likely means by "unrestricted access and use" is the NSA's unrestricted access to, and use of, whatever data they want.

Think of it like a budget justification (since that is the purpose of at least half of all internal government reports). "You need to keep spending a lot of money on this program if you want us to keep getting all that data you like so much."
? I have just always assumed that's the kind of stuff the NSA did, after all, what else would they be doing? So the Snowden revelations were more disappointment than shock.
Structurally, it's denying the antecedent:

If Vitalism is true, Soylent is a bad idea.
Vitalism is false,
therefore Soylent is a good idea.

Vitalism and Soylent can both be crap ideas.
I really enjoy using this. While people seem to dislike the red and blue default, I enjoy it. I am not a big fan of the colors working together but I feel like it works the best for it's intended functionality of the choices you made available. I think this might make reading some things considerably more enjoyable for me. Thanks!
This is excellent. I used to occasionally use assertions to accomplish the same thing.