skysight-inc/HackerNews huggingface dataset:
Nothing would be required of customers. They'd migrate the data over to Paypal's setup in such a scenario. Card data is stored with a symmetric encryption algorithm (e.g. reversible), so this type of thing could happen fairly easily.
Absolutely, I've also done some proof of concepts like that but for production use the "in browser" experience didn't really cut it for my uses.
Short could refer to letter height, not line length.
Yes, you can. You also don't need their card name or CVV.
We've seen this phenomenon, just on a smaller scale. When an encryption standard is compromised, people either switch to something stronger or face the consequences of essentially leaving their data in the open.

DES was an acceptable standard until the late 90s, but you'd be foolish to use it now. RSA is the accepted standard now, but it is said to fall within 5 years or so. At that point, people will either start paying for a license to use Elliptic curve encryption algos or something new will be found. It's a vicious cycle, but I certainly don't think encryption ends with quantum computing, but maybe disrupts it quite a bit for some time.
Yes, you can charge people without the address field. You still need the CVV code for fraud protection.

I read somewhere that credit card companies charge lower rates if the address is provided as well. If that's the case, it seems like Stripe normalizes the price for you.
It is probably time for an audit of code submits to the encryption libararies in open source projects.
Works for me. Nice.
I completely understand. This is actually something that I have 'waffled' on several times.

What is putting me on the side of preservation right now is the hope that with preservation, future generations will benefit, but shredding the document would only help the existing victims. People living in Germany have something concrete to show their children when they teach them about the value of privacy. With that, hopefully the "anti-surveillance immunization" will span generations.
I'm the former CTO of Braintree and one of the founding employees. I was there when Bryan Johnson hired Bill Ready as CEO and decided to move to Chairman. The authors of the TechCrunch article were either misinformed or speculating when they said that Bryan "lost his position" and that Bill joining was a "decision made by Accel." Bryan made the decision to hire Bill and move into the Chairman role without pressure from anyone.
Well, on those feet, I'd ask for money, not knowledge. That has the advantage that the NSA may actually accept the deal, instead of just blackmailing me (or worse).

That is, if I wanted to make any kind of deal with the NSA.
It is might be time for an audit of code submits to the encryption libararies in open source projects.
Your idea is another extreme. On one end you have indoctrination by parents and in the other by society. Both are failures.
That $3 billion in revenue is for the April-June quarter, during which Visa processed $1.74 trillion in transactions.
There is already some support for Gentoo and Archlinux, and if you are willing to use a "foreign" kernel, Red Hat / Fedora / CentOS work as well.

There is some significant work in progress to add compatibility for non-AUFS systems. I don't have an accurate timeline at this point, but expect something (or at least an announcement) at the end of the month!
Doesn't this only help if github lets you leave ssh connections open and not doing anything for long periods of time?

Surely if they do, they won't for too long if lots of people start doing this.
LG Nexus 5 makes probable appearance in FCC with plenty of specs
That might explain why I haven't got the textbook I ordered from him yet!
Do you mean square or stripe?

I don't see how Braintree and Square are interchangeable for anything other than physical point-of-sales use cases ... which doesn't seem like Braintree's sweet spot
For that reason Senators were originally elected by state legislatures. It's only been 100 years, since 1913, that senators have been directly elected.
> Past performance is a way to show what haters are losing every year...

... said real estate agents in the early 2000s.

Folks who bought in April at $260 are out more than a hundred bucks per Bitcoin. It's just as easy to lose your shirt as it is to get rich.
It's funny that so many commenters are complaining about the lack of a linked study. It's as if people are incapable of independently analyzing the claims and reaching their own conclusions.
My reaction was: and does it wear off slowly?
pretty cool - I've used something similar for python JSON validation:

https://code.google.com/p/jsonvalidator/

but love the idea of something for validating nested data structures as well.
Yep, you're right, my fault, will fix.
>I'd bet that a majority of that money is on art projects and legit theme camps

One trip's expenses from Texas for a dozen people. Most of our expense is getting there and back.

Fuel $4000

Tires $2500 (4 flat tires, more than usual)

Geodesic Dome $900 (reusable)

Food $1400

Water Storage $300 (reused three times)

Most of our theme camp stuff is used/re-purposed things that don't cost a lot.
Anyone know how the fees in the industry break down then ... $3bn is < 0.05% of the transaction volume ... that seems tiny to me!

Though all I know is the headline rates quoted for most common processors where <2% seems very aggressive. Who gets the other 1.95% of that?
Nope, Stripe doesn't require the CVV either.
Rewording of http://s4gru.com/index.php?/blog/1/entry-351-teaser-is-the-l...
IOS Security: What Does Security Mean to You?
How do you know the difference between a blocked site and a site with a networking issue without uh... subverting the block and using a proxy or a vpn?
Very valid point, and I you're right you really would have no idea. You could check on some devices if you knew enough about hardware to compare the internals and the diagram, but that is a select few people.

This is why customer-company relationships and company integrity is becoming increasingly important, and frankly not many US companies are doing well in that regard.
How many of Cacophony Society people who led Burning Man to the playa were techies? I'm guessing this number is a lot more than zero.
Do you think your cousin is going to turn you in?
And the artists of the world can have a fresh supply of human skulls -- with the unfortunate defect that there is a bullet hole through them. But that just makes them a bargain.

Don't feel bad. It just means the family of the deviant hacker criminal won't have to pay the bill for the bullet.

Or in other words: Yeah, china. There's an ideal to aspire to.
any links to your code?
Certainly open source benefits only so far from the review it receives. The NSA could conceivably submit a patch to openssh to Debian that once again subtly breaks security.

On the other hand, audit is possible, which is a hell of a lot better than the alternative, limiting their options to underhanded subversion is again better than the alternative, and to my knowledge nobody has actually ever picked up on a case of this happening (while we do know they have had the security of close-source software subverted).
What about Dart? It might play a role here, it's not likely to go far outside the Google ecosystem and I'm not convinced Google ever thought otherwise.
My apologies, I mis-quoted the annual number, which is about $10.4 bln, which is still only about .16%.

Still, your question, "Who gets the other 1.95% of that?", is valid. My guess: the card issuers themselves, who operate the networks (Visa, MC, Amex, Discover). Throw a little on top for Chase PaymentTech and the like.
The Debian OpenSSL bug was and is highly embarrassing, yes, but the fact that the source was open was absolutely instrumental in its discovery. It's also difficult to find a better example of the right way to react to such a bug.
Square probably has better gross margins than Braintree because they target a different market: small businesses.

The value Square adds to that market is much more substantial: free POS system, mobile wallet app, promotion in their marketplace, Jack Dorsey's autographed photo, etc.

Braintree (and Stripe) target ecommerce startups. Their value-add is streamlined APIs and tailored customer service. That value-add is nice but relatively smaller and less scalable to boot. As soon as those sites get big they will negotiate for lower rates they can get from a commodity processor. No doubt the big customers in their portfolio already have and we just don't know it.

Square's got a whole world of small business to expand into, a much larger market than ecommerce startups. And their margins are more sustainable; it takes an awful lot of growth for a merchant to justify switching out all their POS systems and other Square lock-in, just to shave a few basis points off their processing rate.
If someone is using your service and is suspected to be committing a crime through it, as a provider you can be subpoenaed to be reasonably complicit in an investigation on said individual. That can involve keeping temporary logs, contact information, message content, or being placed under total network surveillance without notice.

Or they can just seize the servers again and you can hope _everything_ is secured on the provider's end.

The site's premise is a honeypot for just the kind of people the government would like to keep an eye on.
I read at 146 words per minute, and that is average text. I probably read slower when the material is hard. Over the past year or so I went through roughly 90% of Plato's work (like, really), The Quran (partially), On the Nature of Things, Meditations of Marcus Aurelius, Discourses by Epictetus, How to Read by M. Adler, Alchemy of Happiness by Ghazalli, etc.... I also read several short text including James Allen, Xenophon, etc... Currently I am reading Jacques Rousseau, and getting back soon to Adam Smith Wealth of Nations... I also started but did not finish yet the Communist Manifesto, How we think (slightly), Prior Analytics (slightly) and perhaps my hardest read ever, Suma Theologica. I am 100% sure I forgot a couple of books I read. Many of these writings I re-read a few times because they are hard to grasp for me. AT 146 words/minute. I am an inefficient reader, and I never knew it. I am going to thoroughly research ways to improve this.
Four words: gated wireless meshing network.
I think people not finishing their books it probably one of the stronger use cases of this though. You wouldn't have to buy 8 books only to not finish them, you could just read them on Oyster.

Though admittedly that doesn't cover the library counter point.
They say that they were asked not to publish at all, but did so anyway and chose to remove some specific facts. I don't understand how you get from that to concluding that they know (and are suppressing) the particular vulnerabilities that the NSA is exploiting.
I think he/she means Stripe :)
And you're auditing the compiler code, which you bootstrapped up yourself without using a possibly backdoored compiler on the way.

(I wonder if anyone's audited gcc/clang binaries installed in readily available linux/bsd/MacOSX distros to see if they're free of "Reflections on Trusting Trust" concerns?)
You're correct. Sorry for any confusion.
The most common estimate I've seen is that the NSA has 600 mathematicians. I'd not be at all surprised if, for the areas of mathematics the NSA cares about, that is more than the total for the top 100 universities in the world.

I've also read that the work environment for mathematicians there is very much like a research university. They do their research, write papers for internal publication, give and attend seminars, and so on--and they don't have their research interrupted by someone asking them to teach calculus to freshmen, and without having to worry about impressing a tenure committee to avoid years and years of bouncing between temporary positions.

The combination of a very large number of people, and a pretty nice environment that lets those people throw themselves fully into research makes it plausible that they do make occasional significant breakthroughs.
You get that with an appleTV. You can either hit play on the Mac then send it to appleTV, or navigate from appleTV to your Mac and find the file using the remote (or iPad/iPhone/iPod). I'm of to check out Plex now...
Yes right shoes. If you want to heel toe, you can't do it in your steel capped boots
http://www.youtube.com/watch?v=muxVLOaw2ik
In some form yes. But really the killer feature that makes it "Now" is the fact that (on Android), you don't have to do anything to activate it. It just quietly works in the background and notifies (btw, Notifications, another key feature for a phone that iOS doesn't do too well) you of things you need to know at the time you need to know them (e.g., delays on flights you might have searched for or may have received boarding pass for etc... it has been amazingly useful in exactly such scenarios for me).

That doesn't work on iOS. Probably due to limitations on background processes.. or perhaps because google doesn't feel like providing the full feature-set it on the rival platform... I don't know. But without the automated notifications for things I'm not even aware I should be searching for yet, the magic just doesn't work the same way.
Oops... my bad. Sorry.
It's pretty funny that SilentCircle's website preaches privacy and information hiding. Yet their site is also littered with trackers for analytics, logging what OS you're using, what hardware, etc.
I think Three Fingered Fox is trying to explain the PA artists' behavior. The message seems to be:
1. Three Fingered Fox understands why they think self expression is a greater virtue than not making rape jokes, but, even so,
2. The PA guys need to cut it out.

But maybe that doesn't answer your question? I still think TFF's stance on the rape joke drama is that the jokes shouldn't have been made in the first place, and that PA can't close them off from criticism if they want to call themselves legitimate satire.

My take: this was the single best description that I have ever seen anywhere of how at least one type of "geek" is made - forged by constant early-life bullying and deprivation of a social life, sexuality, and belonging. With this in mind I feel like I have a better understanding of why so many industry big-shots seem to have such a hard time dealing with bullying.
> I prefer my encryption algorithms to not be developed by an organization that has a vested interested in them being broken.

While I understand the sentiment, you should not be using them for encryption in the first place. RIPEMD and SHA are cryptographic hash functions.
It replaced MTBE as an oxygenate. It's present in some blends all the time.
I am going to repeat this, as I don't think you caught the key noun: if you are going into business then you should be making a point of always reading the fine print. You don't hear about "power users" running into serious problems with PayPal because "users" are the core of PayPal's risk model. In stark contrast, this failure of a situation is a business attempting to deal with over one hundred thousand dollars via PayPal... I have absolutely no sympathy for them--or any other business--that can't take a few minutes to read "the fine print", doing even basic due diligence into "am I allowed to use this service for this purpose"; reading the contracts you agree to for critical services like payment processing is fundamentally different than reading the terms of service on your Gawker account: you should understand what you are agreeing to in full, and should not be relying on some cribbed cheat sheet of "the big stuff" handed to you by the service (as you argue should be provided, in this and other threads). Business involves lots of agreements, these agreements have to deal with tons of complex contingencies, and if you don't take agreements seriously (and likely it you don't actively enjoy reading them) you simply shouldn't be in business.
Good to hear. I've played around with Docker a bit but I don't have a compelling enough use for it yet to keep on building AUFS kernels.
But we do know that BQP \ P is non-empty, which is what I was trying to say. In fact, factoring large integers lies in BQP \ P, and is also the basis of some commonly used encryption algorithms.
Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can.

ARGH NO ARGH. ...

Bruce Schneier's suggestion comes after reading countless TS and secret documents. I'm going to go with his advice.
and you are conveniently missing his point. If we were to throw away public key technology today and say 'Only pre-shared keys' some significant portion of the internet would simply be unencrypted. What do we do about that?
Ask HN: GPG. NaCl. NSA. Thoughts?
We now have a better idea what the NSA can and can't do. It seems they have ways to compromise endpoints, and have poisoned algorithms and implementation they have a hand in. GPG is the old standby. NaCl is a popular outsider. I do not know, at this time, however, of any easy integration of NaCl into an email client. Do any of you have thoughts on how to go about encryption for emails and other communications in the modern era?
This. I am a lawyer. I read hundreds of lines of dense fine print every day. It is quite possibly the worst part of my job.
This is a very good point. I remember watching a documentary a long time ago in wich people with DS but only moderate mental retardation became fairly frustrated with the fact that they looked/were different and wanting that to change.
Doctors and Travel Agents
Not sure that's a good comparison. They are basically a merchant account as a service. Retail rate is 2.9% + $0.30. Businesses with strong transaction history and good volumes can get much lower than that from the traditional providers.

The merchant account business has higher numbers than Visa processing business.
Thanks for the summary. So they're basically treating a (albeit important) symptom of the trisomy.
Even if you used the same argument for all my points, the intersection of the result sets seems to be empty.

To be more clear, AFAIK, no other platform accomplishes those three goals as good as JavaScript. Maybe Python? GitHub language stats used to say otherwise (until they removed them). I also have the impression that as far as dynamically typed languages go, JavaScript is one of the most optimized ones. Well, Lua and some others beat it on speed but they are not as popular and/or provide what node.js provides.
i mean square - that's the company that's looking to buy braintree, right? am i seeing things?
Hack the Windows 7 logon screen background
http://www.fixedbyvonnie.com/2013/09/how-to-change-the-logon-screen-background-in-windows-7/
Oh you're the creator? cool. A word of advice: work out a way to sell this to doctors and other people who need to keep appraised of massive amounts of info. They have the money and the motivation to be your primary customer base.
NSA's Decade-Long Plan to Undermine Encryption
Except it's not "non-obvious" at all, but highly obvious.

The people who designed the facade are not the same group that models the behavior under certain conditions? Well, that's apparently stupid, and somebody in the first group should have said, hey, where does this thing focus sunlight?

At some point, somebody drew a giant curved reflective surface and failed to consider what it would do to the sunlight. That is dumb. I don't see any way around that.
Or likely to deter others. Terror, flipped.
Back to the old "dotfiles with git Best Practices".

My favorite is just to alias it all to a different name.

alias dg='git --git-dir=/Users/dragonfax/.dotfiles --work-tree=/Users/dragonfax'

now regular git doesn't overlap with my dotfiles git, and I never have to worry about mis-executing the wrong git
I'm imagining Schneier saying some of these things and then seriously monitoring his operations as something of a testing honeypot. Wouldn't surprise me if there was one somewhat secreted machine at his house that was rigged with triggers, and anything he was really doing with the docs and The Guardian was elsewhere and more heavily secured.
Once someone figures out a natural content creation interface, that will be truly groundbreaking. Who knows if it's even possible purely with hand gestures. I forget where I read this, but one of the major factors in precise control over anything is the use of tactile feedback from your fingers, which you just don't get from hand gestures and a visual interface. Disney was even experimenting with air puffs propelled at your fingers to do this. [1]

[1] http://www.disneyresearch.com/project/aireal
Musopen wants to give away the life's work of Frederic Chopin
Ok Snowden, now release the secure algorithms. :)

If they can break the known algorithms, they probably have better stuff for their own communication.
I really do like Scala, however I also find it to be similar to C++ in the sense that lots of the Scala code I've read seems to be written by people who trade simplicity of implementation for being able to use every single feature of the language all at once. In other words, people unable to resist the urge to be too clever.

Sometimes the result is Scala source files that almost appear to be written in different languages, or lots of little libraries each with their own wacky DSLs that require a major investment of time to comprehend just to accomplish something that should be trivial.

These sorts of abuses you really don't see in Clojure even though it's just as possible in that language. Of course this is all based just on my experience, YMMV.
If the NSA had really broken asymmetric crypto it would imply that they were sitting on an huge unpublished result in one or more of a) complexity theory b) quantum computing c) number theory d) ?? something even more outlandish. It's difficult to imagine even them keeping a lid on that. Mathematics is not a large field nor is it by nature a secretive one. (Arguably recognition is the thing driving most mathematicians.) The furtive whispers would accumulate.
Yeah when I put together a donation site for a small (not-501(c)(3)) org some years ago, I was tempted to use donations but while reading the docs realized I just wanted payments. That site still operates, although thankfully I'm no longer involved, because PayPal still makes me nervous.
If you're bootstrapping an environment you created, checksum the download and verify the checksum before feeding it to the "unpacker".

Another thought would be to mutually authenticate the SSL session. The curl man page has good doco as to how to do this. It does involve mucking around with PKCS12 key material, but it's not bad.

Best...do both.
You can skip the master and spawn a fresh connection for your tunnel using `-o ControlPath=none`.
FBI did just this and pushed a special update to bug a member of a mob's dumbphone a relatively long time ago.
The premise of his statement is invalid. It's "not even" wrong. There are NIST ECC "constants" you might want to avoid, but there are other parameters you can use instead.
I'm a native of California and I'm not having any easier of a time getting this, I assure you.

Burning Man sounds like fun, but this post struck me as contrived and in complete juxtaposition to (what I think is) the intent of the festival. Wrong clothes??

If you're going to a festival seeking a religious awakening, you're doing life wrong.
He had no right to fire the employee who said they can't spell. The brand is Big Dogs --plural-- and there's only one dog. So there.
It looks like a 3d version of the original Sketchpad[1] and GRaIL[2].

[1] http://en.wikipedia.org/wiki/Sketchpad ( http://www.youtube.com/watch?v=495nCzxM9PI )

[2] http://www.youtube.com/watch?v=QQhVQ1UG6aM
The point is not mooted if NSA has compromised a CA, because Chrome does more than simply trusting the CAs.
Some more evidence to the botnet theory: http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-rece...