skysight-inc/HackerNews huggingface dataset:
SlidePay (YC W12) is hiring engineers to radically change financial services
SlidePay is looking to bring on an additional software engineer to help our company grow and continue to make useful, valuable products that people want to use while radically changing the face of financial services.

To be a good fit for our team, you should (these are non-negotiable):
- Be relentless about software quality and testing
- Know how to build a distributed system and do it right - RESTful HTTPS, SOAP, XML/JSON
- We don't expect you to exhaust yourself daily, but you absolutely must be efficient and effective

General requirements for the ideal candidate:
- BS in Computer Science or Computer Engineering
- 2-5 years of previous experience
- Have your own transportation
- Live in the San Francisco Bay area (no relocation)

Candidates that have some (or all) of the following skills will have the best chance of follow-up:
- Experience building one or more successful iPhone and/or iPad applications
- Experience building one or more successful Android applications
- Can say and prove that you are a solid full-stack web engineer
- Have built products that have a long list of positive customer reviews associated with them
- Have leveraged engineering savvy to build content that attracts new customers and grows the business
- Are product centric, understand customer use cases, and have strong design chops

We're a group of talented, experienced engineers that know how to build high quality distributed systems and extensible platforms that solve complex problems the right way (and we have the track record to prove it). We're looking for a software engineer that is motivated, top notch, and wants their opportunity to shine at an awesome startup.

Resumes to joel [at] slidepay [dot] com
I suppose most people who shoot schools have no partners helping them, but at some point they may need to find information to help them carry the attacks, and encryption would help them conceal the fact that they have this information, and how much information they have.

I just think that a politician moved by the desire to do something could construe non-backdoored encryption as something that "helps the enemy."
> The documents are among more than 50,000 shared with The New York Times and ProPublica, the nonprofit news organization, by The Guardian, which has published its own article. They focus primarily on GCHQ but include thousands either from or about the N.S.A.

Is this the first time we've seen a 5-digit number to describe the number of documents Snowden has? Of course, these are just the ones used for this story...
The protocol itself would still seem to be safe (or rather, have safe combinations of key exchange and encryption).

But it is certainly feasible that if they manage to find cracks in popular-but-old communications protocols that they are able to automatically decrypt them, or use prior key recovery successes to bootstrap fast attacks on new communications from the same host.

What would be interesting is if NSA's own "Suite B" crypto recommendations are susceptible to these risks, as that would potentially represent a rather significant break in the U.S.'s own COMSEC, and COMSEC is one of the things NSA is very specifically tasked with ensuring are safe with no backdoors for anyone to jump through.
Man, you're pretty fit in the "before" pic. Everyone looks more buff right after a workout.

Getting a good body is all about diligence, continuous work over a longer period of time. I don't doubt that your program is bad. Just that no one will gain anything significant by doing it for one month. You need to do it forever.
And yet full and anonymous disclosure[1] is eschewed for "responsible" disclosure. Hopefully we can move beyond the insane money-making scheme known as "whitehat" and "ethical hacking" security research.

The zero-day exploit market[2] deserves fair mention too, especially since a variety of three-letter agencies across the planet are some of the largest purchasers. Zero-day exploit purchases and sales haven't had any news publicity at all, even though it's effectively comparable to trafficking nuclear warheads.

Both nuclear warheads and zero-day exploits are used as leverage between competing security organizations and competing nation states, both are being stockpiled, and both are exceedingly dangerous. We're on the cusp of global network warfare and it's just starting to become clear how terrifying and widespread it is. America's rivalry with China is in over-drive now.

I'm not saying that security researchers don't deserve to be paid for their work, but that we should be plain and honest about their work: it can be for the good of humanity or it can be for the destruction of humanity, there's very little inbetween.

And yet what is it for? Fighting terrorists and drug dealers, and protecting children and intellectual property?

[1] http://www.schneier.com/essay-146.html

[2] https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales...
I meant what is at stake in the victimization olympics framework that I was responding to. Downplaying violence against minorities was not intended.
The gmail unreplied is definitely a needed one.
showhnkarma is a very nice addition to HN.
As someone who has been in the RE industry for 6+ years now (loan officer and now processing):

> how inefficient the real estate industry is. There's so much regulations

My biggest time consumer are boilerplate disclosures and astonishing conditions, which have become nightmarish since the housing crisis. That 10 day delay in closing? Someone mis-dated and now we have to wait out Dodd-Frank before proceeding. That 41 page package of forms you need to sign and return before we can even begin underwriting? Sorry, required. The $150 you received from your grandmother for your birthday? Yeah, we're going to need a gift letter. I wish I was being facetious.

> people taking a huge slice out of the consumers pocket

Unfortunately, RE and mortgages are just high-touch industries. People need to be re-assured that someone is working on their behalf. Look what happens when PayPal shuts down an account and gives a generic response? Or Google does the same when blocking a Gmail or AdSense account? People have a complete meltdown. Imagine if that is someone's home purchase (doubly worse for first time homebuyers), and they receive an email stating "Sorry, your loan was denied" with a link to "File an appeal". The ones I work for receive calls all day every day from buyers and agents wanting updates and peppering with questions and concerns.

I automate as much as I can in my workflow (thank you Python and C#) and have considered outsourcing it, but it's a job that is 95% edge cases and one-off situations. The best targets for efficiency improvement are lenders' and RE agents' internal procedures, but that's another discussion.
Best to only use Open Source encryption software.
Hmmmm... I'm sure it'll need a linked scientific study to actually back up the claim. (And every speed-reading product I've seen has usually had a decrease in comprehension rate...)

It's a clever idea, but anecdotally, from my experience, I'm finding it slows down my reading -- I'm having a hard time processing the blurbs because I don't read "linearly" -- I scan content to find the relevant parts, and the color changes are making it difficult to scan (because my eye can no longer use color to determine what is scannable and what isn't), and multiple columns is actually making it even more difficult (it looks like the blue in column 1 leads into the blue in column 2, instead of the blue at the next line of column 1). By trying to force me to read line-by-line, instead of scanning efficiently, it's making me read slower.

But that's just for short-form stuff. It could turn out to be faster for some layouts, and slower for others. But honestly, I've never felt I had difficulty locating the start of the next line... is this a problem that needs solving? But nevertheless, it's certainly a good example of clever out-of-the-box thinking.
That might be why Microsoft brought back the start button in 8.1

They might have been afraid that if they left this prime piece of desktop real estate, Google might take it.
I imagine you'd get a free ride to a federal office if you talked to enough people.
Quantom computing cannot break all of crypto. Anything based on P!=NP is believed to be secure against quantom computing, and there are several encryption methods backed by P!=NP
An alternative bookmarklet would be to apply the gradient to the line your cursor is over, and just move your cursor at the pace you read lines.
What's truly frightening is this line from the Guardian's article on the topic:

> The NSA describes strong decryption programs as the "price of admission for the US to maintain unrestricted access to and use of cyberspace".

What does that even mean? That statement is at the same time paranoid, arrogant, and subtly threatening. It's as if to say that without the ability to decrypt interesting traffic, the NSA would be forced to take stronger measures to curtail internet traffic.
What I find sad about this "growth hacking" phenomenon is how the focus is on a single specific tactic, as if that is the key to all growth-related problems.

On top of that, growth hacking is used a vehicle for self-promotion, as if one person is responsible for success. It's honestly a team effort, and to pretend like it's one person is a shame.

Lastly, isn't "growth" for the sake of growth a vanity metric? Personally, I'd want someone who knows how to retain users and prevent churn over someone who spams his way to millions of users. Just my thoughts.
How are they hard to detect? Wouldn't solutions like certificate pinning prevent this?
It was after the war, and the US was doing enormous infrastructure projects, so it seemed plausible that they did something around that time. Plus, they made a film to show it. But it was really hard to see the trees in the film, so it could be an illusion.
I gave up trying to follow it. It sounded like it might be interesting, I just couldn't follow the thread and maintain any interest. There seemed to be no structure to the narrative.
Thanks tjr! I've been looking into the ranking algorithm and I guess I was under the impression you can a point for each on-topic story posted.

Your upvote was added though, thanks for helping out a newbie!
You're describing negotiations that happen before significant money and services have been exchanged; this PayPal "negotiation" occurs after. This turns out to be a rather large difference. Indeed, it's the difference between a contract negotiation and a hostage negotiation.
That page physically hurts my eyes to read.
You want to use something like TLSpool (http://www.tlspool.org) and DANE. For a browser something like Firefox's Certificate Patrol is a great solution.
Samsung Galaxy Gear Smartwatch Unveiled
I will bet good money that the NSA has never bothered to try and plant backdoors in encryption standards.

If the NSA recommends AES to the US government, but knows there's a vulnerability, then they have to assume that any adversary may be as good as whoever designed it. Which means an adversary would be perfectly capable of discovering and exploiting the weakness. Which in turn means the NSA has just made the entire US government vulnerable to foreign or non-state actors.

The same applies to anything you might imagine doing to chipmakers. Not only is there the risk of being found out (how do you explain to a talented engineer spotting a flaw in a schematic, how high up do you have to go to try and stop that leaking?) but there's the more serious risk that you've just added a backdoor to hardware you yourself need to be secure. Which again, could be discovered by an adversary and used against you.

This whole line of argument has always been speculative fiction on the part of the internet: it's looking for unicorns because you heard hoofs.
Bruce Schneier has seen the documents, and here's his advice: http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...
I don't think it's a good idea to use fingerprint as a way to authenticate. Fingerprint is not private data. By "private", I mean as private as a private GPG key. Any fingerprint is able to read a fingerprint as long as you put your finger on it. When there're more fingerprint powered applications, it's gonna be really easy to steal credentials.

You may use a passphrase. But that would be as secure as using a passphrase alone.

Fingerprint is the public key. The private key would be your hand + your physical presence. However, since fingerprint itself is public, you can't rely on fingerprint to identify physical presence.

Unless, you make fingerprint private enough. For example, permanently attach something on to your finger. Instead of providing your fingerprint to third-party application, it generates a key pair based on your fingerprint, and use these keys for authentication.
That's the quote that jumped out at me too. The solution for those who want to stay out of NSA's reach is to use your own hardware, and use open source software (where it's hard to put a backdoor without being discovered) and strong encryption.
Yup I discovered from a friend that my library has a similar ebook checkout program. I wonder how the terms and selections compare, since libraries seem to be doing an inept job at advertising this feature which could potentially just kill this startup
Original author here: wanted to reflect on the whole accents/founders debate and why we do what we do, not just pitch my startup; but here's our one-liner: "MonoLibre helps non-native English speakers improve their accent enough to be understood, using listening and speech training exercises."
Single page link: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet...
Reminds me of this:
http://marc.info/?l=openbsd-tech&m=129236621626462&w=2

As someone who has been following the NSA and government monitoring of online activity for close to 15 years the Snowden leaks just keep taking the wind out of me. It's like everything that we thought might be going on was actually going on. When Theo de Raadt wrote the above mail I, like many at the time, assumed it was tinfoil hat territory. I was clearly wrong.
Your self-signed 4096-bit key is probably fine. Even better, be your own CA.

People assume CAs should be trusted but it's a huge game of chicken: If the NSA can't break SSL, you have to assume that either SSL is opaque to them, which these revelations seem to contradict, or they have corrupted the CAs.
yeah, cuz there's no way the NSA could contribute code to that too.
If the source code/hardware diagrams are kept private you should assume backdoors, always, with everything. How is there any other way to know for sure otherwise?

These government agencies are obviously dug much deeper in private industry than many expected so I wouldn't put it past them
Why are you surprised, or even disgusted? They've moved on from governments (http://www.bbc.co.uk/news/world-middle-east-23762970) to using technology to do it. I use the term "moved on" loosely, because it is still happening no doubt. The US has long used it might and influence around the world, esp Latin America, to do very questionable things and really no one has batted an eye lid apart from the little guys getting screwed over. Terrorism is the just the new guise they are using to justify their actions.
Actually, just by the attacker sending a long enough text message to push the attack off the screen - which you can do yourself by sending a long text message to yourself from another phone, then forwarding that message to the attacker.
Interesting idea. I like the design of it overall and it flows nicely in all sizes. I think I would have to sign up and start using it to see how it feels. I'm wondering if there's a way you can sell the key benefits on the homepage better.

When I click any of these little app tiles, a detailed explanation opens but that's not reflective of how the app actually works when logged in, right? Instead of screenshots can you show interactive dummy data anywhere?
SEO Google Πρώτη Σελίδα: Βασικό Λεξιλόγιο SEO
ah interesting. So basically the article got it completely wrong (how am I not surprised? :P)
Yes, certificate pinning would alert the user to a MITM attack, but it's not commonly used. By "hard to detect", I meant that it's impossible to see simply by examining the certificate if it's genuine, you can only detect when the certificate changes. And since SSL certs expire and are re-issued all the time, it makes it a fairly large headache to continually try and guess whether the other party changed their own cert or if you are experiencing a MITM attack.
The Allies had broken most of the Nazi codes during WWII but they still withheld information from commanders unless the information concerned an absolutely strategic battlefield that hang on the balance. Better suffer a few dead or some minor setbacks than let the Germans grow suspicious and start doubting their cryptography. Morale of the story: unless you're the next Osama or Showden or some major narco-trafficker it doesn't apply to you.
Yeah, so much fun.
What they have is a bunch of telepaths in tanks that can see dimly into the future and they recover the keys.
A research lab at a well-known university has a study underway.
Remember when Microsoft would trash Linux because it was open source and "not secure." Well, this settles it. Using your own hardware and open source software helps but someone determined will still get in...
You don't want to ask the actual question about the specific application, because it gives a strong advantage to a candidate who has worked on that very specific situation in the past (and they may be able to sneak through just by regurgitating from memory.) It's better to have a scenario they're unlikely to have seen previously. As an interviewer, I'm not interested in your ability to remember solutions you received from others, I want to know how you deal with a problem you haven't seen before.

Sometimes folks call these "puzzlers" but I think they're unfairly lumped in with true "puzzlers" - crap like "why is a manhole round" where there's a right answer that depends on either experience or some specific insight. A question where you're asking a candidate to walk through their thought process on a hypothetical (but reasonable) situation isn't "puzzling" unless you just can't handle the question.
hey Kylnew.

Thanks a ton. I am actually building a demo account. I was intending to put some demo data before I release it.

But since you asked, here it goes:

username: demo@hmpgr.com

password: password

try it and let me know.
Thanks! I made the arrows a "button to nowhere" to see if users would try to vote on them. Now I have 20 emails telling me that people are trying to use the feature, time to build it :)
Even "your own hardware" is going to be pretty damn hard:

working with chipmakers to insert back doors

So you're going to need to make your own chips, too.
There were too many words that I did not know that seemed to be made up. Possibly they are just Australian English words, but it frustrated me in the way that reading a book in a foreign language I only partially understand frustrates me. More time is spent trying to guess the meaning of the word than is spent enjoying the reading.

"logorrheic caddy, yippy-yapping about" or "the crash led to them having some pretty heavy ding-dongs" - this may as well be French from as well as I understand what is trying to be said.
You're not the one buying the laptop though, your company is. The bottom line is they don't feel the need to buy a more expensive laptop for you whose only reason for being more expensive is the screen is nicer. Typing a Word doc or making a powerpoint doesn't require a high PPI screen. High PPI is pretty much dead last in the sprint for "things that matter when corporate buys a laptop for you"
Validation mainly. Because I worry that the hand histories might not be enough and they may be tainted with more examples of bad play than good. I would like to qualify good play with some human validation.

But I think it's worth looking at to only use hand histories and if possible only validate when something unexpected results. Maybe then I could use the human input to validate the computer's decision. I'm still hashing that out.
Or that SSL is irrelevant because they've tapped whatever service you're connecting to.
Plus (form the Guardian article) there are covert agents in all the companies, presumably lifting all the certs, which may well be unauthorised, but you can't prosecute.

Do you know who your covert agents are?
It might be time for the community to do some thorough code audits on stuff like this... :(
This is really damaging.

Not only will this cause other countries to put up barriers against US (and UK) services and products, it's going to affect uptake of standards developed here.

On the lighter side, a treasure hunt was just announced. Can you find one of these vulnerabilities, or evidence of the NSA having attacked a particular system to steal keys?

----

[Edit 1] Some speculation:

By careful hardware design -- and lots of it -- the NSA may be able to find keys large enough that we would be mildly surprised but not shocked. It's not well known that searching for many keys in parallel amortizes well -- it's much cheaper than finding all the keys individually. DJB has a great paper about this:

http://cr.yp.to/snuffle/bruteforce-20050425.pdf

If I were looking for subverted hardware, I'd be really interested in reverse engineering Ethernet chips and BMCs. The CPU would be an obvious choice as well -- could there be some sequence of instructions that enables privilege escalation?

On protocols, the best sort of vulnerability for the NSA would be the kind that is still somewhat difficult and expensive to exploit. They want the security lowered just far enough that they can get the plaintext, but not so far that our adversaries can.

There is some history with not taking timing attacks seriously enough. Perhaps careful timing observation, which the NSA is well positioned to do, could give more of an edge than we suspect. Or perhaps you could push vendors to make their products susceptible to this kind of attack, secure in the belief that it may be difficult for others to detect.

[Edit 2]

I gave a talk that discussed what I think we as engineers should do here:

https://www.youtube.com/watch?v=c7oK59DZwR4#t=1m46s

And Phil Zimmermann and I discussed a number of these issues in a Q&A session:

https://www.youtube.com/watch?v=W42i8zCEizI#t=49m55s
Backdoors in the NSA recommendations could be due to trapdoor functions that only NSA has the key for. Other parties would therefore be unable to utilize that backdoor (short of the secret being exfiltrated).
FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list
Send your own pocket spacecraft to the moon
Types for Flexible Objects
This Isn't Going To Work
>the Bullrun program, the successor to one called Manassas — both names of American Civil War battles. A parallel GCHQ counterencryption program is called Edgehill, named for the first battle of the English Civil War of the 17th century.

Spying on your own citizens codenamed as civil war. How nice.

>Only a small cadre of trusted contractors were allowed to join Bullrun. It does not appear that Mr. Snowden was among them, but he nonetheless managed to obtain dozens of classified documents referring to the program’s capabilities, methods and sources.

Once again, the people spying on everyone suck at keeping their own secrets. How many others have taken the information with them and sold it off instead of leaking it?

>In one case, after the government learned that a foreign intelligence target had ordered new computer hardware, the American manufacturer agreed to insert a back door into the product before it was shipped,

If you're a non-US company how can you keep trusting US IT vendors? I wouldn't want to be one of these companies' reps at Airbus for example.