skysight-inc/HackerNews huggingface dataset:
TACK is a nice improvement to TLS that keeps compatibility with the existing CA system.

However, TACK only protects you after you've visited a site for the first time. If a person is targeted by any organization that can sign a fraudulent certificate before the first time they visit a site, then they are still vulnerable to MITM. Given that many countries have root CAs, many governments have this capability.

Namecoin does not suffer from that issue.

Namecoin and TACK solve different problems. One is an incremental improvement with backward capability; the other is a clean break that attempts to provide stronger guarantees.

"you are vanishingly unlikely to do a better job of designing an encrypted channel than every cryptographer and protocol designer and software security person who has poured time into TLS"

It pains me to see this kind of arrogant dismissal as the top comment so often.

The author said nothing about designing his own protocol. He simply explained the problems with the CA system and the way Namecoin (specifically the DotBIT proposal) might solve those problems. This would simply add new functionality: supporting .bit URLS where the clients looks up the certificate through the blockchain, without trusting the CAs. After that first step, the encrypted channel implementation can be the same. And the blockchain concept (and even Namecoin's specific implementation) is shared with Bitcoin, which has been battle-tested quite thoroughly at this point.
> from a sex tech company called FriXion

Nice name. It has an obvious connection to the product, and if you want to give out pens with the name on them you don't have to pay for custom printing [1]!

[1] http://www.pilotpen.us/Brands/FriXion.aspx
This type of "sophisticated analysis" will be useless whenever zerocoin is proven as a viable addition to the protocol. True anonymity is scary from a regulatory standpoint but extremely desirable to many others.
Doom Creator John Carmack Officially Leaves id Software
In general, one cannot copyright short phrases or sentences. These are able to be trademarked. However, one CAN copyright the presentation of a sentence/phrase. For example, if it were to be in a painting, or a photo, the photo/painting would be able to be copyrighted. However, that does nothing to stop someone from copying the sentence.

The difference is that you can copyright presentation, but you can't copyright an idea.

Once someone strings together enough words, however, you can't copy it either. That is, after all, why we don't photocopy novels when we want to read them.
They've always tagged the seized coins either with 'Silkroad seized coins' or 'DPR seized coins' in the past.
e.g. https://blockchain.info/address/1F1tAaz5x1HUXrCNLbtMDqcw6o5G...
Chromium will not let you connect to MAIL.GOOGLE.COM via port 80; the fact that Gmail requires TLS is pinned just like their certificate is.
The only thing I find even more fascinating than his unwavering attempt to defend the despicable actions of the NSA is how these posts end up every time as the top comments.
Great site, but I see a bigger opportunity that would require a small pivot after thinking more about the real problem behind the concept. Instead of solving the problem behind "sharing" or "creating" a scrapbook of your travels - one of the big holes/problems I see in the market is around booking trips together. I'm planning a trip to China in a few months with a few buddies - organizing the all the logistics, payment, bookings etc. - is a nightmare for 1 person - imagine if your talking about 3 or more people. There a number of trips planned every year for groups - weddings, bachelor parties etc.
Because Bitcoin its only applicable use case is to buy drugs with. What's the point if it's without privacy?
Sounds like a distinct improvement on most of the enterprise documentation I've seen (that's all of our documentation but if you need more specific help we've got some great consultants :).
The size has increased by over an order of magnitude. https://news.ycombinator.com/item?id=4647834
You can get Class 1 certificates for free[1].

[1] - http://www.startssl.com/
Depends on where you first entered the 'system' that makes you reveal your identity. For example, if you buy on localbitcoins in a face to face exchange without the need of identification, it wouldn't be feasible to track the Bitcoins to your real identity. Sovereign money to Bitcoin conversion is the spot where identities are revealed. Otherwise, it remains pseudonymous.
> The balance of power is completely wrong...

If I may get a little meta, the goal of copyright is to reward someone for sharing an idea while allowing those who consume the idea to turn around and share it themselves. Since one cannot truly "own" an idea, copyright uses the "expression" of the idea as a proxy, since (in theory) re-expressing the idea extracts an effort penalty. For example, if I read words you publish, I can't just republish your words without your agreement. I can however express your idea in my own words. I may choose to just pay you to use your expression if generating my own is too costly.

Photographs and "news" reveal the weakness of using "expression" as a mechanism for judging whether copyright exists. If I email my next door neighbor and tell him "garbage pickup is on tuesday" and he emails the exact words to his neighbor, has he violated copyright, or is he reporting news? If I attach a photo of the garbage pickup schedule, have I violated copyright? If I attribute the schedule to the trash company am I compliant?

My point is that copyright is complex and imperfect, and finding the balance of power is very difficult.
I find it hard to believe that a government agency couldn't easily present a forged certificate perceived as valid by popular browsers if they were so inclined.
>> AFP discovered the photos on a Twitter account other than the photographer's with their copyrights already stripped.

It's not compulsory to state the copyright word. Also someone else using the photos is not a reason either. The company has to check the source of the images and ask for permission.
You need an SSL certificate:

Request URL: http://tripstamp.com/api/authenticate
Request Method: POST
...as was clear to anyone with any vague understanding of the definitions for deflation and inflation.
I found the same irony in this story. Getty and AFP would prosecute anyone trying to resell work. I'm not to familiar with Twitters privacy policy so I'm not sure who actually owns the pictures that are posted there, but I'm guessing from the ruling that it's the users.
TACK is a baby step towards a design idea Marlinspike called "Convergence", and I just call "updating the 1995 browser trust store UI to the standards of 2005".

The idea that only members of the CABForum can run CAs is silly, especially when (a) many of those organizations are in fact beholden to governments and (b) some of them have actually sold root CA certs.

There is no technical reason the ACLU should not be able to run run its own trust store, certifying alternate CAs that it is confident aren't corrupted, and revoking CAs when certificate pin errors make it clear that they have been. The UI to make that happen is very simple as well.

My issue with things like distributed ledger verification is that TLS's problem isn't the crypto. The crypto should be kept boring; we're barely holding the crypto together as it stands.

The problem with the TLS security model is browser UX. We can and should leave the protocol alone.
Do you have a link to a tarball for "Private Cloud"? Then I'll tell you what I think.
The Grinch Of Connected Toys
They can, which is why Google pins certificates, and why there are dynamic pinning proposals.
Fantastic article. It summarizes the findings of this article: http://www.theatlanticcities.com/jobs-and-economy/2013/08/ho..., and provides an excerpt of a compelling and self-reflective essay from someone currently struggling with poverty, which can be read in full here: http://killermartinis.kinja.com/why-i-make-terrible-decision....

In a culture where people, some of whom have even overcome serious struggles, muse about why people can't just pull themselves up by their bootstraps, I find this to be a very insightful explanation. And in the Hacker News subculture, which is inherently focused on capitalist solutions to problems large and small, I think we need to reflect capitalism's answers for the problem of self-perpetuating poverty.
The advice being given is more applicable to problems which have some real state inherent in the problem, e.g. network connections, UI state or databases.

In numerical programming, state is less obvious because it depends on how you do the calculation.

In numerical programming, I tend to use a functional style that makes use of objects. E.g. instead of

y = f(params, x)

I would write

y = my_object.f(x)

where my_object encapsulates params. This makes sense as the only function that needs to access params is f. On the other hand Python has no private members anyway so I would probably use the first way for Python anyway.
Traditional currency isn't really anonymous. Sure it is theoretically possible to do an anonymous 150 million dollar cash transaction in USD but in practical terms it's basically impossible without a great deal of money laundering. I believe by law in North America banks have to report any cash transactions >= 10k per 24 hour period to the government. Additionally every bill has a traceable serial number on it.
>My assertion is that absent some way to force TLS

So, my assertion is correct then. Own DNS, own mail.google.com if the browser doesn't force TLS.
DMCA request to Facebook.
The real problem is that you consider Bitcoin as an absolute solution for every transaction.

I don't know for you, but when I want to transfer cash in my bank to someone in another country, it take way more than 60 minutes (6 blocks). If I want to do it faster, I use a private service that will do it faster. The same will apply with Bitcoin.
How is using someone else's image and giving them appropriate attribution any different than retweeting what they say? Quoting them in a blog post? If they post the image in a public forum (the internet) it's the same as words said in public.

Sharing images without attribution is the same as plagiarism. Should journalists that plagiarise words be fined a million dollars? I don't know, maybe. But it's the same issue.

EDIT: I'm not referring to law, only common sense and what actually happens in the real world.
Yet another pop culture reference — French-Belgian movie "Thomas est amoureux":

http://www.imdb.com/title/tt0262826/

http://fr.wikipedia.org/wiki/Thomas_est_amoureux (no English version of this article exist, only French, Russian and very short Italian)
We're getting close to the point that every word a person speaks can be automatically recorded. (e.g. Google glass.)
I wonder if it ever becomes viable to try to brute-force the private key of such a valuable address, rather than devoting the brute force power to mining.

Edit: got curious and found an answer: http://bitcoin.stackexchange.com/questions/2847/how-long-wou...

If I understand correctly, it's still not viable even if you tried your brute-forced keys on all addresses in the network.
I don't think I've seen him defend their actions, just explain them. I, for one, appreciate it. He is in a sphere that I am not in, and were I to guess whether or not this was well-known behavior, I would have guessed not. And, apparently, I would have been wrong.

So I thank tptacek for sharing what he knows that I don't know. That is, after all, why I come here.
>TLS+TACK doesn't solve the first connection problem if you stipulate a corrupted CA PKI.

Don't you think it's a reasonable assumption that the NSA controls at least one CA?

>the DNSSEC PKI is corrupt by design.

That's interesting, have any pointers as to why? With the current model any CA can vouch for any site (hence the need for pinning), with DNSSEC only the CA that controls .COM can issue fake certificates for EXAMPLE.COM. I don't understand how that doesn't make the potential attacks strictly less.

>What dynamic pinning plus CAs buys you, on top of key continuity that corrupted CAs can't break, is surveillance: an entity that can get bogus certificates issued can't assume they can do it undetected, because those certs will almost immediately break on someone's pin.

Right, and that's fine for mass attacks (which is important) and less than stellar for anything that's targeted. Plus there's nothing stopping you from implementing pinning+DNSSEC CA's, so that if the .COM CA starts issuing fake GOOGLE.COM certificates you catch him. At the same time RandomCAFromAntartica doesn't even get to try.
Point arms up into sky, cast yourself aloft into the heavens, if the earth doesn't have gravity.
Economist.
Stripe has expanded to a few countries in Europe, including UK.

https://stripe.com/global
Simudidactic
So if I'd send 1 BTC to myself - this would be considered as $800 transaction?
citation needed

Wikipedia seems to have a different story that you.

http://en.wikipedia.org/wiki/Aluminium#Etymology
The link you posted says:

"Sir Humphry made a bit of a mess of naming this new element, at first spelling it alumium (this was in 1807) then changing it to aluminum, and finally settling on aluminium in 1812."

To me it reads that British academics (Sir Humphry's peers) prefered the -ium spelling. It doesn't say they used political pressure to force him to change it.

While the use of both spellings were in almost equal use in the general British and US populations for a long time, the article hypothesises that the -um spelling became dominant in the US because of Webster's -um entry.
I read this article today: "How Google Sold Its Engineers on Management" 1), which seems to be a much bigger study of how managers affect work and performance. The general conclusion of Google's study is that management matters if it's empowering workers (and not micro managing them).

Github is definitely an interesting experiment in a totally flat structure. Google tried a similar flat structure in 2002, but concluded that it did not work that well. Will be interesting to see how it works for Github as they grow even bigger.

1) http://hbr.org/2013/12/how-google-sold-its-engineers-on-mana...
The USG owns the DNS roots. Or did you not notice the pirate sites with their logos replaced by the DOJ seal? They don't have to "corrupt" the DNS; it's already theirs to control.

We can stop arguing about DNSSEC though, because it is never going to happen. It's a stability disaster, an enormous administrative pain to manage, cryptographically weak, and requires domains to publish all their hostnames (private or not); see NSEC3 for the ludicrous hack the working group came up with to (badly) mitigate that problem.
I'm not being sarcastic. Marriage and family gave me reason and impetus to get my crap together and focus. I am easily distracted by sophomoric pursuits--now I choose hobbies and what not that I can share with the kids. One we really enjoy is kite building.

But then, I started my family early. I didn't have much of an established pattern of productivity before. So my baseline comparison may be way off.
Depends where you live. The article is on bbc.co.uk and Aluminium is the usual spelling used in the UK.

From Wikipedia:

"Two variants of the metal's name are in current use, aluminium and aluminum (besides the obsolete alumium). The International Union of Pure and Applied Chemistry (IUPAC) adopted aluminium as the standard international name for the element in 1990 but, three years later, recognized aluminum as an acceptable variant. Hence their periodic table includes both. IUPAC prefers the use of aluminium in its internal publications, although nearly as many IUPAC publications use the spelling aluminum.

Most countries use the spelling aluminium. In the United States and Canada, the spelling aluminum predominates. The Canadian Oxford Dictionary prefers aluminum, whereas the Australian Macquarie Dictionary prefers aluminium. In 1926, the American Chemical Society officially decided to use aluminum in its publications; American dictionaries typically label the spelling aluminium as "chiefly British"." [1]

[1] http://en.wikipedia.org/wiki/Aluminium#Etymology
I've just started playing around piecing together one. I'm using node.js as the server, redis as the database and virtual file system, ace for the text editor, jquery and some jquery ui plugins for the rest. My goal is to build something I can roll out and run with a raspberry pi and use as something like a pocket cloud ide.

Also for editing the actual html and other files, I wrote a small console app in c# that uses the FileSystemWatcher class to monitor a htdocs folder, which updates the redis key/values in realtime.
Folks are already using bitcoin for international commerce and remittances where they were underserved by banks and services like Western Union or PayPal.

Bitcoin only needs to be useful for one kind of transaction for it to be enormously valuable. Once it is useful for some class of transactions it will be more valuable for other kinds of transactions. This is a classic network effect.

The particular kind of transaction where I am convinced it will take off is international commerce. There are lots of potential transactions that are simply not happening because of the hassles of moving money around between currencies and banking/government regimes. There are lots of other transactions happening that are slow and expensive for the same reason. So bitcoin is providing value there, both by making existing transactions cheaper and making other transactions possible. I'm specifically thinking of capital and labor in currently underserved markets that can now more easily be exchanged where they were not before.

Then there are whole classes of transactions that bitcoin makes possible that were not possible before. For example, right now one could write a bot that receives and spends bitcoin to provide some service and not have to get any permission from a bank or government to do so. What kind of cool weird services are going to come from that?
After having used jQuery Mobile, and then more recently the Ionic framework, I can definitely say that the way Ionic handles routing via AngularJS and the View-Controller paradigm is far more superior to jQuery Mobile's way of handling things with direct URL links, at least in terms of 'native/hybrid' apps.
It's not scaremongering. Can you trust the mixing services?
Valis: an opera based on Philip K. Dick’s work
I'm very appreciative of the the statistical concept of outliers.

As Hume would point out, is is not ought.
I don't know anything about GCHQ, but I don't want British intelligence to have intimate details about my life stored in some nosql database, and I see it as an offensive maneuver by a foreign government from which my government fails to protect me. See my reply to tptacek's post sibling to yours for a general response to your inquiry.
Seems hardly a "small" pivot (but not a bad idea, itself).
How many legitimate websites use that CA? Especially ones Chinese users will visit often? If the browser blocks the CA, those will all break.

Perhaps the browser could do something subtler, but it's not straightforward. Or we could make the https cert protocol more flexible, but changing protocols is hard.
Hmm, I don't think heating is a strong enough use case. What about as cloth dryer? Those things uses a lot of energy to produce heat and you need them even in hot summer. Especially in dense city apartments.
I refer you to the infamous Lasker-Capablanca game where Lasker played a dull drawish game to throw Capa off his guard.
Well, they do. Just like Russia and China. I agree it's offensive. Now what? Next you'll tell me governments routinely have foreigners killed.
Tech Companies Help Make NSA Surveillance Possible—and They Can Help Stop It
> A lot of work is currently going into trustless mixing/anonymising

Call it what it is, money laundering.
The question is will the Bitcoin Foundation put those add-ons into the Bitcoin protocol? I think they would be quite reluctant to do it at this point, as they are more concerned with establishing Bitcoin as a viable currency right now, that's not used just by Silk Road and its ilk.

I do think in the mid to long term Zerocoin or something similar should be added to Bitcoin to at least allow people the option to be anonymous if they want to be.

However, I'm also unsure if this should be done right now as governments are trying to decide what to do with Bitcoin. Perhaps it would be better to wait a couple more years, get Bitcoin more established into the mainstream, and adopted by banks and more companies, and then enable something like Zerocoin in the protocol, when it would be too late to stop Bitcoin. Although I'm not sure what the government's reaction towards Zerocoin would be then.

On the other hand, Bitcoin may be even harder to kill than file-sharing/torrenting, in which case maybe it won't matter if it's done now, as the government's action against it could be irrelevant.
cheez is hardly scaremongering. As it stands truly anonymous and private transactions on Bitcoin are apparently impossible. (I'm not a Bitcoin user so feel free to correct me.) I would say that you are the one who is doing whatever the opposite of scaremongering would be called (hope-mongering?).
Yup. TBH I simply don't understand the logic that makes an offensive act against a non-combatants by an individual illegal, but somehow permits that same act against non-combatants by a nation state.

It it is illegal for an individual to murder someone, then it should be illegal for the government to do so. If it is illegal for a programmer to infect thousands of computers of innocent people with malware, then it should be illegal for the government to do so.

I have no doubt in my mind that among those 50k are many innocent people (foreign and domestic), and that among the domestic infections, I doubt the NSA could produce a warrant or other legal instrument that permits them to have caused that infection.

Under what wacky laws do we actually permit such malware. And are there any provisions in those laws proscribing corrections for any offensive malware programs that cause collateral damage.
If you don't distribute the pin along with the browser you don't get TLS forced on the first connection. As you yourself said in the other thread TLS+TACK doesn't solve this either. So this is hardly a fundamental property of TLS.
Maybe, but it could nonetheless help with the first-visit problem.

There are at least three proposals with a distributed cryptographic ledger to reform or replace the CA system: Namecoin, Sovereign Keys, and Certificate Transparency. Each of them has some security benefit relative to TACK alone in the case of a user-agent's first visit to a site.

In SK and CT the ledger is less distributed than a Bitcoin blockchain, although these systems have historical influence from discussions sparked by the existence of Bitcoin. Ben Laurie argues that proof of work is actually superfluous to the security model of these systems:

http://www.links.org/files/decentralised-currencies.pdf
http://www.links.org/files/distributed-currency.pdf

Anyway, to refocus, a decentralized or distributed ledger does have the potential to help with the first-visit introduction problem, because you can have another place to turn for ground truth or at least for evidence that the certs you accept are publicly known. (There are also alternative techniques that don't rely on such a ledger, including Moxie's own Convergence.)
Exporting a bunch of photos that presumably you uploaded yourself? Don't you already have them?

What I think of is the classic comedy sketch scenario of being invited to a friends house to view a slideshow or home movies of their last trip.

People like to share this stuff... that's obvious. What seems harder to admit is that nobody else cares.