skysight-inc/HackerNews huggingface dataset:
> extensive documentation that the NSA is, in fact, surreptitiously introducing security holes in software?

I've seen speculation to that, but not "extensive documentation", at least from the perspective of simply breaking all hardware.

Buying descriptions of existing vulnerabilities is not "introducing" them. Nor is haranguing companies into leaving in known vulnerabilities (though that is bad enough).

Even things like asking companies to use Dual EC DRBG is not "introducing security holes" in the way we understand it, as EC DRBG is actually secure against all adversaries except NSA.

Like, I'm re-reading the Guardian article now and it talks about the NSA "using supercomputers to brute-force encryption" as a strategy... hardly a jumping testament to the massive brokenness of the Web.

Going further to read the actual list of NSA practices helps confirm this a bit too.

For starters if you look at the description of their SIGINT Enabling Project it states that "To the consumer and other adversaries, however, the system security remains intact." (emphasis mine), which seems to be hinting at Dual EC DRBG (or at least, Snowden doesn't seem to have leaked any other NSA technologies that are broken only to NSA but resistant against other adversaries).

The one blurb I could find about deliberately introducing vulnerabilities had a very important caveat which everyone leaves out: "Insert vulnerability into commercial encryption systems, IT systems, networks, and endpoint communications devices used by targets" (again, emphasis mine). The Guardian somehow left that out of their description of that bullet, I'm sure it was just an oversight.

In other words this is not mass introduction of simple exploitable but a seeming formalization of the types of corporate-government partnerships that led to things like the Siberian pipeline sabotage, to be used in specific targeted operations. Indeed the Guardian seems to confirm that in their description of the NSA Commercial Solutions Center.

Even Snowden has spoken up in support of the concept of targeted operations by U.S. intelligence agencies, so I'm not sure why this should be surprising; it's the kind of stuff we expect the U.S. to do to gear going to Iranian nuclear weapons facilities or Syrian C2 bunkers.

So even if we give the NSA credit for surreptitiously breaking crypto around the world, this particular method does not appear to match their style or even their own internally-held methods. It seems like the kind of thing NSA would take advantage of without revealing it, but not the kind of thing they'd intentionally add to a non-targeted iPhone. And, if they did add it, they'd add it to the flashed image, not the source, à la "Reflections on Trusting Trust".
I've been wondering about analogous things for flute, clarinet and cello. From what i read here, they're all compromises, except for a heavily baffled room in the basement. I really liked an Azola electric (solid body) double bass that i tried but i was too slow in making a decision, and they're now very hard to find.
I'M THE DUKE UNIVERSITY FRESHMAN PORN STAR AND FOR THE FIRST TIME I'M TELLING
Silicon Valley: Top salaries for many, greater inequality for all
Do more with your mind (for $299)
Zidisha and Immunity Project have both launched publicly from this current W2014 batch. There are more.

Also, we don't set quotas at YC. If we think your non-profit would be a good fit for YC, we'll accept you.
Sciomancy: Da'ath symbolic machine
How to Make Yourself Work When You Just Don’t Want To
I'm making an electronic musical instrument. Still in development. I'll think about what you've just said, as the plan is design more than one kind.
The last paragraph is perhaps more crucial than it may seem.
Apple allows robots access to everything! http://www.apple.com/robots.txt
What is the point of having such silly prohibition? It's silly because anyone can crawl it if they want, Facebook may block such DDoS attack, but why would they bother to put up such sign when they know it's useless?
I wonder how many generations I'll eventually turn out to have been born in.
Epiphany Eyewear: Like Google Glass, But Maybe Even Better
It is also unlike how administrative and executive staff are paid. Sure, exec positions often (though not always) have some performance-related bonuses. However, those are normally on top of a base salary that is already rather ridiculous if you're really honest with yourself.

Unlike in those pirates' case, there's simply no way an executive might walk away with a zero outcome (let alone a negative one). So the two are not at all comparable, and executives ought to be treated like janitors (or vice versa).

The way executive income tends to be structured today does follow some logic that makes sense internal to the framework in which it exists. Once you step outside of that framework, however, it's pretty clear that a sane design of society based on almost any reasonably notion of distributive justice would not accept this structure.
Why would they disallow all their about content? (Bit of an SEO noob).
Rescale (YC W12) is looking for a platform software engineer
Rescale is building a simulation platform for engineers (of the non-software variety) to help them design their products faster. Our software has been used by a commercial spaceflight company to design rockets so you really do have an opportunity to make a dent in the universe here.

As a platform software engineer, you will be building a distributed workflow engine and cluster management system that will run compute-intensive simulations across multiple cloud providers.

You'll get a chance to learn more about the processes and tools that engineers and scientists use to build products and how high performance computing power in the cloud can revolutionize this design cycle. Simulation is a $40b market and used across a wide range of industries including aerospace, oil & gas exploration, and life sciences so there are a lot of interesting domains to learn about here.

We are well funded company by top tier investors (including Jeff Bezos, Paul Graham, and Peter Thiel) and offer a competitive salary with matching stock options. We are located in the SOMA district of San Francisco close to BART and Muni.

==========

Our ideal candidate has the following qualifications:

* Five years of programming experience with Java or Python

* Deep understanding of object oriented programming, distributed/concurrent/multicore computing, cloud architectures, virtualization technologies, scalable databases, fault tolerant computing

* Expertise or strong interest in the following areas: high-performance computing, code optimization, concurrent programming, security, encryption, certificates

* Education: B.S. in Computer Science or a related field, M.S. or Ph.D. preferred

* Flexibility and dedication to making exceptional products

==========

Interested? Contact us at dev-jobs@rescale.com
Free hacking classes – Offensive Computer Security (CIS 4930 / CIS 5930)
Does not NSA have access to multiple of the private keys of the preinstalled root certificates anyways? If so they can MITM any SSL connection where you don't specifically say which CA cert it should use?

Isn't it the case anyways that SSL is not very efficient against state sponsored attacks as almost all of them can generate certificates for any domain?

All this speaks towards it being a unfortunate mistake not something malicious, unless there is something wrong with my understanding how things work :-)
Fuschia flower essence: The number 9, Kabbalah, Moon magic and Western magick
This is pretty cool but the last item is pretty ridiculously out of place, also the chronology isn't strictly linear and it seems to skip over some important advancements.
The Codeless Code (Programming Koans)
Average school boy stoner or graduated professional and functional addict? There is a bit of a difference. The majority of full time stoners, not exactly functional usually dealers could easily smoke 10-20 ciggarette sized joints in a day. A functioning addict could smoke 4-5 a night. Schoolboy stoners might smoke 2-3 a day.

4-5 a night is very common, at least where I've come from. I'd say about as common as someone who drinks 4 beers in a night after work. Not the total norm but not crazy or anything either.
Right, haha, like comparing tool that does the same thing and just justifying or proving that this one is better -_-
What I would like more people to understand is, the NSA planting backdoors into everyone's accounts and software makes everyone less safe to both interior and exterior attacks. So no, it's not a case of NSA spying being a lesser threat to eastern spying, it's a case of the NSA punching holes in your walls letting everyone see what's inside.
Vim is already awesome as it is.
Yes, it means "to bid farewell", absolutely no relation with valere.
Show HN: Anagram Solver (weekend fun)
If you cant beat it, buy it and shut it down.
yaaaa this is like rly good. dwn w/ the p4triarchy.. fuck capitalism fuck stephen king (his books are rly skaree)
their popularity was only viable once smart phones and data connections became ubiquitous with everyday life
seriously. appropriating buddhism / zen (or any culture) just to look cool and wise is so condemnable to me. i really dislike the fetishized, orientalist view of eastern religions i often see in the hacker community. ESR is full of himself to begin with, but for him to be writing koans is so arrogant. these have nothing to do with actual zen koans anyway, they're just programming lessons obfuscated by self-indulgent "i'm so wise" writing with a "and then the student was enlightened" at the end. bleh
For those interested, to expand on the above. Physically its not addictive in any of the population, if you are predisposed to addictive tendencies you can very easily build up a pschological dependency which isn't totally hard to break but there is about 8 days worth of withdrawals to go through, the first 4 or so which can be pretty emotionally intense.
Looks like it? Very weird
Then make the payment after a predetermined metric is hit
> To this day I never found out who invited me to that conference.

Pretty sure I did, dude. :) Also, while I sometimes offer names of friends recruiters should talk to, I didnt' around this time. So that part's still a mystery.
Additionally, it was a pleasure to meet you.
Those not finding 'Zukeberg' in the dictionary - it's a misspelling of Zukerberg
"Blue Sky" is the name of an underground drug marketplace. It is one of the new[1] sites looking to replace Silk Road and is apparently popular.

Onion link:

http://blueskyplzv4fsti.onion/

edit: screenshot of the market homepage:

http://imgur.com/O9fvlxI.png

[1] turns out it was launched in the first week of December, which makes it nearly 3 months old - enough time to get it noticed and flagged by the us.gov.
Apart from other meanings mentioned here, in US legal history the "blue sky" laws came in to stop people selling securities for bogus or unlikely business ventures. I don't think OFAC is necessarily directly concerned with this, in this case, but the company they sued may have inadvertently mocked the business law by using the term.
https://en.wikipedia.org/wiki/Blue_sky_law
This is pretty obviously written by a non-physicist.

For one thing, energy isn't conserved on a universal scale. Energy conservation is a consequence of time invariance[1]. We've measured that the universe is inflating, and so isn't invariant in time. So on large enough scales, energy isn't conserved.

And, as a (ex-)physicist, I'd be more likely to say something about how little time we have compared to the age of the universe, or even compared to single atoms. Or about how we end up quantum entangled with the entire universe on long enough time scales (at least in some interpretations of quantum mechanics).

[1] http://en.wikipedia.org/wiki/Noether's_theorem#Example_1:_Co...
Show HN: Listen converts words into spoken voice
A collection of info-graphics entrepreneurs are sharing
The other reason why this is no big deal (anymore) is that the Snowden leaks have shown that the NSA has total control over all iPhones.

Why should we even bother talking about bugs like this anymore? Pure distraction.
It redirects requests from the UK.
It's worse than that. He wasn't advertising for something he sells, he was advertising the ads on his network of wordpress fashion blogs. If I felt his business had merit I might have retained a shred of sympathy, but content farms paid to push merchandise are just a very small step from clickfarms which don't bother with the facade of providing anything of value.
The big difference here is that it's based on refactoring the existing codebase. While not the most glamorous job in the world, it's more realistic than attempting to recreate the product of 22 years of development starting from scratch.
It is not about basing his salary on that of the cleaners. It is about having a limit on the range of salaries in the organization and the cleaners happen to have the lowest there. The idea is that the extra profits should be shared by all the employees and not collected by the top executives.

As to why they wouldn't just leave, well let them. You could hire better faculty members and you will have a sparkly clean university that can attract better students. Your research/teaching statistics go up and you can pick more funding. At some point other universities will follow your example and administrator salaries will normalize.

Not going to happen though .... more likely they will outsource the cleaning so that the president can earn 10x the salary of the IT stuff. Then they will probably outsource IT as well ...
Man Rescued Brother's Books and Started Brooklyn Independent Library
Jacob Perkins started the Mellow Pages Library, an independent library in Bushwick that specializes in hard-to-find small press books. Read more for indie literature, an oil-money scandal, and an innovative company.
Prism is as precisely as "voluntary" as the cops showing up with a search warrant at 5am and asking you nicely to open up "voluntarily", because, well, they have a nice 5.11 MiniRam Breaching Tool 50091 and your door looks very pretty and it would really be a shame to have to knock it off its hinges. Yes, that would be a real mess.

See what I wrote on this last summer: http://news.cnet.com/8301-13578_3-57588337-38/
That was a major "wat", after looking at your username. Whoa.
> And in terms of feasibility, this bug is less exploitable than the kinds of bugs that are disclosed in every platform every month; it requires a specific (common, but not universal) set of circumstances to escalate it to code execution.

What I'm afraid of is an attacker stealing my credentials. Code execution bugs obviously is game over for me. But now with everything in the cloud, an attacker could get all I'm afraid of losing by fucking with my SSL connections. If they get access to everything I have on the web the fact that my machine executed no malicious code locally is no consolation.
The indignity of no work
{arithmetic}
|
{vecops} = {Vector operations}
{dotproduct}

{arithmetic}
|
{RREF} = {Reduced row echelon form}

{arithmetic}
| {patience}
| | {dotproduct}
| | |
{matrices}
{Mops} = {Matrix operations}
{Meqns} = {Matrix equations}
{Mmult} = {Matrix multiplication}
{Mdet} = {Determinants}
{Minv} = {Matrix inverse}

{y=mx+b}
|
{linear} = {Linearity}
{plane} = {Lines and planes}

{dotproduct}
|
{proj} = {Projections}
{basis} = {Coordinate projections}

{vectors}
|
{VS1} = {Vector spaces}
{VS2} = {Abstract vector spaces} // knowledge buzz moment
|
| {dotproduct}
| |
{IPS} = {Abstract inner product spaces}

{y=mx}
| {Mmult}
| | {function f:R->R}
| | |
{linT} = {Linear transformations}
{VSRREF} = {Vector space techniques for matrices}
{TasM} = {Finding matrix representations}
{basis2} = {Change of basis for matrices}

{Mmult}
| {linT}
| |
{eigV} = {Eigenvalues and eigenvectors}
{Mdecomp}= {Matrix decompositions}
|
{specM} = {Special types of matrices}

{VS1}
|{plane}
||{eigV}
|||{linT}
|||||{Meqns}
||||||{Mmult}
||||||||{Mdet}
|||||||||
{invMthm} = {Invertible matrix theorem}

{proj}
|
{GSorth} = {Gram--Schmidt orthogonalization}

{RREF}
|
{LP} = {Linear programming}

{Mmult}
|{Meqn}
||{RREF}
|||
{solve} = {Solving systems of equations}
{LSaprx} = {Least squares approximate solution}
{ML} = {Machine learning}

{LAoverZ_q}= {Linear algebra over a finite field}
|||
||{ECCs} = {Error correcting codes}
|{crypto} = {Cryptography}
{netcode}= {Network coding}

{trig}
|{taylor}
||{AVS}
|||{IPS}
|||||
{fourier}= {Fourier series}

{fourier}
| {prob} = {Probability density}
| | {LAoverC}= {Linear algebra with complex numbers}
| | |
{quantum}= {Quantum mechanics}

UPDATE: Okay so if anyone is interested, I just put up a pre-release of the book https://gum.co/noBSLA
Indeed, the code as presented there had well-defined behaviour according to the standard. Note to lunixbochs: This is why I mentioned sequence points before.

While valid according to the language definition, assignments within conditional expressions do have a reputation for being error-prone and not always the easiest code to read. Sometimes they're still neater than the available alternatives.

However, IMHO in this case, it feels a bit too easy to break the code during later maintenance edits. For example, someone might simplify the code by removing the explicit comparisons with 0 that are unnecessary here, and then later someone else might "fix" an "obvious bug" by replacing the "(err = x) || (err = y)" construction with the common construction "(err == x) || (err == y)" that they assumed was intended, perhaps prompted by a compiler warning. Obviously they shouldn't if they didn't properly understand the code, but when has that ever been a reliable guarantee? :-)
Yep, you're right. PRISM is a process through which NSA obtains legal orders to demand information from companies through a federal law known as FAA 702. I tried to set the record straight on this last summer:
http://news.cnet.com/8301-13578_3-57588337-38/

Since then, we've learned that FAA 702 orders add up to a tiny fraction of user accounts. The order of magnitude is 1,000 accounts per company per year. I really can't get too worked up about this; there are bad guys out there and that figure seems not immediately unreasonable. What we should get worked up about is bulk AT&T etc. fiber taps that vacuum up everything without any accountability, but, well, PRISM is a nice sexy name and everyone's attention spans are short and, yikes, isn't this confusing and BULLRUN and EDGEHILL are too hard to remember. Right?

No companies "joined" PRISM. The slides are likely referring to when NSA managed to write the conversion utilities to import FAA 702-obtained records into the PRISM database. But critical thinking is hard and life is short. Right?
http://opensource.apple.com/source/Security/Security-55471/l...

Can someone explain to me what this code is? It appears to be implementing standard crypto procedures -- are there not suitably licensed public implementations that apple can use? If they are writing it themselves, why are they open sourcing it? (I don't have a reason why they shouldn't it's just that I've never associated apple with much interest in open sourcing things).
> He reportedly used that power to rig the parliamentary elections and gain complete control of the Parliament.

However this can also be disputed since the PoR had previously gained the most votes in parliamentary elections even when Yushchenko was in power... It's not like the PoR was unpopular. And of course Yanukovych also won the presidential elections when the opposition was in power.
Why would you want to force yourself? Life isn't about how much work you can do. If you feel like working, then work. If you don't, then don't work.
For those not finding Zuckerberg in the dictionary, he founded Facebook.
I have written an API for HN:

- Python module: https://github.com/karan/HackerNewsAPI

- REST API: https://github.com/karan/HNify
I think microsoft is really going all guns blazing to populate their ecosystem with apps. As a developer, today I am not motivated enough to create apps for windows. A few years back if any application worked in windows, I need not have cared about other os. I also feel with the new ceo from azure background, microsoft is going to try to earn more from cloud than regular one time licensing of software.
That's amazing. Know of anything like it for Nginx?
> (none of them tried to steal an election before AFAIK)

What do you call the Orange Revolution? Especially since Yanukovych was elected in the following round of Presidential elections?

If anything, the government has been the reasonable party in this whole debacle, with the opposition being represented by violent fascist protesters and racist leaders (Oleh Tyahnybok and Dmitri Yarosh have both risen to prominence).
Yes, I do. It's not hot enough. Heat guns are also cheap here in Ukraine, may be I'll buy on occasion.
> Unfortunately, most revolutions go in the first direction.

Witness Yushchenko and Tymoshenko fighting for power, only to split the entire 'Orange Revolution' coalition and lose the following elections...
Well, considering the US has played a rather strong role in overthrowing Yanukovych's democratically elected government, it's understandable that Russia would be angry.

http://www.youtube.com/watch?v=MSxaa-67yGM
The operator of a crawler doesn't need to sign an agreement for the prohibition to be enforceable. See eBay v. Bidder's Edge. This was 14 years ago, folks.
It sorta sucks to see such a completely positive spin on being plugged in when we are having so many problems with privacy and not caring enough about abuses of our connectedness.

Where's the part about setting precedent for letting marketing, big business, and corrupt government walk all over us?
Personally I would consider Chromebooks to be the horses, I don't need a glorified VT 100.

As for the reports of huge sales, I never saw anyone in Europe using one or them being on sale for that matter.
HEVC decoder libde265 works well with even 4k Videos. There is a gstreamer plugin for easy test http://www.libde265.org/blog/2014/02/22/gstreamer-4k-h265-he...
Fun fact: 83% of visitors to YouTube are not signed into a google account.

Lots of those ads are based primarily the video content or other instantly detectable things like geography, language, etc.
You might find Alan Perlis' epigrams interesting http://www.cs.yale.edu/quotes.html
Hold up. Regardless of whether the media appreciates this point, a memory corruption bug in a relatively restricted (compared to the wealth of JavaScript) protocol like TLS has a decent chance of being very difficult to exploit reliably on modern systems, probably including the NSS bug you mentioned. The NSA might be able to do it, but it's not magic, and failure has some possibility (though low) of being detected; a bug like the current one, an exploit for which is basically 100% reliable if set up correctly and is probably less likely to be detected if not, is going to be a lot more appealing, and sniffing data rather than executing code is probably usually good enough for its purposes. Many other adversaries won't even try difficult exploits, but can easily set up this one now that it's been disclosed.

Admittedly, the above leaves aside the elephant in the room - regular old browser bugs, which are vastly more common, more likely to be reliable, and for the aforementioned other adversaries, relatively easily leveraged with exploit kits. As I assume you know, browser sandboxes provide protection against renderer bugs on MitMed or attacker-controlled origins being used to hijack a HTTPS site (and OS-level sandboxes protect non-browser SSL applications), but sandboxes get popped all the time and one of the two targets of this bug, iOS Safari, is single-process, so meh.

I agree the coverage of this bug is overblown (...depressingly, since that's just saying that modern computing is drastically insecure); I strongly doubt it was introduced intentionally, or that the NSA, if it knew about it, was "relying on" it in the sense that the disclosure is a huge loss. But it's still a particularly good bug.