skysight-inc/HackerNews huggingface dataset:
Suppose, hypothetically, that there was some kind of ultra-phishing virus that resulted in a 1/100 chance of losing money as a result of sending unencrypted email ... people still wouldn't use PGP. They'd switch to facebook messenging or SMS or something.

It's just too much hassle. People don't use it unless they absolutely need to. Signing is slightly more common, and might be easier to bootstrap.

Start by signing your mail. We might be able to persuade banks and other phishable businesses (e.g. Paypal) to start signing mail too. That gets the keys in place.

You mention gamification; some sort of automated system that hands out rewards or does something useful if you send it a PGP-signed mail might be a way to do this.
> particular implementation of democracy

What about the implementation is causing the results you dislike? I think it may be less the system itself and more the specific choices of voters that are causing the undesirable results.
Already discussed here: https://news.ycombinator.com/item?id=7847440
http://www.princetonai.com/bot/bot.jsp
I've never met a statistician who either uses excel or has a "disdain for programming". R or Matlab are basic tools of the trade
The attack being described here goes like this:

1. Attacker steals the private key via heartbleed or other means

2. Attacker sets up their own server using the stolen private key

3. Attacker tricks a user into accessing their server rather than the real server via any of a number of methods, such as a compromised hotspot.

4. User provides their sensitive information to the attacker, thinking they're on the real site.

No server-side action can mitigate the risk of a stolen private key in the above scenario, since the user never communicates with the legitimate server. That said, most browsers ship with certificate revocation lists disabled by default, so revoking the certificate doesn't help nearly as many people as we'd like. But for people who do enable CRLs, they'll see the scary warning rather than their browser trusting the revoked cert.
Yeah - you really have to stop, note, communicate, bill and collect on every request that a client has.

Or else, you will feel tired, broke and like someone has their hand in your pocket all the time.
Amazing that the binary for this is only 288kb
IMO, the issue is that real security is inconvenient, and my email is just not that secret.
I use matlab.

then I use excellink to send everything in matlab to excel.
http://en.wikipedia.org/wiki/ADHD-PI

Would you say this describes you?
Wordpress strikes again. Cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...
You would think with Steam banking it big with the Steambox that they would want people working on these sorts of projects, as it's not only Steam that wins big (having a FOSS OS to run their steam box on), but everyone else.
It was originally part of the authors PhD work, it hasn't been touched since he graduated.
Their line of "it's for user experience" doesn't make sense. There's nothing stopping them from saying they require a 6 character password, but also allowing much longer, with symbols or other 'forbidden' characters.

More worrisome to me is the bank with case-insensitive passwords. I'd like to think they are just .lower()ing the password before proper hashing, but I'd wager they are storing it in clear text (and possibly showing it to bank support agents).
And ALL of that already existed in the marketplace before the iPhone. Heck, the things that are claimed to be unique in what you quote above is an almost exact description of the LG Prada which came out before the iPhone.

Seriously, look at this a moment:
http://i.imgur.com/iBD3A1z.jpg

Remove the phone answer/end keys from the bottom row, and it basically is the front of the iPhone. Re-read what you wrote above and look at that picture of the LG Prada. That design patent should have never been issued.
It's ultimately a tradeoff, and for an organization like a bank it's a really interesting one.

Every added security requirement limits the size of the customer base that's going to use the online system. For myself, a two-factor system with an app or SMS to provide the second factor would work fine, but for my parents it wouldn't. Every increase in security requirements has a tradeoff between customers that will use it and customers that will abandon online banking because it's become "too hard".

For the bank, when a customer abandons online banking, that means that there are longer lines at the branch, which means they need more people to provide the same level of service.

Note that I specifically said "security requirement". If two factor authentication was optional (not a requirement), then some accounts would be more secure than others. This would potentially make the less secure accounts more of a target since attackers may avoid the more secure accounts. There is also all of the development and testing and maintenance efforts required when you make different customers have different authentication methods.

The bank knows all of this and more. They balance their risk (reimbursed customers due to poor security) against the costs (people abandoning online banking, people switching to an easier-to-use competitor, implementation costs, etc).
"A lot of advice says to only accept jobs which are willing to pay the rate you're offering..."

IMHO the rule is good, but you don't have to offer the same rate for each job. If there's a job that benefits you, work out what how much that benefits you and quote the appropriate rate. If there's a job that doesn't benefit you, double your normal rate.

Clients insisting on negotiating the rate is a negative signal. It may be a signal that they don't value your work at the rate you're quoting, and this is often a signal that they won't value your work. It may be a signal that they are under financial pressure (i.e. it's high risk for you). Better clients might ask for a discount but normally will agree if you stick to the quoted rate.
You could read it.
Google Now is a similar one I think. I'd rather Google surface purchases, flights etc. in Google Now than not, even if that means they're reading them emails and know what I bought.
No, it is a different thing but the DRD is another thing that they should mention indeed.
Nobody. Understands. Punctuation.
This is a minor problem now, but it will get much worse if you consider technical development.

Every individual gets more and more power and capabilities with time. In not too many decades, hackers will be able to design bacteria for hobby at home, even if they probably will send for a lab to synthesize the DNA etc. Now, it is still quite expensive to make artificial life.

Consider North Korea and the possibility of a biological analogue to the Stuxnet virus...

Without a 1984 surveillance state, you need some form of immune handling -- everyone as their own bubble boy or intelligent analysis of bacteria/viruses (and hoping that Stuxnet vectors are only oriented towards military installations).

At that time, NSA surveillance like today will literally be trying to stop something as bad as terrorist nuclear weapons. You can't argue analogues about how much liberty costs, since there might not be anyone left to enjoy liberty, if NSA of the 2030s-2040s fail...

I have no clue how to solve this.
Why does everyone simply quote the Fourth Amendment as if that answers the question about privacy, especially privacy as applied to electronic communications?

Let me quote the Supreme Court decision establishing a right to privacy [1] (which was not previously considered present!): "Secondly, the Fourth Amendment cannot be translated into a general constitutional 'right to privacy.'" That Amendment protects individual privacy against certain kinds of governmental intrusion, but its protections go further, and often have nothing to do with privacy at all."

The decision goes further to note: "But the protection of a person's general right to privacy -- his right to be let alone by other people -- is, like the protection of his property and of his very life, left largely to the law of the individual States".

In other words, one may have statute protection, but not blanket Constitutional protection. And that opens up the possibility of the ones writing the statutes carving out "foreign intelligence" exceptions.

And this is all in accordance with the decision to invent the "reasonable expectation of privacy", it's not even going into later decisions like Smith v. Maryland which tended to expand government search ability.

[1] http://www.law.cornell.edu/supremecourt/text/389/347
I was reading before about a solution to procrastination that said you should have 2-3 different tasks. And when you aren't in the mood to do one, do the other. Could work for some, but maybe not everyone. Procrastination is usually not "not doing anything", but doing something else instead of what you should be doing. So try to make that "something else" a task that you need finished anyway.
Just a guess, but it could be that phone based banking is the reason. You can't enter (most) special characters on the phone.
طلبة العراق في السويد يرفعون الأعلام العراقية في سماء يوتبوري أبتهاجا بتخرجهم
The problem will all come down to UX.

* Key generation and exchange is a challenge. Most people I have taught how to use gpg / pgp can't seem to figure out how to publish there keys, send or receive keys.

* Entering your password often is a pain. Most people I have taught have given up using this on a day-to-day basis because its just such a pain.

As an aside, there's the problem of improper use. Right now there are too many choice as to how you can setup pgp leading to the problem of people using it wrong. And don't get me started on private key security. Most people do NOT want to think about this. Quite honestly, I agree. Something needs to be done to make it very hard to compromise your own private key.
Aphyr's Clojure tutorial series is one of the best programming language tutorials I've ever read. I'm definitely a fan.

http://aphyr.com/tags/Clojure-from-the-ground-up
Well, that decision was also conducted under the aegis of a wartime America with a President that actually did have much more expansive Article I powers due to the nation being in a state of war.

I could be hopelessly optimistic and naïve but I simply don't see a similar argument holding in a decision today since there's no National Food Board (or whatever the agency was) to set rationing levels or resource priorities for wartime industrial production.
I would say that as "further regulate", as in the companies in questions, the cablecos and telcos ("AT&T", Century, Verizon) are already regulated government enabled monopolies.
Very awesome! Interestingly, in both Chrome and Firefox, the song stops playing ("mostly") if you switch to a different tab. I say "mostly" because Chrome seems to play a single note every 10-20 seconds even with the tab backgrounded.
That actually caused a bit of an uproar in some circles when the NSA thing came out, because it meant that the government was sitting on a huge pile of exculpatory evidence and not disclosing it to the people they were prosecuting. It's probably too early to know if that goes anywhere, but you can imagine the result if it means that a large fraction of people put in prison since they started collecting the data have grounds for a new trial.
Difficulty is problem #0.

PGP is fucking complicated, annoying, and non-user-friendly to use as a computer literate individual that codes for a living. How do you expect the chain-email-forwarding-toolbar-installing-click-here-for-free-smileys average person to understand it, with the knowledge that screwups in encryption land have the very real possibility to render all that work useless?

The average person doesn't see the value proposition for going through all that effort. Shouting "GOVERNMENT SCARY" at them isn't going to work.

Solving problem 0 would be a massive net benefit for society. You need a cross platform and cross client tool that looks good, is easy enough for my gran to understand, and that does the encryption right.

There is no such tool that exists today.

The Catch-22 is problem #1, after problem #0.

You can encrypt your own stuff all day long, but you aren't emailing encrypted stuff to anyone until a critical mass of people have also gotten past problem #0 long enough to have avoided saying "fuck it" and have distributed their public keys to everyone they know.

On top of all this, you're pushing encryption as a philosophical measure rather than a practical one. For more on how pure philosophy holds up when practicality intrudes, look at the free software movement.
Indeed, they give how-the-sausage-is-made first and second billing, how-pretty-it-is third billing, and what-it-is in the fourth and final slot. It's almost exactly upside down.
I'll "third" the recommendation.

I once managed a commercial mail filtering company on the perl-predecessor, qpsmtpd, which I documented here:

http://book.mail-scanning.com/
While all reasonable points, his resume doesn't actually list any experience in industry. There is certainly a lot of data analysis skills that can be learned while at academic institutions.

I would argue, however, that a skill that is often not put on these lists of 'what you need to become a data scientist' is some time being at a real private sector company. In my experience, there are quite a few differences between writing academic papers and coming up with the terse, actionable information that is useful for a profit-driven company.
I tried running a program originally written for 80386-class CPUs on a Core i7, it didn't magically get a intuitive GUI. Weird.
Here's a scheme I've been thinking about. It's an opportunistic PGP setup:

1) Whenever you want to send an email you look up the PGP certificate for the domain (yes domain) you are sending it to in some central keyserver. If you find it pin that certificate for future use and sign and encrypt the email. If you don't find it just send a normal email, possibly still signing it.

2) For a sysadmin to start using the scheme just publish a public PGP key in the central keyserver and when you receive an email that's encrypted with your domain key decrypt it and deliver it to your user.

This buys you a few things. For large hosting providers (say Gmail) you get a little better security than the current SSL between mailservers setup because it's harder to MitM and can be relayed between mailservers without security issues. You also get a PGP signature attesting that the email does indeed come from @gmail.com and isn't spoofed. Individual users that care can then use this scheme to get user-level encryption by having email in their own domain @myname.net. You could even outsource the @myname.net mail server to a normal POP/IMAP provider and publish the PGP key to the central server yourself. The provider then gets the encrypted mail and you decrypt it locally in your mail software.

But maybe relaying doesn't really happen these days and fixing STARTTLS would give you most of this with SSL certificates instead.
I think it might actually be in Civ5 that I first heard the following quote:

"Asking whether a computer can think is about as useful as asking whether a submarine can swim."

I think this is fairly insightful and relevant.
Girl Progresses towards 265lbs lift
I agree with the points people here have brought up. For my part, I think it would be good to at least have a seamless OpenPGP interface with at least signing enabled for all mails (if encryption not always possible), and I'm working on https://autonomail.com to that end. Other folks (like https://whiteout.io) are also working on similar solutions.
That's a really interesting link, thanks.

I hadn't seen that particular take on it - I don't think we're particularly disagreeing, though, since that parallel construction is still a long way off 'NSA info appearing in police cruiser computers' - it'll happen, it's just not there yet...
I don't quite understand how Mesa and device drivers play together... can someone explain this for me? I read the wiki (http://en.wikipedia.org/wiki/Mesa_(computer_graphics)) and this (http://en.wikipedia.org/wiki/File:Linux_kernel_and_OpenGL_vi...) graphic makes it clear that Mesa is the implementation of the OpenGL specification... what I don't get is the relationship between drivers and Mesa. Why aren't the drivers the implementation of the OpenGL specification? Is pushing bits from the GPU to the screen the only thing that the drivers do?
That's more of a software design consequence than a fundamental limitation.

It's common to build fault-tolerant systems by designing a master-slave architecture, and then bolting a failover mechanism on top so that exactly one node is the master at any time. That approach suffers from exactly the problem you describe: if you can't contact a node, there's no foolproof way to ensure it isn't acting as a master, so you risk split-brain unless you can remotely fence it.

Consensus algorithms like Paxos/Raft don't suffer from this problem; in order to make steady progress, there should be only one master, but they still operate consistently if that assumption is violated in the short term. So no fencing is needed.

A lot of people seem to have a fundamental misunderstanding that using Paxos for leader election is enough to make a system consistent, and it's emphatically not. For instance, I hope this isn't still true in current versions, but for a long time HBase was vulnerable to losing committed data because it misused Zookeeper and allowed multiple regionservers to simultaneously "own" a given table region. (I found about that issue when it happened to me in production, so now my default assumption is that all "distributed locking" systems are broken until proven otherwise.)
IOTLIST – Discover the Internet of Things
Except the case preceded the war except in its winding its way through the courts, it's New Deal law, after the "switch in time that saved nine" (https://en.wikipedia.org/wiki/Switch_in_time_that_saved_nine... from later in the Wikipedia article on the case:

"In July 1940, pursuant to the Agricultural Adjustment Act (AAA) of 1938, Filburn's 1941 allotment was established at 11.1 acres (4.5 ha) and a normal yield of 20.1 bushels of wheat per acre. Filburn was given notice of the allotment in July 1940 before the Fall planting of his 1941 crop of wheat, and again in July 1941, before it was harvested. Despite these notices, Filburn planted 23 acres (9.3 ha) and harvested 239 bushels from his 11.9 acres (4.8 ha) of excess area."
If they meant to limit it only to keep the states from taxing each other then that's exactly what would have been in the Constitution. For instance Art. I. Sect. 10 is very clear about how states may impose duties and tariffs on imports/exports, it was very much not left to chance.

Knowing the intent of a given clause is helpful for the courts in determining how to interpret the law or Constitution when the written text of the same is unclear. But when the Constitution or law is perfectly clear then that's what the law is.

In this case the relevant clause is "The Congress shall have the Power to regulate Commerce with foreign Nations, and among the several States."

That's it... unlike Art. I. Sect. 10, there are no specific constraints or restrains embedded there, certainly nothing about taxes (since it would be easy enough to simply declare that states could not tax each other, similar to how Art I. Sect. 10 does it).
You probably wouldn't station them in the city, too easy to obfuscate avoid if the locations are fixed - something like this will be forthcoming from the Met's Open Source Intelligence Unit fairly soon, I imagine.

http://www.strategypage.com/htmw/htecm/articles/20130524.asp...
An app that allows people to ask for favours from their friends and anyone within a certain radius. Could grow into a marketplace for local tasks (doing the shopping, giving advice, menial tasks etc). Any thoughts?
I've never heard of an employer requesting a Word document, but a plaintext version would be useful to paste into poorly-designed webforms.
Stop helicopter-parenting other people's kids
I think this is a misunderstanding in terminology. "Network partition" in this context does not necessarily mean your LAN cable is broken, it means that you have a cluster of servers that expect to communicate, and some of them cannot communicate between each other.

That could be because of a faulty network, but it could also be due to hardware failures, misconfiguration, slowness of servers (hard to tell from not reachable), and a whole host of other causes. If you have more than just a couple of servers, this will happen sooner or later.

If you only have a couple of servers, IMHO don't bother with a truly distributed system, use a database with failover to a replication slave (lazy or eager, depending on what consistency you need) and be done with it.
Realize that this version is from 2001 and is not the version that was in the recent test.
CoffeeCollider is a coffeescript clone of SuperCollider, it has a lot of options for subtractive/additive/fm/granular synthesis and algorithmic sequencing/composition.

http://mohayonao.github.io/CoffeeCollider/
Maybe I have played too many MMORPGs, because this sounds so much like one of those fake conversations with an NPC. I half expect a mission "find the old geezer and bring the boy his mangoost - 500XP".

Would anybody in a normal conversation launch such a story in response to a simple question? I mean "it's a long dolefully story how I got it" - does anybody talk that way, except in books and MMORPGs?
Valve understands that without other incentives for developers to target Linux, gamers will never switch. It's looking to be a huge win for the FOSS community.
> GCHQ is quite strongly against allowing some evidence to be used in court cases because it would need to be tested in open court.

Yep. And that's the whole reason 'parallel construction' exists at all in the U.S.... even when NSA has solid evidence of actual crimes being conducted, they will not burn intelligence sources & methods to allow for a court prosecution of the same.

So LE has to either find a way to independently arrive at the evidence that they know is there, or go without prosecuting criminals they know to be on the street.

Parallel construction is definitely distasteful but nor is it planting evidence.
In a large company, such a change only has a chance if it is mandated from the top and then the mgmt team is very committed to push the change through for as long as it takes. Without both pieces it will get killed by apathy at the middle management layer and below. Without that support the technical solutions will gain no foothold.
When people/media/govt/everyone is/are still arguing whether the surveillance state is merited or not, whether Snowden is a traitor or not, a technical solution is meaningless. The argument over whether it needs a solution needs to be "solved" or at least agreed on enough that their is an "issue" to be "solved" anyway.