skysight-inc/HackerNews huggingface dataset:
In the same way that we trust bcrypt when we get the source from somewhere we know, it would be possible to make an encryption module in JS that gets imported from a trusted location eg https://github.com/shaneGirish/bcrypt-nodejs/blob/master/bCr.... So long as the web app imports that version, and checks it against a hash from another trusted location then it would be possible to get true end-to-end encrpytion entirely in a browser without trusting some random server. You'd 'just' have to trust Github (or any other trustworthy server) instead.

[1] That's specifically for Node, but it could be tweaked to work in browsers.
It's based on Google account. There might be other vectors too. I tried browsing lots of pages in incognito, making Google searches, clicking ads etc. but that didn't help (might work in long term). Signing into my Google account (with history) was enough to pass the test.
Well that's reassuring. It's not obvious from scanning the first page that this is how it works and will potentially scare away users. So I guess then it only works if I have a reliable internet connection and my battery doesn't run out.

Do you know how battery/network heavy logdog is?
I just tried building a blank app with node-webkit, and the .app file came to around 100MB. It includes the whole Node/Chromium runtime thing.

With MacGap it's only 1MB for a blank app, apparently. It presumably uses OS X webviews, which don't need to be distributed with it.

Obviously node-webkit has a lot more things going for it, like Node/NPM, and cross-platform support. But the size thing does matter. If you are making a basic little utility app, people are going to be suspicious of a very large download size.
In 2013 US government receipts totalled $2.78tn of which corporation tax constituted $273bn (~9.9%)[1]

I imagine most of the boost in margins to be brought down increasing compensation or numbers employed so most of that gets brought in to tax coffers via personal income taxes.

[1]http://www.taxpolicycenter.org/taxfacts/displayafact.cfm?Doc...
In regards to the video, I feel like it has become a cliche to have upbeat, light ukelele music in the background for product demonstration videos. I instantly felt myself become annoyed when the music started.
Sounds like a regression problem? The actual algorithm will depend on how well you need to approximate the function, the nature and amount of example data.

http://en.wikipedia.org/wiki/Machine_learning#Approaches
For me, the ultimate Skype killer is Skype.

It's gone from a messaging app that I couldn't believe worked so well on a low-speed connection, to a messaging app that that I can't believe works so shitty on a high-speed connection. I literally tried for 20 minutes just to get a call to connect last Saturday before giving up and using FaceTime instead.
In the video the user has to type in their first and last name, and an email address.

I have to assume there is a confirmation email, otherwise what's the point in asking for an email address?
Nathan Barry has the same problem with his Authority course.
Guiding Startup Culture – The Genius ISMs
Do you mean after signing up? You can post a message - when you sign up, you don't have any friends or posts, so what you're essentially seeing is the footer. I will make this more clear - thanks for bringing it up.

If you can't even see the login/register part, may I ask which browser you are using?
Passing the captcha through an entirely automated procedure.
Very good point. It took us a while to get around that :-)
I think worst case scenario is that they get what they have today (solve a captcha style problem).

Con: They will have an additional click.
Pro: They might get a more solvable puzzle than some of the "read this distorted text" images they would see today.
Does it run client-side (device), or server-side? I ask, because if you're without a net connection, will LogDog still monitor your accounts (if it's server-side, it will, I guess)?
Firefox Dev Tools still has some gigantic bugs that make it unusable for a lot of scenarios. For example, it doesn't show evaled code in the debugger. Which means anything that dynamically creates code (common in development) can't be debugged. Shumway (the Firefox flash compiler) for example.
More appropriately stated: couldn't determine a priori that you were a human.
No, you can't do that, because browser Javascript lacks a mechanism to segregate one "module" from another. In fact, any page that merely populates the DOM can override any security decision made by any Javascript file.

This idea comes up a lot, and nobody's ever explained to me a workable method for doing an integrity check of the entire Javascript runtime associated with a specific site. It's not as easy to do as it sounds.
> most of the work they do is first-class

Are we talking about the same PayPal?

Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software.

Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.
What makes you think they weren't already monitoring?
Fatherhood
That's kinda hard to evaluate not having actually do it. That said, such a bug, if works as expected might be much more highly priced in the black market.
The EU implicitly backs Eurozone countries because it has to, the UK is not a Eurozone country. The UK should definitely be able to control it's own taxes, the only alternative is fiscal union.
They're a "here's a token of thanks", not a "please don't sell it".
Probably the incognito window. It seems to rely heavily on cookies (likely linked to their analytics data.)
I'm using a tablet device, thus no mouse, and it gives me a captcha whenever I'm not logged in..

Really is this the breakthrough of bot detection? They are just leveraging cookies --which is nice improv UX-- but why do I need to click? delay loading to relax servers?
Yes but if you make up the 'price' of licensing the various IP from the tax haven subsidiary each year, and the eventual profit equation for the UK subsidiary adds up to 0 every year over several years, it's clear that the IP licensing purchases are just being used to avoid taxes.

That's profit shifting.
Dart VM uses a black list for methods that cannot be optimized by VM intelligence.
I cannot say anything about V8.
But with optimization in Dart VM not all so good.
Dynamic typing in Javascript is a normal behavior (VM optimized for that).
Dynamic typing in Dart produce a lot of pitfalls (in the sense of the intelligence of optimization).
I think it's just a demo for a typical form.
Refusing to explain how LogDog works, how should you trust them with your precious accounts?
I believe that the video was just showing an example of a form on which a CAPTCHA would appear.
High schooler who made $300K trading penny stocks under his desk
I use two-factor auth whenever it is available. I've also mandated it for all user accounts (on Google Apps) at my organization.

For a while, I was trying to encourage adoption by expounding on its benefits, but then one of our users (without two-factor auth) had her account hacked, and I was able to employ the panic around the office to justify making it mandatory for everyone. This caused some pain for a little while (when two-factor auth enforcement is enabled for a Google Apps domain, users without two-factor auth enabled must use a temporary code, which can only be retrieved by a domain admin), and I wouldn't recommend this approach for more than a dozen users or so.
Keep in mind that some companies keep all their customers' BTC in one big "account".
Google wouldn't know but the ISP would know who was behind a particular IP at a specific time. They are the ones who should police their network when there are abuses.
Sorry, I heard "Single EU VAT" and assumed you were talking about the Eurozone. Unifying taxation in the absence of unified monentary policy makes no sense to me anyway, so sure: I agree then. :)
Four Fifths = a Fifth
It isn't user friendly, but often with that type it doesn't care what you enter for the tough to read world. The easy to read word is your test. The other is a way to harness people to do difficult OCR tasks. Some web sites have had fun organizing entering dirty words for the tough to read ones regularly to mess with the results :)
Ask HN: How to defend against SSL visibility appliances?
Recently on Tor Talk, there was a discussion of SSL visibility appliances (https://www.bluecoat.com/products/ssl-visibility-appliance). They are able to strip out SSL transparently (good article here: http://www.zdnet.com/how-the-nsa-and-your-boss-can-intercept-and-break-ssl-7000016573/).

Are there any effective means to audit trusted CA's in browsers, so that none of these vendors are in the list? Manually reviewing every CA obviously isn't an option.

Does anyone have any good plugin suggestions, or defensive techniques?
Their last significant outage was only 2 months ago: https://blog.cloudflare.com/route-leak-incident-on-october-2...
In Wayzata, Minnesota, a school spies on its students
Sorry, I just thought "all your data" was a bit unspecific. I have no idea what Google collects in order to derive that. I have a lot of guesses, but "all your data" doesn't tell me in fact, how it works. And I thinks that was what the parent poster asked for.
Modern typefaces vs. the Massachusetts court system
Why are we paying companies so they have the privilege of taking our money?

Companies don't pay taxes. Ever. Their money comes from customers buying their products and services. If they are not taxed, they can offer a lower price to the customers. If they are taxed, that simply means higher prices for customers.

Ultimately, individuals always pay the taxes.
Thank you Scott, I agree with you. Really, you are reaffirming some of the conclusions I had reached myself, but been questioning recently. I appreciate your input.

Here is some background on what I am trying to do:

www.pushvendor.com (early stages of public website)

demo.pushvendor.com (prototype)
A few years ago, I was reading about terrorists in Kashmir who realized they were being monitored, so switched to using common words for their terroristic communications. The same person, talking to X will use "tea bags" for "ammo"; and talking to Y, will use "tea bags", for, well, "tea bags".

Now he makes 2 calls: "I'm out of teabags; can you send some more?". How can you tell what he's talking about?
Its an example form illustrating where CAPTCHAs or where the new captcha will be used
If the incidence of the tax doesn't fall on consumers it doesn't necessarily fall entirely on shareholders. You would expect the incidence to be shared between workers and shareholders.
Perhaps it's simply a poor choice of words on your part, but "get around that" raises red flags for me. It makes it sound like you've found a loophole in their intrusion detection systems, that will (hopefully) be closed when it is detected—which will become ever more likely if your system becomes more popular.
This is pretty well known now in the publishing world. There are a large number of authors in genre fiction making a living self-publishing, and many more that do some mix of traditional and self-publishing.

You don't really need this guy's book though, there's plenty of information out there on how to do it (KBoards' Writers Cafe is a good place to start).
Try this one:

http://nomorecaptchas.com/

It's very similar. I might go as far as saying that Google copied them.
Google's Internet balloons are actually working
Respecting the concept of sovereignty would be my primary argument.
Skipping the schema configuration step only saves a few minutes but if you are sloppy schema-less may hurt you big time (hidden bugs, etc.).
The Long, Hard Quest to Create Digital Smells
Java Doesn’t Suck
I really think this is a terrible idea and wish people would stop making toolkits for these. Also no one should be allowed to claim these are native apps. Its false advertising.
Because ... Google.
A free music creation app for ipad for all levels of musicians-fun and intuitive
It's insultingly low. Auth bypass is easily worth 5 or 6 figures if you can use it to transfer money.
"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human."

Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. I have JS and cookies disabled so they definitely cannot track my mouse movements and I can't use this way of verifying "humanness", but what if they get rid of the regular captchas completely (based on the argument that eventually the only ones who will make use of and solve them are bots)? Then they'll basically be saying "you are a human only if you have a browser that supports these features, behave in this way, and act like every other human who does." The fact that Google is attempting to define and thus strongly normalise what is human behaviour is definitely a big red flag to me.

(Or maybe I'm really a bot, just an extremely intelligent one. :-)
I should also mention that I am not asking about defenses in particular applications, such as Tor, which does include hardcoded certs. I am more interested in everyday use while not using specialized services such as VPN clients and Tor.
Are you working directly with the providers? If you are not you are basically saying you get around their intrusion detection system in some way?

I think that's a point you should be a bit more transparent about because I'm not sure there are a lot of people who want to risk their google account being locked because of your app. We are all aware of the customer support horror stories dealing with getting your accounts re-enabled after they've been flagged.
I use http://nqhost.com/

Very affordable pricing, and these plans support FreeBSD:
http://nqhost.com/freebsd-vps.html
http://nqhost.com/unmetered-xen-vds.html
http://nqhost.com/nq-vps.html
The worst thing a country can do is piss off the intellectuals/job creators.
Anyone know what the interception proxy/tool he's using in the screenshots is? I could really have used that a few days ago
Technically legal is by definition "not fraudulent." It is their duty to their shareholders to pay the minimum tax they legally must pay.
I'm afraid discussions are perishable things.

For instance, perhaps you read a book several years ago, that I only recently picked up. Catching people in the moment, just when they're interested in that very topic has a limited time-window. Not unlike HN threads.
We keep battery consumption <1% and compress all data traffic.
Anyone know the stack they're running?
Hell, even Transferwise would be < 1%
they also used it to decode street number addresses, for street view
All the comments on here are very witty. This Wire app is only available for iOS and recent versions of Android (no joy for me on 4.1 on my obviously ANCIENT Xperia S that still functions fine), and only available for OSX. Great for me on OSX but not for my chums on Windows. Buying a Mac makes for an expensive application price, no?

But in all seriousness I recall having great IM with MSN Messenger about 15 years ago, and despite the incessant barrage of replacement apps, there is still no one leader. Sure, we now have Facetime so I can irritate my mum at all times of the day but that's no good for my brother on Windows. And I find Skype to be a massive battery hog on my laptop, and an advert-infested mess on Windows.

Is anyone else like me, and just sticking to SMS and emails? The other day on a BBC News article it mentioned "if you're a bit old fashioned and use email"... but I think email is great because you can archive it offline (I have useful emails from years ago) and it can also be used in court I think.

IM logs - are they evidence in court? All the old chat logs get tidied up from all the IM systems I come across, so there is no referring back to old messages, or a paper trail.

EDIT: I'm getting downvoted, not sure why? In all seriousness is email really broken that we need another IM system? Obviously the lack of video calling is a big problem....
That's not an excuse really, they could easily have gotten that sorted if they PayPal HQ (US I guess?) wanted to.
Why I do not know anything about how this works. I thought myself how to code but each time I see this stuff I struggle with the feeling that I can't seem to find a reasonably DIY knowledge builder for basic science branches like this.

How do you start? Help please.
Your argument fails when we see Starbucks selling expensive coffee while avoiding tax.

Starbucks does not avoid tax to give me a good deal. Starbucks avoids tax so that Starbucks can make more money.
I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.
I get that it's just republishing stuff that's already available via RSS, but an RSS feed for the site itself would be nice to have.
With price fluctuations of Bitcoin, 4% could be a pretty good deal!
How about simply banning the practice of charging for access to IP when the two corporations are wholly owned by the same parent corporation? The problem arises when one corporate entity is allowed to pose as N corporate entities trading among each other, entirely for the purpose of accounting shenanigans.

What am I missing?
How Much Does It Cost to Be Ambassador to Hungary?
A Cemetery That Showed the Way
Do I have to believe the reddit-like story in the title?
Looking at the website it looks way too professional to be something suddenly made out of the blue one day after your wife got hacked.
I agree that there is no 'superior' culture, yet standardization can result in superior overall outcomes even if point outcomes may not be optimal. Programming, construction, and manufacturing standardization are all founded on that principle.

Based on your education I'm hoping you can share your insight. I have observed that some homogeneous cultures such as Taiwan, Japan, and the Mexican Yucatan have a much higher degree of social cohesiveness and responsibility than areas with mixed cultures. Is there evidence that their homogeneity and breakdown of in/out groups plays a role?
It boggles my mind that otherwise intelligent people have a hard time grasping this simple concept. Taxes are simply another cost of doing business, especially if they are applied to whole categories.

Even if they are applied to specific companies (to favor domestic companies, for instance), then they still have largely the same effect, since they allow the domestic competitors to compete in the market inefficiently, raising prices on the consumer.
You're making the baseless (and some might say naive) assumption that it is secure to the best of their knowledge. If they really wanted to build trust then they would prove it and leave no doubt in people's minds.
Pivotal paragraph:
"We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At this point the attacker Can CSRF “almost” any request on behave of this user."

He captured a cross-site request forgery token which was valid for all users.
Apple offering PayPal Credit installment plans
> If they are not taxed, they can offer a lower price to the customers.

This assumes the owners are targeting some set return rather than pricing their products at whichever point the market can bear, which is a giant, unsubstantiated assumption.

If GM was paying an effective 5% tax rate, which was then cut to 0%, do you honestly think they would lower prices? Yes, I know the theory that Ford would get the same benefit, then lower their prices in competition, but history has repeatedly shown that this is unlikely to result in a price war. Informal collusion is fairly easy to maintain and it's unlikely that the marginal loss in sales from a 5% price premium would be enough to offset an additional 5% booked straight to profits.
> But if it can be solved, I think it would be a turning point for BTC.

Really? I find it hard to believe that the thing preventing widespread bitcoin adoption at the moment is transaction fees.
It's Burp Suite. http://www.portswigger.net/
Great idea. I am surprised so few use two-factor authentication. My bank requires it for logging in, sending money, even for going into the branch (thanks Barclays); RSA fobs or Quest Defender fobs were also used in a company I used to work for, for their VPN.

With Google, the list of massive passwords they provide for logging in via POP3 is a useful thing to print off and have secreted at your house somewhere in case your phone gets pinched.

And periodically/regularly tidying up old emails from your inbox (archiving them offline somewhere) is a way to keep the email account a bit safer, as there isn't any info in the mailbox.
I've never used Skype for anything personal, only for business communications and only when the other party required it.
This, along with regulatory challenges, has hinted to me for at least a few years now that if bitcoin has any long term future at all, it will be as an exchange currency.
I suspect you have mistakenly stumbled into a lighthearted thread with an overly serious mindset.
Along those lines, is a cross-login of any kind really ever a filter for anything? Seems like it's generally more either a huge hassle or something to make seamless login much easier for people who don't care about using their facebook login for everything.

Shouldn't the content/workflow/UX of your site be what attracts certain kinds of users and disincentivizes others?
amazing! in a python intro class now and this will definitely help with my assignments!
A while ago I would have told tou to buy "the art of electronics", and the student manual that accompanies it, and some cheap electronic test equipement and power supply and a bread board and a selection of useful components, and to then spend an hour or so each week ploughing through the book.

Today there are probably better ways.
Your analogy is not wrong, but I think university PR departments ought to be held to a higher standard too. If a university PR department issued a press release that denied anthropogenic climate change or evolution there would be an uproar. Why should it suddenly be OK to play fast-and-loose with the truth just because the topic is physics rather than biology or climate science?
"I have JS and cookies disabled"

So imagine what bots often don't have.

Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot.

So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.
There was once optimism that bitcoin would allow easy micropayments. This seems to be an issue with that, though I believe it's one that has been long recognized by those actually doing much with bitcoin.
Developer or Marketer – Who Is More Important?