skysight-inc/HackerNews huggingface dataset:
The 50k number comes from the number of people who can reach each other through the web of trust.

If you take every key uploaded to the key servers ever, then it's more like 4 million. However most of those aren't active.

TextSecure, in contrast, has vastly more users than PGP has ever had, despite being a lot newer.

Sometimes I wonder how difficult would be to sneak a sabouteur into the crypto community, who advocated for ditching proven and safe crypto tools

Sometimes I wonder if the best way to sabotage the crypto community would be to fill it with people aggressively advocating for obsolete technologies that have zero chance of any meaningful impact :)

Moxie is unusual in the strong crypto space, in that he is willing to make pragmatic engineering choices in order to ship a working product. That is why he and his team have had a lot more impact than most others have.
> (the message will only be encrypted when the pre-key can be retrieved).

The pre-key is needed when you have never talked to someone (I guess it's also needed when the last conversation is really old, I haven't dug throuh the code); it's a necessary bootstrap step. After that all you need is inside your client.

> So, my laptop is off-line, and I have access to a recipients public key. How do I encrypt my message, before moving it to a machine that's on-line for sending via smtp?

You encrypt it on your laptop, transfer the encrypted blob to your online machine and send the blob through it. All state is managed by your laptop, intermediary machines are just forwarding the message (which is merely an opaque blob at this point, possibly with a "destination" to ease routing to the recipient(s)).

> Nor does it appear to work for writing and encrypting an sms while on an air-plane

From a user pov, there is no difference between:

- I type the message and hit send, the message is encrypted now and sent when I have connectivity

- I type the message and hit send, the message is encrypted and sent when I have connectivity

The problem here will not be technical but purely UX (the software has to allow deferring encryption and sending when resources are available)

> It also carries more state around (on the "server" and on the "client") so it's not decentralized.

The little state there is on the server really doesn't sound centralized to me in that it is really simple (the server must be able to store a given list of blobs sent by the client, and the server must not send twice the same blob, ever) and a client can choose any server (there is no concept of "registration", but the client has to trust the server it will not misbehave).

The state on the client is really client-specific, it wouldn't make sense to share a client's ratchet state: as a comparison you wouldn't share the current bucket list of your DHT client with other machines because it doesn't make sense, you would rebuild it from scratch on another machine. Effectively this means every device of yours is considered another independent "peer".

I think it's important at this point to say that this mechanism is the Axolotl ratchet (more details here: https://github.com/trevp/axolotl/wiki). It only describes how to exchange encrypted messages between two DH keys, asynchronously, and with forward secrecy. It doesn't care about :

- what is the relationship between DH keys ("should I encrypt to 2 DH keys because they belong to the same user ?")

- how do get someone's key, and is it the good one (the key distribution management)

- how can I have a coherent message history between my phone and my computer

These are all real problems that TextSecure aims to solve, but they're a whole another thing.
I would love GF to have a feature where you select a departure airport and arrival airport and dates, and make GF find me where to go in between. Like a search with multiple cities but so that you decide the departure city of the first flight and the arrival city of the second flight.
A team 10x4 has all sorts of problems beyond pair programming.
PCF8574 FTW!
All I see is

> This is a modern website which will require Javascript to work.
> Please turn it on!

That is simply not acceptable and is both poor etiquette and bad practice.
Yup, Hamilton Heights in fact. Price per square foot as a function of latitude is a pretty flat curve for a long distance north of 125th, so there's no reason to go into the extra deep boonies to save money. I was on 139th on the West side.
Good Article, Thanks.
If I had to guess, they were buying the flavoring from a third party, and the third party refused to disclose what was in their product to Soylent. In the U.S., for certain items all you have to disclose is either "Natural Flavors" or "Artificial Flavors". So it's not that food regulations prevent the ingredients from being shared, it's that they don't force you to share.
Rarely, as it will feed empty data. It doesn't deny permissions.
But that just says that it is legal according to the BATFE - you can't use a tool to manufacture firearms unlicensed (or in this grey area, to complete someone's 80% receiver for them). That's a legitimate interpretation of an existing law - they're just saying you can't set up a service to finish up lowers for people - they define that as manufacturing. They'd change their tune if the smith was licensed to manufacture and added serial numbers.

I'm unaware of anything that regulates machinery used to make guns, which until about a year ago, was general purpose machine tools (and still is for practical purposes - these Ghostgunner things are political art, not machine tools). I think people WANT to be able to say "that's illegal, or it might be". But it's just not. Not yet. (as far as I know, I can be convinced if someone shows me a law).

I won't argue that the BATFE hasn't done illegal things in the past, and probably will in the future, but as far as I can tell, this is pretty black and white.
> About 95% of all mobile devices already support WebSQL

Yes, they are embedding SQLite. That's not a standard, it's a hack.

> The only missing browsers are IE 11 and Firefox/FirefoxOS

Which is why I'm glad they are still relevant.
The article mentions that the event was possibly recorded in the form of petroglyphs[1]. I think that's a fascinating idea, and it reminded me of Dr. Anthony Peratt's[2] research on the recording of prehistoric auroral events, also in the form of petroglyphs[3].

[1] http://en.wikipedia.org/wiki/SN_1006#cite_note-napetro-5

[2] http://en.wikipedia.org/wiki/Anthony_Peratt

[3] http://plasmauniverse.info/downloadsCosmo/PerattTPSv31-2003c...
If no one's taken you up on that, here's a message for you:

-----BEGIN PGP MESSAGE-----
Version: Keybase OpenPGP v2.0.7
Comment: https://keybase.io/crypto

wcFMA5S7hsT55Ka3AQ/+K3YTd9aLF70PcDuDzUSBwt42I4UJdASvSzU9ljJZhxmh
xn/XgzfuPVEqi75jhI20SfKJetR867leishDNU/XrynFCyJcr0ax6Q6BQes/w94d
ErmBchxcYwFumB0i0tWMygmCUKgpL7W5bC26gB4AUdoPhhdJQnHYwiLvEv+e1G6I
wFEA2/WzJlB+K+4v782zF7RhZaTA6OXl0noL6Nsoi2V/yufD5qKVnolx3RSHzdTd
1bSdS7lTCIQzvDmuLYvkophBL6Vb6Qa8IdwkLVxt+akr/W4oOxLaEE14HxS05OTO
bN0R5yXzNNI7RWfU4cB3JKUMSKLGB4cBf+jEj1WyGCm04/9I1XgnNqFULE4RfHwG
t8mqS1oeetfKlrzEx7NkXVn7mvITiYUzeH+M/DaTlnp5+Nb1FgQK1U54emIgEpmR
qaG9JYDxZBtmBQ2gb3RtXndZFWQh7YifqaDFsUkJl4cdjXZ69WccvFRr+Vr3Ow1O
m19lrHAFj4XZtsS9C1PNBejpdcfANoWjG+9Eitd6iliAo4nCG9jUi/6mIWRuamcs
OS2uAAWMe1ZrfhwwU/x2+/QM6eGKU43DBLy9lmyFj2UgZKW1UokQg7iAp3Wd0f+Z
SBEXNFsM3rPoYVb29boUcJtkA4CpArH36kIBv45A9u1c14uTUVRreGeLe1pqrsXB
wEwD5S1urhQzgBEBCACk1jR8gIaMRKCsl7ofIjGr8PrrOYVCkNtpWjGsNnq+SFkG
SUUekwzB0MfRVSdrkfVk/7Axrm0YGWqW9v12aNrrRLe8Vs/VJU9r2RRBgI164YbI
UDxlGBJZhNnG1BxPVt1en1nH9ceEw4yq15giSxRMOhtlmpdv6Y0HIWzhnAb+Hc68
rxFq74j2wEfkHkIYJV7cOZtXy9WF0WHVgi0wIyiDHvV84KTO5HUv2qA1uJiqt3UU
phq+lmFr3DzH7mcz2vLBW8r1AeFOd9VtRNVPkLEaVIjlCPGTYgr0hCfUX+JSf6PN
1VSRdogjcBu5Cqui60Fz9RKQvPCpX0NAUJpEZ30H0sEQATqCbZ/PF7nEqVHAOoH4
FK+Q6cR4+8iArPnUjr0lP0KWaQDJBghbYqQ8aUX37NUJaih7wae1b5WyBBCtwilI
GowCJXwiD0kd7xUns61MhNDSn2K2ZPifHptJcv5QvODLkoJSHP4ylqCa9SrzyFNR
gpRk3I31NIxZd7M5PT8fepQ75qTOgZ/v8ZTEd0HbPpjjRNJ3hMtIo7nmzPk54aD7
182jBWbXhiYiTTYEExnGwq+uDHoQjtGGBQzJegqeNex/q3Ba7Lf5RCbfFXQy3aDj
JGRY6rZCQFbtcym2fjxeT9lRmHHeXA400zeLXgbqmmAKAcQwBtQQIF4Cg/cDNItN
6o5Jov0+pAm/NKKRWIXGJErGXsi0iTqJyl0anasbrQH6dnEXNbbMslIOtDl9CtKR
N5Y+x+vJJKsOQaT6dJmQHZ19RxW4tickEr6zEu6IhB8ooMGMAjdq+tpRAF4+qKyK
/yWUTIpp14deORe3aK7Hu0mA6H9dxDfwNwvat3Iv8R7YbsILdp7sFBPBlVLRLoBp
BlYe7Eqroe7dCLg+v9Uw3Hpbu0yp3/BY64H3Qj9f7X3HQ+6nHQ0oQNS6XcwvJnKo
JTV8lO263q0P7+Pti05SSs4=
=gLgR
-----END PGP MESSAGE-----
Ask HN: Tax advice for transfer pricing?
I run a Canadian Corp and a US LLC (pass through entity). I'm a US citizen. The LLC owns the software, and licenses it in turn to the Canco.

I'm filing my year ends and just made a transfer from Canco to USA for its annual license fee. I want to account for this properly tax-wise. I am assuming this requires more reporting than an everyday expense. Since I can't be an employee, and this is a legit licensing expense, I use this as the primary way to move profits to home.

International tax accountants and lawyers are outside my price range. Whatever you say here I completely understand is not to be taken as legal advice. I just want to cover my bases the best I can.

For doing this all myself, I think I'm doing OK. I've done the FBAR banking declarations, IRS Form 5471 (yet to hear back...), letter to maintain records outside Canada... and the legal entities are all properly balanced accounting wise in Xero.

Looking for any gotchas some smart people here might be able to point out.

Thank you

-----
If anyone is wondering why I am incorporated in Canada - it's because I do a lot of merchant processing aggregation so I need a banking/legal presence.
In my experience, rental cars are commodities. I search on their websites for the lowest price and go with that. On my last 4 trips I have used all four of Avis, Hertz, National, and Enterprise.

If they're trying to build a brand, they suck at it.

(I guess that what they have managed to do is distinguish themselves from no-name budget operators...I wouldn't really consider going with a rental car I haven't heard of, even if it's mentioned in the press. But then, that's validating the original article's point, first-mover advantage is immensely important, and no amount of spending is changing that.)
"It was only embraced because the web had literally no was to programaticly download assets before that."

Exactly. The version of the DnD API implemented by Microsoft for the most part wasn't that great either (did Microsoft catch up with what other browser vendors provide these days yet?). But at least they did something and they let it be standardized without any patent claims. We had these problems and Microsoft came up with solutions. Of course you want to use XMLHttpRequest2 or WebSockets and you want to use the dataTransfer object with mime types and the FileReader API. But Microsoft at least initiated that development.

Now that almost sounds like I'm a Microsoft fan boy. I'm not. I use Linux. Couldn't stand to use Windows. But I think one should give credit where credit is due.
"We need to bring end-to-end latency down to below one millisecond"

The incredible bandwidth is surely great but they don't mention how to improve latency here, they forget to tell what was the latency of this 100m transfer from an antenna to a receiver.

One of the big issues with today apps is latency, this is easily frustrating. It also prevents apps such as real time multiplayer games to be viable.
Overcoming barriers to adoption of network functions virtualization
When it comes down to it, n-tier, SOA, and microservices are all expressions of the same basic ideas.
Quick and dirty, but this does the trick I think: https://gist.github.com/benshimmin/4bd6bb9cb8733a6acba7
Never having lived in the snow, this concept was new to me. It lead me to this terrible article[1] which says the same thing in each of it's four paragraphs(!), but linked to this article[2] which has a better description of the cultural phenomenon, including some light flamewarring in the comments...

[1]http://www.wbur.org/2015/02/23/space-saver-enforcement
[2]http://www.wbur.org/2015/01/28/space-savers-boston
It's amazing that a big studio like EA has allowed a single developer to maintain such a stranglehold over one of their largest franchises for so long. It makes you wonder how often they quietly call meetings behind his back that are solely focused on replacing the mad scientist.
Sort of irrelevant if it is inevitable and can't be controlled, no? It's an interesting topic, and again, goes well beyond arms. I'm not saying what I think of it one way or the other, just describing the philosophy of the guys behind this.
Where else would the key be?
The decryption happens server-side - the server is the sole holder of encryption keys. Besides, it is the server that generated that ciphertext in the first place, so it already had access to the secret at that point.
I'm relating my experience working in a pair-programming fashion with co-workers. I have talked to others (and seen articles on this very site) which re-enforce my experiences as the norm.

As with all things, individual experience will vary, but this doesn't seem to be a case where the collective experience is positive once the knowledge transfer between pairs plateaus.
This was the comment that started the thread you're posting in. You might want to go back and reread the conversation that preceded your comment.
Look into Event Sourcing and CQRS.

It explains how to manage situations like this.
Lytro raises $50M to shift from still cameras to virtual reality
Very cool!

"DonglePi is released under a dual license. It is GPL for educational and personal use.

It is under a commercial license if you want to produce it and sell it."

Hm.

Am I right in thinking that it doesn't work like this? You can dual license, but you can't say "only some people using it certain (educational, noncommercial) ways may choose the GPL version".

I'm also not sure how good a fit the GPL is for hardware designs. Seems like it might be better to GPL the software, then CC-noncommercial the hardware side, with an option to pay for a commercial license.

(but of course IANAL)

Anyway, this is such a good idea and such an obvious candidate for Kickstarter that I'm surprised to see it on Github first.

[EDIT] grammar
Sorry, I'm a retired Marine, I just cut to the chase, it did wonders for my military / civilian career.

Congratulations on your retirement at 31 as tech recruiter, you surely are one in a million!

Like I said burning bridges with recruiters that have a shelf life 7 1/2 months, I'm okay with. I am more than comfortable that in your tenure as a recruiter you sucked in your pride to get that fat commission check.

As for your offer to teach, I am okay thanks, I don't need to downgrade my knowledge.

Cheers.
Enforced modularity in languages has downsides, like basically killing the flexibility in system construction. Not every image produced is an application program running over an operating system.
Sometimes you just need one fresh set of eyes to help improve conversion rates
How hard would it be to add support for RubyGems certs being added to keybase? I’d love to publish the public cert somewhere without putting it in each repo.
No, it is you who is reading a Popish view into it. My judgement is based on informed comparison with countries like Spain and Portugal, and Bohemia, which either never attempted such separation or failed in it - and their relative importance compared to the British Empire.
>You can find a list of Bitcoin script shortcomings in the Ethereum whitepaper and Ethereum Design Rationale document.

Ah, Ethereum, the ultimate crypto-currency vaporware. When did vbuterin announce it, over a year ago now?

There's a reason the Bitcoin script is simple; because it does everything we want Bitcoin to do (facilitate economic transactions) and it's simple enough that we can be sure it works properly.

If Ethereum actually releases, I'll take that into consideration for my judgement of more complex script schemes.

Yes, Bitcoin is "single-token". What's the downside of this? Why do I care if I need an external registry for non-standard tokens? For tokens to have any effect in the real world (e.g. economic value), you need some form of "external asset registry" no matter what. In most cases, this comes in the form of the seller passing judgement on the value of the token.
> The community asks that you acquire some experience, work with what is there, make sure that you understand it, then suggest improvements.

So what is it that you think people who want Go to have generics don't understand? You say that people should acquire some experience before criticizing Go, but you're only accepting a certain kind of experience. I've written tens of thousands of lines of code in similar languages without generics, and tens of thousands of lines of code in similar languages with generics, and there is no question which I would rather write. I have written a number of compilers and am well aware of the concerns and how to implement a performant compiler. Why is that experience not something you value?

You're basically creating a chicken and egg problem: people who like Go will use it, and people who don't like Go won't, and what you're saying is that the latter won't be allowed to criticize Go. But people who don't like Go are the only ones who are going to ever criticize Go. And criticism is what anything needs to not suck.

Don't talk to me about "acquiring experience" as an excuse to discard any experience that comes from outside your community. My core complaint about Go: the authors simply have ignored decades of compiler research. By deciding that only users of Go can criticize Go, you're deciding to only take feedback from people who would use Go, and the only people who would use Go are people who aren't aware of the last few decades of compiler research: people who think coroutines are a new idea and aren't sure whether generics are useful.

As an outsider to the community, I wouldn't care if Go is crappy, except that I work in this industry, and if Go becomes popular enough, a situation will arise where I have to use Go or a language that imitates Go, or turn down a job because of it. Go being terrible and popular means that it affects the whole software industry negatively.

Also, arguing that I need more Go experience to criticize Go is somewhat ridiculous in response to an article which says, "Being an advocate is not really a separate stage, but a role you can fill at any of the other stages." So you need Go experience to criticize Go, but you don't need Go experience to advocate for it? This is why I assert that Go's popularity is mostly hype.
Out of curiosity, why would you characterize avoiding Yahoo! as a right gamble? Were they in a really tumultuous period at the time? While not particularly hip, they're still probably the hugest company to survive the dot-com bubble.
Schneier addresses that later in his essay:

And third, the remainder of the NSA needs to be rebalanced so COMSEC (communications security) has priority over SIGINT (signals intelligence). Instead of working to deliberately weaken security for everyone, the NSA should work to improve security for everyone.
My point is that this attitude of "only people who have proven themselves as cryptography geniuses may dare to think about thinking about cryptographic protocols" also discourages the potential UX/UI/workflow/etc. programmers from participating, since it gives the impression that their contributions will never be "good enough" to be accepted. It also discourages potential developers of the crypto algorithms and protocols themselves from participating, even if they have gone through the (in your opinion) requisite experience of learning how to break existing cryptosystems, because of the fear that they'll just be burned at the stake by the rabid likes of Hacker News and Slashdot for daring to suggest anything new (these are the sorts of cryptographic programmers I'm talking about, not some "badass rockstar ninja" Macbook-toting YCombinator-funded Ruby.js hipsters manufactured in the heart of Silicon Valley like you seem to be implying).

This results in things like GnuPG being considered hard to use. This results in things like GnuPG struggling along with a single core developer and barely enough funding to support that developer (even now). This results in things like OpenSSL being horribly undermaintained, to the point where nasty bugs like Heartbleed are allowed to exist longer than they should because there is an insufficient quantity of eyeballs to find them and squish them. It doesn't take a rocket surgeon or a cryptographic guru to see that this is nothing but an awful situation for pretty much everyone involved.
Much what now?
Watch it play:

http://www.nature.com/nature/journal/v518/n7540/extref/natur...

http://www.nature.com/nature/journal/v518/n7540/extref/natur...
You don't HAVE to live in an eventually consistent world. If you use something like ZeroMQ or use REST then you can "notify" other services of a "person deleted" event in a synchronous manner.
Except that they completely ruined the sound there in order to protect the houses that got built too close to it.
It's raised $50 million in funding in a round led by GSV Capital
that bumps the company's valuation 5x. At the same time, Lytro
is cutting 25 to 50 jobs from its current roster of 130.

Neat trick, to grow the valuation while pivoting and laying off a third of staff.
Not mine but there's contact info at the bottom of their page http://genopharmix.com/TuataraSum/medium_ref.html
http://thenextweb.com/insider/2015/02/25/lenovos-website-was...
Getable Gets $5M to Help Contractors Rent Construction Equipment
Going Beyond PGP
Lollipop already added profiles. No reason you couldn't have a profile per app.
You're completely delusional
"even if they're jerks?" the social-justice-on-social-media movement is a platform to publicly stone people who step out of line, not a vehicle for change. you fuck up and say something "problematic" or "harmful" on twitter just once and as soon as it's mentioned by a social justice person, everyone will try to destroy you because you're now "the enemy".

if you're a white male the best thing you can do is shut the fuck up and watch because you are literally only in the movement to get ripped apart. none of these people have any respect for you in the first place. the currency of the social justice movement is being institutionally oppressed. more oppression directly gives you more authority. you have none.

moreover, the fundamental currency of human self-esteem is in overcoming adversity. but as a white male, you will never be allowed to have a struggle. and if your struggle is denied, then your humanity is denied. you're here to play the role of the oppressor and the privileged. don't think you're a "fellow member" of the social justice movement. everyone already hates you.
An isolating transformer, like the ADUM3160 ( http://www.analog.com/en/products/interface-isolation/isolat...) should be more than overkill in protecting there.
Ask HN: review my startup: www.kojai.tv
I just launched my very first production website and would appreciate any feedback on it.
The concerns about AGI are very real and none of these comments address any of the arguments made about them. I feel like someone in the 1930's trying to warn people about nuclear weapons. Everyone automatically assumes it's absurd and can't happen, that it's fear mongering etc.

Fortunately nuclear weapons didn't destroy the world, but AI almost certainly will. No amount of smarthphone apps or genetic engineering is going to make humans anywhere near the level of superintelligent machines.
Typo has been fixed, thanks for reporting.
You seem to think that Henry VIII staying married to Catherine of Aragon is but one step removed from Francisco Franco and Mussolini? Now there is some Protestant Anglo centrism!
BTW, the Spanish Empire did manage to convert quite a few more people to Catholicism than the British did to their reformed religion.
Agreed, but the more problematic assumption is that the Poisson rate function is time homogeneous is what I'm saying.
YouTube Drops a Bomb on YouTubers