skysight-inc/HackerNews huggingface dataset:
The Phuctor operates by taking the greatest common divisor of the RSA modulus of a new PGP key with the product of other keys in its set. The factor that was found was 231. This is a result of bad prime generation, or a bad random number generator, not a advance in factoring technology.
What strawman? You supported the idea of detaining people on any suspicion. I suggested that there's no point in going down that road because anyone could be a threat anywhere.

Sure, sometimes someone is suspicious because he's actually up to no good. But that doesn't mean detaining people on various subjective suspicions is a good idea.
Exactly. The GPG that generated that keypair was obviously not doing what it was supposed to do.

It can be something on the level of the famous Debian patch fiasco.

The worrying thing is that nobody until now published such findings.

The second found p is 21(!?)

Edit: see the new post from agwa, if all the keys with bad properties came the same way it's much less worrying.
Text_0.txt – tezcatloicloud.com
Tell a Story with Your Startup Marketing
Yes you can, we just need to find hpa's n value and see whether it is divisible by 231. If it is, the claim is correct.

I found the n value for my own PGP public key before and I can find hpa's too, I just have to remember the right arguments to gpg.
you can trivially verify a key was broken if it was, duh, broken
For hyper environments like SV, probably because there is a shortage of hyper individuals in the general population.

For more general environments, it's probably not a shortage of engineers, just a shortage of engineers who will enthusiastically work at the rates that employers would prefer to pay.
If you can get 11.3% per year on your investments forever, spending anything on anything is going to look foolish: just wait a few hundred years and you will have more money than the US GDP, which only grows at 2-3%.

If you do want to enjoy an espresso, I will point out that coffee is considered "food for office" and is a 100% deductible business expense.
Eh, the last time any single party got the majority of the popular vote was the 1931 general election — and then a coalition National Government was formed regardless. The last time the Government got the majority of the popular vote was 2010, and before that Churchill's wartime coalition.

The Tories got a larger proportion of the total vote than Labour did in 2005 (35.2%), and I don't remember hearing much uproar about that.
Salix arctica – Arctic Willow
Is there any way to get GPG to print out the two factors when the key is generated? 231 is absurd.
This is not the first time low quality keys have been produced. I'm thinking of https://www.debian.org/security/2008/dsa-1571. Seems like quality control is a bigger problem than we would like to admit.
Ok, that is an awesome web site.
In the army battle field tactical communication are handle by streaming ciphers on the radio. The idea is not to be impossible to breach. But strong enough that time is on your side, so that you can say "move those tanks over to feature 229", and that will be tactically perishable information.
on the internet, i would treat all information the same. if they can't break it today, they will wait until they have the math or the raw power to break what you have encrypted. so only talk about what doesn't matter if someone finds out about it.

like, hey lets meet up here at time x. in two days that means nothing significant.

but anyway, first step is getting an old mobile without data.
From http://nosuchlabs.com/theory

An RSA public key consists of a modulus n and an exponent e. Modulus n is a product of two large primes, p and q. If one knows p or q, one can derive the private key corresponding to the given public key.

A typical GPG public key contains one or more RSA moduli, depending on the number of sub-keys.

Under certain conditions, a public key modulus will share a common factor with an existing modulus belonging to someone else. This may happen if both keys were generated on a system with a thoroughly-broken entropy source, or if a particular GPG implementation has been back-doored.
You know that in RSA the modulus n is effectively your public key, right? And that n = p * q, where p and q are essential parts of your private key?

So if you can factor n into the corresponding primes, you have just cracked the person's private key.

Implications? You can decrypt all RSA encrypted messages for that private key. You can IMPERSONATE the person whose private key you have cracked. (Signature = data encrypted with private key that can be verified with the public key.)

All encrypted messages sent to the compromised keys must be treated as leaked. All signatures made by the compromised keys are suspect.

It's as bad as it gets for the individuals in question.
I think this is an uncharitable reading of the page. rms' stance doesn't ignore the concerns of people, because it isn't a proclamation telling how people should live; it's just a description of how he lives.

The only parts that proscribe are the sections about DRM, and even those are not "you should sacrifice yourself to oppose DRM" but "only buy DRMed content if you can break it", which is more a personal advice than a moral commandment.

In general, rms doesn't tell software users they are bad people for using proprietary software or for allowing tracking; he's just alerting people about the dangers of doing so. His criticisms are usually solely directed at software producers and at the organizations that track people.
I'll take the algorithms any day of the week. The sooner we remove assholes from administering the law, the better.
Cryptographic Data Structures
The question is too general. There are shortage for certain requirements of engineer. For example experienced engineer to build self driving car is in shortage, or engineer understand high speed trading.

I don't think there is a shortage for engineer without much real world experiences.
Perhaps it's to do with the fact that these particular bamboo species are monocarpic, i.e. in one life-cycle they set seed just once and then die. So the timing of this event is more crucial for their reproductive success than for typical trees (which are polycarpic and not grasses).
> And the first factor - get a load of this - is 231. Which... yes, 231 = 3 * 77.

Why isn't the first factor just 3 then?
Why Japanese Toilets Are Failing in America (2013)
If you haven't started it yet, I say don't. I am effectively addicted to caffeine and while it has its purposes it isn't a good think. In the past, every few months I'd stop drinking all caffeine for 1-2 months then I'd slowly wind up starting to drink it again. I haven't done this in the past year, which has sucked.

You can be highly functional and productive without caffeine. Taking a nap and getting better sleep is far better then being addicted to coffee or pop.
The web experience is optimised for the average user, who typically prioritises features over privacy, aesthetics over performance, and ability-to-use over ability-to-customise. Your priorities may be different, but you can run your own website which does meet your priorities, and even a search engine of websites of which you 'approve'.

_THAT_ is the beauty of the web.
I generally agree with this reasoning. You'll notice each member of society had their ability to contribute go up by 2 units. So the overall gain was 20 units, and the overall loss was 10 units, for a net gain of 10 units of "ability to contribute".
Author of 'phuctor' speaking. We did not break RSA! Please put that Luger down, unload it. You have things to live for!

We only found (at the time of this writing) two sets of two poor buggers each who happened to have generated RSA keys having a common factor.
You paraprased the definition of squared error but didn't say why it makes sense.
> Thus, optimizing utilization through improved container scheduling is something that the core site reliability engineering team could do independently of individual services.

But is that something it is known they prioritized, or was there perhaps more interest in optimizing the efficiency of deploying thousands of containers on every deploy, across data centers, with reliable testing, without killing in flight processing, and scaling for subsecond response to bursty demand? Who sets the priorities for what is most important, and how much of one they're willing to sacrifice to improve physical utilization?

I have absolutely no doubt they had as many resources as any other company dedicated to finely tuning their data centers and related infrastructure. I question whether they had the same motivation as a company like Amazon (who was deriving direct profit from selling this resource) to prioritize the optimization of utilization.
Yes:

817023023960376946633975507110154649249407598806798730414849884461776172171921668594148071323527016137506405823108520062504849249423700259406905313281403901410082762097159560221463048924336192384026777502177262731045200322200149773127502888545234973139480887644585192600631058962876114156934248895171959246969597637127280010272143593885240940877456234662196130491400738438731832514335353824697930453078426722191105157568392826870043655708008545411143367763836566011740499383456592129662585004880376777597714978023542434421914201119537685489173509942329090631662014650033142642110914360849421856179611226450806562235534802516081595259914768497444702718749402330070488028751073730349460752771915484847399385631524708487646079936572410398967582895983187640798072309362094727654167628620105981459021548290415800096769214437425690934372015628796027498219902441288189398386359846661623243493534897411417685435424010451956954083531228374002591372549525280610594684910812811287436481207089763125424247793044043309737269468709710679872269272855389945385386467765509880648929743498214329578288874987193768439353382305260108425688024147656806932474058888992099083804597481699305852902662863062054067183925164590726103552998367994727700722491707 `mod` 231
0
This isnot really new work, see eg https://eprint.iacr.org/2012/064.pdf (and http://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf if you're interested in other RSA weaknesses)
I never understood many people's fixation with avoiding long functions/methods. I would much rather have that hook check long call stacks. I have never went "wtf" as I dove into a new code base because of long functions, but I do it all the time when five levels of inheritance is used to provide all the magic necessary to "shield" me from whatever the code is actually doing.
Source for this? I use Chocolatey on Win7 and haven't had anything unwanted installed. No Ask Toolbar (from multiple JRE and JDK installs), etc.
ublock shows it clearly. Ghostery seems to whitelist GA these days?
probably being a 34 years old ceo sucks. :) that looks at things a lot differently. and have to deal with things which people call it 'shit happens'. I am only rejoicing when it does not. and it's very rare.

copyright act is entirely and solely built around 'consumer confusion'. anyway ;) there is apple bank https://www.applebank.com/ with apple in their logo too ;) but a slight resemblance in design language resulted in 1 billion fine to samsung. reason., former does not cause consumer confusion and the later did or tried to steal the thunder immorally.

and i did mention, project is cool. it's bookmarked in the same folder where i have hackernews ;)

but generally i tend not to like anything that tries to steal the thunder immorally... in this case, if the OP tries to monetize this app with the same domain name, it would be immoral and would delete it from my bookmarks.
> all the captchas I have to solve because of Tor

Do you see those when posting from your current account? If so, I'm not sure we have this right. There are hurdles on new accounts to impede spammers and trolls, but we don't mean to make things harder for established users.

If you wouldn't mind, sending details of what you're experiencing to hn@ycombinator.com would be helpful. We'll look into it and maybe adjust how this works.
There's a concept of "social prescribing" being developed. So, if you need to go to a gym a doctor will give you a prescription which gives you cheaper access to a gym.

There are a bunch of organisations to provide "vocational services" for people with mental health problems. Vocational services doesn't just mean work based activity, it involves social and sports and etc stuff too. This used to be "day services" and was provided in sub-optimal ways. Usually it'd be in a room in a hospital or other mental health building, and there would be strict segregation so no members of the general community would use the room and people with a MH problem wouldn't use rooms in the wider community. There was little concept of progression or push.

The Sainsbury Centre for Mental Health did a great report and so now day services are better - although still no where near good enough.

My local area has "People and Places". They have a large allotment in a normal allotments place. They grow fruit and veg and flowers with other gardening work.

There's also the Independence Trust which run a variety of different groups and sign post to other groups.

Both these groups work with people at most stages of illness (not while they're detained under section in hospital, but pretty much everything else) and they can tailor the work to what the people feel able to do.

http://www.independencetrust.co.uk/

http://www.peopleandplacesglos.co.uk/
I never had a chance to interact with him but I share the same feeling. I'm probably too an old fool but I really liked YUM.
> like, hey lets meet up here at time x. in two days
> that means nothing significant.

It might still be significant in the far future that you have met a particular person on May, 19th 2015!
Using millions of online photos together, we can now watch history unfold
Author of 'phuctor' speaking.

I can only confirm that we have a key, downloaded from an SKS dump, said key purporting to belong to one Mr. Anvin, containing one sub-key being an RSA public key which turned out to be factorable with trivial effort.

Anything else is mere conjecture.
Thia sounds like lampposting -- closing a model because the math is nice, not because it is an accurate model.
> Getting Python on something like an AVR or PIC18, that would be far more interesting...

Are you sure it would be more interesting? We have people asking (and working!) for more ARM, MIPS ports, but nobody ever asked about AVR port, so maybe it's not that interesting, even though ATmega2560 should be able to fit it. No ATtiny or PIC18 ports on the horizon, sorry ;-), but PIC24 port exists.

Anyway, if you'd like to see MicroPython run on smaller devices, please consider contributing to the project - we love optimization freaks ;-). Current minimal requirements are 128K flash (50K for your code), 8K RAM.
It's: gpg --list-key --with-key-data <id>
Isn't nginx written in C?
RSA is not broken per se. (AFAIK) If you have a 4096-bit key, nobody is able to factor a 4096-number yet.

However, using a bad random prime generator might lead to birthday attack when someone is using the same prime as you. Having two keys that share a prime, it is possible to factor both.

Also, one of the "primes" used is 231, which is extremely stupid, its factors 3711, so there are two keys that are using the same non-prime number as one of "prime" factors for the key. And one of its factors is motherfucking second prime.

I suspect it's a backdoor or a blatant error in RSA key generator or prime checker.
When you use factoring algorithms other than simple trial division - things like Pollard rho and its ilk - you are not guaranteed to get the smallest factor(s) first. Sometimes you get bigger factors, or combinations of factors, because those are what happen to pop out of the algebraic structure you're running over.

But any "primes" being used should have some serious factorisation algorithms run over them before being used, so this is really embarrassing.

EDIT

And to answer contravariant's question[0]:

Also, shouldn't it only
have 2 prime factors?

It's possible that one of the "primes" it found was in fact composite, and it's that "prime" that has these factors. So you generate two large primes and multiply them together, not realising that one of your "primes" wasn't.

[0] https://news.ycombinator.com/item?id=9561051
Is the origin of the keys and why they're broken in this way known? Perhaps they were generated on embedded devices and their demise could be traced back to an early boot time entropy problem.
https://eprint.iacr.org/2012/064.pdf

https://factorable.net/weakkeys12.extended.pdf
We think properly created RSA keys couldn't possibly have such tiny factors because they were created by sophisticated algorithms, presumably would be two very large primes, and yet... this happens.

Dumb-and-stupid trial division by the first 1000 or so primes wouldn't take much time and could've easily caught this. I see this as a nice precautionary tale that we may sometimes think too highly of sophisticated algorithms that we trust them blindly, and miss looking for the bloody obvious. It's like an "is it plugged in?" sort of thing.

If I deliberately generated a public key that was divisible by 3, I wonder how long it would take for someone to notice...

I also entertain the (admittedly very slim) possibility that he did this deliberately to see what would happen.
Interesting, I'm not sure it's worse than your experience. I was pretty well equipped to discount the advice of a therapist pushing prayer and weird conspiracy theories. On the other hand, your therapist was an authority on mental health who was actually confirming some of the negative thoughts that depressed people often have. That would be a lot harder to defend against.
Here's the section of legislation in question.

http://www.legislation.gov.uk/ukpga/2015/9/section/44/prospe...

Specifically it turns

Section 1(1) [Unauthorized access offence definition] above has effect without prejudice to the operation—
(a)in England and Wales of any enactment relating to powers of inspection, search or seizure; and [...]

into

Sections 1 to 3A [Unauthorized access / access with a view to further offences / access with intent to impair / making or supplying artefacts to enable the above] have effect without prejudice to the operation—
(a)in England and Wales of any enactment relating to powers of inspection, search or seizure or of any other enactment by virtue of which the conduct in question is authorised or required ; and [...]

The governments position is that this change (I believe this is the right one anyway) gives ordinary rank-and-file GCHQ officers immunity from hacking offences because their conduct will be 'authorized' (by the government) and 'required' (to protect us from the Bad Guys). Previously what was permissible under the Act could be construed to be tighter than what GCHQ were doing - were they only inspecting searching and seizing? Certainly before the Act didn't give them explicit immunity from the later offences such as intent to impair the system.

Side note 1: Enactment is defined in a legal sense, to mean pretty much any legislation. I'm unusure as to whther the definition it provides allows for e.g. Statutory Instruments (which rarely have any debate in Parliament) to also be covered under the definition.

Side note 2: It also makes the same changes to Scotland, which for legal reasons, tends to get called out in separate subsections with minor variation on the wording if the Act applies at all.

Obviously, IANAL.
Not known to me.
Wait a minute, I get a different n value by downloading that key and running gpg --list-keys --with-key-data on it.

You have one ending in 131307671292149646652772992033083 and I have one ending in 726103552998367994727700722491707 that is not divisible by 231.
Neither the movie nor the code was amazing.
Disappointing movie and a simple price of python code.
Was about to ask the same question. I was thinking the ground shifted over the years or something.
The key as seen by Phuctor had three sub-keys, one of which was an RSA key which turned out to be factorable.
Not to complain, but help. It looks bad on my android chrome
Best motivational video
> I have met a number of people who have depression and it's usually the same story - being very defensive about whatever the root cause might be and if you probe them, they'll clamp up. It's almost like it hurts too much to admit that you are not ok.

There often isn't a root cause for depression. Asking people why they're depressed can feel like you're judging them - "What have you got to be depressed about?"
Jeff's Jump [Android app]
Wikileaks releases BND-NSA inquiry transcripts of 'unclassified sessions'
Syntax isn't really the problem, given that one could easily write a wrapper around pacman, or apt-get, or dnf/zypper (at least for the subset of common operations supported by all). The problem with pacman as a package manager is that it simply does not have the features needed by fedora or debian. With the infrastructure given by Arch there is basically no way to have automated upgrades without potentially breaking the system. The same goes for the AUR: it's great when you know that the user is reading the script and making sure it's not malicious: it's not a model that scales for server (just like FreeBSD ports do not cut it if you have lots of machines), or if you imagine 10% of the computer running Arch (malware bonanza). Still, automating apt-get is messy (and here dnf/zypper do a better job) and building .deb packages and setting up your own repo is too complicated.
Yes, we can take preventable diseases as an example instead, if you prefer.
Yeah, we can agree that utility is non-linear. What we haven't established yet is: "so what?" :)

> I think it's a fair question, but it seems hypocritical to ask immediately after asking: "why would anyone else have the right to decide how their property is allocated or used".

Why would it be hypocritical? I'm not advocating for someone else using your property, nor for helping some through harming others.

> However, every study I've seen done on this issue has shown that unconditional cash transfers to impoverished people tends to be used reasonably well[1]

Didn't we already conclude that evidence is really quite meaningless in this discussion? It's not difficult to find statistics and articles to support the idea of redistribution.

It is difficult, however, to explain why anyone's money should be "redistributed" away from him, considering it's his property. If a rich person's kid has a shitload of Lego bricks, should some of them be taken away from him to be redistributed to poor people's kids?

> Certainly there will be some people who choose not to use redistributed income well, just as there are some people who have lots of capital who choose not to use their income well.

What does it mean to use one's income well? Who decides if my use of my income is acceptable? Why would anyone be in a position to decide that for me?

If I want to buy my seventh Ford Fiesta because it will bring me immense joy, can you claim I'm not using my capital or income well?

> This one you'll have to take up with the Supreme Court, Congress, the United States Treasury, and the Internal Revenue Service who all take it as a given that the United States Government has the right to decide how your property is allocated or used.

Well no, I don't "have" to, and that would be roughly as worthwhile as writing to your representative, asking not to get shafted by SOPA/CISPA/PIPA/NDAA/PATRIOT ACT/etc.

Instead, I brought it up with you, as part of OUR discussion here, which you're perfectly capable of continuing by answering my question.

Here's a related video though: https://www.youtube.com/watch?v=ngpsJKQR_ZE
But s much smaller few knew specifically what they were building.

And communication tech was much less efficient then.