This is the interest on the bond, and the Fed sells these Treasurys to the public in order to raise money on an interim basis.

Effectively, it reflects the cost of borrowing money by the Federal Government of the United States to borrow money for ONE MONTH. This is a very short time period, as Treasurys are for sale in 1-mo to 30-year periods. So you'd only charge a high interest rate if you think the likelyhood of non-payment is actually an issue (that's risk vs. return).

Typically, 1 month is very not-risky, as it's highly likely that the US Gov is still around and solvent in a month. But with the recent debt ceiling / government shutdown rhetoric the market is beginning to get a little worried, so the premium the government must pay in order to borrow money has increased.

Basically by the Congress/White-House being deadlocked and having such fiery rhetoric it begins to appears as if there is a chance of default, and that chance is slightly higher than normal, so the risk/return on the 1 mo treasury has increased, as reflected in the increased interest rate the government has to pay to its bond holders.

Imagine we enter an agreement - you'll lend me $100 for a year, and I'll pay you $10 after a year. The banks will pay you $5 to borrow your $100, so you think this is a good deal.

After a year, I pay you back the $100, but I don't have my $10 for interest. I'll pay you back as soon as I can, I swear, seeing myself to the exit. Five years later, true to my word, I give you the $10. So you get your money eventually - is this a good deal?

Well, no, of course not. It may be better than the bank still, but it's not as good as the deal initially made it appear. You could have taken my $10, given it to a bank for the next five years and - assuming you didn't reinvest interest payments out of a noble desire to make math easier for yours truly - made $0.50 each year, for a total of $2.50. What's more, I could have done that, effectively reducing my debt to you by 25%.

Of course, this isn't on that scale, but that is the risk of delayed payment.

The Trillion Dollar Bet is also a good, high-level documentary.

  On-Topic: Anything that good hackers would find interesting.

  anything that gratifies one's intellectual curiosity.

  Please don't submit comments complaining that a submission
  is inappropriate for the site. 

:)

Now, way back when they were probably more using larger sized shot for larger birds (dove are about as small as is practical, and probably more useful for learning real wing shooting), but that gives you an idea of the scale. If you go up to #6 for pheasant and grouse sized birds, 1 oz is 219 pellets.

And, yeah, this is a very cool hack for cheaply making this stuff, which we do indeed use in mass quantities.

Though whether it's inefficient in any other sense is, I think, open to question: The up front expense and difficulty of the tower is a one-time cost, and I'd think maintenance on it would be fairly minimal. I'd think other methods discussed in these comments would almost certainly incur significantly more overhead, particularly over the life of the facility.

Parent said "very effective", I am not sure what it means if not "efficient".

> Though whether it's inefficient in any other sense is, I think, open to question

Indeed, that's exactly what I meant.

1) Why, exactly, should this not be on HN?

2) What makes a submission suitable to be on HN?

You've said that you found it interesting. You maybe learned something? Your curiosity isn't piqued - do we still use this process, does anyone anywhere in the world use this process, could it be used for anything, what happens if you use other materials or if the air is hotter or colder, or if we try it on the moon or on Mars or etc etc etc?

Surprisingly (to me), this is merely a signal of a government agency that takes public perception to heart and issues a vote of not-complete-confidence in standards it has previous prescribed, and today is seeking to rectify the problem by looking for nothing up my sleeve numbers [0] agreed upon by security researchers and the public at large. A smart move, no doubt a difficult one to make, as even the slightest suggestion of no-confidence in a prescribed standard is quite damaging to the reputation of an institution devoted to maintaining reliable standards.

More info on nothing-up-my-sleeve: [0] http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number

(Perlroth quotes from a few unpublished, leaked memos.)

Imagine if the super-official, international standard nothing-up-my-sleeve number was 1. Any time you need consistent but arbitrary bits in a cryptographic algorithm, they must be ...000000000000001. That doesn't sound like it would work very well.

It sounds like the NYT is convinced. The caption under the header picture reads:

"As part of its efforts to foil Web encryption, the National Security Agency inserted a backdoor into a 2006 security standard adopted by the National Institute of Science and Technology, the federal agency charged with recommending cybersecurity standards."

While it is clear that hacker culture embraces putting things from numerous sources together, in this case the Google Maps elevation API with crime data, it's one thing to make a cool presentation and another to make a cool presentation derived from someone else's work against their explicit wishes, expressed in the terms.

The use of software implies (by necessity or otherwise) that you wish to make/create/analyze/do-X with the software, and by using it you've accepted the fact that you will do-X, but within the terms.

It's a funny world we live in ;)

I think it's reasonable to assume that when the service cannot be accessed before the accessor clicks "agree", and the accessor clicks "agree", that constitutes a valid contractual agreement. It's no more silly than mailing in a credit card application and being bound by those terms.

The fundamental attributes are present. There is a contract and you can agree to it or not. Your interaction with the company is viewing the terms the lawyers wrote and agreeing to them or leaving the website.

There is no signature, there is no proof of identity of the signing party (copy of personal ID, witness, ...). Usually no confirmation that other side also accepted it. No copy of ToS received after "accepting". We all know that it could be that, for example, my 4yo child clicked on it when I went to the toilet after reading first few paragraphs of ToS, and now I'm somehow bound to it? Also, it happens very frequently that you "accept" some ToS, and after two years you find on some forum that Google, or PayPal just changed their ToS without sending you the updated copy for acceptance.

Sorry, but too many things that are really different between ToS and a real acceptance of a Contract.

It seems like you are angered that you have to enter into a contract before using software, and you would prefer to just click "accept" and have that magically not be interpreted as you agreeing to the terms. "I'll use it but I don't accept the terms". I'd like that too, but I'm afraid that's not how it works.

I could as well write whatever ToS on my homepage with "accept" and "not accept" link with whatever terms, and then wait for Google bot to "accept" my terms. Do you think Google would be bound by their "acceptance" in the same way.

It's not like I was using my digital signature or whatever, it's just that someone clicked somewhere.

The burden of proof here is on the "vendor" or software provider. They need to prove that I accepted their terms, not the other way round. That's why many free services require credit card, copy of the ID and physical signature as a proof of identity. The fact that Google decided that this might be too expensive for them to enforce, and that is cheaper to just not do it is their choice.

A contract must consist of:

1. A "meeting of the minds." This means both sides come to a common understanding of what's in the contract. Basically, it means there's an offer by one side and acceptance by the other without changes.

2. Intention to be legally bound. Basically, this means that the context of a contract matters. It seems to boil down to commercial agreements generally being enforceable while others (e.g. promising money to family) are not.

3. Consideration. This is some sort of exchange of value. In short, a contract cannot be one-way. This is why you sometimes see e.g. things being sold for $1 rather than being just plain given away for free.

The way I see it, there are serious problems for click-through agreements for both 1 and 3. 2 is not a big deal, as despite the name, it doesn't appear to actually apply to the case where you click Agree without the intention to follow the contract.

One problem with #1 is that essentially nobody ever reads these things. In general, "I didn't read the contract I signed" is not an excuse, of course. However, I think this does (or should) change when everybody doesn't read it, because it means that the other party knows, or should know with reasonable certainty, that you're unaware of the contents. Normally you presume that each party is aware of the contents of the contract, but you can't do that with click-through agreements since it's widely-known that they go unread. A contract which I don't read and which you are well aware I didn't read should not be enforceable. For high-value, important contracts like buying a house, a person familiar with the contract will go over each page with you and have you initial it to affirm that you read it, precisely to avoid this problem. The combination of widespread failure to read the contracts and a complete lack of effort to ensure that you, personally read the one in question means that, IMO, there is no meeting of the minds.

Another problem with #1 is that there is either no opportunity to propose changes, or the other side never notices or reviews them. With a normal contract, I can cross out clauses, add or change wording, etc., at which point the other party can accept or reject my changes, or propose further changes. Where this really runs into trouble, I think, is when you edit the contract locally before clicking Agree. This is generally trivial using a DOM inspector for any click-through agreement found on the web. Imagine I take the ToS in question here and alter it to read, "In exchange for mikeash's use of the Google API, Google promises to pay mikeash the sum of ten million dollars." Then I click Agree. Should Google be bound by this agreement? I imagine you immediately and strongly say "No!" But why should I be bound by the original while they are not bound by the alteration? In a normal contractual setting, they have the opportunity to say yes or no to my proposed changes. They will, of course, say no. In this setting, they don't say no! They simply grant me access to their service after I "Agree" to the altered contract. Does this not imply acceptance on their part? If not, what's the difference between their situation and mine?

Finally, #3 seems to completely destroy the concept of any click-through agreement that isn't part of some sort of payment process. Terms of service presented as part of a checkout process would seem to be fine in this respect, but when presented as part of a free web site, it doesn't seem to work. They give you access in exchange for... nothing. Similarly, click-through software licenses seem to fail here because they show up after the money has been exchanged. I pay for a copy of software which I obtain, and only later am I presented with the EULA. Since the money and product already changed hands, there's no further consideration, and so the EULA should not have force.

That's my thinking. I welcome dissenting opinions.

But I think there's a very clear distinction between a simple agreement with the original and with altering the DOM. If you are clever enough to alter the DOM you definitely know that the alterations are not going to be sent back to the server. You also know that agreeing will let you use the service because the server will think you agreed to the original. That seems like a clear-cut case of fraud to me. I don't see why an agreement to the original contract is invalidated because you weren't offered the opportunity to make a counter-offer (I agree that's a shitty situation, though). That's why I think it's like a contract in the mail; you get an offer and you can agree to that or not. You can make a counter-offer but it will be binned.

Consideration isn't solely concerned with monetary purchases, is it? I imagine they can construe your incoming data as valuable. It would be interesting to know if sites like Reddit can claim user interaction has inherent value for the site and for the users. I guess the EULA would be granting you license to use the software, but would not give any additional value to the developer so consideration does seem to invalidate that.

You're probably right that a ToS is going to be hard to uphold in civil court.

Anyway, thank you for elaborating, I'm glad to get a better understanding of your perspective and contract law.

Yeah, they'll probably just toss your counter-offer. But the point is that you can make it. You can take their contract, alter it, sign the altered copy, and send it back, and then they can accept or refuse. The important point here is that you are not considered to have agreed to the original because you signed an altered copy.

A more thorough way to do this electronically would be to modify the DOM, save the modified agreement, click Agree to sign your end, and then e-mail the modified agreement back to the originator and let them know what's going on. Of course, their automated systems have given you access in the meantime, but that's hardly your fault.

I don't really understand how making a modification you know won't be sent back to the server is "fraud", but sending the user an agreement you know won't be read is "not fraud". Seems like either we base both scenarios on what people should do (read the original/modified agreement), or on what people actually do (not read anything), but not base one scenario on one and one scenario on the other.

You say you don't see why an agreement to the original is invalidated because you couldn't make a counter-offer, but that's how contracts work. Negotiation is inherent to the process. Big companies are trying to hide that with form contracts that everyone is expected to sign as-is, but it's still supposed to be present.

Those are really the only two options, no matter how much we wish people would be honorable.

Statistics isn't a feeling, and the comparison is correct in that, on average, air travel is significantly safer than car travel. One should note, however, that the "on average" is the key bit, as one might argue that drivers in accidents have some special characteristic at work making them more susceptible than most, but claiming that Schneier or his source is making a false comparison somehow is simply unfair and untrue. Moreover, plenty of fatal auto accidents are not the explicit fault of those that die (drunk driver, someone else texting while driving, semi-trucker not paying attn). So "feeling safe" is worth nothing when you're staring down the grim reaper in the grill of the semi that switched lanes without signalling to pass without seeing you.

   |Note: recent events have lead to these topics being in the news quite often in recent weeks. However, Pond is not a reaction to those events - it was started nearly a year ago.

On topic to your comment, unfortunately there's no way to avoid leaking traffic information, or at least the fact that there is traffic at all, to a "global passive attacker" :) gone are the days of radio silence

A thing I don't know is whether Pfitzmann et al.'s scheme held up to subsequent analysis. I haven't even read the whole paper, actually.

A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.

Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willing to falsely sign a key, and 2) trusted by others, you can have these people sign a spoofed key. But then these people would be putting their reputations on the line, and the probability of being exposed is high. Thus the cost of the attack is high.

The lesson being: If you're emailing info that is valuable enough to warrant such a costly attack, verify the key through some other means. Meet the message recipient in person, for example. And consider a thorough security audit of everything in your digital and physical life. You're obviously operating in a far more dangerous world than I do. There are probably many vulnerabilities available to attackers that have nothing to do with your email.

My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.

https://we.riseup.net/riseuplabs+paow/openpgp-best-practices...

Edit: nevermind, i see you meant the site with the tutorial, not key exchange

It's bilateral, but I wonder if the Bolivians would keep him after the US refused to send them their former coca-growing president [2].

[1] http://www.oas.org/juridico/mla/en/traites/en_traites-ext-us... [PDF]

[2] http://shadow.foreignpolicy.com/posts/2012/09/12/why_did_the...

> US refused to send them their former coca-growing president

Not a shocker to me. They refused Poland sending a guy involved in contracting mob hitmen on our national police chief http://en.wikipedia.org/wiki/Edward_Mazur

i.e. will this also disable any scripts that would send data to GMail while drafting is in progress, because if not I could see that as a potential hole for a future breach. Something like "while typing a draft, block all upward data triggered by this page" seems appropriate, rather than targeted draft-saving

It's also sort of ironic that this extension is trying to protect your privacy against the same company making both the browser and the email service:)

You'll see that in the secured compose when it tries to save a draft it says "Draft saving..." "Save failed".

And un-secure composes and replies don't get blocked.

Running across the ocean is possibly the most cowardly thing, and only further cements his future legacy as a "traitor". Unfortunately one narcissist cannot decide the policy of a nation, and Mr. Snowden has made a mistake in attempting to do so via leaks of classified and top secret information. It's... Traitorous.

No person acting in their own interest would willingly face trial in a US court, unless they had millions of dollars to spend on lawyers. The way our courts work, acquittals are expensive and actively discouraged, and there is almost no chance of jury nullification. The best bet any defendant has in a US court is for the police to make a procedural error, though even then you better be ready to pay a good lawyer to spot it. There is almost no chance of Snowden getting off on a procedural error, though -- for someone that high profile, a lot of care will be taken to ensure that everything is done by the book.

The government also has a lot of power to keep arresting a person and keep putting them back in a court room. If Snowden were not convicted for espionage, he would be arrested for hacking and tried separately for that. If that failed, it would be for tax evasion, illegal orchids, or some other obscure crime. If that failed, he would just be followed by the police day in and day out until he ate ice cream on a Tuesday afternoon in some county in Georgia. Even if the cases are all thrown out, he could be waiting for years to go to trial, and the judge may not be willing to grant someone with his international connections bail.

"Running across the ocean is possibly the most cowardly thing"

There is nothing cowardly about retreating from and avoiding an adversary that has vastly more resources and capabilities than you. Snowden's adversary is the world's most powerful government. It would be stupid not to run.

In other words, what you are advocating is stupidity, and what you call cowardice is what most people would call intelligence.

I'm not making a judgment either way (although I probably have in my earlier comment history), it's just easier for some people to say "Whatever, he's a traitor and a coward" rather than actually think about why he did what he did, what his motivation(s) were/are, and if they ultimately think the ends justify the means.

Indiscriminate dumping of classified data that you didn't look at, to opponents of your government, is pretty much on page 1 of "Compendium of Spies".

What the public got out of his leak was that a) war sucks and b) diplomats are not pure as the driven snow. Both of which the public knew, and have known, and will pretty much always know.

What AQ, TTP, Taliban and other extremist groups got is detailed ground-level descriptions of how the Army operated against them, what informants they used, and much much more. As an intelligence analyst himself, Manning would be in an exception position to understand just how useful those documents would be in their hands, and if we are charitable somehow still judged that the gain to the enemy was somehow still less than the gain to the public.

And this is why Snowden was so careful to note in his initial interviews that he took specific things from the NSA instead of just copying what he could.

However, the most relevant point is that, based on what is being written in the media, there is no real distinction in the average American's mind between the two except that one was caught and the other is on the run. They are both labeled as "leakers" and "traitors" by the government, and except for a few outlets, the mainstream media largely parrots the official talking points. Being treated as a traitor based on a label the government applies to you rather than on the details of what you did is what is really frightening.

The media has little choice about the distinction the people draw though. He fled to Hong Kong, away from a nation where at least 1/3rd of the population still has a jingoistic antagonism to China. He allied with WikiLeaks, who the American people know are at least somewhat more anti-American than anti-secrecy. He tried to get asylum from Ecuador (who is already allied with WikiLeaks), and Venezuela has been chomping at the bit to grant him asylum (I'll let you guess what Americans think about either country at this point).

To put the cherry right on top he delivered his TS-containing brain and his TS-containing gear to effing Russia.

His father has been the smartest Snowden in this whole sorry affair; there's a reason he's worried about the perceived association to WikiLeaks, and that's because it's not favorable to Snowden in the USA.