adamsmith

Would you say that governments should have no secrets?

I think the issue is more nuanced than it first seems to most people.

Do you trust these newspapers to have access to the raw information? Even if the public doesn't see the names of informants/etc, that doesn't mean that foreign governments aren't intercepting the information being handled by the press.

I guarantee you the NYT INFOSEC budget is lower than you think. : )

More importantly, lots of the information is compromising in a way that is not in the best interests of the public. For example, it embarrases the Yemeni president, along with many other countries. Will that make these people more or less likely to work with the US (or anyone else for that matter) in the future?

If times were good and budgets were flush you can be sure reform proponents would suggest using the excess capital to grandfather the old systems in and support the new ones.

However, that's not the case we're in right now. That doesn't mean it won't change in the future. It's also possible (likely?) that reformers' strategy for lean times will be less successful than the strategy for times of excess. Only time will tell!

Wow, I wonder how. Presumably they could have encoded a watermark into the text by changing out synonyms. All you'd need is 15 words with two possible synonyms.

...Or, more simply, they probably used packet sniffing/similar?

MG might or might not run into trouble once his SSD drive burns in / fills up, as it no doubt has on the other laptops he talks about. His comparison might be somewhat apples to oranges..

This article misses the main reason people omit information: to avoid embarrassing others.

I always talk about how Xobni Analytics failed, for example. Recently I've been talking a lot to others about my own weaknesses.

But by necessity most of the stories about Xobni involve other people, and the stories often involve internal conflict among some of the people on the team, and to tell those stories properly would require being honest about others' weaknesses as well. There's not a culture of doing that in public settings, and I don't expect that to change.

EDIT: the two exceptions that prove the rule are High Stakes No Prisoners by Charles Furgeson, and some of Steve Blank's recent blog posts, even though Steve doesn't name names. AFAIK, both of these guys are basically retired from the valley.

I'm pretty surprised the police department thought they could ever win this. The best interests of the public seem pretty clear cut here.

You could try starting with twitter and working your way up to larger texts over time. Particularly as the 140 chars becomes annoying!

events are a GREAT example.

long term, services like greplin will also make it easier for people to switch / move around across service providers for various cloud functions. for example, the more greplin gets used the easier it will be for folks to switch to using event webapps other than facebook.

It sounds like you have it covered, but why not use a service like Dropbox or Tarsnap that backs out to Amazon S3 where they have like nine 9's of redundancy?

Backing up to the cloud is the next big step in backup.

I don't know for sure, but one theory is that if they carpet bomb at the seed stage only some of those companies will be series A fundable, which means many will be cut off. The negative signaling to other investors when a startup isn't supported at the series A would be significant, so VCs know if they carpet bomb eventually they will get a bad rep.

Ancesotally, more super angel funds are saying they will participate in later rounds, and since some of them are doing lots of broad seed investing they are the canary in the coal mine on how this will turn out.

Some problems with this argument:

* Value creation is value creation. Even if the optics of how liquidity is realized are changed, what matters is making something people want, not the exit strategy.

* There will always be financing options for later stage startups. Super angels will not kill venture capital altogether, as is implied.

This is a good overview of today's funding ecosystem.

I'm not sure how concerned I am about having enough founders swinging for the fences and building big companies.

Certainly founders are getting more of what they want as these small exits happen more frequently. For first time entrepreneurs a few million in the bank is a huge fucking deal.

Acquiring companies are getting what they want, too. Often at the lower prices they want the talent, and I think companies are starting to understand more and more the value of acquiring founder talent.

I think we'll see where this goes. Everything is still playing out and it's a very rapid evolution. Examples:

1) Founder cash-outs are happening more and more, likely in direct response to more frequent early acquisitions.

2) Acquiring companies are still experimenting with how to motivate founders after a talent acquisition. The state of the art for the median case -- shelf their code and throw them into a team often with little creative freedom -- is quite stark.

Thank you that's very helpful.

Maybe hedge funds need to get into this business. Or maybe I should find a way to show hedge funds that my new risk assessment is better.

Though one of the challenges is getting new types of hard-to-fake data. If my risk assessment looks at a person's email account or does machine vision on their facebook photos, those things are easily forgable.

Is this a business opportunity?

If the premise of the article is true, that people who should be getting credit are not, why can't we start a credit-extending company that does a better job of assessing risk?

One or more of three things must be true here. Either:

1) there is an untapped business opportunity here,

2) the premise of this article is false and the machine is working fine, or

3) there are regulatory barriers getting in the way of making the machine work well.

having been in all three places, you should leave europe to start your company. but move to silicon valley instead.

If you start considering active man-in-the-middle attacks, someone can modify the HTTP page that hosts the login form to, for example, also send the password somewhere else.

For defending against passive MITM, you're right (as far as I know) that HTTP-to-HTTPS is okay.

Sorry for the confusion -- this whole thing is about how passwords are transmitted, not how they are stored.

When it comes to password storage, though, the only way to find this out is: (1) if you are able to look at the backend systems, (2) if someone hacks in, as happened with rockyou (google: rockyou passwords), or (3) if they send you your password back in the clear in a password reminder email, rather than forcing you to create a new one. Note that #2 and #3, if they happen, only indicate that passwords are stored in the clear. If they don't happen that doesn't mean they are not stored in the clear.

My first surprise moving into my first apartment was that, unlike dorms, people didn't socialize with one another. I found that very odd and disappointing, but soon after realized why: unlike college students, people living in apartments are at different stages of life and have different interests.

There are a few compelling use cases to hyperlocal social networking. This article touches on a few, but confuses them with the type of relationships you have with friends.

Yes, there are probably some people in your building that you would actually want to be friends with, but it's not clear IMO how to make that happen. If there really were that many people around who you could be friends with, people in apartments would hang out regularly offline, and they don't.

Joel's thinking re taking VC for SO: http://www.joelonsoftware.com/items/2010/02/14.html

I'll be doing cartwheels once someone gets ZFS working on this, so I can plug in a bunch of USB hard drives through a USB hub and share a pool over the network.

(In the mean time, I have a Dell box doing this for me, though it was hard to set up. It took hours of debugging to figure out that OpenSolaris would crash until I disabled the second core/SMP. Then, it took hours to find out that the network crashed randomly due to a driver bug, and to find the right hotpatch off a random forum thread.)

But most major domains use domain keys / DKIM.

http://en.wikipedia.org/wiki/DKIM

As far as I understand it, you can't fake being an SMTP server sending mail from such a domain because their emails get signed with a private key whose matching public key is published by DNS.

Though one could argue that by buying a 'clean' diamond you are increasing the prices for dirty ones.

Not that that makes it immoral to do so. I wouldn't go that far.

Thanks, Daniel!

It's worth noting that those are content aware, lossless compression for single image files, not cross-file.

That said -- very cool -- I didn't know those existed!

Go for it if you're passionate about it!

I understand the principle but don't understand enough of how it would actually work to speak for it as much as I'd want to.

Such a technique could also be especially useful for low bandwidth situations, most notably Paul English's proposed Internet for Africa effort, http://joinafrica.org/ .

If you're interested in this pursuit you should also look at SPDY, Google's suggested augmentation of HTTP. It would probably speed up the web more than better compression in many cases.

I also wonder if it would be possible to establish a set of well known reference bits to compress against.

E.g. if you shipped an additional 10 MB of "data" with every browser, could you reduce the average image size on the internet by X% by leveraging that 10 MB?

(I have no idea; just an interesting thought exercise. Could make a cool masters thesis for someone.)

That's a really important question.

It should be possible to cross-file de-dup more than just images.

One important test to watch will be Ocarina's market success, or lack thereof.

EDIT: also, because of the growth of proprietary data stores in the cloud it becomes more and more lucrative to leverage this tech even if it's not a standard. E.g. if you were Amazon S3 compressing redundancies, you use JPEG on your interfaces but use a non-standardized algorithm on your backend.

Here's a good overview paper: http://www.usenix.org/event/usenix04/tech/general/full_paper...

So for example a future image compression algorithm should define how to compress a single image, and how to compress a group of compressed images?

Interesting thought.

The downside of this coupling might be slower adoption of new cross-file compression algorithms if there is going to be a string of them, which empirically there seems to be. It's kind of funny that the de facto image compression algorithms haven't changed in ~10 years whereas video compression algorithms change flavors every two to four years.