TomAnthony

I think this might have been true in the past, but I don't think it is true any longer. Zoom grew at a wild pace during the early days of the pandemic, and with that came security issues. However, they recognised that and invested into security.

I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.

Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.

However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.

Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.

[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crac...

Thanks for the detailed reply! The Greaseweazle looks good and is inexpensive. I think I’ll get one. :)

I have a bunch of 3.5" floppy disks from my BBC Master, which date back to late early 90s. Will the data on them still be ok?

If I bought a Kryoflux or similar device would I be able to access and save the data?

This was fun. :)

I feel like there should be another scoring axis rather than just time. I think selector length would be wrong, but something like selector complexity, or how robust the selector is to updates.

I scored 3m 50s, but felt like some of my selectors were a bit 'dirty'.

The negative test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640187792DOH...

The positive test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640524880jk8...

Excited about Caido! Been waiting on the beta list for a while!

In 2017 I found a security issue with the Tesco website. It was a minor security issue, but I could see they had _attempted_ to stop people doing what I could do.

I did manage to find an email address, but I got a templated response, and when I checked a year later it was still not fixed.

Sure, it was a minor issue, but I was surprised Tesco didn't have a proper Vulnerability Disclosure Program or Bug Bounty program. A bug bounty program is an inexpensive way to avoid exactly this sort of issue.

Yes, I understand that, but how do I _know_ if I am using this functionality?

In this case, it is the ability for an app to install and execute arbitrary code that hasn't been reviewed. I download an update to DoodleJump and it installs some malware on my device. I'd be none the wiser.

I don't want that stress, which is why I chose an Apple device. It protects me from that scenario.

I agree - I'd also be opposed. I understand why it frustrates people (especially in the cases such as iDOS 2), but it was a known factor for me buying an Apple phone. More importantly, it was an aspect of the ecosystem that I _wanted_.

On Android the Play Store is a major distributor of malware [1]. I would like to avoid that, which comes with trade-offs, which I accept. Is it perfect? No. But it works.

I do wonder if there is a path where iOS can be completely replaced by a third party OS, so iPhones can be used in a way to allow you to install anything you want, but it is no longer Apple's 'responsibility'. However, that also comes with its own set of problems.

[1] https://www.zdnet.com/article/play-store-identified-as-main-...

In Information Theory, there is a concept of Channel Capacity. If a channel is defined as the probability of the output being s if you send a, across all possible values of a, then the Channel Capacity is the maximum amount of information you can communicate across this channel, measured in bits.

To achieve the Channel Capacity you need to find the optimum distribution across a - i.e. what set of signals maximises the information you can transmit on this channel. There are known algorithms for finding this distribution (e.g. Blahut-Arimoto).

Now if you model the world as a channel, where s represents the reachable states and a represents the actions the agent can take (and the channel, P(s|a), represents the dynamics of the world), you can calculate what actions allow you maximal control (in terms of states you can controllably reach).

More info in this paper: https://uhra.herts.ac.uk/handle/2299/15376

Hah - thank you for sharing!

That is very interesting that this emerged from two different approaches.

I published my result years back, and have never heard of this emerging elsewhere before!

Didn’t take it as accusatory [but thanks to child for sharing link :)].

The approach I used was similar. The idea of maximising observed control of the world means you seek states where you can reach many other states, but _predictably_ so. This comes 'for free' when using Information Theory to model a channel.

Sure! The PDF is available here:

https://uhra.herts.ac.uk/handle/2299/15376

Yes, you are right.

I experimented with different time horizons, mostly look 3-7 steps ahead.

In terms of the 'reward', that was implicit within the model - if the ghosts caught you, your ability to influence the state of the world dropped to 0.

Yes! Exactly - kiting. I didn't know the term but when I explained the behaviour I was seeing to a colleague they told me about this.

The method was called 'empowerment'. Two ways to explain it...

From a mathematical perspective, we used Information Theory to model the world as an information theoretic 'loop'. The agent could 'send' a signal to the world by performing an action, which would change the state of the world; the state of the world was what the agent 'received'. This obviously relies on having a model of the world and what your actions will do, but doesn't burden the model with other biases.

Pore more colloquially, the agent could perform actions in the world, and see the resulting state of the world (in my case, that was the location of the agent and of the ghosts). Part of the principle was that changes you cannot observe are not useful to you.

Similar story of unexpected AI outcomes...

As part of my PhD research, I created a simplified Pac-Man style game where the agent would simply try to stay alive as long as possible whilst being chased by the 3 ghosts. The agent was un-motivated and understood nothing about the goal, but was optimising for maximising its observable control over the world (avoiding death is a natural outcome of this).

I spent sometime trying to debug a behaviour where the agent would simply move left and right at the start of each run, waiting for the ghosts to close in. At the last minute it would run away, but always with a ghost in the cell right behind it.

Eventually, I realised this was an outcome of what it was optimising for. When ghosts reached cross-roads in the world they would got left or right randomly (if both were same distance to catching the agent). This randomness reduced the agent's control over the world, so was undesirable. Bringing a ghost in close made that ghost's behaviour completely predictable.

Alas, that isn't as true as German's tell me it is, I find.

"Weg" <- how do you pronounce this?

"Geh weg" (go away) "Der Weg ist da drüben!" (the path is over there)

Legitimate question, from someone who had just built an app (that will have a cost) that is a helper to Dropbox and has 'Dropbox' in the name.

Where do you think the line is? There are several apps on the Mac app store that have 'Dropbox' in their name and are charged. Is the difference they they are all 'sidecar's that rely on you have Dropbox?

Offtopic: I despair that a calendar widget for my Mac is now a pay monthly thing. It is becoming widespread that things that were previously just a piece of software you could buy (then optionally upgrade in the future) are now a monthly cost.

It makes sense for high ticket pieces of software (Office, Photoshop), where it makes it more accessible for regular users. However, for a calendar widget or many similar examples that come up nowadays, it just turns me off immediately.

It was only Monday that they announced 9 new people joining the AMP AC to replace 10 others leaving: https://blog.amp.dev/2020/12/14/amp-advisory-committee-2020-...

The author presents an extremely incomplete picture of modern SEO. As an SEO professional for the last decade, I think we can do better in a discussion of the shortcomings of SEO.

The whole article presents SEOs in a similar way to how people talk about 'used car salesmen'; we all know the clichés about used car salesmen, but the reality for any professional selling used car is vastly different. Presenting SEOs as 'the world’s most scruple-free douchebags' is fairly insulting and not productive.

His article discusses _some_ SEO tactics used by _some_ SEO practitioners. For the subset he presents, then I certainly agree there are a lot of issues, but he presents it as the complete picture.

# Modern SEO

Modern SEO is made up of many facets, one part of which is content, but which also includes technical considerations around crawling and indexing of content, as well as advocating for site speed optimisations, and improving user experience and signals.

A reputable SEO practitioner should be asking 'does this deserve to rank?', and should be advocating improvements that have longevity (i.e. will be helping next year, not just next week). I spent 9 years in an SEO agency, where these were central and core to our whole approach.

# Blackhat SEO

Yes, there is a lot of manipulative and shady stuff going down. That is not just content focused, as the author discusses, but there is also a lot of link buying and selling, which is design to manipulate the link graph with the aim of gaming PageRank essentially.

There is no denying that this stuff happens, but it is once again the same as the used car salesman analogy -- the majority of modern SEOs are professionals, and they don't deserve to be tarred with the same brush.

The line is, I accept, not as clear cut with SEO and there are people who practice manipulative tactics who operate in a grey area, and present themselves as the 'proper' solution.

# Google

Obviously, people practicing manipulative SEO are to blame for their own actions, and for making the situation worse. However, another aspect is Google's monopoly. I don't see how Google could have done a lot better at preventing some of the shady SEO practices that go down - they actively try.

However, their _monopoly_ is problematic as it means that there is only one black box to optimise against, and no real SEO consideration needs to be paid to other search engines.

It will be interesting to see what happens if Apple enter the fray, and what the knock on effects are.

Hey!

My memory of this is imperfect and I joined as the project was already underway, but I believe there were two companies, yes.

The main POC at the second company that got the project completed was Rebecca Heineman [1] from Contraband Entertainment; my job was facilitating comms and help manage and organise the beta testing. I also built the installer.

I _believe_ that yes, Rez was created specifically for this. All EV modders know that the resource fork part of files was a critical part of how EV data files, and all mods, worked. There was a huge dependency there, and so I think the decision was made to create Rez to fill that gap. However, that is the extent of my knowledge.

[1] https://en.wikipedia.org/wiki/Rebecca_Heineman

Yeah, EV Nova was HUGE. The content was primarily the product of ATMOS studios in Australia. It started out as a plugin for EV Override, but Ambrosia bought the rights and helped turn it into the 3rd iteration of the game.

The original EV was great to explore in, but fairly linear (two main threads to the storyline, I believe), but Nova was massive with so many routes through, I doubt anyone ever saw it all!

I was also a fan before I was an employee. I know the love they inspired!

I had moved on from Ambrosia before Steam became a thing, but have also wondered the same. I did point this thread out to Andrew, and he has dropped in some replies, so maybe he can shed some light. I would guess it is a case of all the legal shenanigans needed to make it happen cleanly. Various people external to Ambrosia own various parts of the rights, so you would need to get a bunch of people on board and spend money on lawyers.

I also thought some games could be suited to something like the Nintendo Switch. However, that would obviously need a bunch of technical work to convert it (something I admit to having looked into late last year!).

Hey! That is kind of you to ask.

I joined Ambrosia in late 2002 as part of a 'sandwich degree' as we call it in the UK. I was doing a 4 year BSc in Computer Science, where the 3rd year was spent as a year in industry. For that I moved to upstate NY to work for Ambrosia. It was a dream for someone who had grown up modding EV (like so many here apparently!).

I returned to the UK and kept working for Ambrosia from the UK whilst finishing my studies and for a while after. Andrew offered me a role at Ambrosia and I _agonised_ about the decision as I loved the company but ultimately I was too afraid of moving to the US without an end date there. I often wonder if that was a mistake.

I then did freelance web dev for a couple of years, before going back to Uni to do a PhD in AI. I found out I was going to be a father, and freelance web dev wouldn't cut it any more so I joined an SEO consultancy (Distilled), having taught myself a lot of that building small company websites.

In February of this year, the SaaS project I led at Distilled spun out as its own company SearchPilot (https://www.searchpilot.com/). I know SEO doesn't have a great reputation on HN, but what I love about SearchPilot is it applies A/B testing to SEO to remove the mystery, hand waving, and everything else. My focus is on the product and the network infrastructure side of things, but we are a small team so I get to do all sorts.

I do miss both the fun of working on games, and being part of the joy people would experience (as this thread shows). I also miss the AI research, as it was an interesting set of intellectual challenges.

This was before my time at Ambrosia, but I did work the booth at a few shows in different cities (San Fran, LA, Paris being memories). Your story definitely sounds like the sort of thing that would go down.

I also don't have any t-shirts anymore, but EV:Nova mouse mats are still used at my Mum's house!

I think it was a product of the era, because nowadays games are either big budget with huge teams, or they are indie games which will struggle to differentiate themselves from the crowd.

Back then, there weren't the tools available for most single devs to launch a full game (which is where Ambrosia came in with a suite of libraries, artists, and knowledge) as they can do nowadays. So there wasn't a huge mass of games, and also there was an overhead to releasing something- nowadays you can throw things up on the App Store and see if it sticks (not diminishing anything from the amazing people working on things nowadays). Ambrosia had a phone line you could phone for free at any time to get tech support!

So Ambrosia games were not big budget but they were created by people who loved what they were doing and who had the expertise to make games with great playability. Nowadays that is possible, but it strikes me as harder to differentiate yourself.

Once something is big budget and with a big team, I think the dynamics change a lot. On a small team every voice could be heard, everyone could have an impact on the direction of the game.

I remember them changing the licensing system, it was shortly before I started at the company. Matt Slot, who was the lead coder alongside Andrew, wrote an article about it which I've managed to find archived [1].

The article doesn't shed a lot more light on it, but the rough understanding (between my understanding at the time and what I've lost to memory!) was that it was similar to public key cryptography, with a public key in the app that could be used to verify license codes signed with the private key.

[1] http://www.windowsusers.org/piracy.html

Yeah, EV is still top 3 for me!

As for the Windows release of Nova, I had the honour of packaging that up and releasing it. I still remember exactly where I was when I pressed the button!

People on IRC were going wild! I was so fortunate to be part of it.