rubyalex

Google's intent is very straightforward; to disable TLS in the interest of their ad business. The post does not include how to whitelist domains (which should be recommended before you completely disable TLS). I did this today and yesterday to my iOS app and it took 2 minutes of editing Info.plist [0]. You shouldn't compromise app security in the interest of letting ad networks continue to serve unencrypted content to your user's devices.

[0] http://ste.vn/2015/06/10/configuring-app-transport-security-...

You can do this once, but rarely ever twice. The world is surprisingly small and word gets around quickly when you take that "free ride" at the expense of the people funding you. Besides, it's different from 1998 in the sense that VCs are placing more money on later-stage startups than seed/A-stage startups.

This is awesome!

This is awesome! So much better than SoundCloud's!

how do you recover from it if your yubikey got lost or stolen?

What does 300m years mean? Is that 300 or 300 Million?