weeks

They're referring to the EU not being able to compete.

“Buy, receive, or sell the personal information of 50,000 or more California residents”

If a business engages this type of activity, they need to have a scalable process for providing California residents with their data.

Describing a California law passed by a majority of voters as “idiotic hoops” is a miss.

Is. :D

Do I have a choice not to work with you?

Apache Spark and Apache Kafka? It doesn't seem likely that the Apache Software Foundation would consider implementing the SSPL instead of the Apache License.

The technical claims don't seem very far fetched. They're basically describing every banking "anti-fraud SDK" I've ever reversed.

https://googleprojectzero.blogspot.com/2017/10/over-air-vol-...

Even Apple's IOMMU has had vulnerabilities allowing for full memory access from the WiFi modem.

Apple's policy is one certificate per company. So it being a single point of failure is unavoidable.

Code review, trusted build environments and code signing could entirely prevent a single engineer from modifying the code running on the car.

"I recommend rolling your own email server"

This is actively harmful advice. Do not roll your own email. Use a well-known provider with a solid security track record.

https://developer.android.com/distribute/best-practices/deve...

That hasn't actually happened yet.

You think the CEO of 23andMe and ex-wife of Sergey Brin can't afford the best nursing home for her grandmother?

Thanks for pointing that out. I've escalated internally to have the video restored.

Edit: the video has been restored.

https://developer.android.com/guide/topics/ui/layout/recycle...

https://developer.android.com/guide/topics/media/exoplayer.h...

RecyclerViews are only implemented in the support libraries, even for newer versions of Android. I haven't used Exoplayer personally but by reputation it does all of the hard media stuff for you.

While I absolutely agree with you, it seems far more likely that native implementations by Apple, Google and Microsoft will dominate the market. Windows Hello is a great early example of this.

Android supports U2F via NFC and Bluetooth now, which is used for user authentication on Android devices. We've also released an (experimental?) iOS app to support U2F over Bluetooth.

https://itunes.apple.com/us/app/google-smart-lock/id11520663...

https://www.ubnt.com/edgemax/edgerouter/

Ubiquiti's EdgeRouter gets my vote if you're willing to muck around on the CLI to get to advanced features.

My former employer reimbursed our lunch as taxable income for this reason.

From what I've gathered this totally depends on your market. Creating a paid app or an app targeting US University students? iOS first. Creating an ad supported app or targeting an international market? Android first or use a framework that supports compiling to both platforms.

Android 1.0 had this via ACCESS_COARSE_LOCATION, unfortunately Android only recently got runtime permissions.

If the user isn't informed the app they installed is clicking on ads, it absolutely is malware.

Playing whack-a-mole with memory corruption vulnerabilities isn't how you create a secure operating systems.

Where I feel a lot of the animosity from the Wikipedia community stems from is that the people who have "cultivated expertise in governing" are actually Wikipedia volunteers, not WMF employees.

As a Wikipedia administrator (mostly inactive), this sentiment makes complete sense to me. The WMF seemingly spends the majority of its money on non-critical functions such as community outreach, local chapters, yearly conferences and other non-critical costs. Including a parade of highly paid, not very effective executives. One thing to keep in mind is the WMF != the Wikipedia community, it is very possible to truly support the Wikipedia mission without also supporting how the WMF is ran.

While you're right that a lot of FinTech applications do use fingerprinting, it is absolutely against the rules. It's rather annoying from a mobile security perspective but given the rampant abuse of persistent device identifiers on Android, I understand and appreciate Apple's stance here.

The purpose of ascertaining device identity is to prevent someone who can't obtain legitimate Google issued hardware from using stolen user credentials. If you're already a Google employee you can just ask for more trusted hardware, so there would be little point in breaking that part of the security model.

For one, without Google Play Services you have no Play Store. Unless you're going to prevent users from installing apps entirely, there isn't really another safe way to obtain apps. Additionally Verify Apps, SafetyNet, Safe Browsing, etc. are all part of Google Play Services. You _really_ want Verify Apps.

https://source.android.com/security/verifiedboot/verified-bo...

How do you propose a custom rom can establish hardware root of trust without being signed by the device manufacturer?

Disabling Verified Boot and not having Google Play Services would dramatically reduce the security posture of an Android device.

Disclaimer: I work at Google.

I don't think this could be accurately described as merely a _vulnerability_ disclosure. These web stores are already compromised, therefore anyone that makes a purchase is exposing their payment information. Furthermore there is no "responsible" way to contact thousands of web stores across the globe. The best case for disclosure is Google's Safe Browsing beginning to warn users immediately.