I think this might have been true in the past, but I don't think it is true any longer. Zoom grew at a wild pace during the early days of the pandemic, and with that came security issues. However, they recognised that and invested into security.
I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.
Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.
However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.
Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.
I feel like there should be another scoring axis rather than just time. I think selector length would be wrong, but something like selector complexity, or how robust the selector is to updates.
I scored 3m 50s, but felt like some of my selectors were a bit 'dirty'.
In 2017 I found a security issue with the Tesco website. It was a minor security issue, but I could see they had _attempted_ to stop people doing what I could do.
I did manage to find an email address, but I got a templated response, and when I checked a year later it was still not fixed.
Sure, it was a minor issue, but I was surprised Tesco didn't have a proper Vulnerability Disclosure Program or Bug Bounty program. A bug bounty program is an inexpensive way to avoid exactly this sort of issue.
Yes, I understand that, but how do I _know_ if I am using this functionality?
In this case, it is the ability for an app to install and execute arbitrary code that hasn't been reviewed. I download an update to DoodleJump and it installs some malware on my device. I'd be none the wiser.
I don't want that stress, which is why I chose an Apple device. It protects me from that scenario.
I agree - I'd also be opposed. I understand why it frustrates people (especially in the cases such as iDOS 2), but it was a known factor for me buying an Apple phone. More importantly, it was an aspect of the ecosystem that I _wanted_.
On Android the Play Store is a major distributor of malware [1]. I would like to avoid that, which comes with trade-offs, which I accept. Is it perfect? No. But it works.
I do wonder if there is a path where iOS can be completely replaced by a third party OS, so iPhones can be used in a way to allow you to install anything you want, but it is no longer Apple's 'responsibility'. However, that also comes with its own set of problems.
In Information Theory, there is a concept of Channel Capacity. If a channel is defined as the probability of the output being s if you send a, across all possible values of a, then the Channel Capacity is the maximum amount of information you can communicate across this channel, measured in bits.
To achieve the Channel Capacity you need to find the optimum distribution across a - i.e. what set of signals maximises the information you can transmit on this channel. There are known algorithms for finding this distribution (e.g. Blahut-Arimoto).
Now if you model the world as a channel, where s represents the reachable states and a represents the actions the agent can take (and the channel, P(s|a), represents the dynamics of the world), you can calculate what actions allow you maximal control (in terms of states you can controllably reach).
The approach I used was similar. The idea of maximising observed control of the world means you seek states where you can reach many other states, but _predictably_ so. This comes 'for free' when using Information Theory to model a channel.
I experimented with different time horizons, mostly look 3-7 steps ahead.
In terms of the 'reward', that was implicit within the model - if the ghosts caught you, your ability to influence the state of the world dropped to 0.
The method was called 'empowerment'. Two ways to explain it...
From a mathematical perspective, we used Information Theory to model the world as an information theoretic 'loop'. The agent could 'send' a signal to the world by performing an action, which would change the state of the world; the state of the world was what the agent 'received'. This obviously relies on having a model of the world and what your actions will do, but doesn't burden the model with other biases.
Pore more colloquially, the agent could perform actions in the world, and see the resulting state of the world (in my case, that was the location of the agent and of the ghosts). Part of the principle was that changes you cannot observe are not useful to you.
As part of my PhD research, I created a simplified Pac-Man style game where the agent would simply try to stay alive as long as possible whilst being chased by the 3 ghosts. The agent was un-motivated and understood nothing about the goal, but was optimising for maximising its observable control over the world (avoiding death is a natural outcome of this).
I spent sometime trying to debug a behaviour where the agent would simply move left and right at the start of each run, waiting for the ghosts to close in. At the last minute it would run away, but always with a ghost in the cell right behind it.
Eventually, I realised this was an outcome of what it was optimising for. When ghosts reached cross-roads in the world they would got left or right randomly (if both were same distance to catching the agent). This randomness reduced the agent's control over the world, so was undesirable. Bringing a ghost in close made that ghost's behaviour completely predictable.
Legitimate question, from someone who had just built an app (that will have a cost) that is a helper to Dropbox and has 'Dropbox' in the name.
Where do you think the line is? There are several apps on the Mac app store that have 'Dropbox' in their name and are charged. Is the difference they they are all 'sidecar's that rely on you have Dropbox?
Offtopic: I despair that a calendar widget for my Mac is now a pay monthly thing. It is becoming widespread that things that were previously just a piece of software you could buy (then optionally upgrade in the future) are now a monthly cost.
It makes sense for high ticket pieces of software (Office, Photoshop), where it makes it more accessible for regular users. However, for a calendar widget or many similar examples that come up nowadays, it just turns me off immediately.
I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.
Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.
However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.
Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.
[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crac...