Month: June 2019

Rep. Will Hurd will no longer give the keynote address at the Black Hat security conference amid questions about his voting record on women’s rights.

Hurd, a Texas Republican congressman was scheduled to headline the conference later this year but the board decided to walk back the decision a day later.

“Black Hat has chosen to remove U.S. Representative Will Hurd as our 2019 Black Hat USA Keynote. We misjudged the separation of technology and politics,” said a statement. “We will continue to focus on technology and research, however we recognize that Black Hat USA is not the appropriate platform for the polarizing political debate resulting from our choice of speaker.”

“We are still fully dedicated to providing an inclusive environment and apologize that this decision did not reflect that sentiment,” the statement added.

A new keynote speaker has not yet been announced.

We reported yesterday that some in the security community felt uncomfortable and described their unease with the decision to appoint Hurd as keynote speaker. Hurd has consistently voted against legislation supporting women’s rights, including a bill that would financially support women in STEM fields, but also voting in favor of allowing states to restrict access and coverage to abortions and defunding access to women’s health organizations like Planned Parenthood.

Critics said the move alienated women at a time where diversity in security remains a challenge. Others criticized the choice of speaker on his views, calling access to women’s healthcare a human right.

Several long-time Black Hat attendees said on Twitter that they would not attend the conference following news of Hurd’s keynote.

Hurd’s office did not respond to a request for comment.

Elizabeth Warren, who earlier this year confirmed her intent to run for president in 2020, has an ambitious plan to advance entrepreneurs of color.

In a series of tweets published this morning, the Massachusetts senator proposed a $7 billion Small Business Equity Fund to provide grants to Black, Latinx, Native American and other minority entrepreneurs, if she’s elected president. The initiative will be covered by her “Ultra-Millionaire Tax,” a two-cent tax on every dollar of wealth above $50 million the presidential hopeful first outlined in January.

The fund would be managed by the Department of Economic Development, a new government entity to be constructed under the Warren administration. With a goal of creating and defending American jobs, the Department of Economic Development would replace the Commerce Department and “subsume other agencies like the Small Business Administration and the Patent and Trademark Office, and include research and development programs, worker training programs, and export and trade authorities like the Office of the U.S. Trade Representative,” Warren explained.

The Small Business Equity Fund will exclusively issue grant funding to entrepreneurs eligible to apply for the Small Business Administration’s existing 8(a) program and who have less than $100,000 in household wealth, aiming to provide capital to 100,000 new minority-owned businesses, creating 1.1 million new jobs.

Founders of color receive a disproportionate amount of venture capital funding. There’s insufficient data on the topic, but research from digitalundivided published last year suggests the median amount of funding raised by black women, for example, is $0. According to the same study, black women have raised just .0006% of all tech venture funding since 2009.

Startups founded by all-female teams, despite efforts to level the playing field for female entrepreneurs, raised just 2.2% of venture capital investment in 2018.

VCs are a majority white and male. Plus, they have a proven tendency to invest their capital into entrepreneurs who look like them or who resemble founders that were previously successful. In other words, VCs are continuously on the hunt for the next Mark Zuckerberg .

“Even if we fully close the startup capital gap, deep systemic issues will continue to tilt the playing field,” Warren wrote. “86% of venture capitalists are white, and studies show that investors are more likely to partner with entrepreneurs who look like them. This tilts the field against entrepreneurs of color. So I plan to address this disparity head on too. I will require states and cities administering my new Fund to work with diverse investment managers—putting $7 billion in the hands of minority-and women-owned managers.”

Freelance marketplace Fiverr has become closely associated with the gig economy, but Micha Kaufman argued that not all gig economy companies are created equal.

I spoke to Kaufman yesterday afternoon, after Fiverr debuted on the New York Stock Exchange and spent the day climbing to 90% above the IPO price.

As we talked about Fiverr’s community of freelancers, I brought up the driver strikes before Uber’s IPO and wondered how Kaufman can ensure freelancers can benefit from the company’s success. In response, he pointed out that Fiverr sellers are often highly-skilled, and they determine the terms of the job and of payment.

“That is very different than [some of the] other platforms called gig economy,” he said.

He added that this structure means a freelance designer in (say) San Francisco doesn’t have to worry as much about about matching the prices of someone across the world, who has much lower costs and can charge less.

Fiverr at the NYSE

“I think that if you have a market that pushes for bidding, then definitely, yes, there’s a downward pressure,” he said. “In a market where freelancers get to define their own scope, timing, and price, you see the opposite trend. What we’re seeing is freelancers all around the world making more and more money very year. It’s a counterintuitive, or countercyclical rather, race to the top.”

To get a little more specific about that: While the company’s S-1 filing doesn’t discuss the income of individual sellers, it says the total value of all transactions on the platform increased from $213 million in 2017 to $293.5 million in 2018, and that it had 255,000 active sellers at end of the first quarter of 2019.

The S-1 also reported that the company saw a net loss of $36.1 million on revenue of $75.5 million in 2018, but Kaufman noted that the losses — as measured in negative EBITDA — are shrinking: “We are on the path to profitability. That’s the balance we’re trying to keep — focusing on growth while building a business that would be profitable in the long term.”

And he suggested that one of the things that impressed Wall Street investors was the fact that Fiverr operates less like a traditional hiring site and “much more similar to traditional e-commerce businesses like Etsy and Amazon,” where you can browse and purchase the services you need.

As for how going public changes the company, Kaufman said it means he has “a larger constituency to report to now.” But beyond that, he said, “I don’t think that that’s going to change the culture of the business or our focus. What we’re trying to create is this everything store for digital services.”

Kaufman suggested there’s room for geographic expansion, particularly in non-English-speaking countries, and to add new categories of work. More broadly, he said he wants to change the fact that the vast majority of freelancers still get hired via offline channels.

“The average time to order a service on Fiverr is 15 minutes,” he said. “Why would you spend a minute more doing it any other way?”

Amazon will now allow developers to offer premium content for purchase in Alexa skills aimed at children. The company on Friday introduced new tools for building skills with in-app purchases which requires the Amazon account holder — typically mom or dad — to approve or decline the requested purchase via a text or email.

In-skill purchasing was first introduced to all U.S. Alexa developers last year, and more recently became available to international developers. But like any app aimed at children, Alexa skills needed to offer a purchase approval workflow for those in its kids’ category, or it would risk unapproved purchases initiated by younger users.

That’s where these new developer tools come in.

Now, developers can create premium kid skills using either the Alexa Skills Kit Command-Line Interface (ASK CLI) or the Alexa Developer Console. Other tools allow the skills to route purchase requests to the account holder over SMS or email. The account holder then has 24 hours to act on the request, or the request is automatically canceled.

The premium content can come in the form of either one-time purchases or subscriptions, says Amazon.

A group of developers had early access to the tools and already added premium content to their own kid skills. This includes the grand prize winner from one of Amazon’s developer contests, Kids Court; plus You Choose Superman Adventures; Travel Quest; Animal Sounds; and Master Swords.

Parents who don’t want their kids asking to buy anything have two options to opt out of all this.

They can disable the feature in the Alexa app under Settings -> Alexa Account -> Voice Purchasing -> Kid Skills Purchasing. Meanwhile, FreeTime on Alexa customers, which comes with the Echo Dot Kids Edition, won’t receive offers to purchase premium content. And those who upgrade to FreeTime Unlimited will get much of this premium content included with their subscription.

The addition of premium purchases to kid skills comes at a challenging time for Amazon.

Amazon updated its Echo Dot for kids this week with new designs and other under-the-hood features, as new lawsuits over Alexa’s children’s privacy violations were filed. The suits say Amazon recorded children’s voices without consent.

As a part of its updated Echo Dot for kids experience, Amazon said it worked with the Family Online Safety Institute (FOSI) and various industry groups to rebuild FreeTime on Alexa so that it adheres U.S. children’s privacy law, COPPA (the Children’s Online Privacy Protection Act).

Amazon now restricts Alexa skills from accessing or collecting personal information from children and offers ways for parents to delete children’s voice recordings, it says.

But its changes to the Kids Edition Echo smart speaker and related feature set don’t fully address the plaintiffs’ allegations.

According to Amazon’s announcement this week, parents can now review and delete recordings through the Alexa app or the Alexa Privacy Hub, and they can contact Customer Service to request deletion of their child’s profile. However, the lawsuits said the way Amazon manages recordings — by asking parents to take manual action — is not ideal. They point out that Apple’s Siri only stores recordings for a short period of time and then automatically deletes them.

In addition, CNET found that Amazon may retain the text transcripts even when people delete the recordings themselves.

Privacy regulations take time to catch up to the pace of technology and today’s issues around how smart speakers should operate in family homes where children are present is another example of that problem. While parents are the ones buying and installing these devices, many weren’t aware that Alexa’s intelligence is aided not only by algorithms and A.I., but by human beings on the other end who listen to recordings, check them for errors, then use this data to improve how Alexa works.

Of course, there are people who are less concerned about this sort of thing and just enjoy using the device regardless of its potential invasiveness. They may appreciate the ability to upgrade their skills and support favorite developers’ efforts, especially if the family enjoys the skills together or they feel they add value.

Amazon is not offering all developers the ability to sell through their kids skills at present. Instead, interested developers who want to kid skill with purchases can fill out a form that tells Amazon about their plans and the company will reach out if the application is selected.

On the heels of unveiling its pink-wheeled e-bikes for the San Francisco Bay Area, Lyft is doing the same for its electric scooters in Denver, Colo. Lyft says these scooters are designed to be more durable, feature a more powerful battery and a hand brake.

Upon first look, however, these scooters don’t look particularly sturdier or durable than Lyft’s first batch of scooters. The scooters were built in partnership with Segway Ninebot, which unveiled the Model Max back in January.

The Model Max was designed with the realization that wear and tear is a major issue for shared electric scooter services. It’s supposed to be stronger, have a better rider experience and more operational efficiency, with a battery that can last 37.5 miles on a single charge, compared to just 15 miles.

To help with bumpy roads, the Model Max features air-filled, 10-inch front and rear wheels, versus 8-inch ones. The scooters also feature a wider baseboard.

“With this new scooter model, Lyft is bringing rider experience to the next level,” Lyft Head of Bike, Scooter and Pedestrian Policy Caroline Samponaro said in a statement. “For the first time, Lyft scooters will also feature our iconic pink wheels, making it undeniably clear that scooters are central to Lyft’s vision for a future where cities are built around people, not private cars.”

As you may have noticed, there’s still quite a lot going on in the shared electric scooter space. Earlier this week, Bird confirmed its acquisition of Scoot, one of the two electric scooter operators approved to offer its services in San Francisco.

At the Uber Elevate Summit in Washington, D.C., Uber unveiled its latest go at electric scooters. Built in partnership with an undisclosed company, V2 of Uber’s JUMP electric scooters are designed to be sturdier and safer, thanks to a bigger frame and hand brakes.

While in D.C., I tried to use a handful of scooters from the likes of JUMP, Spin, Bird and Lyft. JUMP’s new scooter handled bumpy roads better than some of its competitors and Lyft’s V1 offered an enjoyable ride. But between dead batteries, pre-reserved scooters, scooters in need of repair, and faulty acceleration and abrupt deceleration on a scooter I finally rode, I left feeling less than enthused about shared electric scooters.

Every time I see a “the future of work is remote” article, I think to myself: “How backwards! How retro! How quaint!” That future is now, for many of us. I’ve been a fully remote developer-turned-CTO for a full decade. So I’m always baffled by people still wrestling with whether remote work is viable for their company. That jury rendered its verdict a long time ago.

One reason companies still struggle with it is that remote work amplifies the negative effects of bad practices. If everyone’s in one place, you can dither, handwave, vacillate, micromanage, and turn your workplace into an endless wasteland of unclear uncertainty, punctuated by ad-hoc last-second crisis meetings — and your employees will probably still conspire against your counterproduction to get something done, albeit much less than what they’re capable of.

If they’re remote, though, progress via conspiracy and adhocracy is no longer an option. If they’re remote, you need decisive confidence, clear direction, iterative targets, independent responsibilities, asynchronous communications, and cheerful chatter. Let me go over each of those:

Decisive confidence. Suppose Vivek in Delhi, Diego in Rio, and Miles in Berlin are all on a project. (An example I’m drawing from my real life.) It’s late your time. You have to make a decision about the direction of their work. If you sleep on it, you’re writing off multiple developer-days of productivity.

Sometimes they have enough responsibilities to have other things to work on. (More on that below.) Sometimes you don’t have to make the decision because they have enough responsibility to do so themselves. (More on that below.) But sometimes you have to make the business-level decision based on scant information. In cases like this, remember the military maxim: “Any decision is better than no decision.”

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 9am Pacific, you can subscribe here.

1. Fiverr shares climb 90% in first day of trading

Freelance marketplace Fiverr had a good first day on the New York Stock Exchange.

The company priced its IPO at $21 per share on Wednesday, raising around $111 million. It then started trading at $26, with shares climbing for most of the day and closing at $39.90 — up 90% from the IPO price.

2. Facebook backs social commerce startup Meesho in first India investment

Y Combinator alumnus Meesho is an online marketplace that connects sellers with customers on social media platforms such as WhatsApp.

3. Nintendo exec on E3, streaming and game delays

We sat down with Nintendo’s Senior Director, Corporate Communications Charlie Scibetta following the big unveils to discuss the company’s take on streaming, mobile and what things look like following the departure of Reggie Fils-Aimé.

4. Airbnb launches ‘Adventures’ for tourists seeking more thrills

Airbnb Adventures is effectively a collection of tours and trips lasting between three days and a week that go beyond the usual city walking tour.

5. Binance begins to restrict US users ahead of regulatory-compliant exchange launch

Binance, which processes more than $1 billion on a daily basis and for so long has embodied crypto’s Wild West culture, announced that it will launch a U.S.-based service — but, in the meantime, it is implementing restrictions for U.S. passport holders worldwide and those based in the country.

6. A widely used infusion pump can be remotely hijacked, say researchers

Researchers at healthcare security firm CyberMDX found two vulnerabilities in the Alaris Gateway Workstation, developed by medical device maker Becton Dickinson.

7. Why is Andreessen Horowitz (and everyone else) investing in Latin America now?

Investments by U.S. venture capital firms into Latin America are skyrocketing, and one of the firms leading the charge into deals is none other than Silicon Valley’s Andreessen Horowitz. (Extra Crunch membership required.)

After only a few years, Microsoft’s free Visual Studio Code has become one of the most popular code editors on the market. One of VS Code’s advantages is its flexibility. This flexibility does come with some complexity when it comes to getting everything set up. Today, the company launched a new project that makes it significantly easier to get started with writing Java on VS Code.

Recently, a Microsoft spokesperson told us, the VS Code team noticed that it was still difficult for some developers, including students and novices programmers, to set up their Java development environments. Typically, this is a pretty involved process that includes installing a number of binaries and VS Code extensions.

To help these developers, Microsoft today launched an installer that handles all of this for them. It first looks at whether a JDK is already installed or not. If not, it’ll install a binary from AdoptOpenJDK (which Microsoft sponsors), install VS Code if needed and the Java Extension Pack. AdoptOpenJDK, which is essentially a vendor-neutral alternative to the Oracle JDK, is now Microsoft’s recommended Java distribution for users who install the VS Code Java extension.

Currently, the installer is only available for Windows, but the team plans to expand its availability once it sees interest by the community.

An internet advertising company specializing in helping law firms sign up potential clients has exposed close to 150,000 records from a database that was left unsecured.

The database contained submissions as part of a lead-generation effort by X Social Media, a Florida-based ad firm that largely uses Facebook to advertise various campaigns for its law firm customers. Law firms pay the ad company to set up individual websites that aim to sign up victims from specific categories of harm and injuries — from medical implants, malpractice, sexual abuse and more — who submit their information in the hope of receiving legal relief.

But the database was left unprotected and without a password, allowing anyone to look inside.

Security researchers Noam Rotem and Ran Locar found the database and reported it to the company, which pulled the database offline. The researchers also shared their discovery exclusively with TechCrunch and posted their findings on vpnMentor.

The database contained names, addresses, phone numbers, the date and time of a person’s submission and the circumstances and explanation of their accident, injury or illness. Often this included personal health information, sensitive medical information, details of procedures or the consumption of certain medications or specifics of traumatic events.

Several records seen by TechCrunch include records from campaigns targeting combat veterans who were injured on duty. Other campaigns sought to sign up those who suffered illnesses from pesticides or medications.

Other campaigns included soliciting claims for sexual abuse. We found several names, postal and email addresses and phone numbers of victims, many of which also described their sexual abuse as part of filling out the website form.

One of the records in the database

The researchers said the exposed data could be “easily traced” back to the individuals who filled out the website forms.

The exposed database also contained a list of more than 300 law firms who paid X Social Media to set up the lead-generation operation. It also contained records of how much each law firm paid the ad company — in some cases amounting to tens of thousands of dollars. The database also contained the bank routing and account numbers of the ad company, which law firms used to pay the company for its services.

In reporting this story, we found a second, smaller database. In an effort to get the database secured, we provided the IP address to Jacob Malherbe, founder of X Social Media, in an email. Within an hour, the database had been pulled offline.

Despite this, Malherbe denied that the company stored medical data, described the findings as “inaccurate” and asked we “direct all other emails to our company lawyers.”

When presented with several files containing the data, Malherbe responded:

After being notified by TechCrunch about a security problems in MongoDB the X Social Media developer team immediately shut down the vulnerability create [sic] by a MongoDB database and did a night long log file review and we only found the two IP addresses, associated with TechCrunch accessing our database. Our log files show that nobody else accesses the database while in transit. We will continue to investigating this incident and work closely with state and Federal agencies as more information becomes available.

When asked, Malherbe declined to provide the logs to verify his claims. The company also wouldn’t say how long the database was exposed.

This is the latest exposed database found by the researchers in recent months.

The researchers have previously found data leaking on Fortune 500 firm Tech Data, exposed user records and private messages of Jewish dating app JCrush and leaking data from Canadian cell network Freedom Mobile and online retailer Gearbest.

Read more:

• Fortune 500 giant Tech Data exposed customer and billing data
• Jewish dating app JCrush exposed user data and private messages
• Rela, a Chinese lesbian dating app, exposed 5 million user profiles
• At Blind, a security lapse revealed private complaints from Silicon Valley employees
• Donald Daters, a dating app for Trump supporters, leaked its users’ data
• Security lapse exposed private Theta photos
• After breach, Stack Overflow says some user data exposed
• An unsecured SMS spam operation doxxed its owners

Rivian, the once secretive company that made its public debut in November with an electric pickup truck and SUV, plans to give its batteries a second life and put them to work in a solar microgrid project in Puerto Rico.

The automaker is teaming up with The Honnold Foundation, an organization started by Alex Honnold, the professional climber and subject of the documentary Free Solo, on the microgrid project. Honnold and Rivian CEO RJ Scaringe will discuss the project Saturday in Denver. The discussion, which is scheduled for 6 pm MT, will be live streamed.

The microgrid project will be set up in Adjuntas, a city of about 20,000 people in midwestern Puerto Rico that was severely impacted by Hurricane Maria in 2017. Casa Pueblo, an environmental watchdog based in Adjuntas that has been looking for ways to setup affordable sources of community power, is also a partner in the project.

Rivian is providing 135 kilowatt-hour battery packs from its development vehicles to support the microgrid. Earlier this year, battery engineers from Rivian and The Honnold Foundation visited Casa Pueblo and met with community leaders to design a site-specific system that will power many of the businesses located in the Adjuntas town square.

The downtown solar microgrid project will serve two purposes. It will give residents access to electricity for core business if the primary source of power is gone. The microgrid will also be used daily to offset the high cost of energy in Puerto Rico, which is twice the national average of the U.S.

The system is expected to launch in 2020.

“Second-life batteries are a big enabler to accelerating widespread adoption of renewable energy, and it’s exciting to envision this system contributing importantly to a community. This project allows us to model a customized energy storage solution that takes into account space constraints, disaster resiliency and energy independence,” Scaringe said.

The project marks the beginning of the company’s long-term plans to find a wide variety of applications for second-life batteries.

The company designed its pack, module, and battery management system to transition from vehicle energy storage to stationary energy storage at the end of their vehicle life. The module itself is thin, a design that allows for second-life applications that are space-efficient and customizable.

Rivian is an electric automaker focused on adventure vehicles like pickup trucks and sport utility vehicles. The company announced in February that it had raised $700 million in a round led by Amazon.

The company has spent the first part of its life operating out of the public eye. It was originally launched as Mainstream Motors in 2009. By 2011, the name changed to Rivian and moved out of Florida. Today, the company has more than 1,000 employees split between development locations in Plymouth, Michigan, San Jose and Irvine, California and Surrey, England. It also has a 2.6 million-square-foot factory in Normal, Illinois.

Rivian plans to launch the R1T electric pickup truck and the R1S SUV in the U.S. in late 2020, with introduction to other global geographies starting in 2021.