Year: 2019

Facebook and Google were far from the only developers openly abusing Apple’s Enterprise Certificate program meant for companies offering employee-only apps. A TechCrunch investigation uncovered a dozen hardcore pornography apps and a dozen real-money gambling apps that escaped Apple’s oversight. The developers passed Apple’s weak Enterprise Certificate screening process or piggybacked on a legitimate approval, allowing them to sidestep the App Store and Cupertino’s traditional safeguards designed to keep iOS family friendly. Without proper oversight, they were able to operate these vice apps that blatantly flaunt Apple’s content policies.

The situation shows further evidence that Apple has been neglecting its responsibility to police the Enterprise Certificate program, leading to its exploitation to circumvent App Store rules and forbidden categories. For a company whose CEO Tim Cook frequently criticizes its competitors for data misuse and policy fiascos like Facebook’s Cambridge Analytica, Apple’s failure to catch and block these porn and gambling demonstrates it has work to do itself.

 

TechCrunch broke the news last week that Facebook and Google had broken the rules of Apple’s Enterprise Certificate program to distribute apps that installed VPNs or demanded root network access to collect all of a user’s traffic and phone activity for competitive intelligence. That led Apple to briefly revoke Facebook and Google’s Certificates, thereby disabling the companies’ legitimate employee-only apps which caused office chaos.

Apple issued a fiery statement that “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.” Meanwhile, dozens of prohibited apps were available for download from shady developers’ websites.

The problem starts with Apple’s lax standards for accepting businesses to the enterprise program. The program is for companies to distribute apps only to their employees, and its policy explicitly states “You may not use, distribute or otherwise make Your Internal Use Applications available to Your Customers”. Yet Apple doesn’t adequately enforce these policies.

Developers simply have to fill out an online form and pay $299 to Apple, as detailed in this guide from Calvium. The form merely asks developers to pledge they’re building an Enterprise Certificate app for internal employee-only use, that they have the legal authority to register the business, provide a D-U-N-S business ID number, and have an up to date Mac. You can easily Google a business’ address details and look up their D-U-N-S ID number with a tool Apple provides. After setting up an Apple ID and agreeing to its terms of service, businesses wait one to four weeks for a phone call from Apple asking them to reconfirm they’ll only distribute apps internally and are authorized to represent their business.

With just a few lies on the phone and web plus some Googleable public information, sketchy developers can get approved for an Apple Enterprise Certificate.

Given the number of policy-violating apps that are being distributed to non-employees using registrations for businesses unrelated to their apps, it’s clear that Apple needs to tighten the oversight on the Enterprise Certificate program. TechCrunch found thousands of sites offering downloads of “sideloaded” Enterprise apps, and investigating just a sample uncovered numerous abuses.  Using a standard un-jailbroken iPhone. TechCrunch was able to download and verify 12 pornography and 12 real-money gambling apps over the past week that were abusing Apple’s Enterprise Certificate system to offer apps prohibited from the App Store. These apps either offered streaming or pay-per-view hardcore pornography, or allowed users to deposit, win, and withdraw real money — all of which would be prohibited if the apps were distributed through the App Store.

In an apparent effort to step up policy enforcement in the wake of TechCrunch’s investigation into Facebook and Google’s Enterprise Certificate violations, Apple appears to have disabled some of these apps in the past few days, but many remain operational. The porn apps that we discovered which are currently functional include Swag, PPAV, Banana Video, iPorn (iP), Pear, Poshow, and AVBobo, while the currently functional gambling apps include RD Poker and RiverPoker.

The Enterprise Certificates for these apps were rarely registered to company names related to their true purpose. The only example was Lucky8 for gambling. Many of the apps used innocuous names like Interprener, Mohajer International Communications, Sungate, and AsianLiveTech. Yet others seemed to have forged or stolen credentials to sign up under the names of completely unrelated but legitimate businesses. Dragon Gaming was registered to US gravel supplier CSL-LOMA. As for porn apps, PPAV’s certificate is assigned to the Nanjing Jianye District Information Center, Douyin Didi was licensed under Moscow motorcycle company Akura OOO, Chinese app Pear is registered to Grupo Arcavi Sociedad Anonima in Costa Rica, and AVBobo covers its tracks with the name of a Fresno-based company called Chaney Cabinet & Furniture Co.

You can see a full list of the policy violating apps we found below:

Apple refused to explain how these apps slipped into the Enterprise Certificate app program. It declined say if it does any follow-up compliance audits on developers in the program or if it plans to change admission process. An Apple spokesperson did provide this statement, though, indicating it will work to shut these apps down and potentially ban the developers from building iOS products entirely:

“Developers that abuse our enterprise certificates are in violation of the Apple Developer Enterprise Program Agreement and will have their certificates terminated, and if appropriate, they will be removed from our Developer Program completely. We are continuously evaluating the cases of misuse and are prepared to take immediate action.”

TechCrunch asked Guardian Mobile Firewall’s security expert Will Strafach to look at the apps we found and their Certificates. Strafach’s initial analysis of the apps didn’t find any glaring evidence that the apps misappropriate data, but they all do violate Apple’s Certificate policies and provide content banned from the App Store. “At the moment, I have noticed that action is slower regarding apps available from an independent website and not these easy-to-scrape app directories” that occasionally crop up offering centralized access to a plethora of sideloaded apps.

Strafach explained how “A significant number of the Enterprise Certificates used to sign publicly available apps are referred to informally as ‘rogue certificates’ as they are often not associated with the named company. There are no hard facts to confirm the manner in which these certificates originate, but the result of the initial step is that individuals will gain control of an Enterprise Certificate attributable to a corporation, usually China/HK-based. Code services are then sold quietly on Chinese language marketplaces, resulting in sometimes 5 to 10 (or more) distinct apps being signed with the same Enterprise Certificate.” We found Sungate and Mohajer Certificates were farmed out for use by multiple apps in this way.

“In my experience, Enterprise Certificate signed apps available on independent websites have not been harmful to users in a malicious sense, only in the sense that they have broken the rules” Strafach notes. “Enterprise Certificate signed apps from these Chinese ‘helper’ tools, however, have been a mixed bag. Zoe example, in multiple cases, we have noticed such apps with additional tracking and adware code injected into the original now-repackaged app being offered.”

Amazon Lockers are coming to a new location: Coachella. The retailer says it will make its storage lockers available to festival-goers, allowing them to order both in advance and same-day to have items like sunscreen, hats, phone chargers and more delivered to an on-site locker at the event at no extra charge during the festival weekends of April 12 through 14 and April 19 through 21.

Ahead of the event, Amazon will also launch a dedicated Coachella storefront on its retail site, where customers can shop festival needs in advance across categories like fashion & accessories, beauty, health & wellness, tech, and camping gear.

To use the new festival Locker system, customers will be able to select one of the Amazon Lockers at Coachella during the checkout process as the shipping address. When the package arrives for pickup, the customers will be sent an email with a barcode that they’ll use to pick up the package.

Amazon says the Lockers will have a dedicated place at the festival and will be staffed by team members in case of any issues that arise.

An Amazon spokesperson confirmed that all shipping options will be available to the Coachella Lockers than are currently available to all Lockers not at the festival.

The retailer today operates Lockers in over 900 cities and towns across the U.S. as an alternative for those who don’t want to take delivery at work or at home. Lockers eliminate issues around package theft concerns, and work well for customers whose “homes” are actually shared spaces, like college dorms. They also allow for convenient returns and can help customers receive some items faster, as they offer a centralized delivery location for package drop off.

However, Amazon Lockers are usually permanent installations – at Whole Foods, local 7-Eleven stores, or other area businesses.

The retailer says this is the first time it’s brought Lockers to Coachella. It also appears to be the first time that Amazon has set up temporary Lockers at all, outside of hurricane relief efforts.

The deal with the large music festival is likely just as much about advertising the Amazon and Prime brands as well as the retailer’s same-day delivery service to a large, receptive audience, as it is a decision to cater to the festival market as a strategy for Amazon Lockers. That said, if the Coachella Lockers prove to be a big success, it wouldn’t be surprising to see Amazon set up Lockers at other events. But Amazon has no announced plans in that direction at this point in time.

The move also speaks to the flexibility of Amazon’s delivery operations – that it can drop in a few lockers over a weekend, then cash in on the uptick in sales from attendees.

“We want customers to make the most out of their weekend at Coachella,” said Patrick Supanc, Amazon Worldwide Director of Lockers and Pickup, in a statement about Amazon’s plans. “Bringing the convenience of Amazon Lockers to Coachella will help customers focus on their experience instead of worrying about forgetting something at home or having to carry it in with them.”

 

 

The founders of Glide, a member of the Y Combinator Winter 2019 class, had a notion that building mobile apps in the enterprise was too hard. They decided to simplify the process by starting with a spreadsheet, and automatically turning the contents into a slick mobile app.

David Siegel, CEO and co-founder at Glide, was working with his co-founders Jason Smith, Mark Probst and Antonio Garcia Aprea at Xamerin, a cross-platform mobile development company that Microsoft acquired for $500 million in 2016. There, they witnessed first-hand the difficulty that companies were having building mobile apps. When their two-year stint at Microsoft was over, the four founders decided to build a startup to solve the problem.

“We saw how desperate some of the world’s largest companies were to have a mobile strategy, and also how painful and expensive it is to develop mobile apps. And we haven’t seen significant progress on that 10 years after the smartphone debuted,” Siegel told TechCrunch.

The founders began with research, looking at almost 100 no-code tools and were not really satisfied with any of them. They chose the venerable spreadsheet, a business tool many people use to track information, as the source for their mobile app builder, starting with Google Sheets.

“There’s a saying that spreadsheets are the most the most successful programming model of all time, and smartphones are the most successful computers of all time. So when we started exploring Glide we asked ourselves, can these two forces be combined to create something very valuable to let individuals and businesses build the type of apps that we saw Xamerin customers needed to build, but much more quickly,” Siegel said.

The company developed Glide, a service that lets you add information to a Google Sheet spreadsheet, and then very quickly create an app from the contents without coding. “You can easily assemble a polished, data-driven app that you can customize and share as a progressive web app, meaning you can get a link that you can share with anybody, and they can load it in a browser without downloading an app, or you can publish Glide apps as native apps to app stores,” Siegel explained. What’s more, there is a two-way connection between app and spreadsheet, so that when you add information in either place, the other element is updated.

The founders decided to apply at Y Combinator after consulting with former Xamerin CEO, and current GitHub chief executive, Nat Friedman. He and other advisors told them YC would be a great place for first-time founders to get guidance on building a company, taking advantage of the vast YC network.

One of the primary lessons he says that they have learned is the importance of getting out in the field and talking to customers, and not falling into the trap of falling in love with the act of building the tool. The company has actually helped fellow YC companies build mobile apps using the Glide tool.

Glide is live today and people can create apps using their own spreadsheet data, or using the templates available on the site as a starting point. There is a free tier available to try it without obligation.

Biomanufacturing technologies — taking modified versions of existing organisms and bending them to the will of humans — has moved from the world of science fiction to becoming a new reality.

Across the startup landscape companies are launching to make synthetic spider silk, or make leather substitutes, or meat substitutes, or novel chemicals and pharmaceuticals.

What all of these companies have in common is that they need to be able to rapidly experiment with different organisms and processes for cultivating them to make their visions work at a commercial scale — and that’s where Culture Biosciences comes in.

The company was founded by two Chapel Hill, N.C. natives and Duke alums Matthew Ball and Will Patrick. The two met in college at Duke and worked together in Google’s famous skunkworks division (then known as Google X).

After leaving Google, Patrick, the company’s chief executive, wound up at MIT’s Media Lab where he was exposed to the work that companies like Gingko Bioworks was doing around biomanufacturing and became convinced that it would be transformational by human society.

“I was becoming incredibly inspired by all of that,” says Patrick. “What I was noticing was that the problem and the bottleneck in the industry was moving from industrial design to scale-up.”

The solution to that bottleneck rested in making the fermentation process more precise and more controlled, Patrick thought.

Think of biomanufacturing as a process similar to brewing beer. Organisms are sitting in a soup of goo, eating some things and excreting other things and all of that needs to be controlled. It’s one thing to be able to control the growth and extraction of goo in a test tube, quite another to do it at the scale of a hundred-gallon sized tanks.

“There are these really challenging aspects of operating bioreactors, sampling, and testing and getting data,” said Patrick . “We have been able to create this infrastructure that we can scale out.”

The company has built its own hardware — including customized robotics, sensors, and networks for its bioreactors, which, at 250 milliliters, are roughly the size of coke cans.

“That was the problem we were solving with Culture Biosciences,” says Patrick. “We do cloud fermentation.” 

The company, which just raised $5.5 million from investors including Refactor Capital, and Verily, the life sciences division of Google parent company, Alphabet, already has 50 bioreactors and is going to be scaling up to 100 really rapidly.

“What we’re helping [customers] with is making their R&D much more high throughput,” says Patrick.

Those customers include companies like Geltor, the manufacturer of a collagen replacement; Modern Meadow, the company that’s looking to make a leather replacement; and Pivot Bio, which makes supplements for agriculture to replace chemical fertilizers.

Verily and Refactor aren’t the only two investors to be impressed by Culture’s technology. Section 32, the investment shop founded by Google Ventures’ former chief executive Bill Maris, Y Combinator, BoxGroup, Shana Fisher from Third Kind Venture Capital, and Data Collective are also investors in the company.

Culture Biosciences actually shares office space with Verily, working from that company’s shared office space in South San Francisco, which was built to house startup companies in the life sciences space.

With Culture, the biomanufacturing industry and the investors who are supporting it seem to be learning one of the critical lessons from the last wave of big bets on biology — in biofuels.

“That first wave in the 2000s there were lots of lessons that were learned.” says Patrick. “You have to think with the end in mind. What can those systems actually deliver from a technical perspective? Replicate those large scale environments as much as you can in your small scale lab… Not having to compete with oil really helps.”

[gallery ids="1781816,1781815,1781811"]

Mode, a five-year-old collaborative analytics platform based in San Francisco, has raised $23 million in Series C funding led by Valor Equity Partners.

Foundation Capital and REV Venture Partners, who led Mode’s Series A and B financing rounds, respectively, also joined the round, which brings the company’s total funding to $50 million altogether.

In some ways, the investment is a bet on the continuing need for data scientists, despite the many companies that are focused on making data analysis available and understandable to a broader swath of employees, like Snowflake and BigQuery.

The way Mode cofounder and CEO Derek Steer sees it, owing to today’s tools, organizations may need fewer data scientists. But they need also to better empower those individuals to quickly and effective answer key questions, like how clients are using their product in unexpected ways, and how companies can take advantage of trends they are seeing in the data, and other business intelligence questions. Mode does this through an integrated SQL editor, Python, R notebooks, and visualization builder that it says give users the flexibility to choose the level of abstraction they want for a given dataset.

The investment is also a bet on Steer, says David Obrand, a partner at Valor who is joining the board, and who worked previously with Steer at Yammer, the enterprise-level social networking site that was acquired by Microsoft in 2012.

Obrand, who’d been Yammer’s chief customer officer, credits Steer as “key in accelerating [Yammer’s]  path as a data driven business.” He says further that Steer “embodies the persona of the customer he’s serving.”

As importantly, at Yammer, Steer learned how to build a “freemium” software business that’s adopted by an organization after a small set of employees begins actively using its free version. Indeed, Mode’s playbook is much the same, giving data scientists access to a free product called Mode Studio with the hope that, for many, it will become core to their workflow, and they’ll then ask a broader team of decision-makers across the organization to use it, too.

That plan appears to be working. Steer tells us 600 organizations now use Mode, including Twitch, Lyft, Shopify, Meredith, and Conde Nast. And while he says he isn’t certain of the exact percentage of users that are paying the company for its tools, its newest round suggests the number is meaningful.

Right now, Mode targets companies with up to 5,000 seats. It also caters largely to a U.S. audience.

With its new capital, the company plans to expand geographically, including hiring employees outside of San Francisco for the first time. Steer suggests to expect new features. The company also plans to expand each of its departments, focusing on its community efforts in particular.

As tech companies continue their race to control the smart home, a promising energy startup has raised a round of funding from traditionally-tech and strategic investors, for a geothermal solution to heat and cool houses. Dandelion Energy, a spinout from Alphabet X, has raised $16 million in a Series A round of funding, with strategic investors Comcast Ventures leading the round along with GV, the investment arm of Alphabet formerly known as Google Ventures.

Lennar Corporation, the home building giant, is also coming in as an investor, as are previous backers NEA, Collaborative Fund, Ground Up, and Zhenfund, and other unnamed investors. Notably, Lennar once worked with Apple but is now collaborating with Amazon on smart homes.

As a side note, Dandelion’s investment is a timely reminder of how central “new home” startups are right now in smart home plays. Amazon just yesterday announced one more big move in its own connected home strategy with the acquisition of Mesh WiFi startup eero, which helps extend the range and quality of WiFi coverage in a property.

This is the second funding round for Dandelion in the space of a year, after the company raised a seed round of $4.5 million in March 2018, a mark of how the company has been seeing a demand for its services and now needs the capital to scale. In the past year, it had accrued a waitlist of “thousands” of homeowners requesting its services across America, where it is estimated that millions of homeowners heat their homes with fossil fuels, which are estimated to account for 11 percent of all carbon emissions.

The company is based out of New York, and for now New York is the only state where its services are offered. The funding may help change that. It will be used in part for R&D, but also to hire more people, open new warehouses for its equipment and supplies, and for business development.

It’s not clear what Dandelion’s valuation is — we will be asking — but in its last round the company had a modest post-money valuation of $15 million, according to PitchBook. It has now raised $23 million in total since spinning out from Alphabet X, the company’s moonshot lab, in May 2017.

The premise of Dandelion’s business is that it provides a source of heating and cooling homes that takes people away from consuming traditional, energy grid-based services — which represent significant costs, both in terms of financial and environmental impact. If you calculate usage over a period of years, Dandelion claims that it can cut a household’s energy bills in half while also being significantly more friendly for the environment compared to conventional systems that use gas and fossil fuels.

While there have been a number of efforts over the years to tap geothermal currents to provide home heating and cooling, many of the solutions up to now have been challenging to put in place, with services typically using wide drills and digging wells at depths of over 1,000 feet.

“These machines are unnecessarily large and slow for installing a system that needs only a few 4” diameter holes at depths of a few hundred feet,” Kathy Hannun, cofounder and CEO of Dandelion, has said in the past. “So we decided to try to design a better drill that could reduce the time, mess and hassle of installing these pipes, which could in turn reduce the final cost of a system to homeowners.”

The smaller scale of what Dandelion builds also means that the company can do an installation in one day.

While a pared-down approach this means a lower set of costs (half the price of traditional geothermal systems) and quicker installation, that doesn’t mean that upfront costs are non-existent. Dandelion installations run between $20,000 and $25,000, although home owners can subsequently rack up savings of $35,000 over 20 years. (Many choose to finance the installation which also brings down the upfront cost.)

This is also where Lennar comes in. The company is in the business of building homes, and it has been investing in particular in the idea of building the next generation of homes by incorporating better connectivity, more services — and potentially alternative energy sources — from the ground up.

“We’re incredibly excited to invest in Dandelion Energy,” said Eric Feder, Managing General Partner for Lennar Ventures, in a statement. “The possibility of incorporating geothermal heating & cooling systems in our new homes is something we’ve explored for years, but the math never made sense. Dandelion Energy is finally making geothermal affordable and we look forward to the possibility of including it in the homes Lennar builds.”

The fact that Comcast is among the investors in Dandelion is a very notable development.

The company has been acquiring, and taking strategic stakes in, a number of connected-home businesses as it builds its own connected home offering, where it not only brings broadband and entertainment to your TV and come computers, and also provides the tools to link up other connected devices to that network to control them from a centralised point.

Dandelion is literally “off grid” in its approach to providing home energy, and while you might think that it doesn’t make sense for a company that is investing in and peddling services and electronic devices connected to a centralised (equally electricity-consuming) internet to be endorsing a company that’s trying to build an alternative, it actually does.

Viewed in terms of the segment of customers that Comcast is targeting, it’s selling a bundle of connected home services to a demographic of users who are not afraid of using (and buying) new and alternative technology to do things a different way from how their parents did it. Dandelion may not be “connected” but even its approach to disconnecting will appeal to a person who may already be thinking of ways of reducing his or her carbon footprint and energy bills (especially since they may be consuming vast amounts of electricity to run their connected homes).

“The home heating and cooling industry has been constrained by lack of innovation and high-costs,” said Sam Landman, managing director of Comcast Ventures, in a statement. “The team at Dandelion and their modern approach to implementing geothermal technology is transforming the industry and giving consumers a convenient, safe, and cost-effective way to heat and cool their homes while reducing carbon emissions.”

Landman and Shaun Maguire, a partner at GV, will both be joining Dandelion’s board with this round.

“In a short amount of time, Dandelion has already proven to be an effective and affordable alternative for home heating and cooling, leveraging best-in-class geothermal technology,” said Maguire, in a statement. “Driven by an exceptional leadership team, including CEO Kathy Hannun, Dandelion Energy is poised to have a meaningful impact on adoption of geothermal energy solutions among homeowners.”

Walmart in 2016 said it would begin testing last-mile delivery using services like Uber, Lyft, and Deliv to bring customers’ orders, including groceries, to their homes. Last year, Walmart ended its grocery delivery deal with Uber and Lyft, and today it’s ending the deal with Deliv as well, according to a report from Reuters.

Deliv had started working with Walmart in pilot markets, including Miami and San Jose, as one of the few services Walmart was testing for last-mile deliveries at the time. The retailer has since significantly expanded its delivery operations through an array of partners to markets across the U.S., in relatively short order.

Walmart this morning confirmed to TechCrunch that Deliv was not a large part of its operations. The retailer said Deliv was only working with 3 Walmart stores out of the total 800, and in only 1 market out of 100, at the time the deal ended.

The retailer in 2018 said it was on track to expand grocery delivery to more than 40 percent of U.S. households by year-end, meaning a jump from just 6 markets to over 100 metros during a year’s time. Uber and Lyft, however, were dropped in May 2018, as Walmart shifted more of its deliveries to other partners, like Postmates and DoorDash.

Last month, Walmart added a handful of new partners, as well, including Point Pickup, Skipcart, AxleHire and Roadie. It said it planned to expand grocery delivery from the 800 stores in 100 U.S. metros where it’s live now, to double that number by the end of 2019.

In Canada, Walmart works with Instacart, which also partners with Walmart’s Sam’s Club in the U.S.

Despite the quick expansion, Walmart’s decision to work with third-party courier services instead of bringing delivery operations in-house has led to some problems. Simple tasks, like allowing customers to change pickup orders to delivery or vice versa, are often impossible. Technical and logistical issues also often can’t be communicated directly from drivers to Walmart, but have to go through the third-party delivery partner.

According to Reuters, Deliv drivers were frequently having to wait up to 40 minutes for grocery orders when they arrived at the store for pickup, as Walmart was unable to process the online orders fast enough, the report claimed. The report also said delivery volume was low in some Walmart delivery markets, and orders had to travel long distances, which caused both Walmart and Deliv to lose money at times.

Related to Walmart’s decision to end its partnership with Deliv, the companies will also no longer operate the keyless entry test in partnership with smart lock maker August Home. Announced in fall 2017, the test would allow customers with August smart home devices to have their packages delivered inside their home, instead of left on the doorstep.

This gives Amazon an advantage in keyless entry, as its Key by Amazon product last month expanded to include garage and business delivery, new locks and Ring compatibility.

“In 2017 we began a pilot program with Deliv in San Jose to understand how the Walmart Grocery Delivery model would work with a scheduled platform,” a Walmart spokesperson told TechCrunch, confirming the news.

“As with any pilot, the intent is to learn and ultimately came to the conclusion that Deliv’s platform was not the best fit for our program. Today, we work with a number of third-party delivery companies operating an on-demand based platform, and we will continue to test different delivery approaches that will help us continue to learn,” they added.

Deliv raised $40 million in Series C funding last October, from Google, Clayton Venture Partners, UPS, General Catalyst Partners, The Macerich Company, PivotNorth Capital, RPM Ventures, and Upfront Ventures. It also works with Best Buy, Macy’s, Home Depot and Walgreens.

 

Datadog, the popular monitoring and analytics platform, today announced that it has acquired Madumbo, an AI-based application testing platform.

“We’re excited to have the Madumbo team join Datadog,” said Olivier Pomel, Datadog’s CEO. “They’ve built a sophisticated AI platform that can quickly determine if a web application is behaving correctly. We see their core technology strengthening our platform and extending into many new digital experience monitoring capabilities for our customers.”

Paris-based Madumbo, which was incubated at Station F and launched in 2017, offers its users a way to test their web apps without having to write any additional code. It promises to let developers build tests by simply interacting with the site, using the Madumbo test recorder, and to help them build test emails, password and testing data on the fly. The Madumbo system then watches your site and adapts its check to whatever changes you make. This bot also watches for JavaScript errors and other warnings and can be integrated into a deployment script.

The team will join Datadog’s existing Paris office and will work on new products, which Datadog says will be announced later this year. Datadog will phase out the Madumbo platform over the course of the next few months.

“Joining Datadog and bringing Madumbo’s AI-powered testing technology to its platform is an amazing opportunity,” said Gabriel-James Safar, CEO of Madumbo. “We’ve long admired Datadog and its leadership, and are excited to expand the scope of our existing technology by integrating tightly with Datadog’s other offerings.”

In case you hadn’t seen, Amazon is buying router maker Eero. And in case you hadn’t heard, people are pretty angry.

Deluged in a swarm of angry tweets and social media posts, many have taken to reading tealeaves to try to understand what the acquisition means for ordinary privacy-minded folks like you and me. Not many had much love for Amazon on the privacy front. A lot of people like Eero because it wasn’t attached to one of the big tech giants. Now it’s to be part of Amazon, some are anticipating the worst for their privacy.

Of the many concerns we’ve seen, the acquisition boils down to a key concern: “Amazon shouldn’t have access to all internet traffic.”

Rightfully so! It’s bad enough that Amazon wants to put a listening speaker in every corner of our home. How worried should you be that Amazon flips the switch on Eero and it’s no longer the privacy-minded router it once was?

This calls for a lesson in privacy pragmatism, and one of cautious optimism.

Don’t panic — yet

Nothing will change overnight. The acquisition will take time, and any possible changes will take longer. Eero has an easy to read privacy policy, and the company tweeted that the company will “continue to protect” customer privacy, noting that Eero “does not track customers’ internet activity and this policy will not change with the acquisition.”

That’s true! Eero doesn’t monitor your internet activity. We scoured the privacy policy, and the most the router collects is some basic information from each device connecting to the router that it already broadcasts, such as device name and its unique networking address. We didn’t see anything beyond boilerplate language for a smart router. And there’s nothing in there that says even vaguely that Eero can or will spy on your internet traffic.

Among the many reasons, it (mostly) couldn’t even if it wanted to.

Every single time you open an app or load a website, most now load over HTTPS. And most do because Google has taken to security-shaming sites that don’t. That’s an encrypted connection between your computer and the app or website. Not even your router can see your internet traffic. It’s only rare cases like Facebook’s creepy “research” app that forces you to give it “root” access to your device’s network traffic when companies can snoop on everything you do.

If Eero starts asking you to install root certificates on your devices, then we have a problem.

Fear the internet itself

The reality is that your internet service provider knows more about your internet activity than your router does.

Your internet provider not only processes your internet requests, it routes and directs them. Even when the traffic is HTTPS-encrypted, your internet provider for the most part knows which domains you visit, and when, and with that it can sometimes figure out why. With that information, your internet provider can piece together a timeline of your online life. It’s the reason why HTTPS and using privacy-focused DNS services are so important.

It doesn’t stop there. Once your internet traffic goes past your router, you’re into the big wide world of the world wide web. Your router is the least of your troubles: it’s a jungle of data collection out there.

Props to the spirited gentleman who tweeted that he trusts Google “way more with my privacy than Amazon” for the sole reason that, “Amazon wants to use the data to sell me more stuff vs. Google just wants to serve targeted ads.” Think of that: Amazon wants to sell you products from its own store, but somehow that’s worse than Google selling its profiles of who it thinks you are to advertisers to try to sell you things?

Every time you go online, what’s your first hit? Google. Every time you open a new browser window, it’s Google. Every time you want to type something in to the omnibar at the top of your browser, it’s Google. Google knows more about your browsing history than your router does because most people use Google as their one-stop directory for all they need on the internet. Your internet provider may not be able to see past the HTTPS domain that you’re visiting, but Google, for one, tracks which search queries you type, which websites you go to, and even tracks you from site-to-site with its pervasive ad network.

At least when you buy a birthday present or a sex toy (or both?) from Amazon, that knowledge stays in-house.

Knock knock, it’s Amazon already

If Amazon wanted to track you, it already could.

Everyone seems to forgets Amazon’s massive cloud business. Most of the internet these days runs on Amazon Web Services, the company’s dedicated cloud unit that made up all of the company’s operating income in 2017. It’s a cash cow and an infrastructure giant, and its retail prowess is just part of the company’s business.

Think you can escape Amazon? Just look at what happened when Gizmodo’s Kashmir Hill tried to cut out Amazon from her life. She found it “impossible.” Why? Everything seems to rely on Amazon these days — from Spotify and Netflix’s back-end, popular consumer and government websites use it, and many other major apps and services rely on Amazon’s cloud. She ended up blocking 23 million IP addresses controlled by Amazon, and still struggled..

In a single week, Hill found 95,260 total attempts by her devices to communicate with Amazon, compared to less than half that for Google at 40,527 requests, and a paltry 36 attempts for Apple. Amazon already knows which sites you go to — because it runs most of them.

So where does that leave me?

Your router is a lump of plastic. And it should stay that way. We can all agree on that.

It’s a natural fear that when “big tech” wades in, it’s going to ruin everything. Especially with Amazon. The company’s track record on transparency is lackluster at best, and downright evasive at its worst. But just because Amazon is coming in doesn’t mean it’ll necessarily become a surveillance machine. Even Google’s own mesh router system, Eero’s direct competitor, promises to “not track the websites you visit or collect the content of any traffic on your network.”

Amazon can’t turn the Eero into a surveillance hub overnight, but it doesn’t mean it won’t try.

All you can do is keep a close eye on the company’s privacy policy. We’ll do it for you. And in the event of a sudden change, we’ll let you know. Just make sure you have an escape plan.

InVision, the design company valued at $1.9 billion, has today announced the acquisition of Australia-based Trunk.

Trunk is focused wholly on file versioning for designers. In the world of engineering, GitHub has provided a way for developers to keep versions organized — developers can track changes, create a separate branch to experiment, and collaborate more easily with other developers by merging branches. But the same courtesy hasn’t properly been extended to designers, who usually spend plenty of time scrolling through long email chains searching for the latest version of the attachment.

The deal, the terms of which were not disclosed, came about after Trunk applied for funding from InVision’s Design Forward Fund. After taking a look at the Trunk business and getting to know the team better, InVision decided to take it a step further with a proper acquisition offer.

“We’re truly inverting the workflow,” said InVision CEO and founder Clark Valberg . “It’s gone from engineering first to design first because, in the process of building, design is the best place to have conversations across the company. Everyone can understand it and strategize. Engineers have had version control since the very early days.”

The Trunk team will be focusing their energy on Studio, InVision’s design tool, which launched about a year ago.

The launch of Studio was the first time that InVision truly showed its hand, revealing efforts to go well beyond a simple collaboration tool and become the Salesforce of the design world.

In order to do so, InVision is building bridges between itself and other design focused startups, whether its through integrations, investment, or straight-up acquisition.

“As a growing company with some 800 employees, we’re always looking for people who are passionate about each individual slice of this design pie as possible,” said Valberg. “After using Trunk’s technology, we realized that they really really really care about this slice around design file versioning.”

The InVision collaboration suite currently boasts a place at 98 percent of the Fortune 100 companies, with more than 5 million users. This means the company is shifting its focus squarely to Studio. Design collaboration software was a relatively novel idea back when InVision launched, but design software wasn’t. With Studio, InVision is taking on incumbents like Adobe and other newcomers such as Sketch.

Of course, the feature set of Studio itself is important in beating out other design tools, but InVision believes that the real deal closer is integration with the deeper back-end of InVision’s suite of tools, such as InVision collaboration and now, design file versioning.