Monthly Archives: April 2021

News: Hear about building AVs under Amazon from Zoox CTO Jessie Levinson at TC Sessions: Mobility 2021

Last year, autonomous driving startup Zoox was acquired by Amazon in a deal worth $1.3 billion. Since then, Zoox has continued to pursue its existing strategy of developing and deploying autonomous passenger vehicles, revealing the design of its long-anticipated robotaxi late in December. From concept to reveal, Zoox spent six years developing its built-for-purpose passenger

Last year, autonomous driving startup Zoox was acquired by Amazon in a deal worth $1.3 billion. Since then, Zoox has continued to pursue its existing strategy of developing and deploying autonomous passenger vehicles, revealing the design of its long-anticipated robotaxi late in December. From concept to reveal, Zoox spent six years developing its built-for-purpose passenger AV, and the plan is to launch them initially with commercial deployments in Las Vegas and San Francisco following testing. At TC Sessions: Mobility this year on June 9, we’ll have the chance to speak to Zoox co-founder and CTO Jesse Levinson about the company’s progress toward those goals, and what it’s like for Zoox nearly a year on as an Amazon company.

[Did you know? Early-bird ticket sales end next week! Save $100 before prices go up]

In an interview with TechCrunch from last year, Levinson told us that life under Amazon at the AV company has been essentially business as usual since the acquisition — with greatly expanded access to resources, of course, and potentially with even more autonomy than before, he said, since they’re not beholden to a host of outside investors as they pursue their goals.

Of course, the natural assumption when considering Amazon and its interest in autonomous vehicles is package delivery — which is why it’s so interesting that Zoox is, and has always, prioritized movement of people, not parcels, in its AV development roadmap. Zoox’s debut vehicle has been designed entirely with passenger transportation in mind, though the company’s CEO Aicha Evans has acknowledged in the past that it could definitely work on package delivery in partnership with its new corporate owner in the future.

We’ll hear from Levinson if there are any updates to Zoox’s plan or focus, and what Amazon’s ambitions are for autonomous vehicles in the long term. We’ll also talk about the AV industry overall, and the major shifts its undergone in the years that Zoox has been operating, and what that means for growing and attracting talent. Levinson knows the industry and the state of the art in AV technology better than most, so be sure to grab tickets to TC Sessions: Mobility 2021 ASAP and check out our chat on June 9.

Book your early-bird pass today and save $100 before prices increase next week and join today’s leading mobility-startup event.

News: Cloudflare rallies the troops to fight off another so-called patent troll

Nearly four years ago, we wrote about a battle between Cloudflare, the San Francisco-based internet security and performance company, and Blackbird Technologies, a firm that quickly amassed dozens of patents, then began using them to file dozens of patent infringement lawsuits against companies, including Cloudflare. The suit was typical in every way, except how Cloudflare responded to

Nearly four years ago, we wrote about a battle between Cloudflare, the San Francisco-based internet security and performance company, and Blackbird Technologies, a firm that quickly amassed dozens of patents, then began using them to file dozens of patent infringement lawsuits against companies, including Cloudflare.

The suit was typical in every way, except how Cloudflare responded to it. Unlike many targets of similar lawsuits that opt to settle, Cloudflare fought back, asking very publicly for help in locating prior art that would not only invalidate the broad patent that Blackbird was using to sue Cloudflare, but to invalidate all of Blackbird’s patents. The public answered the call, and two years and 275 unique submissions later, the case against Cloudflare was dismissed and Blackbird’s operations were diminished.

One might surmise that given the stink that Cloudflare raised, other patent trolls might choose an easier target. Yet last month, Cloudflare was sued yet again, this time by Sable Networks, a “company that doesn’t appear to have operated a real business in nearly ten years — relying on patents that don’t come close to the nature of our business or the services we provide,” as says Doug Kramer, general counsel of CloudFlare.

Unsurprisingly, Cloudflare isn’t going to take this newest action lying down. This morning, after revealing the lawsuit publicly, it invited the engineering community to again “turn the tables” on patent trolls by inviting them to participate in a crowdsourced effort to find evidence of prior art to invalidate the “ancient, 20-year-old patents” that Cloudlflare says that Sable is is “trying to stretch . . . lightyears beyond what they were meant to cover.”

Cloudflare is also offering a $100,000 bounty to be split among entrants who provide the most useful prior-art references that can be used in challenging the validity of all of Sable’s patents, not just those being asserted against Cloudflare.

The idea is to deal a big enough blow to Sable that not only is its case against Cloudflare hobbled but also future cases against other entities.

“We feel fortunate that we didn’t run into one of these cases earlier in our history, where it might have really taken us off our path,” Kramer tells TechCrunch. “Blackbird came along when we had a bit more stability, and we have even more stability now.”

Given that position of relative strength, he says, “We want to go about this in a way that will force [Sable] to define their claims and stand on their claims, and we want to do it in a way that leaves something behind for other folks, particularly smaller companies that may come behind us, so we want to put [Sable’s] entire patent portfolio under scrutiny.”

Certainly, Cloudflare is not the only company to attract Sable’s attention. Indeed, a quick search shows that Sable has also sued the cybersecurity business Fortinet, the data platform Splunk, and networking giants Juniper Networks and Cisco Systems, among roughly a dozen other companies.

Eight of those cases — including with Juniper and Cisco — have already settled. The reality is that most companies see infringement cases by non-practicing entities like Sable as a nuisance to be quickly resolved because they are a distraction and because the expense of fighting is often equal to or even more than the cost of settling.

The companies also lose oftentimes. Though in 2017, the Supreme Court ruled unanimously that patent holders suing corporations can’t seek out a friendly court — their venue of choice was long the Eastern District of Texas, where 2,500 cases were brought in  2015 alone, 95% of them initiated by non-practicing entities like Sable — business remains brisk in Texas, where legal teams bring in a lot of money and often successfully cast major corporations to local jurors as villainous.

A report in the Houston Chronicle last year noted that businesses and individuals filed 747 patent complaints in Texas during the first six months of 2020 — double the number from a year earlier and twice as many as any other state. To underscore the point, it noted that while patent infringement lawsuits jumped 16 percent nationwide in the first six months of last year, the number of new disputes in Texas soared 96%.

Some of those cases landed in the Eastern District of Texas (and mostly in Marshall, Texas, which boasts a population of 23,000). Some landed in the Southern District, which covers Houston and, according to that same Houston Chronicle report, experienced a 43% jump in new patent violation cases last year.

But Waco, the Western District of Texas, has become the new center for patent infringement cases. That’s largely because the district encompasses Austin, where many tech companies have offices, and notably, a key piece of that 2017 Supreme Court ruling limited filings to venues where the defendants have actual operations.

So-called patent trolls have also found a friend, seemingly, in U.S. District Judge Alan Albright, a former trial attorney who was nominated to become a federal judge in Waco in 2018 by former President Donald Trump. In the two years following his confirmation by the Senate, Albright has come to preside over the most popular court in the country to litigate intellectual property disputes, with a very high percentage of plaintiffs winning their cases.

It’s no wonder that outfits like Sable continue on their path. Scoring early settlement agreements can add up to big business. (Their continued success is also why litigation finance funds continue to spring into existence.)

Cloudflare is a much bigger quarry now, too. While Blackbird sued while it was still a privately held entity, Cloudflare went public in 2019 and currently boasts a market cap of $26 billion.

Kramer is acutely aware of the upward battle ahead. It’s why despite its resources, Cloudflare is reaching out to the public again. “I don’t mean to sound self-serving, but we have a very intense group of engineers and people in this space who read [our] blog regularly,” Kramer says of the detailed post he published this morning relating to the case. “I also think this really strikes a nerve with some people because they are so bothered by” the practice of patent infringement suits.

Kramer says it’s impossible to overstate the impact of these far-flung engineers in Cloudflare’s fight against Blackbird. “It wasn’t just people who thought, ‘Oh, it’s a chance to make some money and I’m gonna go do this.’ There wasn’t a lot of junk in [what they submitted]. Instead, we had people saying, ‘Hey, listen, I worked on this back in the ’90s when I was over at this company, and it’s crazy that they’re trying to say they invented this,’ and they would send us articles that they had written.

“We had people doing research at libraries and stuff like that,” continues Kramer, “but we also had people who had worked in the industry and said, ‘I worked on this three years before they ever got that patent; there’s no way they should be able to create this [trouble] based something that I did.’”

Cloudflare is hoping again that a lot of its followers will get energized, and “also the exact right people, who are motivated by this and and who are very, very knowledgeable in this space,” says Kramer. “We’re hoping to get the gang back together.”

It might need them more than ever.

News: Netflix won seven Oscars last night

After everything was wrapped up at a very weird Oscars ceremony, original films released by Netflix had won seven statuettes. The streaming service’s awards include for two for “Mank” (production design and cinematography), two for “Ma Rainey’s Black Bottom” (hair/makeup and costume), documentary feature (“My Octopus Teacher”), animated short (“If Anything Happens I Love You”)

After everything was wrapped up at a very weird Oscars ceremony, original films released by Netflix had won seven statuettes.

The streaming service’s awards include for two for “Mank” (production design and cinematography), two for “Ma Rainey’s Black Bottom” (hair/makeup and costume), documentary feature (“My Octopus Teacher”), animated short (“If Anything Happens I Love You”) and live action short (“Two Distant Strangers”).

Meanwhile, Amazon’s “Sound of Metal” won the awards for sound and editing, while Facebook’s Oculus, EA and Respawn won their first Oscar for “Colette,” which won in the documentary short category.

This comes after a pandemic year in which theaters closing or operating at reduced capacity, forcing the Academy of Motion Picture Arts and Sciences to delay the ceremony and change its awards eligibility rules. It also essentially erased the distinction between theatrical and streaming films — for example, Searchlight Pictures released Best Picture-winner “Nomadland” in theaters and on Hulu at the same time.

Netflix received 36 nominations total, making it the most-nominated studio, with “Mank” the most-nominated film. And seven wins is a big improvement on the two it won last year.

Going into the evening, “Nomadland” was seen as the front runner for Best Picture, but Netflix executives still had reason to be  disappointed: In a nearly unprecedented move, Best Picture wasn’t the final award of the night — instead, it was Best Actor, which was widely expected to go to the late Chadwick Boseman for his performance in “Ma Rainey.” So when Anthony Hopkins (who wasn’t in attendance) won for “The Father,” it made for a pretty deflating end to the evening.

News: Airbus taps Luminar to test how lidar could be used to make flying safer and autonomous

Luminar Technologies is expanding its lidar business beyond automotive and into aviation through a partnership with Airbus. The collaboration with the French aerospace giant, which was announced Monday morning, marks the latest in a string of partnership announcements between Luminar and companies like Daimler, Volvo and Mobileye. Until now, these have exclusively focused on applying

Luminar Technologies is expanding its lidar business beyond automotive and into aviation through a partnership with Airbus. The collaboration with the French aerospace giant, which was announced Monday morning, marks the latest in a string of partnership announcements between Luminar and companies like Daimler, Volvo and Mobileye. Until now, these have exclusively focused on applying its light detection and ranging radar to automated vehicles on the ground — not in the skies.

The partnership won’t bring lidar into commercial aircraft. Unlike Luminar’s deal with Daimler, Mobileye and Volvo this is not a production contract. Instead, the partnership is with Airbus’ UpNext subsidiary, which is focused on developing and eventually applying new technological breakthroughs to aviation. The effort will be folded into Airbus Flightlab, an ecosystem that offers access to flight test platforms across Airbus’ business lines, including commercial aircraft, helicopters, defense and space. Luminar and Airbus will develop and test how lidar can be used to enhance sensing, perception and system-level capabilities to ultimately enable safe, autonomous flight, the companies said.

“We’re able to directly re-apply what we’ve accomplished for the automotive industry into aviation, an established nearly $1 trillion industry,” Luminar founder and CEO Austin Russell said in a statement Monday. “We believe that automation and safety enhancements will transform how we move across all modes of transport as we take our technology from roads to the skies. We look forward to accelerating our shared vision to define the future of flying.”

Lidar, which measures distance using laser light to generate a highly accurate 3D map of the world, is considered by most in the autonomous vehicle industry critical to commercial deployment. Automakers have also begun to view lidar as an important sensor to be used to expand the capabilities and safety of advanced driver assistance systems in new cars, trucks and SUVs available to consumers.

Airbus is interested in how Luminar’s lidar and perception stack can be used to automatically detect obstacles, a key step toward autonomous operation of aircraft such as urban air mobility vehicles. The companies said the sensor also has the potential to “substantially improve the safety of existing aircraft applications.”

Increasing helicopter safety is one of Airbus’ missions. The company said Monday it will introduce a number of new features to its helicopter Flightlab through a project code-named Vertex. These technologies, which include lidar and other sensors coupled with software for obstacle detection, fly-by-wire for enhanced auto-pilot and a touchscreen and head-worn display for inflight monitoring and control, aim to reduce helicopter pilot workload and increase safety. Airbus said that when combined, the system will be able to manage navigation and route preparation, automatic take-off and landing, as well as following a predefined flight path. The incremental integration of these technologies onto the helicopter Flightlab has begun ahead of a complete demonstration in 2023. Airbus said its Urban Air Mobility project will also benefit from this technology as a step toward autonomous flight.

Luminar, which burst onto the autonomous vehicle scene in April 2017 after operating for years in secrecy, became a publicly traded company in late 2020. The company announced in February that it would work with Volvo Cars to develop and eventually sell to other automakers an automated driving system for highways. The partnership, which is between Luminar and Volvo’s self-driving software subsidiary Zenseact, builds upon an existing relationship with Volvo. The two companies are combining their tech to create what Luminar founder and CEO Austin Russell described as a “holistic autonomous vehicle stack” made for production vehicles. Volvo will be the first customer. Russell and Zenseact CEO Ödgärd Andersson said at the time that they plan to also offer this system to other automakers.

Last year, ahead of its public debut, Luminar also locked in a supplier deal to furnish Intel subsidiary Mobileye with lidar for its fleet of autonomous vehicles. Under that contract, Luminar’s lidar will be part of Mobileye’s first-generation fleet of driverless vehicles, which are being piloted in Dubai, Tel Aviv, Paris, China and Daegu City, South Korea.

 

News: SLAIT’s real-time sign language translation promises more accessible online communication

Sign language is used by millions of people around the world, but unlike Spanish, Mandarin or even Latin, there’s no automatic translation available for those who can’t use it. SLAIT claims the first such tool available for general use, which can translate around 200 words and simple sentences to start — using nothing but an

Sign language is used by millions of people around the world, but unlike Spanish, Mandarin or even Latin, there’s no automatic translation available for those who can’t use it. SLAIT claims the first such tool available for general use, which can translate around 200 words and simple sentences to start — using nothing but an ordinary computer and webcam.

People with hearing impairments, or other conditions that make vocal speech difficult, number in the hundreds of millions, rely on the same common tech tools as the hearing population. But while emails and text chat are useful and of course very common now, they aren’t a replacement for face-to-face communication, and unfortunately there’s no easy way for signing to be turned into written or spoken words, so this remains a significant barrier.

We’ve seen attempts at automatic sign language (usually American/ASL) translation for years and years: in 2012 Microsoft awarded its Imagine Cup to a student team that tracked hand movements with gloves; in 2018 I wrote about SignAll, which has been working on a sign language translation booth using multiple cameras to give 3D positioning; and in 2019 I noted that a new hand-tracking algorithm called MediaPipe, from Google’s AI labs, could lead to advances in sign detection. Turns out that’s more or less exactly what happened.

SLAIT is a startup built out of research done at the Aachen University of Applied Sciences in Germany, where co-founder Antonio Domènech built a small ASL recognition engine using MediaPipe and custom neural networks. Having proved the basic notion, Domènech was joined by co-founders Evgeny Fomin and William Vicars to start the company; they then moved on to building a system that could recognize first 100, and now 200 individual ASL gestures and some simple sentences. The translation occurs offline, and in near real time on any relatively recent phone or computer.

Animation showing ASL signs being translated to text, and spoken words being transcribed to text back.

They plan to make it available for educational and development work, expanding their dataset so they can improve the model before attempting any more significant consumer applications.

Of course, the development of the current model was not at all simple, though it was achieved in remarkably little time by a small team. MediaPipe offered an effective, open-source method for tracking hand and finger positions, sure, but the crucial component for any strong machine learning model is data, in this case video data (since it would be interpreting video) of ASL in use — and there simply isn’t a lot of that available.

As they recently explained in a presentation for the DeafIT conference, the first team evaluated using an older Microsoft database, but found that a newer Australian academic database had more and better quality data, allowing for the creation of a model that is 92 percent accurate at identifying any of 200 signs in real time. They have augmented this with sign language videos from social media (with permission, of course) and government speeches that have sign language interpreters — but they still need more.

Animated image of a woman saying "deaf understand hearing" in ASL.

A GIF showing one of the prototypes in action — the consumer product won’t have a wireframe, obviously.Image Credits: Slait.ai

Their intention is to make the platform available to the deaf and ASL learner communities, who hopefully won’t mind their use of the system being turned to its improvement.

And naturally it could prove an invaluable tool in its present state, since the company’s translation model, even as a work in progress, is still potentially transformative for many people. With the amount of video calls going on these days and likely for the rest of eternity, accessibility is being left behind — only some platforms offer automatic captioning, transcription, summaries, and certainly none recognize sign language. But with SLAIT’s tool people could sign normally and participate in a video call naturally rather than using the neglected chat function.

“In the short term, we’ve proven that 200 word models are accessible and our results are getting better every day,” said SLAIT’s Evgeny Fomin. “In the medium term, we plan to release a consumer facing app to track sign language. However, there is a lot of work to do to reach a comprehensive library of all sign language gestures. We are committed to making this future state a reality. Our mission is to radically improve accessibility for the Deaf and hard of hearing communities.”

From left, Evgeny Fomin, Dominic Domènech, and Bill Vicars.Image Credits: Slait.ai

He cautioned that it will not be totally complete — just as translation and transcription in or to any language is only an approximation, the point is to provide practical results for millions of people, and a few hundred words goes a long way toward doing so. As data pours in, new words can be added to the vocabulary, and new multi-gesture phrases as well, and performance for the core set will improve.

Right now the company is seeking initial funding to get its prototype out and grow the team beyond the founding crew. Fomin said they have received some interest but want to make sure they connect with an investor who really understands the plan and vision.

When the engine itself has been built up to be more reliable by the addition of more data and the refining of the machine learning models, the team will look into further development and integration of the app with other products and services. For now the product is more of a proof of concept, but what a proof it is — with a bit more work SLAIT will have leapfrogged the industry and provided something that deaf and hearing people both have been wanting for decades.

News: With a third of its capital deployed, Risk & Return is transforming how we think about emergency response

Disasters are, unfortunately, a growth business, and the frontlines that were once distant have moved much closer to home. Wildfires, hurricanes, floods, tornadoes — let alone a pandemic — has forced much of the United States and increasingly large swaths of the world to confront a new reality: few places are existentially secure. How we

Disasters are, unfortunately, a growth business, and the frontlines that were once distant have moved much closer to home. Wildfires, hurricanes, floods, tornadoes — let alone a pandemic — has forced much of the United States and increasingly large swaths of the world to confront a new reality: few places are existentially secure.

How we respond to crises can radically adjust the ledger of mortality for the people slammed by these catastrophes. Good information, fast response, and strong execution can mean the difference between life and death. Yet, frontline workers often can’t get the tools and training they need, particularly new innovations that may not wind their way easily through the government supply chain. Perhaps most importantly, they often need post-traumatic care far after a disaster his dissipated.

Risk & Return is a unique venture fund and philanthropic hybrid that has set its mission to seek and finance the next-generation of technologies to help first responders not only on the frontlines, but even after as they confront the strains both physical and mental from missions they undertake.

The family of organizations sees a spectrum from emergency workers in the United States to U.S. military veterans, all of whom share similar challenges and need solutions today — solutions that can often be hard to finance for traditional VCs who aren’t aware of the unique needs of this community.

The group was founded by Robert Nelsen, who made his name as a co-founder and managing director of biotech VC leader ARCH Venture Partners, which last year announced a $1.5 billion pair of funds. He’s joined by board chairman Bob Kerrey, the former co-chair of the 9/11 Commission as well as former governor and senator of Nebraska, and managing director Jeff Eggers, a Navy SEAL who served as senior director of Afghanistan and Pakistan on President Barack Obama’s National Security Council.

Nelsen had been thinking through the idea when he met Kerrey, who recalled the conversation happening during a fundraising event for Navy SEALs. “There has been a lot of suffering for those who have been on the frontlines,” Kerrey said. “Bob had this idea, and I thought it was a really smart idea, to try to take a different approach to philanthropic efforts.” They linked up with Eggers and the trio brought Risk & Return to fruition.

The venture fund is $25 million, with about 35% of it already deployed. The fund has had a big emphasis on mental health for first responders, with 75% of the companies funded broadly in that category.

The fund’s first investment was into Alto Neuroscience, which is developing precision medicine tools to treat post-traumatic stress. The fund has also invested in behavioral management startup NeuroFlow; alternative well-being assessment tool Qntfy; Spear Human Performance, which is a brand-new spinout focused on connecting commercial and health data sources to optimize human performance; and Xtremity, which is designing better connection sockets for prosthetics. The fund has invested in another six startups including Perimeter, which I profiled a few weeks ago.

This isn’t your typical venture portfolio, and that’s exactly what Risk & Return wants to focus on. Eggers said that “We love that type of technology since it has that dual purpose: going to serve the first responder on the ground, but the community is also going to benefit.”

While many of the startups the firm has invested in obviously have a focus on first responders, the technologies they develop don’t have to be limited to just that market. Kerrey noted that “Every veteran is a civilian, [and] these aren’t businesses targeting the military market.” Given the last year, “it’s hard to find a human being in this pandemic that hasn’t suffered at least some PTSD,” referencing post-traumatic stress disorder. Sales to governments can be incredibly challenging, and the ultimate market for the kinds of specialized mental health services that frontline workers need may not be as commercially viable as one would hope.

While the government does research and innovation in this category, Kerrey sees a huge opportunity for the private sector to get more involved. “One thing that you could do in the private sector that is difficult in the public sector is look for alternative therapies for PTSD,” he said, noting that areas like psychedelics have intrigued the private sector even while the government would mostly not touch the category today. Risk & Return has not made an investment in that space at this time though.

Half of the returns from the fund will stream into Risk & Return’s philanthropic arm, which writes grants to charities along the same thesis of aiding frontline workers both on the job and after it. The organizations hope that by approaching the complicated response space with a multi-pronged approach, they can match potential needs with different sources of capital that are most appropriate.

We’ve increasingly seen this hybrid for-profit/non-profit venture model in other areas. Norrsken is a Swedish foundation and venture fund that is investing in areas like mental health, climate change, and other categories from the UN Sustainable Development Goals. MIT Solve is another program that is working on hybrid approaches to startup innovation, such as in pandemics and health security. While disasters are always looming, it’s great to see more innovation in financing this critical category of technology.

such as in pandemics and health security

News: Apple’s App Tracking Transparency feature has arrived — here’s what you need to know

iOS 14.5 — the latest version of Apple’s mobile operating system — is launching today, and with it comes a much-discussed new privacy feature called App Tracking Transparency. The feature was first announced nearly a year ago, although the company delayed the launch to give developers more time to prepare. Since then, support for the

iOS 14.5 — the latest version of Apple’s mobile operating system — is launching today, and with it comes a much-discussed new privacy feature called App Tracking Transparency.

The feature was first announced nearly a year ago, although the company delayed the launch to give developers more time to prepare. Since then, support for the feature has already gone live in iOS and some apps have already adopted it (for example, I’ve seen tracking requests from Duolingo and Venmo), but now Apple says it will actually start enforcing the new rules.

That means iPhone owners will start seeing many more privacy prompts as they continue using their regular apps, each one asking for permission to “track your activity across other companies’ apps and websites.” Every app that requests tracking permission will also show up in a Tracking menu within your broader iOS Privacy settings, allowing you to toggle tracking on and off any time — for individual apps, or for all of them.

What does turning tracking on or off actually do? If you say no to tracking, the app will no longer be able to use Apple’s IDFA identifier to share data about your activity with data brokers and other third parties for ad-targeting purposes. It also means the app can no longer use other identifiers (like hashed email addresses) to track you, although it may be more challenging for Apple to actually enforce that part of the policy.

Apple App Tracking Transparency

Image Credits: Apple

There’s been intense debate around App Tracking Transparency in the lead up to its launch. The pro-ATT side is pretty easy to explain: There’s a tremendous amount of personal information and activity that’s being collected about consumers without their consent (as Apple outlined in a report called A Day in the Life of Your Data), and this gives us a simple way to control that sharing.

However, Facebook has argued that by dealing a serious blow to ad targeting, Apple is also hurting small businesses that depend on targeting to affordable, effective ad campaigns.

The social network even took out ads in The New York Times, The Wall Street Journal and The Washington Post declaring that it’s “standing up to Apple for small businesses everywhere.” (The Electronic Frontier Foundation dismissed the campaign as “a laughable attempt from Facebook to distract you from its poor track record of anticompetitive behavior and privacy issues as it tries to derail pro-privacy changes from Apple that are bad for Facebook’s business.”)

Others have suggested that these changes could do “existential” damage to some developers and advertisers, while also benefiting Apple’s bottom line.

The full impact will depend, in part, on how many people choose to opt out of tracking. It’s hard to imagine many normal iPhone owners saying yes when these prompts start to appear — especially since developers are not allowed to restrict any features based on who opts into or out of tracking. However mobile attribution company AppsFlyer says that early data suggests that opt-in rates could be as high as 39%.

News: iOS 14.5 goes live with Watch unlocking, tracking transparency and kissing emojis

At its big event last week, Apple tipped off the forthcoming arrival of the latest point update to iOS. Today 14.5 goes live for all users, and it’s shaping up to be one of the bigger updates to the mobile operating system in a bit. Mask-wearers will be able to unlock their iPhone with the

At its big event last week, Apple tipped off the forthcoming arrival of the latest point update to iOS. Today 14.5 goes live for all users, and it’s shaping up to be one of the bigger updates to the mobile operating system in a bit.

The most long-awaited update from a purely user standpoint is probably the ability to unlock the phone using an Apple Watch. It’s another useful addition for the company’s wearable, but more importantly, it comes after a year of frustrated mask wearers hoping for a work around for face unlock.

Image Credits: Apple

When wearing a mask, the handset will default to the Watch (once watchOS 7.4 is installed), sending a notification to the wearable, along with a haptic buzz.

A big new arrival on the security side, as well, with the addition of app tracking transparency. Anthony wrote about the feature in a post earlier this month, noting,

Apple will actually start enforcing its new rules, meaning that iPhone users will probably start seeing a lot more requests. Those requests will appear at various points during the usage of an app, but they’ll all carry a standardized message asking whether the app can “track your activity across other companies’ apps and websites,” followed by a customized explanation from the developer.

So, get ready for a lot of pop-up notifications – but for a good cause.

Image Credits: Apple

Also arriving:

  • A ton of new emojis. We’ve got kissing couples, fiery hearts and additional gender inclusivity.
  • Updates to Siri, including an additional voice (there is no default voice now) and the ability to dial an emergency number.
  • AirTag support!
  • Apple Podcasts app redesign
  • Fitness+ can now be streamed to devices with AirPlay 2 enabled
  • Reminders can be date, priority and title
  • Updates to voice control accessibility
  • Users can directly report traffic incidents to Apple Maps, using Sir commands like, “There’s a crash up ahead” and “There’s something on the road.”
  • The News+ tab gets reorganized to make it easier to find relevant stories and publications.

 

News: A software bug let malware bypass macOS’ security defenses

Apple has spent years reinforcing macOS with new security features to make it tougher for malware to break in. But a newly discovered vulnerability broke through most of macOS’ newer security protections with a double-click of a malicious app, a feat not meant to be allowed under Apple’s watch. Worse, evidence shows a notorious family of

Apple has spent years reinforcing macOS with new security features to make it tougher for malware to break in. But a newly discovered vulnerability broke through most of macOS’ newer security protections with a double-click of a malicious app, a feat not meant to be allowed under Apple’s watch.

Worse, evidence shows a notorious family of Mac malware has already been exploiting this vulnerability for months before it was subsequently patched by Apple this week.

Over the years, Macs have adapted to catch the most common types of malware by putting technical obstacles in their way. macOS flags potentially malicious apps masquerading as documents that have been downloaded from the internet. And if macOS hasn’t reviewed the app — a process Apple calls notarization — or if it doesn’t recognize its developer, the app won’t be allowed to run without user intervention.

But security researcher Cedric Owens said the bug he found in mid-March bypasses those checks and allows a malicious app to run.

Owens told TechCrunch that the bug allowed him to build a potentially malicious app to look like a harmless document, which when opened bypasses macOS’ built-in defenses when opened.

“All the user would need to do is double click — and no macOS prompts or warnings are generated,” he told TechCrunch. Owens built a proof-of-concept app disguised as a harmless document that exploits the bug to launch the Calculator app, a way of demonstrating that the bug works without dropping malware. But a malicious attacker could exploit this vulnerability to remotely access a user’s sensitive data simply by tricking a victim into opening a spoofed document, he explained.

GIF showing a proof of concept app opening uninhibited on an unpatched macOS computer.

The proof-of-concept app disguised as a harmless document running on an unpatched macOS machine. (Image: supplied)

Fearing the potential for attackers to abuse this vulnerability, Owens reported the bug to Apple.

Apple told TechCrunch it fixed the bug in macOS 11.3. Apple also patched earlier macOS versions to prevent abuse, and pushed out updated rules to XProtect, macOS’ in-built anti-malware engine, to block malware from exploiting the vulnerability.

Owens asked Mac security researcher Patrick Wardle to investigate how — and why — the bug works. In a technical blog post today, Wardle explained that the vulnerability triggers due to a logic bug in macOS’ underlying code. The bug meant that macOS was misclassifying certain app bundles and skipping security checks, allowing Owens’ proof-of-concept app to run unimpeded.

In simple terms, macOS apps aren’t a single file but a bundle of different files that the app needs to work, including a property list file that tells the application where the files it depends on are located. But Owens found that taking out this property file and building the bundle with a particular structure could trick macOS into opening the bundle — and running the code inside — without triggering any warnings.

Wardle described the bug as rendering macOS’ security features as “wholly moot.” He confirmed that Apple’s security updates have fixed the bug. “The update will now result in the correct classification of applications as bundles and ensure that untrusted, unnotarized applications will (yet again) be blocked, and thus the user protected,” he told TechCrunch.

With knowledge of how the bug works, Wardle asked Mac security company Jamf to see if there was any evidence that the bug had been exploited prior to Owens’ discovery. Jamf detections lead Jaron Bradley confirmed that a sample of the Shlayer malware family exploiting the bug was captured in early January, several months prior to Owens’ discovery. Jamf also published a technical blog post about the malware.

“The malware we uncovered using this technique is an updated version of Shlayer, a family of malware that was first discovered in 2018. Shlayer is known to be one of the most abundant pieces of malware on macOS so we’ve developed a variety of detections for its many variants, and we closely track its evolution,” Bradley told TechCrunch. “One of our detections alerted us to this new variant, and upon closer inspection we discovered its use of this bypass to allow it to be installed without an end user prompt. Further analysis leads us to believe that the developers of the malware discovered the zero-day and adjusted their malware to use it, in early 2021.”

Shlayer is an adware that intercepts encrypted web traffic — including HTTPS-enabled sites — and injects its own ads, making fraudulent ad money for the operators.

“It’s often installed by tricking users into downloading fake application installers or updaters,” said Bradley. “The version of Shlayer that uses this technique does so to evade built-in malware scanning, and to launch without additional ‘Are you sure’ prompts to the user,” he said.

“The most interesting thing about this variant is that the author has taken an old version of it and modified it slightly in order to bypass security features on macOS,” said Bradley.

Wardle has also published a Python script that will help users detect any past exploitation.

It’s not the first time Shlayer has evaded macOS’ defenses. Last year, Wardle working with security researcher Peter Dantini found a sample of Shlayer that had been accidentally notarized by Apple, a process where developers submit their apps to Apple for security checks so the apps can run on millions of Macs unhindered.

News: Snap has acquired Pixel8earth, a 3D mapping developer, for $7.6M

Last week, when we reported that Snap paid $124 million for Fit Analytics, we also noted that, according to the SEC filing that disclosed the value of the acquisition, Snap made another deal in the same quarter for a smaller amount, $7.6 million. We’ve now learned was that the acquisition was: Snap has confirmed to

Last week, when we reported that Snap paid $124 million for Fit Analytics, we also noted that, according to the SEC filing that disclosed the value of the acquisition, Snap made another deal in the same quarter for a smaller amount, $7.6 million. We’ve now learned was that the acquisition was: Snap has confirmed to us that it has acquired Pixel8earth, a company developing 3D mapping technology, specifically based on crowdsourced data.

Pixel8earth is based out of Boulder, Colorado, and four employees from the startup are joining Snap to work on map product development. Specifically, they will be building out tools that will work with Snap’s location-based augmented reality experiences along the lines of the Local Lenses that Snapchat introduced last June at its annual Partner Summit developer event.

As we’ve reported previously, we’ve heard that this year’s Partner Summit is likely to see some launches related to Snap’s wider e-commerce strategy, and we now understand that it will also feature some news on the AR mapping front, too.

It’s not clear if Snap (or Snapchat) will keep Pixel8earth going, or if it will roll selected technology and further development into products like Snap Map, but given the price of the deal, it’s most likely more of a talent acquisition.

For the record, Pixel8earth — co-founded by Sean Gorman and Pramukta Kumar, two repeat founders and mapping PhDs — had built a platform where it encouraged people (dubbed “ambassadors”) to join the platform and use their 360 cameras and other cameras to record and contribute information to the startup’s global mapping database. (In that regard, the tech was not unlike what Mapillary, which got acquired by Facebook, had developed.)

Snap has largely been building its mapping experiences around the idea of using maps to increase and improve engagement with its users. One of the bigger deals it’s made on that front was its acquisition in 2017 of Paris-based startup Zenly, an app that let you opt in to be able to be discovered by your friends on a map. Other mapping acquisitions have included StreetCred, announced in January of this year. StreetCred’s service was shut down after the deal, but it was also based around the idea of crowdsourcing points-of-interest and other mapping data, paying contributors in crypto tokens and putting the information “on the blockchain.”

Snap’s mapping efforts already have some decent traction and differentiation as a more “personalised” map — in contrast with, for example, the very much used Google Maps experience, which is about universal accuracy and being as thorough as possible, not exactly personalised (unless you are logged in and have locations saved, but even so, not with strong social features in mind).

At its investor day in February Snap noted that Snap Map was used by more than 250 million Snapchatters monthly. “On other platforms, everyone sees the same Map. But on Snapchat we are building the world’s most personal Map,” Jacob Andreou, VP product, said there. “Your Snap Map reflects your world; it features the people, places, and activities you care about, and no two are the same. The Map is built to see where your friends are and what they’re up to quickly and easily. This kind of sharing is at it’s best with close friends, a perfect fit for the best friends network that is unique to Snapchat. The version of the map in our app today is one that has been relentlessly improved in conversation with our community over the last two years leveraging this data-informed approach.”

While some of that usage and growth will have inevitably been curtailed in the last year, given the pandemic-enforced lockdowns and reduction in travel, Evan Spiegel, Snap’s CEO and co-founder, also said last week in its earnings that this might be turning a corner.

“We are optimistic about the engagement trends we are seeing as the world is beginning to open up,” he said. “As things began to open up in the United States in late February, we saw inflection points in key behaviors like Story posting and engagement with the Map.”

And while engagement is definitely something Snap has developed, it seems monetization might well be on the cards, too.

“Local, digital advertising is an established market – it has a playbook, and we’re confident that this will be an important part of our business in the future,” said Peter Sellis, senior director of product, at its recent investor day. “But we want to do it right.”

The company has slowly been testing out some more commercial features like Promote Local Place to give smaller businesses, and specifically retailers, a boost, which was the first time Snap had put businesses on the Snap Map.

“We’re going to spend a lot of time expanding these products to work for the largest multi-location enterprises in 2021,” he continued, “but they were honestly reactive to the pandemic, and we feel that we have yet to truly build on the potential of the Map.”

It seems that Pixel8earth could be a sign of how Snap and its flagship app Snapchat plan to do that.

WordPress Image Lightbox Plugin