Here you go: https://news.ycombinator.com/item?id=50285981
Free wifi sync of Withings Scales to your own server. Alas, not in Rust. :)
3,781 karma · joined May 17, 2011
By night: I'm a hobbyist security researcher, and enjoy bug bounty programs.
Free wifi sync of Withings Scales to your own server. Alas, not in Rust. :)
It only supports two models of scales so far, but I got it working. My Withings scales are now syncing automatically into Apple Health over wifi, and without anything going to Withings.
Blog post: https://www.tomanthony.co.uk/blog/withings-yow-free-wifi-syn...
Github project: https://github.com/tomanthony/YourOwnWeigh/
Now the app is absolutely bloated and I can barely find my weight, and the syncing has become _much_ less stable, and the app is constantly asking me to sign in again.
Amazing how they were from good, to bad, to terrible.
I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.
Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.
However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.
Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.
[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crac...
If I bought a Kryoflux or similar device would I be able to access and save the data?
I feel like there should be another scoring axis rather than just time. I think selector length would be wrong, but something like selector complexity, or how robust the selector is to updates.
I scored 3m 50s, but felt like some of my selectors were a bit 'dirty'.
https://pcr.euprava.gov.rs/validate.php?cqcode=1640187792DOH...
The positive test result:
https://pcr.euprava.gov.rs/validate.php?cqcode=1640524880jk8...
I did manage to find an email address, but I got a templated response, and when I checked a year later it was still not fixed.
Sure, it was a minor issue, but I was surprised Tesco didn't have a proper Vulnerability Disclosure Program or Bug Bounty program. A bug bounty program is an inexpensive way to avoid exactly this sort of issue.
In this case, it is the ability for an app to install and execute arbitrary code that hasn't been reviewed. I download an update to DoodleJump and it installs some malware on my device. I'd be none the wiser.
I don't want that stress, which is why I chose an Apple device. It protects me from that scenario.
On Android the Play Store is a major distributor of malware [1]. I would like to avoid that, which comes with trade-offs, which I accept. Is it perfect? No. But it works.
I do wonder if there is a path where iOS can be completely replaced by a third party OS, so iPhones can be used in a way to allow you to install anything you want, but it is no longer Apple's 'responsibility'. However, that also comes with its own set of problems.
[1] https://www.zdnet.com/article/play-store-identified-as-main-...
To achieve the Channel Capacity you need to find the optimum distribution across a - i.e. what set of signals maximises the information you can transmit on this channel. There are known algorithms for finding this distribution (e.g. Blahut-Arimoto).
Now if you model the world as a channel, where s represents the reachable states and a represents the actions the agent can take (and the channel, P(s|a), represents the dynamics of the world), you can calculate what actions allow you maximal control (in terms of states you can controllably reach).
More info in this paper: https://uhra.herts.ac.uk/handle/2299/15376
That is very interesting that this emerged from two different approaches.
I published my result years back, and have never heard of this emerging elsewhere before!
Didn’t take it as accusatory [but thanks to child for sharing link :)].
I experimented with different time horizons, mostly look 3-7 steps ahead.
In terms of the 'reward', that was implicit within the model - if the ghosts caught you, your ability to influence the state of the world dropped to 0.
From a mathematical perspective, we used Information Theory to model the world as an information theoretic 'loop'. The agent could 'send' a signal to the world by performing an action, which would change the state of the world; the state of the world was what the agent 'received'. This obviously relies on having a model of the world and what your actions will do, but doesn't burden the model with other biases.
Pore more colloquially, the agent could perform actions in the world, and see the resulting state of the world (in my case, that was the location of the agent and of the ghosts). Part of the principle was that changes you cannot observe are not useful to you.
As part of my PhD research, I created a simplified Pac-Man style game where the agent would simply try to stay alive as long as possible whilst being chased by the 3 ghosts. The agent was un-motivated and understood nothing about the goal, but was optimising for maximising its observable control over the world (avoiding death is a natural outcome of this).
I spent sometime trying to debug a behaviour where the agent would simply move left and right at the start of each run, waiting for the ghosts to close in. At the last minute it would run away, but always with a ghost in the cell right behind it.
Eventually, I realised this was an outcome of what it was optimising for. When ghosts reached cross-roads in the world they would got left or right randomly (if both were same distance to catching the agent). This randomness reduced the agent's control over the world, so was undesirable. Bringing a ghost in close made that ghost's behaviour completely predictable.
"Weg" <- how do you pronounce this?
"Geh weg" (go away) "Der Weg ist da drüben!" (the path is over there)
Where do you think the line is? There are several apps on the Mac app store that have 'Dropbox' in their name and are charged. Is the difference they they are all 'sidecar's that rely on you have Dropbox?
It makes sense for high ticket pieces of software (Office, Photoshop), where it makes it more accessible for regular users. However, for a calendar widget or many similar examples that come up nowadays, it just turns me off immediately.
The whole article presents SEOs in a similar way to how people talk about 'used car salesmen'; we all know the clichés about used car salesmen, but the reality for any professional selling used car is vastly different. Presenting SEOs as 'the world’s most scruple-free douchebags' is fairly insulting and not productive.
His article discusses _some_ SEO tactics used by _some_ SEO practitioners. For the subset he presents, then I certainly agree there are a lot of issues, but he presents it as the complete picture.
# Modern SEO
Modern SEO is made up of many facets, one part of which is content, but which also includes technical considerations around crawling and indexing of content, as well as advocating for site speed optimisations, and improving user experience and signals.
A reputable SEO practitioner should be asking 'does this deserve to rank?', and should be advocating improvements that have longevity (i.e. will be helping next year, not just next week). I spent 9 years in an SEO agency, where these were central and core to our whole approach.
# Blackhat SEO
Yes, there is a lot of manipulative and shady stuff going down. That is not just content focused, as the author discusses, but there is also a lot of link buying and selling, which is design to manipulate the link graph with the aim of gaming PageRank essentially.
There is no denying that this stuff happens, but it is once again the same as the used car salesman analogy -- the majority of modern SEOs are professionals, and they don't deserve to be tarred with the same brush.
The line is, I accept, not as clear cut with SEO and there are people who practice manipulative tactics who operate in a grey area, and present themselves as the 'proper' solution.
Obviously, people practicing manipulative SEO are to blame for their own actions, and for making the situation worse. However, another aspect is Google's monopoly. I don't see how Google could have done a lot better at preventing some of the shady SEO practices that go down - they actively try.
However, their _monopoly_ is problematic as it means that there is only one black box to optimise against, and no real SEO consideration needs to be paid to other search engines.
It will be interesting to see what happens if Apple enter the fray, and what the knock on effects are.
My memory of this is imperfect and I joined as the project was already underway, but I believe there were two companies, yes.
The main POC at the second company that got the project completed was Rebecca Heineman [1] from Contraband Entertainment; my job was facilitating comms and help manage and organise the beta testing. I also built the installer.
I _believe_ that yes, Rez was created specifically for this. All EV modders know that the resource fork part of files was a critical part of how EV data files, and all mods, worked. There was a huge dependency there, and so I think the decision was made to create Rez to fill that gap. However, that is the extent of my knowledge.
The original EV was great to explore in, but fairly linear (two main threads to the storyline, I believe), but Nova was massive with so many routes through, I doubt anyone ever saw it all!
I had moved on from Ambrosia before Steam became a thing, but have also wondered the same. I did point this thread out to Andrew, and he has dropped in some replies, so maybe he can shed some light. I would guess it is a case of all the legal shenanigans needed to make it happen cleanly. Various people external to Ambrosia own various parts of the rights, so you would need to get a bunch of people on board and spend money on lawyers.
I also thought some games could be suited to something like the Nintendo Switch. However, that would obviously need a bunch of technical work to convert it (something I admit to having looked into late last year!).
I joined Ambrosia in late 2002 as part of a 'sandwich degree' as we call it in the UK. I was doing a 4 year BSc in Computer Science, where the 3rd year was spent as a year in industry. For that I moved to upstate NY to work for Ambrosia. It was a dream for someone who had grown up modding EV (like so many here apparently!).
I returned to the UK and kept working for Ambrosia from the UK whilst finishing my studies and for a while after. Andrew offered me a role at Ambrosia and I _agonised_ about the decision as I loved the company but ultimately I was too afraid of moving to the US without an end date there. I often wonder if that was a mistake.
I then did freelance web dev for a couple of years, before going back to Uni to do a PhD in AI. I found out I was going to be a father, and freelance web dev wouldn't cut it any more so I joined an SEO consultancy (Distilled), having taught myself a lot of that building small company websites.
In February of this year, the SaaS project I led at Distilled spun out as its own company SearchPilot (https://www.searchpilot.com/). I know SEO doesn't have a great reputation on HN, but what I love about SearchPilot is it applies A/B testing to SEO to remove the mystery, hand waving, and everything else. My focus is on the product and the network infrastructure side of things, but we are a small team so I get to do all sorts.
I do miss both the fun of working on games, and being part of the joy people would experience (as this thread shows). I also miss the AI research, as it was an interesting set of intellectual challenges.
I also don't have any t-shirts anymore, but EV:Nova mouse mats are still used at my Mum's house!