That's not true though, Apple does make the devices, but the user owns them, and therefore has the legal right to install whatever they wish. Apple does not have control over this, as evidenced by the legality ruling of jailbreaking.
>Apple makes the devices, they are 100% legally allowed to only allow apps from their own App Store and that precedent has already been set.
This is false. As proven time and time again, the Device Owner has full legal control after purchase.
It is monopolistic behavior due to the scope of the control from Apple. The devices are the owner's property, and it is monopolistic for them to implement software/policies/hardware blocks, that prevent users from using the devices as they see fit.
Take a simplistic example, Keurig. Keurig tried to prevent users from using any other coffee pod besides theirs. There is precedent to these monopoly lawsuits.
No, historically OS's haven't been linked to hardware like iOS is. Imagine if every time you got a new webcam, you had to buy a new version of Windows. XP was supported for 12 years, iOS 12 was officially discontinued after 1 year. You're talking about orders of magnitude difference in time.
This concept doesn't really work as the OS updates are required to interface with features of the new phones and support features of older phones. This would essentially force users to buy new devices every cycle, or cough up money for the updated OS. Also what about important security updates and bug fixes? Would Apple just allow these vulnerabilities to exist if people didn't pay? Either way this would be a terrible business decision on their part.
The issue isn't that apple made jailbreaking harder, its that apple shouldn't be the sole controller of what apps people can install on their phone. For example, if you have a company with millions of users and Apple decides you are a threat to their business, (or whatever reason they make up), they can ban your apps from the store, (e.g. Epic Games). This is monopolistic behavior. If apple were to allow third party store options, (without jailbreaking required), there wouldn't be an issue. The root issue isn't jailbreaking, (that's still possible and required to install non-store apps), but rather the requirement that ONLY store apps can be installed in the first place.
IF you're worth way more than you're getting paid, negotiations should be super easy. This is probably a terrible analogy, but think of working like mining diamonds and the employer like selling cut stones. If you mine huge diamonds with fairly regular frequency asking to get paid more is a no brainer for you and the company.
Exactly this! There is no reason why both laborer and company can't be happy. Work is a mutually beneficial arrangement and as a manager I get to make sure that is true for both parties! I hate when people have the mentality that life, work, or happiness is a zero sum game.
I disagree with a lot the points in your article. The things you listed as cons with having office "friends" all sound like things no real "friend" would do. I don't generally use social media, so maybe I don't understand that aspect, but honestly if someone came to work and gossiped about me, they wouldn't be considered a friend. This article seems to specifically mean Facebook friends so I guess my opinion isn't super relevant as I don't use Facebook.
A real friend would understand if you told them you don't want to do something. As a manager I'm not super interested in making people do things they don't want to do anyways. Obviously its unavoidable sometimes, but I think most employees also understand this.
I don't think that necessarily true. I am friends with a couple of my direct reports, but we have a distinction between work relationship and personal. When we are at work it is business, they understand my job duties and I am clear with my requirements as a manager. I have even had to fire a work friend before and we are still real life friends. I think the main distinction is to set boundaries from the get go. Work is work, personal is personal.
Overall, however I would say that my personal relationship with my reports has led to phenomenal gains on both sides. On the personal side its always great to have people who understand your job and can relate. On the business side it brings a touch of humanity so that you're not just a rote machine making decisions, (contrary to some people's belief I see this as better). I think a lot of manager believe they can't make exceptions to rules for any reason, but I find that workers are far more productive and loyal to the company when they are treated with compassion and understanding.
You can get a static IP through my business provider, (Cox), for free. It comes with the business subscription. Getting a business subscription is as easy as signing up for it. I work from home and the guaranteed speed and higher line priority is worth ~$20/month premium. Also no data cap!
So much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server. <head smashes through desk>
Are you serious? The orginally predicted death number was over 250,000 in Britain. How do you explain the numbers in Sweden which had a much different policy compared UK? Yes Sweden has a higher mortality/million pop rate, but estimates are showing that the number of people dying in UK from non-covid-19 health issues as a result of covid-19, (not going to hospital or getting treatment), would put those numbers on par.
You know that anyone can edit a wikipedia page right? I think it's telling that this man is an ex director at the WHO with over 50 years experience as an Oncologist and rather than listen to what he is saying, people are continually trying to discredit him.
>The bottom line is, there's no reason to request the non-HTTPS connection in the first place.
The example I gave wasn't to excuse the issue, it was to maybe explain why the fix is taking so long.
> And there's apparently no checks in the app to make sure it's connected to their real server.
I don't think you can make that statement. The description of the issue only attempts to hi-jack the session, he didn't actually try to do anything with it. There may very well be checks in place.
I meant most likely as in a as to why they do the http to https redirect. I have seen this from several other apps, I don't think its extreme, but my guess is just based on the redirect seeming to be intentional. I should probably have said "this could possibly be because", rather than "most likely".
The http link could theoretically be serving the cert to the device. I'm not sure WHY they would do this, just guessing. However, the redirect makes it seem intentional for whatever reason.
I'm not a valve developer so I can't tell you exactly what is happening, but you most certainly can serve different certificates to browser vs mobile. The apps are using WebViews which are not the same as Chrome and Mobile safari. It would make sense to us a CA cert for normal browser traffic as it is fairly sandboxed as far what you can and cannot do, the WebViews are a completely different environment.
Again I'm saying this based on real world experience with why someone would use http instead of https, so my point is just a guess. I might be giving Valve too much credit and trying to explain something that is just a mistake. I am basing my theory on the fact that the http endpoints immediately re-direct to https ones, so it seems to be intentional for one reason or another.
It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.
I don't think you understand. There is no such thing as a "self-signed" CA cert, (its one or the other). This not about money, it's about control. There are many benefits to using a self-signed SSL cert over purchasing a CA one. However, Apple and Android inherently distrust self-signed certs so you have to actually provide the cert directly to ATS/Android OS which involves bundling it within the app, (a messy process). The current industry "hack" is to use http within the app, and then re-direct to https, (which is exactly what the steam app does).
A self signed cert is a a real cert, its just not provided by an CA authority. I guarantee you this http just redirects to an https location, (just tested it on my own device), so there is no plain text transfer. In the mobile industry this happens all the time as backend endpoints grow and change.
This is most likely not a typo. The redirect from http to http is most likely due to valve using a self signed ssl certificate and not directly exposing it to ATS, (iPhone). If they went directly to the https endpoint the OS would block the traffic to an invalid, (not CA authority signed), SSL certificate.
>For a simple MITM exploit that can be fixed by replacing "http://" with "https://", this is simply unacceptable.
I think the author is really not understanding the complexity of updating to an https:// url inside of a mobile applicaiton. Valve is most likely using a self signed cert so that would require bundling the certification in with the app so that Apple/Android allowed it to load inside of a webview. This is not nearly as simple as just updating all of the urls in the app to https:// and the fix could very well take a few months. Furthermore, loading the store page is not necessarily a vulnerability to valve as if you are able to re-direct it, you wouldn't have access to any of the Steam user specifics, (like account data). It wouldn't be much different than putting a shady link somewhere on the internet, and people navigating to it.
This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.