President-elect Joseph Biden has plucked Ron Klain, a longtime colleague and confidant and the current executive vice president of the venture capital firm Revolution, as his White House chief of staff, reports The New York Times.
Klain was Biden’s chief of staff for two years during the Obama administration and left his post as chief of staff in 2011 to join Revolution, the firm founded by former AOL chief executive and founder Steve Case. Revolution did not immediately respond to a request for comment.
If Klain makes his second entrance into the White House, Biden will be bringing on a chief of staff he’s known for more than 35 years. The duo first worked together in 1989, when the president-elect was a senator and Klain was a newly graduated law student from Harvard Law School. He most recently worked as the White House Ebola Response coordinator from October 2014 to February 2015, and helped as a debate advisor to President Obama and President Clinton, as well as nominees Al Gore, John Kerry and Hillary Clinton.
Klain’s appointment could pacify some of the presumed tension that could occur between startups and the government under the Biden-Harris administration. Biden has been vocal about pursuing aggressive regulation on the tech industry, which could negatively impact behemoths like Google, Apple and Facebook. Klain has spoken up (in TechCrunch!) about how regulatory hurdles could hinder key innovation in startup-land. Klain also helped lead efforts for Higher Ground Labs, an incubator and accelerator focused on politically-focused (and Democrat-loved) startups. While that likely wouldn’t impact Big Tech, it doesn’t hurt that, reportedly, one of Biden’s closest confidants will have a soft spot for startups.
via TechCrunch https://ift.tt/2K3LZ5j Shared by Ivan Ling
India’s antitrust watchdog has approved Google’s proposed investment of $4.5 billion in the nation’s largest telecom platform Jio Platforms, it said in a tweet on Wednesday.
Google announced in July that it would be investing $4.5 billion for a 7.73% stake in the top Indian telecom network. As part of the deal, Google and Jio Platforms plan to collaborate on developing a customized-version of Android mobile operating system to build low-cost, entry-level smartphones to serve the next hundreds of millions of users, the two companies said.
Jio Platforms is planning to launch as many as 200 million smartphones in the next three years, according to a pitch the telecom giant has made to several developers. These smartphones, as is the case with nearly 40 million of Jio’s feature phones in circulation today, will have an app store with only a few dozen apps, all vetted and approved by Jio, according to one developer who was pitched by Jio Platforms. An industry executive described Jio’s store as a walled garden.
The Indian watchdog, Competition Commission of India (CCI), was said to be interested in reviewing the data sharing agreement between Google and Jio, Indian newspaper Economic Times reported last month, citing an unidentified source.
The announcement today comes days after the CCI announced it had directed an in-depth investigation into Google to verify the allegations of whether the Android-maker promotes its payments service during the installation of an Android smartphone (and whether phone vendors have a choice to avoid this); and if Google Play Store’s billing system is designed “to the disadvantage of both i.e. apps facilitating payment through UPI, as well as users.”
The call for this in-depth investigation was prompted after the CCI concluded in its initial review that requiring Google Pay to be used to buy apps or make in-app payments was an “imposition of unfair and discriminatory condition, denial of market access for competing apps of Google Pay and leveraging on the part of Google,” the watchdog said.
Tailscale has raised a $12 million funding round. Accel is leading the round with Heavybit and Uncork Capital also participating. The company is building a better corporate VPN by leveraging a modern protocol and focusing on ease of implementation.
A VPN, or a virtual private network, is an encrypted tunnel between two devices. Many companies rely on a VPN for remote employees, multi-office setups and internal services that are supposed to be visible to employees exclusively. For instance, if you’re working remotely, chances are you can connect to your company’s intranet and internal services by connecting to a VPN server from your corporate laptop.
Over the past few years, there have been multiple trends when it comes to accessing your company’s internal network. Some companies rely on sophisticated access policies. Google has been going down this path with its BeyondCorp zero trust system.
Other companies still rely on corporate VPNs and firewalls as they are easy to implement. They often use the IPsec protocol with a VPN gateway that handles the connection to the internal network.
If you’ve been working remotely lately, you may have noticed that this traditional VPN setup doesn’t scale well. The gateway is a bottleneck and you can experience long loading times when there are a lot of people connected at the same time.
Going back to Tailscale, the startup is trying to modernize the corporate VPN. It starts with a different VPN protocol. Tailscale chose WireGuard, a lightweight VPN protocol that relies on a combination of public and private keys to establish an encrypted tunnel between two clients.
But Wireguard itself is just a protocol. It doesn’t tell you how you’re supposed to handle public keys, add new devices to your network, etc. Tailscale acts as the glue that brings all the separate pieces together.
"Architecturally, I would describe Tailscale as the Control Plane and WireGuard is the data plane,” co-founder and CEO Avery Pennarun told me.
Image Credits: Tailscale
Let’s take an example. Your company has an internal Git server and an internal documentation wiki. You have a corporate laptop and you want to access those two services. You can install the Tailscale client on three different machines — your laptop, the Git server and the wiki server.
When you want to connect to the internal services, Tailscale asks you to log in using your company’s identity provider, such as G Suite, Okta, Active Directory, etc.
All Tailscale clients check a coordination server to see if the connection is authorized. “It’s a drop box for public keys,” Pennarun said. When somebody leaves the company, the public key is removed from the coordination server and Tailscale no longer works. Keys are rotated regularly for improved security.
A connection is then established between your laptop and the Git server or your laptop and the wiki server. There’s no bottleneck due to the VPN gateway as the Git server and the wiki server act as their own VPN gateways. There’s no need to expose your documentation wiki to the internet as employees first use Tailscale to access the server.
You don’t have to open the SSH port on the server as Tailscale can find a way to establish a connection through firewalls.
The company is still quite small but pretty efficient. With around 20 employees, Tailscale is generating tens of thousands of client installs per month.
You can get started for free with a single user and multiple devices. Some users have tried it with a Raspberry Pi at home so that they can connect to their local network when they’re on the move. They bring it to work later.
By keeping customer acquisition costs very low, Tailscale has managed to raise $12 million. Twingate is another company trying to solve the same issue, but it has made different technical choices — they rely on TLS tunnels and relays.
Patreon and Acast are teaming up to make it easier for podcasters to publish episodes that are only available to the patrons financially supporting them on Patreon.
Most paywall solutions for podcasts are pretty clunky or limited. That’s why Acast launched technology last year that allows publishers to release paywalled episodes that listeners can access on any podcast app.
Patreon, meanwhile, already supports the creation of a patron-only RSS feed, and Brian Keller, the company’s director of creator success said that “exclusive content is the biggest and most effective benefit that [podcasters] can offer to their members.”
Still, he said that many of the podcasters on Patreon are asking for a better solution, which is where the Acast partnership comes in.
Through the integration, a podcaster can link to their Patreon account in their public podcast show notes. If someone clicks on the link and they aren’t already a patron, they can sign up. If they are a patron, their membership level will be authenticated and they’ll be directed to a listening experience allows them to subscribe, via the podcast app of their choice, to a feed that combines whatever patron-only content they should have access to, plus all the free content included in the public feed.
Image Credits: Acast
So from the patron/listener experience, you should only need to sign up once, then you’ll can get your premium episodes without any extra work. The podcaster, meanwhile, can manage their public and private feeds from a single dashboard, while also getting access to detailed listener data from Acast.
Leandro Saucedo, Acast’s chief strategy and business officer, noted that the companies aren’t forcing any Patreon creators to go down this route. They can still distribute their podcasts with whatever platform or tool they were using before.
“With this partnership in place, we hope that usage will be high as possible, but we’re not forcing anybody into it,” Saucedo said.
At the same time, he suggested that there should be a seamless migration process for any podcasters making the switch to Acast, without requiring any listeners to subscribe to a new feed.
Patreon and Acast have already been beta testing this integration with select podcasts, including Sleep With Me and 90 Day Gays.
“I love the Acast integration!” said Sleep With Me’s Drew Ackerman in a statement. “The analytics let me know that patrons are listening to the content and give me clear insight into exactly what and how they’re consuming it. It’s secure and easy for patrons to get set up, and the fact that there is only one link to share makes it simple for listeners to find the content and brings new patrons to our membership!”
Apple is organizing its third event in three months today. The company is holding a (virtual) keynote at 10 AM PT (1 PM in New York, 6 PM in London, 7 PM in Paris). And you’ll be able to watch the event right here as the company is streaming it live.
Apple has already announced at its developer conference that there would be a new Mac with an ARM-based processor this year. So today’s event seems like the perfect opportunity to introduce a new computer with Apple’s own processor.
Similarly, we’ll likely find out when macOS Big Sur is going to be released. The new major update is likely to ship with the new Apple computer. Apple could also use this opportunity for other, smaller announcements. Let’s see if the company has some new accessories to show off.
You can watch the live stream directly on this page, as Apple is streaming its conference on YouTube.
If you have an Apple TV, you don’t need to download a new app. You can open the Apple TV app and find the Apple Events section. It lets you stream today’s event and rewatch old ones.
And if you don’t have an Apple TV and don’t want to use YouTube, the company also lets you live stream the event from the Apple Events section on its website. This video feed now works in all major browsers — Safari, Firefox, Microsoft Edge and Google Chrome.
via TechCrunch https://ift.tt/38uK3wO Shared by Ivan Ling
Bill Zhang lowered himself into lunges on a squishy mat as he explained to me the benefits of the full-body training suit he was wearing. We were in his small, modest office in Xili, a university area in Shenzhen that’s also home to many hardware makers. The connected muscle stimulator attached to the suit, called Balanx, is designed to bring so-called electronic muscle stimulation, which is said to help improve metabolism and burn fat.
“We are not really aiming at Chinese consumers at this point,” said Zhang, who started Balanx in 2014. “The suit is for the more savvy consumers in the West.”
Prospects for hardware makers were looking bright until two years ago when the Trump administration began setting trade barriers on China. Relations between the two countries have been deteriorating over a series of flashpoint events, from Beijing’s policy on Hong Kong to the coronavirus pandemic.
Chinese entrepreneurs don’t expect relationships between the countries to warm up anytime soon, but many do believe the new office will make “less erratic” and “more rational” policy decisions, according to conversations TechCrunch had with seven Chinese hardware startups. Chinese tech businesses, big or small, are adapting swiftly in the new era of U.S.-China competition as they continue to woo overseas customers.
Designed in China
Zhang is just one of the many entrepreneurs looking to bring state-of-the-art Chinese hardware to the world. This generation of founders no longer hawk cheap electronic copycats, the image attached to the old “Made in China” regime. Decades of knowledge transfer, product development, manufacturing, export practice and policy support have made China a powerhouse for producing new technologies that are both edgy and still widely affordable.
Anker’s power banks, Roborock’s vacuums and Huami’s fitness trackers are just a few items that have gained loyal followings in several overseas markets, not to mention global household names like Huawei, Xiaomi, Oppo and DJI.
Consumer sentiment is also changing. Europeans’ perception of “Made in China” quality and innovation has “improved significantly” over the last 10 to 15 years, said Frank Wang who oversees marketing at Xiaomi-backed Dreame which makes premium home appliances including cheaper alternatives to Dyson hairdryers and vacuums.
The new players are eager to replicate the success of their predecessors. They seek media attention and retail partners at international trade fairs like CES, teach themselves Facebook and Google campaigns, and court gadget lovers on crowdfunding platforms. Investors ranging from GGV Capital to Xiaomi rush to back scrappy startups that are already shipping millions of units around the globe.
For Donny Zhang, a Shenzhen-based electronics parts supplier to hardware companies, businesses have been shrinking as soon as the trade war began. “My clients are taking the brunt because the costs of procurement have increased,” he said of those who directly or indirectly deal with American firms.
While many export-led hardware businesses loathe decreasing profitability, some learn to adapt and look for a silver lining. That has unexpectedly spurred new directions for factory owners in China. Indiegogo, one of the world’s largest crowd-funding platforms, saw the changes first hand.
“Once tariffs increase, there’s not much profit margin left for manufacturers because the middlemen already eat up the bulk of their profit,” Lu Li, general manager for Indiegogo’s global strategy, told TechCrunch.
“A good solution is for factories to skip the middlemen and sell directly to consumers with their own brands. Once the goal of brand building is clear, they often come to us because they need marketing help as a first step to establish themselves as a global consumer brand.”
The trend, dubbed “direct-to-consumers” or D2C, also plays into China’s national plan to encourage manufacturing upgrade and homegrown innovations to compete globally, an initiative that began to take shape around 2015. The development naturally makes China Indiegogo’s fastest-growing region in the last two years: in the first three quarters of 2020, businesses coming from China jumped 50% year-over-year, according to Li.
Localize
Having an appealing product and brand is just the prerequisite. Ever-changing trade policies and geopolitics have forced many Chinese businesses to localize seriously, whether that means setting up a foreign entity or building a local team.
For Tuya, which provides IoT solutions to device makers around the world, the trade war’s effect has been “minimal” since it has operated a U.S. entity since 2015, which employs its local sales and technical support staff. Most of its research and development, however, still lies in the hands of its engineers in India and China, the latter of which can be a potential contention point, as shown by TikTok’s recent backlash in the U.S.
“The key is compliance. We have a dedicated team of security experts to work on compliance issues. For instance, we were one of the first to get GDPR certified in Europe,” said the company’s chief marketing office Eva Na.
The company’s readiness is prompted by practical needs though. Many of its clients are large Western corporations that demand strict legal compliance in vendors, so Tuya began collecting the needed certificates early on. Connecting 200,000 SKUs today, Tuya’s footprint is found in over 190 overseas countries, which account for over 60% of its business.
Well-funded Tuya may have the financial and operational capacity to sustain an overseas team; but for smaller startups, localization can be a costly and tedious learning curve. Many opted to set up a Hong Kong entity to tap the city’s status as a global financial hub and evade trade restrictions on China, an advantage of the territory that began to crumble following Beijing’s implementation of the national security law.
Balanx, the smart training suit maker, has a Hong Kong entity like many of its export-facing hardware peers. To cope with new global headwinds, it registered a virtual company in Nevada but quickly realized the entity is of little use unless it has an on-the-ground operation in the U.S.
“Many local banks would ask for utility bills and etc. if I want to open an account, which we don’t have. We realized we must have a local team,” asserted the founder.
Hope
Zhang is positive that small companies like his own will remain under the radar in spite of U.S. sanctions. “Just avoid having any government connection,” he said.
Indeed, some of the more “benign” and niche products are continuing to thrive in their global push. PopuMusic, a Xiaomi-backed startup making smart instruments like ukulele and guitar to teach beginners, is one. “We aren’t affected by the trade war. We are in a business that’s neither threatening nor aggressive,” said Zhang Bohan, founder of PopuMusic, which counts the U.S. as one of its biggest overseas markets.
Chinese brands are also seeing their edge as the coronavirus sweeps across the globe and confines millions at home. Hardware makers like Balanx, Dreame and PopuMusic have long learned to master e-commerce and logistics in a country where online shopping is ubiquitous.
“Consumers in Europe and the U.S. are growing more accustomed to e-commerce, a bit like those in China five to eight years ago,” said Wang of Dreame.
Rather than rethinking the U.S., PopuMusic is forging further ahead by launching a new connected guitar via an Indiegogo campaign. Global expansion is at the core of the startup’s vision, the founder said. “We are global from day one. We had an English name before even coming up with a Chinese one.”
In the process of making big bucks, hardware makers may have to downplay their “Made in China” or “Designed in China” brand, said Li of Indiegogo. This could help them avoid unnecessary geopolitical complications and attention in their international push. But one has to wonder how this new generation of entrepreneurs is reckoning with their national pride. How do they deal with the mission passed down by Beijing to promote Chinese innovation in the global marketplace? It’s a line that Chinese entrepreneurs have to tread carefully in their global journey in the years to come.
via TechCrunch https://ift.tt/3lmnQVm Shared by Ivan Ling
A press report emerged over the weekend claiming European lawmakers who are worried about terrorism are speeding towards a ban on end-to-end encryption. Spoiler: It’s a little more nuanced than that. Read on for our break down of what’s actually going on…
Is Europe about to ban E2E Encryption?
No.
A report in the Austrian press yesterday appeared to suggest a ban incoming on end-to-end encryption which the headline linked to a recent terror attack in the country. In fact there have been discussions ongoing between Member States on the topic of encryption — and whether/how to regulate it — for several years now.
The report is based on a draft resolution of the Council of the European Union (CoEU), dated November 6. Per the draft document a final text, which could incorporate further amendments, is due to be presented to the Council on November 19 for adoption.
The CoEU decision-making body is comprised of representatives of Member States’ governments. It’s responsible for setting the political direction for the bloc however it’s the European Commission which is responsible for drafting legislation. So this is not in any way ‘draft EU legislation’.
One Commission insider we spoke to who’s involved in cyber security strategy couched the resolution as a “political gesture” — and most likely an empty one.
What does the CoEU draft resolution actually say?
It starts by asserting the EU’s full support for “the development, implementation and use of strong encryption” — which would be a very odd position to hold if you also intended to ban E2EE.
Then it discusses “challenges” to public security that flow from criminals having easy access to the same technologies that are used to protect vital civic infrastructure — suggesting criminals can use E2EE to make “lawful” access to their communications “extremely challenging” or “practically impossible”.
This is of course a very familiar discussion in security circles — regularly fuelled by the ‘Five Eyes’ nations’ push for greater surveillance powers — and one which recurs repeatedly in relation to the technology industry owing to developments in communications tech. But note the CoEU does not say access to encrypted data is actually impossible.
Instead the resolution moves on to call for discussion of how to ensure the powers of competent security and criminal justice authorities can be preserved — while ensuring full respect for due legal process and EU rights and freedoms such as (notably the right to respect for private life and communications; and the right to the protection of personal data).
The document suggests a “better” balance should be created between these competing interests. “The principle of security through encryption and security despite encryption must be upheld in its entirety,” is how it’s phrased.
The specific call is for “governments, industry, research and academia… to work together to strategically create this balance”.
Does the draft resolution call for encryption to be backdoored?
No.
Indeed, the Council of Ministers specifically writes [emphasis ours]: “Competent authorities must be able to access data in a lawful and targeted manner, in full respect of fundamental rights and the data protection regime, while upholding cybersecurity. Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality.”
So the push here — beyond the overarching political push to be seen to be doing something ‘pro-security’ — is for ways to improve targeted access to data but also that such targeting respect key EU principles that link to fundamental rights (like privacy of communications).
That doesn’t sum to an E2EE ban or backdoor.
But what does the resolution say about the legal framework?
The Council of Ministers want the Commission to carry out a review of relevant existing regulations with relevance to ensure it’s all pulling in the same direction and therefore contributing to law enforcement being able to operate as efficiently as possible.
There is a mention of “potential technical solutions” at this point — but again the emphasis is on any such law enforcement aids supporting the use of their investigatory powers within domestic frameworks that comply with EU law — and a further emphasis on “upholding fundamental rights and preserving the advantages of encryption”. Security of information is a vital advantage of encryption previously discussed in the document so it’s essentially calling for preserving security without literally spelling that out.
This portion of the draft document has several strike-throughs so looks most likely to be subject to wording changes. But for a signal of the direction of travel one bit of rewording emphasises the need for transparency should there be joint working with comms services providers on developing any “solutions”. (And a backdoor that everyone is told about obviously wouldn’t be a backdoor.)
Another suggestion in the draft calls for upskilling relevant authorities to boost their technical and operational expertise — aka more cyber training for police.
In a final section, joint working to improve relevant co-ordination and expertise across the EU is again highlighted by the CoEU as key to bolstering authorities’ investigative capabilities.
There is also talk of developing “innovative approaches in view of new technologies” — but the conclusion makes a point of stating clearly: “there should be no single prescribed technical solution to provide access to encrypted data”. Aka no golden key/universal backdoor.
So there’s nothing to be worried about then?
Well, the Commission may feel some pressure over the issue as it works on its new cyber strategy so it could get some political push on specific policy ideas — although we’re unlikely to see anything much on this front before next year. The CoEU isn’t setting out any policy ideas yet. At most it’s asking for help formulating some.
TechCrunch spoke to Dr Lukasz Olejnik, an independent cybersecurity researcher and consultant based in Europe, to get his thoughts on the draft resolution. He agreed there’s no broadside against E2EE in the draft, nor any near-term prospect of legislation flowing from it. Indeed, he suggested the CoEU appears not to know what to do — hence looking to outside experts in academic and industry for help.
“First, there is no talk of backdoors. The message sets things clearly with respect to encryption being important for cybersecurity and privacy,” he told us. “As for the topic of this document, it is a long-term process in the exploratory phase now. Problems and ideas are identified. Nothing will happen immediately.
“It’s not getting even near to banning E2EE. It appears they do not know what to do exactly. So among the ideas is to perhaps set up a ‘high level expert group’ — the document speaks about engaging ‘academia’. This process is sometimes initiated by the Commission to identify ‘recommendations’ which may or may not be used in the policy process. It would then revolve around who would get to be admitted to such a group, and this varies a lot.
“For example the AI group was seen as quite reasonable, while the other dedicated one on disinformation was in fact geared towards the EU media figures rather than researchers or concrete expertise. We do not know where all this will lead.”
Olejnik expressed doubt that the Council could drive legislation on its own in this case, given the complexity involved. “It’s too premature to speak of any legislation,” he said. “Legislative process in the EU can be quite complex to understand but the EU Council would be unable to pull such a complex thing on their own.”
New strategic approach (?): "security despite encryption", the policy term blends two meanings of security, technical and non-technical ad the same time, showing that reversible encryption systems are means to guarantee security. pic.twitter.com/CcEZHVIAzZ
But he did highlight the CoEU’s coining of the phrase ‘security despite encryption’ as a noteworthy development — suggesting it’s unclear where this novel framing might lead in policy terms. So, as ever, the security debate around encryption demands a close eye.
“What I find of particular importance is coining the term ‘security despite encryption’. It is both unfortunate and ingenious. But the problem with this technology policy term is that it may consciously blend policy understanding of (physical?) security with technology security, as guaranteed today by encryption. This puts the two in direct opposition,” he said, adding: “Where the fallout would lead is anyone’s guess. I believe this process is far from over.”
But couldn’t there be a push to introduce some kind of ‘lawful intercept mechanism’ across the EU?
There would be huge challenges to such a step given all the EU legal principles and rights that any mechanism would need to respect.
The CoEU’s draft resolution reiterates this multiple times — highlighting the need for security activity to respect fundamental rights like privacy of communications and principles of legality, transparency, necessity and proportionality, for example.
Domestic surveillance laws in several EU Member States have also recently been found falling short in this regard by Europe’s highest court — so there would be a clear path to challenging any security overreach in the courts.
That means that even if some kind of intercept mechanism could be pushed through an EU legislative process, via enough political will to drive it, there’s no doubt it would face fierce legal challenge and the prospect of being unpicked by the courts.
Happy to drag this to the courts (if it would ever happen).. :)
Asked for a view on the notion put forward in the draft resolution — of seeking a “better” balance between security and privacy — and whether it might be a push towards something like the ‘ghost protocol’ advocated by GCHQ in recent years as an “exceptional access mechanism” (but which critics argue would both undermine user trust and introduce a blanket security risk that’s all but equivalent to a backdoor) — Olejnik told us: “Undermining encryption is a tricky territory because modern technology goes in a direction of more security, not less. In modern security ecosystems it would be hard to imagine a lawful intercept functionality known from the telecommunication infrastructure. For private business it’s also a question of trust. Can the individual users freely move their social interactions online even further? It’s a question measured in billions of dollars.”
via TechCrunch https://ift.tt/3klLaRP Shared by Ivan Ling
(@maxschrems)