TomAnthony

Here you go: https://news.ycombinator.com/item?id=50285981

Free wifi sync of Withings Scales to your own server. Alas, not in Rust. :)

In response to this, I set out to see if I could patch my scales to sync to my own server.

It only supports two models of scales so far, but I got it working. My Withings scales are now syncing automatically into Apple Health over wifi, and without anything going to Withings.

Blog post: https://www.tomanthony.co.uk/blog/withings-yow-free-wifi-syn...

Github project: https://github.com/tomanthony/YourOwnWeigh/

The Withings app has just got consistently worse and worse over the last few years. I just wanted some scales that would sync to my phone and record my weight over time.

Now the app is absolutely bloated and I can barely find my weight, and the syncing has become _much_ less stable, and the app is constantly asking me to sign in again.

Amazing how they were from good, to bad, to terrible.

I think this might have been true in the past, but I don't think it is true any longer. Zoom grew at a wild pace during the early days of the pandemic, and with that came security issues. However, they recognised that and invested into security.

I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.

Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.

However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.

Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.

[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crac...

Thanks for the detailed reply! The Greaseweazle looks good and is inexpensive. I think I’ll get one. :)

I have a bunch of 3.5" floppy disks from my BBC Master, which date back to late early 90s. Will the data on them still be ok?

If I bought a Kryoflux or similar device would I be able to access and save the data?

This was fun. :)

I feel like there should be another scoring axis rather than just time. I think selector length would be wrong, but something like selector complexity, or how robust the selector is to updates.

I scored 3m 50s, but felt like some of my selectors were a bit 'dirty'.

The negative test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640187792DOH...

The positive test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640524880jk8...

Excited about Caido! Been waiting on the beta list for a while!

In 2017 I found a security issue with the Tesco website. It was a minor security issue, but I could see they had _attempted_ to stop people doing what I could do.

I did manage to find an email address, but I got a templated response, and when I checked a year later it was still not fixed.

Sure, it was a minor issue, but I was surprised Tesco didn't have a proper Vulnerability Disclosure Program or Bug Bounty program. A bug bounty program is an inexpensive way to avoid exactly this sort of issue.

Yes, I understand that, but how do I _know_ if I am using this functionality?

In this case, it is the ability for an app to install and execute arbitrary code that hasn't been reviewed. I download an update to DoodleJump and it installs some malware on my device. I'd be none the wiser.

I don't want that stress, which is why I chose an Apple device. It protects me from that scenario.

I agree - I'd also be opposed. I understand why it frustrates people (especially in the cases such as iDOS 2), but it was a known factor for me buying an Apple phone. More importantly, it was an aspect of the ecosystem that I _wanted_.

On Android the Play Store is a major distributor of malware [1]. I would like to avoid that, which comes with trade-offs, which I accept. Is it perfect? No. But it works.

I do wonder if there is a path where iOS can be completely replaced by a third party OS, so iPhones can be used in a way to allow you to install anything you want, but it is no longer Apple's 'responsibility'. However, that also comes with its own set of problems.

[1] https://www.zdnet.com/article/play-store-identified-as-main-...

In Information Theory, there is a concept of Channel Capacity. If a channel is defined as the probability of the output being s if you send a, across all possible values of a, then the Channel Capacity is the maximum amount of information you can communicate across this channel, measured in bits.

To achieve the Channel Capacity you need to find the optimum distribution across a - i.e. what set of signals maximises the information you can transmit on this channel. There are known algorithms for finding this distribution (e.g. Blahut-Arimoto).

Now if you model the world as a channel, where s represents the reachable states and a represents the actions the agent can take (and the channel, P(s|a), represents the dynamics of the world), you can calculate what actions allow you maximal control (in terms of states you can controllably reach).

More info in this paper: https://uhra.herts.ac.uk/handle/2299/15376

Hah - thank you for sharing!

That is very interesting that this emerged from two different approaches.

I published my result years back, and have never heard of this emerging elsewhere before!

Didn’t take it as accusatory [but thanks to child for sharing link :)].

The approach I used was similar. The idea of maximising observed control of the world means you seek states where you can reach many other states, but _predictably_ so. This comes 'for free' when using Information Theory to model a channel.

Sure! The PDF is available here:

https://uhra.herts.ac.uk/handle/2299/15376

Yes, you are right.

I experimented with different time horizons, mostly look 3-7 steps ahead.

In terms of the 'reward', that was implicit within the model - if the ghosts caught you, your ability to influence the state of the world dropped to 0.

Yes! Exactly - kiting. I didn't know the term but when I explained the behaviour I was seeing to a colleague they told me about this.

The method was called 'empowerment'. Two ways to explain it...

From a mathematical perspective, we used Information Theory to model the world as an information theoretic 'loop'. The agent could 'send' a signal to the world by performing an action, which would change the state of the world; the state of the world was what the agent 'received'. This obviously relies on having a model of the world and what your actions will do, but doesn't burden the model with other biases.

Pore more colloquially, the agent could perform actions in the world, and see the resulting state of the world (in my case, that was the location of the agent and of the ghosts). Part of the principle was that changes you cannot observe are not useful to you.

Similar story of unexpected AI outcomes...

As part of my PhD research, I created a simplified Pac-Man style game where the agent would simply try to stay alive as long as possible whilst being chased by the 3 ghosts. The agent was un-motivated and understood nothing about the goal, but was optimising for maximising its observable control over the world (avoiding death is a natural outcome of this).

I spent sometime trying to debug a behaviour where the agent would simply move left and right at the start of each run, waiting for the ghosts to close in. At the last minute it would run away, but always with a ghost in the cell right behind it.

Eventually, I realised this was an outcome of what it was optimising for. When ghosts reached cross-roads in the world they would got left or right randomly (if both were same distance to catching the agent). This randomness reduced the agent's control over the world, so was undesirable. Bringing a ghost in close made that ghost's behaviour completely predictable.

Alas, that isn't as true as German's tell me it is, I find.

"Weg" <- how do you pronounce this?

"Geh weg" (go away) "Der Weg ist da drüben!" (the path is over there)