A new take on the age-old question: Should you rewrite your application from scratch, or is that "the single worst strategic mistake that any software company can make"? Turns out there are more than two options for dealing with a mature codebase. Herb Caudill: Almost two decades ago, Joel Spolsky excoriated Netscape for rewriting their codebase in his landmark essay Things You Should Never Do . He concluded that a functioning application should never, ever be rewritten from the ground up. His argument turned on two points: The crufty-looking parts of the application's codebase often embed hard-earned knowledge about corner cases and weird bugs. A rewrite is a lengthy undertaking that keeps you from improving on your existing product, during which time the competition is gaining on you.

For many, Joel's conclusion became an article of faith; I know it had a big effect on my thinking at the time. In the following years, I read a few contrarian takes arguing that, under certain circumstances, it made a lot of sense to rewrite from scratch. For example: Sometimes the legacy codebase really is messed up beyond repair, such that even simple changes require a cascade of changes to other parts of the code. The original technology choices might be preventing you from making necessary improvements. Or, the original technology might be obsolete, making it hard (or expensive) to recruit quality developers.

The correct answer, of course, is that it depends a lot on the circumstances. Yes, sometimes it makes more sense to gradually refactor your legacy code. And yes, sometimes it makes sense to throw it all out and start over. But those aren't the only choices. Let's take a quick look at six stories, and see what lessons we can draw.

Millions of smartphone users confess their most intimate secrets to apps. Unbeknown to most people, in many cases that data is being shared with someone else: Facebook. [Editor's note: the link may be paywalled; here's an alternative source.] The Wall Street Journal reports: The social-media giant collects intensely personal information from many popular smartphone apps just seconds after users enter it, even if the user has no connection to Facebook, according to testing done by The Wall Street Journal. The apps often send the data without any prominent or specific disclosure, the testing showed. [...] In the case of apps, the Journal's testing showed that Facebook software collects data from many apps even if no Facebook account is used to log in and if the end user isn't a Facebook member.

In the Journal's testing, Instant Heart Rate: HR Monitor, the most popular heart-rate app on Apple's iOS, made by California-based Azumio, sent a user's heart rate to Facebook immediately after it was recorded. Flo Health's Flo Period & Ovulation Tracker, which claims 25 million active users, told Facebook when a user was having her period or informed the app of an intention to get pregnant, the tests showed. Real-estate app Realtor.com, owned by Move, a subsidiary of Wall Street Journal parent News Corp, sent the social network the location and price of listings that a user viewed, noting which ones were marked as favorites, the tests showed. None of those apps provided users any apparent way to stop that information from being sent to Facebook. Update: New York Governor Cuomo has ordered probe into Facebook access to personal data.

For some reason, Apple's website where you can manage your Apple ID (appleid.apple.com) is blocking users of Linux browsers from accessing it. From a report: Having access to the website is important to manage things such as payment information, two-factor authentication, and other account details. Even though the number of Linux users accessing the website must be relatively small compared to other operating systems, some iPhone users who use Linux on the desktop noticed the issue. This behavior was first explained by user Alexander Martin on Mastodon. He discovered that when the browser reports itself as being a Linux browser, Apple's website will block the access by throwing a "Bad Gateway" error.

More than a third of all Google Chrome extensions ask users for permission to access and read all their data on any website, a recent survey conducted by US cyber-security firm Duo Labs of over 120,000 Chrome extensions has revealed. From a report: The same survey also found that roughly 85 percent of the 120,000 Chrome extensions listed on the Chrome Web Store don't have a privacy policy listed, meaning there's no legally-binding document describing how extension developers are committing to handling user data. Additional survey findings include the fact that 77 percent of the tested Chrome extensions didn't list a support site, 32 percent used third-party JavaScript libraries that contained publicly known vulnerabilities, and nine percent could access and read cookie files, some of which are used for authentication operations.

Last May, Facebook promised to launch a "Clear History" feature that it said would give users more control over their data. 9 months later it's nowhere to be found and now a report claims that it's a key example of the company's "reactionary" way of dealing with privacy concerns. From a report: Thus far, Facebook's public discussions of Clear History appear to have been more about communications strategy than charting a new course. In a Facebook post looking back on 2018, Zuckerberg pointed to the tool as one that would "give people more transparency" while Sandberg highlighted it to show Facebook's willingness to change during a speech at the World Economic Forum in Davos, Switzerland, last month.

Still, nine months after its initial announcement, Clear History is nowhere to be found. "We want to make sure this works the way it should for everyone on Facebook, which is taking longer than expected," the company said in a statement to BuzzFeed News. It's unclear if new high-profile hires, like Nate Cardozo (formerly of EFF) and Robyn Greene (formerly of New America's Open Technology Institute), will work with Facebook's new privacy unit or if they will be involved with Clear History. It has reached out to groups like Access Now, the Electronic Frontier Foundation (EFF), and the Center for Democracy and Technology (CDT), as well as academics. Sources confirmed that CDT and EFF were advising Facebook on its Clear History tool, but could not disclose specifics of their meetings due to nondisclosure agreements. Access Now's Masse confirmed Facebook had reached out on a number of issues, including Clear History, in the last few months, but called the conversations "punctual and limited." "Despite repeated statements and apologies from the company, we are not seeing a shift in Facebook data practices or an attitude that would suggest that they take data protection seriously," she said.

An anonymous reader quotes a report from TechCrunch: Facebook will end its unpaid market research programs and proactively take its Onavo VPN app off the Google Play store in the wake of backlash following TechCrunch's investigation about Onavo code being used in a Facebook Research app the sucked up data about teens. The Onavo Protect app will eventually shut down, and will immediately cease pulling in data from users for market research though it will continue operating as a Virtual Private Network in the short-term to allow users to find a replacement. Facebook has also ceased to recruit new users for the Facebook Research app that still runs on Android but was forced off of iOS by Apple after we reported on how it violated Apple's Enterprise Certificate program for employee-only apps. Existing Facebook Research app studies will continue to run, though. Onavo billed itself as a way to "limit apps from using background data and use a secure VPN network for your personal info" but also noted it would collect the "Time you spend using apps, mobile and Wi-Fi data you use per app, the websites you visit, and your country, device and network type." A Facebook spokesperson confirmed the change and provided this statement: "Market research helps companies build better products for people. We are shifting our focus to reward-based market research which means we're going to end the Onavo program."

The first privately funded mission to land on the moon took one giant step forward this evening as an Israeli spacecraft blasted off from Cape Canaveral, Florida. "[I]f the mission is successful, it would make Israel the fourth country to land a spacecraft on the lunar surface -- after the U.S., the former Soviet Union and China," reports NPR. From the report: The spacecraft launched with a Space X Falcon 9 rocket, according to SpaceIL's partner Israel Aerospace Industries. It detached from the reusable rocket, which returned to an off-shore platform. The spacecraft was to make several orbits around Earth, slowly getting closer to the moon. In a difficult maneuver, it was to pivot from orbiting Earth to orbiting the moon, and then eventually attempt a treacherous landing on the moon. The total journey will take several months, with a landing anticipated in mid-April. According to IAI, it would be the "longest journey until landing on the moon, 6.5 million kilometers."

[The spacecraft, which is called Beresheet (Hebrew for "in the beginning"] is covered in gold-colored reflective coating. And as WMFE's Brendan Byrne reported, it's about the size of a kitchen table. It's carrying a digital time capsule which, according to The Jerusalem Post, contains "drawings by Israeli children, the Bible, the national anthem, prayers, Israeli songs and a map of the State of Israel, among other cultural items." The spacecraft is set to run experiments on the moon's surface -- in particular, SpaceIL says it will collaborate with the Weizmann Institute of Science and UCLA to "take measurements of the Moon's mysterious magnetic field."

In response to a mother's inquiry into why her son's gymnastics videos were deemed not advertiser friendly, YouTube said on Twitter it has "taken a number of actions to better protect the YouTube community from content that endangers minors." The video-sharing website went on to say something very concerning for anyone who has ever uploaded a video to the site: "... even if your video is suitable for advertisers, inappropriate comments could result in your video receiving limited or no ads (yellow icon)."

Essentially, what YouTube is saying is that if someone leaves a "incendiary or demeaning" comment, or one with "inappropriate language," the video which features that comment could get demonetized and the content creator would not generate money from it. If you've ever read a comment thread on YouTube, it shouldn't take long for you to realize how big of an issue this could become. According to YouTube's "advertiser-friendly content guidelines," the following content may not be suitable for most advertisers: "controversial issues and sensitive events," "drugs and dangerous products or substances," "harmful or dangerous acts," "harmful or dangerous acts," "hateful content," "inappropriate language," "inappropriate use of family entertainment characters," "incendiary and demeaning [content]," "sexually suggestive content," and/or "violence."

The best advice for circumventing this issue is to disable comments entirely, but this would significantly reduce the interaction between the YouTuber and the viewer. "If this is our new reality we're going to need the ability to restrict comments from accounts under 1-4 weeks old," says news commentator and YouTube personality Philip DeFranco. "Sounds like this is prime for weaponization. Also it would probably be best to have an official blog post instead of my tweet as a reference for this change."

In the event that a traffic light is not working, Waymo's self-driving cars will now be able to use AI to detect and respond to the arm movements of a traffic cop as they wave traffic through an intersection. You can watch a demo of it on YouTube. Futurism reports: Waymo first claimed that its autonomous vehicles could respond to hand signals from nearby cyclists back in 2016. That particular research treated cyclists, from the vehicle's perspective, as obstacles to track and avoid. A new video published by Waymo on Wednesday is the first that shows its vehicles responding to gesture commands -- especially in the absence of the traffic lights on which it would normally rely -- and obeying police orders. The video, which runs at three times normal speed, shows a picture-in-picture display of the car's digital perspective and a video camera as it goes through an intersection.

The video shows the car approach the intersection where a virtual red wall blocks off the road, suggesting that the computer's software responds to the absence of a green light at an intersection the same way as it might to an illuminated red light. The cop in the video, represented by a small prism, teeters across the virtual representation of the intersection before finally waving the Waymo vehicle's vehicle through the intersection and along its way.

Google said it will no longer require current and future staff to go through mandatory arbitration for disputes with the company. "The change goes into effect on March 21," reports CNET. "The search giant will also remove mandatory arbitration from its own employment agreements with contract and temporary staff, though the change won't impact staffing firms." From the report: This comes after Google employees in November walked out of their offices to protest the company's handling of sexual harassment claims. One of their demands was to end forced arbitration in cases of sexual harassment and discrimination. In January, some Google employees launched a social media campaign to pressure the company and other tech companies to drop mandatory arbitration. Mandatory arbitration often means workers can't take their employers to court when they complain internally. The campaign organizers said 60 million Americans are affected by forced arbitration.

Verizon has announced plans to turn on its 5G mobile network in 30 U.S. cities this year. "It revealed the plan during an investor meeting Thursday, though didn't disclose the list of cities," reports Engadget. From the report: Verizon already offers home broadband service via 5G in Los Angeles, Houston, Indianapolis and Sacramento. This month, it hinted at upcoming rollouts in New York City and Atlanta, as well as Medford, Massachusetts, suggesting Verizon will bring 5G to nearby Boston too. The provider plans to flip the switch on its mobile 5G network in the first half of this year, and it will expand its home 5G service to more markets later in 2019. One of the first phones to support Verizon's nascent 5G network will be the Samsung Galaxy S10 5G, which was unveiled yesterday at Samsung's Unpacked event. The device has a larger screen and battery than the S10 Plus, and will temporarily be a Verizon exclusive before expanding to other carriers in the weeks after launch. It's slated to go on sale sometime "in the first half of 2019."

An anonymous reader quotes a report from Motherboard: Switzerland made headlines this month for the transparency of its internet voting system when it launched a public penetration test and bug bounty program to test the resiliency of the system to attack. But after source code for the software and technical documentation describing its architecture were leaked online last week, critics are already expressing concern about the system's design and about the transparency around the public test. Cryptography experts who spent just a few hours examining the leaked code say the system is a poorly constructed and convoluted maze that makes it difficult to follow what's going on and effectively evaluate whether the cryptography and other security measures deployed in the system are done properly.

"Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said.

The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."

Consumer Reports is pulling its recommendation of the Tesla Model 3, citing reliability issues with the car. "Tesla buyers are more likely to be satisfied with their car than customers of any other brand, according to Consumer Reports," reports CNN. "Yet the publication says many customers reported problems with the Model 3, including loose body trim and glass defects." From the report: "Consumers expect their cars to last -- and not be in the repair shop. That's why reliability is so important," said Jake Fisher, senior director of automotive testing at Consumer Reports. Tesla pointed to its overall customer satisfaction rating from Consumer Reports and said it has corrected many of the problems found in the survey. "We take feedback from our customers very seriously and quickly implement improvements any time we hear about issues," said the company statement. It said the survey was conducted from July through September, "so the vast majority of these issues have already been corrected through design and manufacturing improvements, and we are already seeing a significant improvement in our field data." Last May, the product testing website failed to give the Model 3 a recommendation due to issues with braking, but ultimately reversed its decision after Tesla released a firmware update improving the car's breaking distance by nearly 20 feet.

AmiMoJo shares a report from The Register: Privacy warriors have filed fresh evidence in their ongoing battle against real-time web ad exchange systems, which campaigners claim trample over Europe's data protection laws. The new filings -- submitted today to regulators in the UK, Ireland, and Poland -- allege that Google and industry body the Interactive Advertising Bureau (IAB) are well aware that their advertising networks flout the EU's privacy-safeguarding GDPR, and yet are doing nothing about it. The IAB, Google -- which is an IAB member -- and others in the ad-slinging world insist they aren't doing anything wrong. The fresh submissions come soon after the UK Information Commissioner's Office (ICO) revealed plans to probe programmatic ads. These are adverts that are selected and served on-the-fly as you visit a webpage, using whatever personal information has been scraped together about you to pick an ad most relevant to your interests. [...] The ICO's investigation will focus on how well informed people are about how their personal information is used for this kind of online advertising, which laws ad-technology firms rely on for processing said private data, and whether users' data is secure as it is shared on these platforms.

An anonymous reader quotes a report from BuzzFeed News: A viral photo showing a camera in a Singapore Airlines in-flight TV display recently caused an uproar online. The image was retweeted hundreds of times, with many people expressing concern about the privacy implications. As it turns out, some seat-back screens in American Airlines' premium economy class have them, too. Sri Ray was aboard an American Airlines Boeing 777-200 flight to Tokyo in September 2018 when he noticed something strange: a camera embedded in the seat back of his entertainment system. The cameras are also visible in this June 2017 review of the airline's premium economy offering by the Points Guy, as well as this YouTube video by Business Traveller magazine.

American Airlines spokesperson Ross Feinstein confirmed to BuzzFeed News that cameras are present on some of the airlines' in-flight entertainment systems, but said "they have never been activated, and American is not considering using them." Feinstein added, "Cameras are a standard feature on many in-flight entertainment systems used by multiple airlines. Manufacturers of those systems have included cameras for possible future uses, such as hand gestures to control in-flight entertainment." After Twitter user Vitaly Kamluk saw a similar lens on Singapore Airlines and tweeted photos of the system last week, the airline responded from its official Twitter account, saying the cameras were "disabled." Still, the airlines could quell passengers' concerns by covering the lenses with a plastic cover, if indeed there is no use for the camera.

The unusual move is set to be rolled out by Personalised Plates Queensland (PPQ) from next month, allowing drivers to adorn their number plates with a touch of emotion. From a report: Royal Automobile Club of Queensland (RACQ) spokeswoman Rebecca Michael said it was no different from allowing drivers to express themselves with other available themes like their favorite footy team. "For quite some time we've seen that you can support your favourite team or your favourite town with a symbol on your number plate," Dr Michael told 7News Brisbane.

"And using an emoji is no different." But before your mind goes straight to the gutter, no, you won't be able to completely replace the letters and numbers on your number plate with an eggplant or smiling poo emoji. The smartphone symbols won't be included in rego numbers and are simply decorative.

AmiMoJo writes: Nike users are experiencing some technical difficulties in the wild world of connected footwear. Nike's $350 "Adapt BB" sneakers are the latest in the company's line of self-lacing shoes, and they come with the "Nike Adapt" app for Android and iOS. The app pairs with the shoes and lets you adjust the tightness of the laces, customize the lights (yeah, there are lights), and see, uh, how much battery life your shoes have left. The only problem: Nike's Android app doesn't work. Android users report that their new kicks aren't paring with the app properly, and some customers report failed firmware updates for the shoes, which render them unable to pair with the app at all. "My left shoe won't even reboot." writes one owner.

An anonymous reader shares a report: Facebook makes money by charging advertisers to reach just the right audience for their message -- even when that audience is made up of people interested in the perpetrators of the Holocaust or explicitly neo-Nazi music. Despite promises of greater oversight following past advertising scandals, a Times review shows that Facebook has continued to allow advertisers to target hundreds of thousands of users the social media firm believes are curious about topics such as "Joseph Goebbels," "Josef Mengele," "Heinrich Himmler," the neo-nazi punk band Skrewdriver and Benito Mussolini's long-defunct National Fascist Party.

Experts say that this practice runs counter to the company's stated principles and can help fuel radicalization online. "What you're describing, where a clear hateful idea or narrative can be amplified to reach more people, is exactly what they said they don't want to do and what they need to be held accountable for," said Oren Segal, director of the Anti-Defamation League's center on extremism. After being contacted by The Times, Facebook said that it would remove many of the audience groupings from its ad platform.

Contrary to general belief that Earth's atmosphere stops a bit over 62 miles from the surface, a new study based on observations made over two decades ago by the joint US-European Solar and Heliospheric Observatory (SOHO) satellite shows that it actually extends as far 391,000 miles (630,000 km) or 50 times the Earth's diameter. This makes the Moon a very high altitude aircraft. From a report: Launched on December 2, 1995 atop an Atlas IIAS launcher from Cape Canaveral Air Force Station in Florida, SOHO is parked in the first Lagrange point (L1) 930,000 miles (1.5 million km) from Earth where it has carried out studies of the Sun and the solar winds, and will continue to do so until at least 2020. From this vantage point, the observatory's Solar Wind Anisotropie (SWAN) instrument is able to measure the presence of hydrogen by looking at the Lyman-alpha line in the solar spectrum. And what works for the Sun, works for Earth. By turning SWAN on the Earth at the right times of the year, SOHO was able to detect hydrogen atoms from the atmosphere and measure how far out they extend into what space scientists call the geocorona. While the existence of the geocorona is well known -- the telescope set up by the Apollo 16 astronauts on the Moon even photographed it -- no one was sure how far out it reaches until now.

By looking at data collected by SOHO in the mid 1990s, scientists from Russia's Space Research Institute and elsewhere were able to work out the extent and density of the geocorona. What they found was that sunlight on the day side of the Earth compresses the hydrogen until it reaches a density of 70 atoms per cubic cm at an altitude of 37,000 miles (60,000 km), and on the night side it can expand out until it has a density of only 0.2 atoms per cubic cm at the distance of the Moon's orbit. According to the study leader Igor Baliukin, the geocorona is so tenuous that it poses no hazard to astronauts or spacecraft.

A group of researchers say that it will be difficult to avoid Spectre bugs in the future unless CPUs are dramatically overhauled. From a report: Google researchers say that software alone is not enough to prevent the exploitation of the Spectre flaws present in a variety of CPUs. The team of researchers -- including Ross McIlroy, Jaroslav Sevcik, Tobias Tebbi, Ben L Titzer and Toon Verwaest -- work on Chrome's V8 JavaScript engine. The researchers presented their findings in a paper distributed through ArXiv and came to the conclusion that all processors that perform speculative execution will always remain susceptible to various side-channel attacks, despite mitigations that may be discovered in future.