Google is allowing developers of non-gaming apps to provide alternative billing systems to users in the EEA region. The European Economic Area (EEA) comprises all countries in the EU, Norway, Iceland, and Liechtenstein. More: - The European Parliament passed the Digital Markets Act earlier this month, forcing Apple and Google to allow sideloading apps, download apps from third-party sources, and alternative billing systems.
- Google will charge developers a service fee of 12% when a consumer uses a third-party billing system. The service fee will be 27% for developers who make more than $1M annually.
- Google asked developers who offer alternative options to ensure appropriate user protection requirements and service fees.
- Google said it will not remove or reject updates of non-gaming apps from participating developers for offering alternative billing systems.
| |
Pixalate shared Q1 2022's App Store Safety Report based on its analysis of over 5 million active apps for a detectable privacy policy in Google and Apple stores. More: - The report provides a breakdown of apps with a detectable privacy policy across countries and categories, data shared with advertisers and data brokers, and how many are child-directed.
- 17% and 13% of apps on Google and Apple's app stores have an undetected privacy policy. This pushes the total number of apps without a privacy policy to over 787,000.
- A 98% of these apps also had no terms of service, and a good percentage had access to users' personal data.
- The number of child-directed apps with no detected privacy was higher in Apple (14%) than in Google (5%).
- According to Pixalate, Over 26,000 apps registered in the U.S had an undetected privacy policy. The top five countries with the largest non-privacy policy apps were Spain, Italy, Mexico, Egypt, and Pakistan.
| |
 A message from SECURITY COMPASS The top challenges companies encounter when implementing DevSecOps are budget constraints and managing legal, regulatory & compliance controls. These challenges, along with the time it takes to create software applications while documenting AppSec processes along the way, have resulted in very high interest for automating proactive security and compliance processes. The need to build software with security by design, and in so doing to shift security left, is broadly accepted as one of the top priorities among mid-market-sized companies that produce software. These companies struggle to proactively define security for new software under development alongside an inability to document and track implemented controls in reasonable time periods. In this report you will learn: - a comprehensive look at the current state of AppSec
- security maturity in the mid-market
- the challenges and opportunities growing companies face when trying to scale their secure development efforts
Download the report
| |
JetBrains announced the availability of Space On-Premises in beta. The On-Premises version enables users to manage, maintain, and upgrade Space entirely at their end. More: - Space is a complete development platform that combines Git hosting, code reviews, automation, CI/CD, packages, etc., all in one place.
- The On-Premises version provides complete control over data, Space maintenance, and upgrades.
- The beta program is available with the Organization plan and is limited to 1,000 users and 50 concurrent automation workers.
- JetBrains recommends installing Spaces On-Premises either for Docker to run a quick test environment or Kubernetes for bigger installations that scale.
- The beta version is currently available for free, and JetBrains plans to offer a free plan for up to ten users once it is publicly available.
| |
Google's Threat Analysis Group (TAG) identified an Android malware distributed by Turla, a group publicly attributed to Russia's FSB. Google believes the malware did not have a major impact on its users, and the number of installs was minuscule. More: - Turla created the Cyber Azov app, spoofing the Ukrainian Azov Regiment, and disguised it as a DoS attack tool against Russian websites.
- The app was not distributed through the Google Play Store. It was hosted on a domain controlled by Turla and disseminated through third-party messaging services.
- According to TAG, this is the first instance of Turla distributing Android-related malware.
- During this investigation, TAG identified another Android app called StopWar, believed to be developed by pro-Ukrainian developers, that could have served as inspiration for Turla.
| |
 A message from LAIKA If you’re trying to close deals, SOC 2 is probably a thorn in your side. What is it, and who cares? Your business needs SOC 2. But building compliance from scratch is complicated, time-consuming, and the cost can be crippling. Laika has you covered. Uncomplicate SOC 2 with our guide for growth-minded founders. In the guide by Laika you’ll learn: - What is SOC 2 compliance and why it matters for your startup
- How to close more deals faster by becoming SOC 2 compliant
- How to prepare for SOC 2 compliance
- What to expect in terms of time and cost
- What to do after the report is in
What makes Laika the authority on SOC 2? They’re the only compliance automation solution that was built by compliance experts. Learn how to turn compliance from a pain point into a secret edge over your competitors. Download Now 
| |
New Tools and Updates: - Apple developers will have to use the App Store Connect API instead of the XML feed from November to automate the management of in-app purchases, subscriptions, metadata, and app pricing. The XML feed will continue to support existing Game Center management functionality.
- July's update to Java on Visual Studio Code fully enabled built-in support for Lombok, drag and drop support in Java Project Explorer view, inlay hints exclusion list, more code actions to Quick Fix prompt, and more.
- The World Wide Web Consortium (W3C) announced Decentralized Identifiers (DIDs) v1.0 is an official web standard. It is expected to provide better control of online information, security, and privacy. W3C had rejected Google and Mozilla's objections to the proposal.
- Google introduced the new CrUX docs with rewritten documentation, making it easier to find answers to most frequently asked questions.
| |
| |
Quick Hits: - Ransomware attacks grew by 485% in 2020. This multi-pronged approach can help organizations respond to and recover from ransomware attacks.*
- Microsoft changed its Store policy to allow the sale of open-source apps. The ban on apps that use Apple's WebKit browser still continues. Earlier this month, Microsoft delayed the enforcement of these policies following backlash from developers.
- Multiple Google Cloud services, including Big Query, Firestore, Kubernetes Engine, and many more, experienced errors and service unavailability in Europe following a cooling-related failure. An extreme heat wave is scorching the continent.
- Tech research firm Digital Enterprise Journal conducted a study among 3,000 organizations on managing IT performance. The survey found that 68% of an IT team's time is spent on tasks that do not contribute to key business outcomes.
- How's your current digital marketing strategy? Make it even stronger with our new interactive worksheet.*
*This is a sponsored post.
| |
Upcoming Events: DID YOU KNOW WE'RE HIRING? - We have multiple positions open for 100% remote, full-time analysts. Apply or refer someone.
| |
 |  | Sudarshan lives in Toronto, Canada, and is an engineering graduate. He is passionate about business, tech, entrepreneurship, and politics. FUN FACT: Sudarshan worked for the election campaign teams of two heads of state in India. When he is not busy with work, he enjoys hiking, playing cricket, and cooking. | | | | Editor | Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 Ford. | |
Security Compass is on a mission to accelerate software time-to-market while managing risk. | |
Laika is a unified compliance platform that automates workflows for audits, infosec monitoring, and vendor due diligence in a single, collaborative space. | |
Comments
Post a Comment