If an engineer ends up leaving a company, on their own, or for any other reason, the company work is going to have to quickly work to change all of their keys for their credentials and keys application components.

That’s a huge hassle, because often times it’s hard to know where they are stored, who can access what, and how to change everything at a massive scale — especially if the company is a huge one. Dane Schneider hopes to change that with a new service called EnvKey, a way to create a kind of encrypted repository internally where a company can store all its API credentials in order to make them easy to update, as well as manage who has access to what. Think of it as a sort of LastPass or 1Password, but for important credentials within a company. EnvKey is launching out of Y Combinator’s Winter 2018 class.

“At the last place I worked, a coworker got fired and my manager said he said, okay, we need to change all the API keys across the infrastructure — and it was Friday at 4 p.m.,” Schneider said. “I had to tell him that’s not something we can just do right now. That’s a bit of an undertaking. I had been thinking along those lines, I had the idea in my mind, then I thought man if we had something that we could just update this in one place it’d be really simpler. We’d be able to deal with the security issue going on right now. We would share [our keys] over email or Slack, but it always felt like the wrong thing to do security-wise.”

Schneider is a solo-founder in Y Combinator, which is a bit of an anomaly, but the idea sounded smart enough given that it’s a pretty big issue among companies — especially as they scale. Engineers might run into the problem where they accidentally publish their credentials on Github while updating a code repository, which could lead to potential security issues for that application. The hope is this offers startups and companies an opportunity to not only make those keys easy to manage and update, but also locked up tight to make sure something like that doesn’t happen in the first place.

Each company has its own account, with a user interface where a company can start entering configuration information for their applications. They can also import from another system, and then invite the rest of a team through email and generate keys that Schneider calls EnvKeys. Users can create a developer level access key, for example, and then set it in a env file like one in a python project — which will always have access to the latest credentials every time someone runs that project. When an app runs, it’ll grab the latest configuration, decrypt it, and synchronize it. There are simple access levels, where someone can access it for development and staging, or servers, or administrators that can invite additional people.

EnvKey stores the API keys, which are end-to-end encrypted, and Schneider says the company doesn’t have access to the information. The hope is that companies will upload that information and feel good about it being stored securely and that they can quickly update and shift around credential information as necessary. Schneider also wants to build EnvKey to work on any platform, rather than having it pinned down to a single one, such as one Amazon might do for its web services for example.

There is going to be plenty of competition for this kind of low-hanging fruit for managing this information, given that it can lead to massive headaches for companies. Already there are startups like Hashicorp, which raised $40 million in October last year, and of course the major infrastructure providers may look to build something similar in their own ecosystems. But Schneider’s hope is that EnvKey can have a simpler approach and work in most environments, which can help convince engineers — especially as the companies grow up — to start using it.

“[Products like Hashicorp’s vault] take a pretty high level of developer operations expertise to set up and run it,” Schneider said. “Unless you’re prepared to do a pretty substantial project, it’s pretty tough to work with. Another is AWS has a service called parameter store, which can work pretty well if you’re again, pretty savvy, with AWS and you’re using AWS services for everything else. That makes sense, but it also comes along with the complexity and baggage AWS has in general. There’s a lot of things to configure. There’s a pretty high learning curve with that.”

Average wait times for a new battery have jumped up to 2.7 to 4.5 weeks based on a series of Apple Store checks conducted by Barclays analyst Mark Moskowitz (via Business Insider). That’s up from around 2.3 to 4.5 weeks earlier in the year.

MacRumors has received complaints from customers who are facing long wait times for replacements and who have, in some cases, been waiting for weeks to hear back from Apple about previously requested battery replacements.

When you initiate a battery replacement from Apple, stores typically need to order the part from Apple and then let you know when the new battery arrives, so getting a fresh battery isn’t as simple as scheduling a Genius Bar appointment.

Wait times vary based on location and by the device that needs the battery replacement. Batteries for devices like the iPhone 6 and iPhone 6s are harder to come by than batteries for the iPhone 7, and for some devices, like the iPhone 6 Plus, battery wait times have ranged into months.

Back in January, Apple said that for the iPhone 6 Plus, which is no longer being sold, replacement batteries are in such short supply that customers will need to wait until March or April for a new battery.

Customers who are seeking Genius Bar appointments for battery replacements are also crowding out appointment slots for customers with other issues, which is a problem in areas with few Apple Stores.

According to Barclays, the increased battery wait time suggests demand for replacement batteries remains strong, and it indicates an increasing number of iPhone users are opting to take advantage of Apple’s $29 battery replacements instead of purchasing a new iPhone.

Barclays previously said that Apple’s program could result in millions of fewer iPhone purchases during 2018, something Apple CEO Tim Cook recently said Apple did not take into account when choosing to implement the program in the first place. From Cook:

We did it because we thought it was the right thing to do for our customers. I don’t know what effect it will have for our investors. It was not in our thought process of deciding to do what we’ve done.

Apple has been offering $29 battery replacements for the iPhone 6 and newer since the beginning of the year. Apple implemented the program after facing backlash from power management features that were introduced in iOS 10.2.1.

The power management features have the potential to slow down older iPhones with degraded batteries in order to prevent unexpected shutdowns, and after the issue faced widespread media attention in late 2017, Apple apologized for its lack of transparency and implemented new policies.

In addition to offering reduced cost battery replacements through the end of 2018, Apple is also introducing a new Battery Health feature in iOS 11.3 that lets customers see more detailed information about the status of their iPhone’s battery.

Power management features impact the iPhone 6, iPhone 6 Plus, iPhone 6s, iPhone 6s Plus, iPhone SE, iPhone 7, and iPhone 7 Plus, and for any affected iPhone, a new battery effectively fixes the issue.

When Equifax was broken into late last year — one of the biggest security breaches in recent history — Fletcher Heisler wanted to make sure engineers got to know exactly what happened right away, and how to fix it.

That’s part of the goal of Hunter2, a new online learning platform for engineers that’s designed to teach them how to handle these kinds of breaches in a more hands-on way. Hunter2 aims to spin up training labs centered around real-world scenarios to teach engineers exactly why something broke in a web app, and how to fix it. Engineers work through responsive web apps, which are spun up on a fully functional server, that include some scenarios built off of real-world events — like the Equifax hack. It’s essentially like a game, where they try to break it and fix it, except it isn’t happening quite in the real world. Hunter2 is launching out of Y Combinator’s winter 2018 class.

“We try to keep every lesson in the context of what’s happening in the industry and what’s happening in the wild,” Heisler said. “We spin up a lab in 20 minutes that perfectly replicates the vulnerability. Engineers can get hands on practice. We train them — here’s what happens, here’s what they should have done, here are the best practices that should have been followed and gonna patch the code. It’s one thing to teach a topic in the abstract and say, beware of SQL injection, it’s another to tie this to something that’s happened.”

Hunter2 was in some ways born as a response to training programs for engineers within companies where they check in for a few hours every year to ensure that they are somewhat up-to-date with the current security environment on the Web. But as development languages continue to evolve rapidly and new frameworks like NodeJS become more and more popular, these programs are sometimes finding themselves in catch-up mode, Heisler said. That, and the approach needs to be more hands-on, rather than just a typical video class.

Engineers then go through a number of challenges to identify their strengths and weaknesses. If they run into problems, they go more in depth into the skills where they need some work. Think of it like the sorts of compliance training you might need for larger organizations, except it’s a routine check-in on making sure you know all the right skills in order to deal with issues as they arise.

There are plenty of industries that need to be more conscious about security, like healthcare for example, and need to make sure their engineers are trained and ready for new scenarios as they emerge. Hunter2 aims to be a sort of ramp-up for joining those companies, and one an engineer will check back in for a couple of hours every month to make sure they’re still working those muscles, so to speak. Companies can customize the content they are seeing with their own kinds of vulnerabilities, and Hunter2 helps create content for them for their engineers to work through.

“[We have a problem with] traditional training because it’s based in slide decks and videos is a lot harder to update,” Heisler said. “It takes a lot of time to keep up to date with new tech. It’s not like we’re gonna miraculously create half a million cyber security experts in the next year or two. What we can do is teach those basic skills to a number of people who are becoming not just developers but tech workers in general. That’ll become a much more fundamental piece of every role in the next couple years. That way we can save a lot of time and money upfront by giving those security skills to the right people working in tech or getting into tech but bringing the right mindsets.”

That idea of teaching in a simulated or more hands-on environment is an area that’s gathering more and more interest. If you look at sites like Codecademy, there are some places that are trying to focus on the do rather than the watch in order to teach people how to code and start dealing with more real-world scenarios.

After all, if you’re in the process of learning how to program, one of the pieces of advice people will give you is probably “go work on a project” — and that kind of freezing up to figure out what kind of a project can be a big barrier to entry to learn how to apply those skills. Hunter2 aims to build its own virtual environment to handle these kinds of scenarios, rather than just simulations, in order to offer its own flavor of how to teach how to handle these problems.

“You don’t actually have the full control over your access. What we’ve done is put lessons on the left and a server on the right,” Heisler said. “There are a couple similar platforms, but they sill simulate access. The difference is there’s time for hands on keyboard training. Having time to exploit or patch seems to be the right way to teach the lessons hand on. I think a lot of security education coming from traditional security is coming from the fact or academic spaces that.”

Featured Image: Krisztian Bocsi/Bloomberg/Getty Images

Apple will apparently have every kind of show from anyone with any kind of name working in Hollywood when it launches its updated approach to original video content: The latest original on its slate is a 10-episode, half-hour thriller series order that will be executive produced by M. Night Shyamalan, who is also going to direct the first installment (via Variety).

The thriller is being written by writer Tony Basgallop, who wrote 24: Live Another Day and 24: Legacy (so he is familiar with action-packed TV productions). There’s not much else we know about the show at this stage, beyond that it’s described as a “psychological thriller,” which makes sense given that Shyamalan is attached.

The Unbreakable director’s latest foray into TV, ‘Wayward Pines,’ just ended after a two-season run, but last year’s Split  was a hit and will lead into the forthcoming sequel Glass.

Meanwhile, Apple’s upcoming original TV slate is looking positively packed, and includes a Reese Witherspoon/Jennifer Aniston hour-long drama about morning news shows, a sci-fi show from the creator of ‘Battlestar Galactica,’ an ‘Amazing Stories’ reboot from Steven Spielberg and a bunch more.

Sonos One users in Canada can now join their peers south of the border in yelling requests at their connected speakers – a free update issued today enables Amazon Alexa on the Sonos One. The One launched with Alexa support in the U.S., but while the speaker has been available to Canadian buyers since late last year, Alexa voice commands are new with the update.

That means Canadians will be able to do tremendously Canadian things like ask for updates from The Weather Network, get flight info from Air Canada, listen to news reports from the Canadian Broadcasting Corporation (CBC) and more. I know what all of these things mean because I am, in fact, Canadian myself.

Canadians also have relatively few options when it comes to premium smart speakers on the market: The Apple HomePod and the Google Home Max have yet to launch in country. Still, an Alexa-enabled Sonos One should be all that most Canadians need – in fact, I recently called the Sonos One the best option out there all around in a smart speaker, and that remains true.