Prod/staging environments now taken seriously

As if...

I am less curious about the year and more curious as to how the hell flip phones are rendering video. Like 64p 3GPP or something realtime transcoded?

ASCII art.

aalib and aaxine, baby!

https://m.youtube.com/watch?v=mGphynqDkS4

At least on Android you can generate a fake VPN-esque connection locally that passes everything through a proxy, so the proxy isn't exposed to the application

Sure but then the verification will fail since you won't be able to sign the handshake with the "pin'd" cert. (Assuming they implement TLS or other crypto in their own code.) If you aren't modifying the execution environment then it's possible for an app to be "safe".

Clever-enough is the key word, with Safetynet involved, which dynamically executes signed classes and you don't know what checks will be done

Also variably checks http accept headers (<img src> produces accept of image/* iirc)

Isn't it for setting cookies not on the google.com domain?

You already proved that you have access to it. Why is that no question asked?

Normal DV certs are either "add a CNAME, upload a uniquely named html / txt file, or click a link in an email" -- you've already done one of those (automatically in caddy)

> I'd demand my money back, and contract canceled

$500 early termination fee, 8-12 weeks for a "partial refund" via cheque ;)

GCE ~= EC2

GAE ~= Elastic Beanstalk

Might as well toss the azure comparble ones in here while we're at it.

Azure Virtual Machines ~= Google Compute Engine ~= Amazon EC2

Azure Websites/App Service ~= Google App Engine ~= Amazon Elastic Beanstalk

I would say more correctly GAE ~= Lambda

then we get into the whole "at what point do we stop supporting windows xp for real this time guys" argument though..

There's a big difference between a 10 year-old OS and a two-year old phone, though. Especially if the unlocked model of the phone has received a Marshmallow update, but your carrier decides they don't feel like going through the cert process for that when they could easily twist your arm to getting a nice, new $750 phone instead.

For Google Chrome the answer is: April 19

That decision is generally made by the app vendor. Apps in the Play Store declare a minimum OS version they compile / run against.

html5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others.

> html5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others.

Really? what's the justification for that policy? You'd think ad networks would want ads to be safe for users.

Probably cross-domain abuse. I'd imagine there's a few edge cases that result in behavior Google doesn't want for ads. For example, double serving, accidental clicks, ad obscuring, etc.

Their FAQ does mention that they'll grant exceptions though.