Technology

Movie ticketing company Fandango has agreed to buy Walmarton-demand video streaming service, Vudu, for an undisclosed sum. The video service today reaches more than 100 million living room devices across the U.S., including smart TVs, Blu-ray players, game consoles and other over-the-top streaming devices, as well as Windows 10 and Mac computers, and iOS and Android mobile devices.

To date, the Vudu app on mobile has been installed more than 14.5 million times.

As a part of the agreement, Vudu will continue to power Walmartdigital movie and TV store on Walmart.com.

In addition, Walmart says Vudu customers will have uninterrupted access to their Vudu library. They&ll also continue to be able to use their Walmart login as well as their Walmart wallet to make purchases on Vudu, the retailer notes.

Details as to how Fandango will specifically leverage Vudu weren&t immediately disclosed, but the company today operates its four-year old movie streaming platform, FandangoNOW, which is an obvious integration point. The service has become a more essential business in the wake of the COVID-19 pandemic, which has shut down theaters, significantly impacting Fandangodigital ticketing operations.

As a result, Fandango has put more efforts into its streaming business. For example, its stream of the newly released &Trolls World Tour,& which skipped its theatrical release due to COVID-19, was the most pre-ordered title in the streaming servicehistory, the most-rented digital title on opening day and the best-selling rental during its first three days of digital release, according to Deadline.

Fandango says that Vudu will allow it to scale that side of its business. It also plans to make offers to the majority of the Vudu team, when the deal closes.

&For us, ita combination of scale for our on-demand streaming service and the addition of Vudu talent,& a Fandango spokesperson said. &Vudu has a strong brand presence and customer base. So right now, we&re focusing on making sure that during this transition Vudu customers are taken care of and likewise on the FandangoNOW side. Both businesses will exist for the time being,& they noted.

Rumors that Walmart was shopping Vudu have been reported for many months. In February, Walmart was said to be in discussions with Comcast, which could have leveraged the platform for its newly launched streaming service, Peacock.

Walmartinterest in an online movie purchase and rental marketplace may have dwindled in recent months, as competition from other major players has ramped up: WarnerMedia is preparing HBO Max; NBCU just launched Peacock; and Apple TV+ and Disney+ are also live, and gaining traction. Thereeven a mobile-only service (Quibi). Elsewhere, therebeen significant consolidation in TV and video, with Viacom and CBS& merger completing in late 2019, with plans to beef up the CBS All Access streaming service. Viacom also purchased free service pluto.tv. And sports-focused streamer fuboTV just sold to FaceBank.

Meanwhile, Walmartoriginal plans for Vudu to be something of a competitor to Amazon Primevideo service never really panned out.

That said, Walmart had been recently working to release a slate of original content on Vudu alongside newshoppable ads, powered by technology from its joint venture with interactive content startup Eko. Its first original Vudu series, a reboot of &Mr. Mom,& debuted last September. Itunclear at this time to what extent those plans will continue at Fandango.

Fandango couldn&t yet comment on what role Vuduadtech or original content plays in the deal, beyond noting that everything live on the platform today would be included in the acquisition.

&We will continue to invest in areas where we have the greatest strength and are in the best position to serve our customers today and in the future,& a Walmart spokesperson noted in a statement, referencing the sale. &Pickup and delivery are great examples of how we&ve invested to bring digital and physical capabilities together to better serve our customers, by offering more choice and convenience. We&re focused on serving customers through these type of omni-retail experiences and we&re actively prioritizing our investments to maximize our strengths and serve them in new ways,& they added.

Walmart has seen a surge of interest in its e-commerce operations as a result of the pandemic. The companyfocus now is on hiring to fulfill consumer demand for online shopping and grocery. It has already hired 150,000 new workers and is hiring another 50,000, it said last week.

The Fandango acquisition is expected to close in the months ahead, says Walmart.

Updated, 4/20/20 4:00 PM ET with Fandango comments.

After being forced to quickly shift plans and stage a remote demo day last month following the outbreak of COVID-19 stateside, Y Combinator announced today that they will officially be fully moving their next batch to a remote format.

In a post today on Y Combinatorsite, YC CEO Michael Seibel announced the move. &We have decided to run the S20 batch remotely, because amid the COVID-19 crises, the safety of founders and YC staff is our top priority.&

The Summer 2020 group of founders will operate fully online with interviews, office hours, evening talks and meetups taking place over video conferencing. This could assumedly extend to the groupdemo day as well, though that was not explicitly stated. Y Combinator had given startups in the most recent class the option to defer an onstage launch until a later Demo Day; it seems that those YC startups may not get that option for 2020.

As YC shifts online, questions are sure to only grow on whether founders are still getting a good deal from the accelerator in the midst of a crisis.

Founders joining the program give up a 7% slice of their company in exchange for $150K and, more importantly, access to YCnetwork and group of advisors.

Y Combinator has already been scaling rapidly with larger class sizes, and this move will force the company to add a radical format change to the mix. Accelerator batches have ballooned in size in recent years, tapping out at 240 startups in this most recent class.

To account for these larger groups, YC has had to experiment with major format changes in how startups are grouped internally and how they present to investors. Losing their Demo Day last session meant founders lost easy access to in-person introductions with the large group of VCs that typically flock to the event.

Last week, TechCrunch reported that YC was changing the terms of its pro rata investment program and would be investing in startups on a case-by-case basis, shifting their years-old policy of investing in every companyseed and Series A rounds.

Building a startup is hard enough. But COVID-19, our generationworst plot twist, gives new meaning to uncertainty and stress. No one had &pandemic& on their early-stage startupradar, which begs the question: How do you move your business forward in unprecedented times?

Ita huge challenge, and we&ve worked hard to find a way to help you keep momentum in the face of lockdowns and travel restrictions. Drumroll please — the Digital Startup Alley Package, a virtual exhibition for startups at Disrupt SF (September 14-16).

Accept no virtual substitutes. Disrupt is the OG of startup conferences, and TechCrunch has the resources and industry connections to replicate the Startup Alley experience as a truly world-class virtual event.

The Digital Startup Alley Package lets early-stage, pre-Series A startups disrupt from home for only $445. Digital Startup Alley kicks off early, and it runs through the end of the physical event in September. Place your startup in front of thousands of influential investors, technologists, customers and media — with months to pitch, demo, network and schedule meetings.

The Digital Startup Alley Package covers three people and includes:

CrunchMatch: TechCrunchAI-powered founder/investor networking platform. Save time, zero in and connect with the people who can move your business forward. Each startup will create a customizable profile, allowing startups to easily note their value add and business model to potential customers and investors.

Exceptional Pitch Coaching: Grab a brew and join TechCrunch editors for Pitchers and Pitches — an interactive opportunity to learn from the best. Whip your pitch into shape with the team that coaches the Startup Battlefield competitors.

Exposure to Investors: Exhibiting startups will be included in a deck available exclusively to investors attending Disrupt SF.

Exhibitor Guide: The definitive resource to Startup Alley and Disrupt SF — modified to reflect our digital exhibitors. Plus, you get access to the content included with a Disrupt Digital Pro Pass.

Exclusive Founder Webinars: All Startup Alley exhibitors will get exclusive access to the brightest industry minds to hear their current thinking on ways startups can adapt and thrive both during and after the COVID-19 pandemic.

Pro Tip: Come September, if you can exhibit at Disrupt SF in person, you can upgrade your package and still enjoy the benefits of Digital Startup Alley.

Remember, founders don&t quit — they adapt and move forward. Buy your Digital Startup Alley Package today.

TechCrunch is mindful of the COVID-19 issue and its impact on live events. You can follow our updates here.

The new Magic Keyboard is good, Uber launches new delivery services and Facebook releases its Gaming app ahead of schedule.

Hereyour Daily Crunch for April 20, 2020, a totally regular date with no cultural significance whatsoever. Also, just a reminder: We&re holding our first Extra Crunch Live session, with Aileen Lee and Ted Wang, at 1:30pm Eastern!

1. AppleMagic Keyboard review: Laptop-class typing comes to iPad Pro

TechCrunchEditor in Chief Matthew Panzarino says that, for the past two years, hetyped nearly every word while traveling on the iPad ProSmart Keyboard Folio. Even so, he acknowledged that, aside from its reliability and durability, the Keyboard Folio kind of stinks.

In contrast, the new Magic Keyboard is a first-class typing experience, full stop.

2. Uber adds retail and personal package delivery services as COVID-19 reshapes its business

Uber Direct is a delivery platform for retail items, while Connect is a peer-to-peer package delivery service for sending goods to family and friends. This marks the most aggressive foray yet for Uber into courier services after it already introduced grocery items to its Uber Eats platform.

3. Facebooknew Gaming app launches on Android, with iOS version coming soon

The social media giant pushed the app out two months prior to its scheduled unveiling — amid a global pandemic thatleft people all over the world isolated at home, rapidly burning through entertainment options.

4. Hundreds of academics back privacy friendly coronavirus contact tracing apps

A letter, signed by nearly 300 academics and published Monday, praised recent announcements from Apple and Google to build an opt-in and decentralized way of allowing individuals to know if they have come into contact with someone confirmed to be infected with the novel coronavirus.

5. Top investors predict whatahead for BostonVC scene in Q1

While Bostonstartup market announced a number of huge rounds that bolstered its total venture dollars raised in the first quarter, there were signs of weakness: Deal volume was still a little under the pace set in 2018. (Extra Crunch membership required.)

6. Marc Andreessencall to arms: build something meaningful

In a new essay published over the weekend, Andreessen writes that to &reboot the American dream& we need to &demand more of our political leaders, of our CEOs, our entrepreneurs, our investors. We need to demand more of our culture, of our society. And we need to demand more from one another. We&re all necessary, and we can all contribute, to building.&

7. This weekTechCrunch podcasts

The latest full-length episode of Equity discusses Robinhoodplans to raise new capital, while the Monday news roundup looks at the U.K.financial aid for startups. And on Original Content, we reviewed &Tigertail& and the full season of &Devs& (both are good, but everyone should be watching &Devs&).

The Daily Crunch is TechCrunchroundup of our biggest and most important stories. If you&d like to get this delivered to your inbox every day at around 9am Pacific, you can subscribe here.

It would be easy to assume that Verizonpurchase last week of video-conferencing tool BlueJeans was an opportunistic move to capitalize on the sudden shift to remote work, but the ball began rolling last June and has implications far beyond current work-from-home requirements.

The video-chat darling of the moment is Zoom, but BlueJeans is considered by many to be the enterprise tool of choice. The problem, it seems, is that it had grown as far as it could on its own and went looking for a larger partner to help it reach the next level.

BlueJeans started working with Verizon (which owns this publication) as an authorized reseller before the talks turned toward a deeper relationship that culminated in the acquisition. Assuming the deal passes regulatory scrutiny, Verizon will use its emerging 5G technology to produce much more advanced video-conferencing scenarios.

We spoke to the principals involved in this deal and several industry experts to get a sense of where this could lead. As with any large company buying a startup, outcomes are uncertain; sometimes the acquired company gets lost in the larger corporate bureaucracy, and sometimes additional resources will help grow the company much faster than it could have on its own.

What is BlueJeans?

Research institutes Inria and Fraunhofer have shared details on their contact-tracing protocol that could be used by the French and German governments in the coming weeks. It is named ROBERT for ROBust and privacy-presERving proximity Tracing protocol.

Inria and Fraunhofer are members of the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) project. On Friday, PEPP-PT said that seven European governments were interested in developing national apps based on the standardized approach. So ROBERT could become an important inspiration for various contact-tracing apps around Europe.

The French and German research teams have chosen to share technical specifications on GitHub with various documents explaining their work so far. In addition to a full-fledged specification document, the group has written a high-level overview with frequently asked questions, an illustrated example and an interestingly-named document: &Proximity Tracing Applications: The misleading debate about centralised versus decentralised approaches.&

InriaCEO Bruno Sportisse also wrote an article on Inriawebsite describing the thinking behind Inria(and Fraunhofer&s) work. In addition to explaining the concept of contact tracing, he says thereno such thing as a decentralized contact-tracing protocol or a centralized contact-tracing protocol.

&None of the projects aim to implement a peer-to-peer network in which everything would rely on a supposedly ‘independent& community […] of devices/smartphones that exchange information between them. The main reason why thatnot the case is that security vulnerabilities could have an impact with such an approach,& Sportisse wrote.

&All systems in the works include a common component (a server) and a decentralized component (a group of smartphones that can communicate between them using Bluetooth): all systems currently in the works are therefore both centralized […] and decentralized,& he continued.

And yet, centralization and decentralization have been at the heart of a debate between privacy researchers in Europe, with backers of the DP-3T initiative sometimes calling out PEPP-PTapproach. DP-3T is another coalition of experts that claim to care more about privacy than PEPP-PT.

So letdive in to ROBERT and find out what Inria and Fraunhofer mean by a centralized-decentralized contact-tracing protocol.

Unpacking ROBERT

In the specification document, Inria and Fraunhofer define the big principles behind ROBERT.

Our scheme provides the following goals as detailed in [2]:

• Open participation. Participants are free to join or leave the system at any time.
• Simple and transparent. The system is simple to use and understand.
• Easy deployment. The scheme is easy to deploy and requires only minimal infrastructure.
• Anonymity. The smartphone App as well as the back-end server database do not collect or store any personal data.
• Federated infrastructure. The system must scale across countries, ideally worldwide. In order to preserve countries& sovereignty, a trusted federation of infrastructures is necessary.

Those are all fair points, but based on the rest of the document, anonymity is not 100% guaranteed for all actors involved (the government, other app users, malicious users). The document itself describes why there could be some loopholes in the protocol:

The authority running the system, in turn, is &honest-but-curious&. Specifically, it will not deploy spying devices or will not modify the protocols and the messages. However, it might use collected information for other purposes such as to re-identify users or to infer their contact graphs. We assume the back-end system is secure, and regularly audited and controlled by external trusted and neutral authorities (such as Data Protection Authorities and National Cybersecurity Agencies).

Thata big if.

Basically, the protocol is designed in such a way that it protects your privacy as long as you trust the government/the health ministry/whoever is in charge of running the central server. Based on that statement alone, it seems like the authority could log a ton of information about app users.

Generating a log of your proximity contacts

At its core, a contact-tracing app uses Bluetooth to build a comprehensive list of other app users who you&ve interacted with for more than a few seconds. A ROBERT-based contact-tracing app would make those matches on your device.

ROBERT uses ephemeral Bluetooth IDs that change every 15 minutes. For example, if you&re talking with someone for 10 minutes, you&re going to regularly send your ephemeral Bluetooth ID to the other person, and you&re going to receive the other personephemeral Bluetooth ID. If nobody gets infected with COVID-19, those IDs remain on your device (and might even get purged after a while).

The app also collects additional information associated with ephemeral Bluetooth IDs. For instance, it collects the strength of the Bluetooth signal to evaluate the distance between the two persons.

All of this is fairly standard.

Uploading your contact list, not your own ephemeral identifiers

Approaches differ if somebody is confirmed to be infected with COVID-19. Under the ROBERT implementation, if a user is diagnosed COVID-positive and gives their consent to help the community of other app users, the app will upload the list of ephemeral Bluetooth IDs of other users that they&ve been interacting with over the past 14 days.

Again, the app doesn&t send the userown ephemeral Bluetooth IDs — it sends information about the circle of people gravitating around the infected user.

The server then has a list of potentially exposed users. It doesn&t necessarily mean they&ll be infected with COVID-19.

Computing a risk score on the server

So what does the server do with this list of potentially exposed users?

When you download a ROBERT-based contact-tracing app (such as FranceStop Covid app that is in the works) and launch it for the first time, the server is notified. The server generates and sends a permanent ID and a list of ephemeral Bluetooth IDs. The server also keeps a list of all temporary IDs associated with permanent IDs.

In other words, the authority has a giant database of all permanent and ephemeral IDs associated with all app users. While the specifications say &the stored information are ‘anonymous& and, by no mean, associated to a particular user,& itin no way anonymous. Itpseudonymous.

When a user is diagnosed COVID-positive and accepts to share a list of the ephemeral Bluetooth IDs of people they&ve interacted with, the server logs all that information and increases the risk score of people they&ve interacted with.

Over time, multiple users who are confirmed to be infected with COVID-19 could flag different Bluetooth ephemeral IDs that belong to the same user. The server is going to increase the risk score of the permanent ID associated to that user.

Essentially, the authority will have a database of permanent IDs with each ID representing one person. There will be a risk score associated to each person. When the risk score reaches a certain threshold, the user is notified.

A weak defense of centralization

As you can see in my description of the ROBERT protocol, the project tries to minimize the attack surface by centralizing most computing on a server. It is designed to be resilient against malicious users as much as possible — it requires you to ®ister& your account by obtaining a permanent ID from a central server.

But this centralized implementation means that you&ll have to trust your government. In particular, you have to trust that:

• They&re not doing anything nefarious without telling you.
• They have developed a secure implementation of the ROBERT protocol.

For instance, what if a ROBERT-based app uploads your IP address when your app checks the risk score associated with your permanent ID? What if the government wants a little more data to examine the social graph of pseudonyms? Those could be huge privacy risks and the end user wouldn&t even be aware of the vulnerability. It is basically the opposite of &privacy by design.&

Instead, Inria and Fraunhofer throw the DP-3T implementation under the bus:

Other, qualified as ‘decentralised&, schemes broadcast to each App an aggregate information containing the pseudonyms of all the infected users. This information allow each App to decode the identifiers of infected users and verify if any of them are part of its contact list. Our scheme does not follow this principle because we believe that sending information about all infected users reveals too much information. In fact, it has been shown that this information can be easily used by malicious users to re-identify infected users at scale. We claim that infected user re-identification must absolutely be avoided since it could lead to stigmatisation. Instead, we chose to securely store this information on a central server.

Dismissing decentralized protocols in such a way is completely irresponsible. In both cases, it depends on the implementation. Thatwhy itgoing to be important to let developers audit the code that runs both on the smartphone and the server — whether the server is only a relay server or a central database. Otherwise, people are not going to trust contact-tracing apps and they will be useless.

Data on your device can be encrypted and inaccessible to other apps and malicious users. The government could even control a decryption key using a multi-signature authentication. This way, malicious users wouldn&t be able to decrypt data without interacting with the central server, and the central server wouldn&t be able to access user data.