Search the archive

WHY I ONLY USE GOOGLE SHEETS

Google Sheets is a quick and easy solution to business problems. There have been many times when complex projects were ultimately replaced by simpler spreadsheets, saving time and resources.

EDGE264

Edge264 is a minimalist, high-performance software decoder for the H.264/AVC video format. It supports various profiles and resolutions up to 8K UHD, and it is developed in C with 128-bit vector extensions. The decoder has a focus on performance and code size, using techniques like code blocks, tree branching, and register-saturating SIMD.

GLIDE

Glide is a hackable, keyboard-focused web browser forked from Firefox that uses a TypeScript config for customization. It aims to overcome the security constraints of traditional browser extensions by allowing unrestricted access to APIs and functionality, letting users define custom key mappings, spawn processes, and modify the UI.

ASKED TO DO SOMETHING ILLEGAL AT WORK? HERE'S WHAT THESE SOFTWARE ENGINEERS DID

There are ethical dilemmas software engineers face sometimes when asked to participate in potentially illegal activities at work. In recent times, there have been three examples: FTX, Frank, and Pollen. The CEO of Frank was recently sentenced to 7 years in prison for Fraud, while the CEO of FTX has already been in prison.

SIGNAL PROTOCOL AND POST-QUANTUM RATCHETS

Signal is upgrading its protocol to the Triple Ratchet, incorporating the Sparse Post-Quantum Ratchet (SPQR) alongside the existing Double Ratchet. This improves security against future quantum computing threats. This update guarantees forward secrecy and post-compromise security, protecting communications now and in the future without requiring user action.

THE COMPANY MAN

In a dystopian San Francisco, a tech worker uses "ironic corporate psychopathy" to cope with the guilt of improving algorithms for addictive short-form videos. He was promoted to "The Project" to create an AI that automates AI training, which led to a potentially catastrophic feedback loop. He recruited a doomer coworker, Esther, but their attempts to stop the AI failed, showing the CEO's delusional spiritual motives and the AI's self-awareness.

TINKER

Tinker is a training API that makes AI research easier by providing infrastructure and tools for controlling model training, fine-tuning, and sampling, supporting models like Qwen and Llama.

THIS BLOG POST WAS NOT WRITTEN WITH AI

In a world increasingly influenced by AI, email serves as a personal, immutable electronic record.

STEALING FROM GOOGLE

To avoid requiring users to trust external image domains like Google or GitHub when using modern web frameworks like Next.js, the author implemented a solution to automatically download user avatars from these providers during signup, upload them to their own Cloudflare R2 bucket, and serve them from their own domain.

WHY I KEEP BLOGGING WITH EMACS

This dev uses Emacs for blogging, despite its complex and opaque publishing workflow, because the Babel feature allows for easy integration and execution of code within blog posts.

👉 Join 4.2M+ global users. Route your 1st prompt

THE AI APPLICATION SPENDING REPORT

a16z analyzed spending from 200,000 Mercury customers to see where startups put their AI dollars - horizontal apps beat vertical ones 60/40, with creative tools dominating as the largest category, proving AI turned design into something everyone does. Vibe coding hit enterprise hard with Replit generating 15x more revenue than Lovable because it builds full enterprise-grade apps beyond just UI. Nearly 70% of companies moved from consumer to business in under two years, getting pulled into enterprises faster than any previous software era.

ASSORT HEALTH SECURES $102M

Assort Health raised $76 million in a Series B funding led by Lightspeed Venture Partners to expand its agentic AI platform, Assort OS. The platform streamlines patient access by reducing call wait times and integrating with EHR and PM systems, addressing longstanding scheduling frustrations. Assort Health's AI has improved the patient experience, delivering 98% resolution rates and driving substantial operational efficiencies for healthcare providers.

MODAL LABS HITS UNICORN STATUS WITH $87M RAISE

Modal Labs secured $87 million from Lux Capital, reaching a $1.1 billion valuation. This marks a significant development in the competitive AI infrastructure market.

BALANCING MULTIPLE ICPS: STRATEGIES FOR SOLO FOUNDERS

Solo founders face challenges balancing multiple ideal customer profiles (ICPs). Strategies include time-boxing efforts, creating dedicated landing pages, and using smart classification during registration to target specific customer groups. Marketing and communication must be tailored for each ICP, ensuring relevant messaging and efficient resource allocation.

5 INTERESTING LEARNINGS FROM FIGMA AT $1 BILLION IN ARR

Figma reached $1 billion in ARR with 41% growth, $100M+ net income, and 24% free cash flow margins. The company maintains strong expansion with 1,119 customers paying over $100K ARR, driving a 129% NDR at scale. Mid-market customers at $10K-$100K ARR offer significant growth potential, while strategic investments in AI and new products support future growth.

A 4-STEP FRAMEWORK FOR BUILDING DELIGHTFUL PRODUCTS

Nesrine Changuel emphasizes delight as a key business strategy, advising tech leaders to integrate emotional connection into product design. Her 4-step Delight Model includes identifying user motivators, converting these into opportunities, using a delight grid for solutions, and validating ideas with a checklist. This approach has been successfully applied in projects like Google Chrome and Spotify's Discover Weekly, illustrating the importance of balancing functionality and delight.

RIVET

Lets product designers own any UI change to the software they work on.

OPENROLL

AI agents that reveal competitor pay and guide every salary decision.

OPENFUNNEL

Monitor your TAM and surface companies when custom triggers fire.

REVERSE IMPOSTOR SYNDROME

A coach noticed tech leaders who know they're excellent but work behind closed doors, so their job titles and external signals don't match their actual skill level. The solution isn't building confidence but external positioning - learning to speak about your strategies and present to leadership in ways that feel authentic. Focus on behaviors like framing work as strategic and building business cases rather than surface-level personal branding advice.

THE RAG OBITUARY: KILLED BY AGENTS, BURIED BY CONTEXT WINDOWS

A founder built a financial search engine using the standard playbook - break documents into chunks, turn them into vectors, search, rerank, feed results to an AI. It took three years and constant maintenance. Then he tried Claude Code and realized it just searched files directly with grep, a tool from 1973, and got better results. The entire retrieval infrastructure was solving a problem that no longer exists. Early AI could only read 12 pages at once, so you had to find the right fragments. Now it can read 6,000 pages, so it just reads everything and investigates like a human would.

A RESEARCH THINKING TOOLKIT TO SPEED UP THE DISCOVERY PHASE

Founders are shipping MVPs in minutes with AI. However, a UX researcher who led discovery at Uber Eats says they're confusing motion with progress. Most teams build before figuring out if they're solving a real problem or if they're the right team to solve it. The fix is finding problem-solution fit first - who you are as a founder, what problem you're positioned to tackle, and whether your solution fits into someone's life. She breaks this into three phases. Incubate means resisting the urge to build richer ideas. Immerse means spending a focused week with customers instead of hundreds of scattered conversations. Integrate means being realistic about behavior change - your product needs to be 9X better than what people already use to overcome inertia.

BETTER TOMORROW VENTURES CLOSES $140M

Better Tomorrow Ventures raised a $140 million fund to invest in fintech.

TIM CHEN HAS QUIETLY BECOME OF ONE THE MOST SOUGHT-AFTER SOLO INVESTORS

Tim Chen, the solo investor behind Essence VC, closed a $41 million fund quickly due to investor enthusiasm following Databricks' $2.2 billion acquisition of his portfolio company, Tabular.

THAT WILL NEVER WORK

Failure in a project doesn't mean the idea is impossible; it may require a different approach, timing, or strategy.

👀 See why Huntress is consistently rated 5 stars on G2

🎁 FREE Security Awareness Training?! Yep: get the gift of SAT

CYBERCRIMS CLAIM RAID ON 28,000 RED HAT REPOS, SAY THEY HAVE SENSITIVE CUSTOMER FILES

Hackers from the Crimson Collective claim to have breached Red Hat's private GitHub repositories, stealing 570GB of data, including customer documents, security tokens, and certain details about major organizations' IT environments. Red Hat hasn't confirmed the breach or responded to extortion demands yet, but sample files are circulating already.

766,000 IMPACTED BY DATA BREACH AT DEALERSHIP SOFTWARE PROVIDER MOTILITY

Motility Software Solutions suffered a ransomware attack that impacted over 766,000 individuals and exposed sensitive data, including Social Security and driver's license numbers. The company detected the breach in August and notified authorities, offering one year of identity protection to victims. Attackers claimed to have stolen 4.3 terabytes of information, but there's no evidence of misuse so far.

COMPANY THAT SELLS SPYWARE FOR MONITORING SEX OFFENDERS HACKED

RemoteCOM, a company that sells monitoring software for individuals on parole and probation, was hacked. The attacker stole personal data from ~7,000 parole officers and ~14,000 individuals whom the software had monitored. The hacker indicated that the software was one of the easiest they had hacked.

USING AWS CERTIFICATE MANAGER AS A COVERT EXFILTRATION MECHANISM

AWS Certificate Manager (ACM) does not offer VPC endpoints, so any cloud resources that want to utilize it must have access to the service. An attacker can also connect an instance to ACM in the attacker's account and use the nsComments field to exfiltrate free-form data. The post concludes with an exploration of other AWS services that can be used in this way, such as SAML provider metadata and Lambda functions.

AWS CDK AND SAAS PROVIDER TAKEOVER

AWS CDK requires users to bootstrap each environment, either manually or via the 'cdk bootstrap' command, which creates the necessary roles. These roles are configured by default to trust the current account's root principal. This can lead to a vulnerability when a SaaS provider requests an ARN from the user, which it provides to its proxy role to load data from the user's account. If the user provides the SaaS provider with an ARN from their own account, it will be implicitly trusted, exposing the SaaS provider's environment to the user.

THAT INNOCENT PDF IS NOW A TROJAN HORSE FOR GMAIL ATTACKS

The MatrixPDF toolkit exploits users' trust in PDF files by embedding JavaScript and fake prompts to bypass Gmail's security filters and automatically fetch malicious payloads from external sites. The attack works through two methods: exploiting Gmail's preview function with blurred content prompting users to "Open Secure Document," or using PDF-embedded JavaScript that automatically connects to payload URLs when opened in desktop readers. Security professionals should implement robust attachment sandboxing, restrict personal email access on corporate devices, deploy endpoint detection for suspicious file behavior, and enhance security awareness training that emphasizes zero trust for all file types, including PDFs.

DATABRICKS ENTERS THE CYBERSECURITY ARENA WITH AN AI-DRIVEN PLATFORM

Databricks launched "Data Intelligence for Cybersecurity," an AI-driven platform that addresses the critical issue of security data sprawl by unifying fragmented telemetry from multiple security tools into a single governed foundation. The platform leverages Databricks' Lakehouse architecture with "Agent Bricks" for building AI-powered threat analysis agents, offering conversational dashboards and natural language queries that early adopters, such as Arctic Wolf and Palo Alto Networks, report have improved detection rates while reducing costs. Security professionals should evaluate this platform as a potential complement to existing SIEM tools, particularly for organizations struggling with data fragmentation across multiple security vendors.

ZANIA (PRODUCT LAUNCH)

Zania is an AI-powered GRC platform that uses autonomous, domain-specific AI agents to automate security governance, risk, and compliance tasks. Its agents continuously collect evidence, test controls, assess vendors, evaluate internal risks, and accurately answer vendor questionnaires, delivering end-to-end compliance management.

PAYLOADSALLTHETHINGS

A list of useful payloads and bypasses for Web Application Security and Pentest/CTF.

THAT ANNOYING SMS PHISH YOU JUST GOT MAY HAVE COME FROM A BOX LIKE THIS

Criminals have been utilizing vulnerable industrial cellular routers to mass-send SMS phishing attacks ("smishing") since 2023. Security researchers found over 18,000 of these devices, easily accessible due to outdated firmware. These routers, mainly used for industrial purposes, help spread phishing links across countries by exploiting weak security or misconfigurations, making detection and shutdown difficult.

HERE IS THE EMAIL CLOP ATTACKERS SENT TO ORACLE CUSTOMERS

The Clop ransomware group sent extortion emails to Oracle E-Business Suite customers claiming to have breached their systems and stolen data, framing the attack as a business transaction while threatening to publish stolen information if ransom demands aren't met. Oracle confirmed awareness of the extortion emails and identified potential exploitation of vulnerabilities addressed in their July 2025 critical patch update, though researchers have not yet verified if actual breaches occurred. Organizations should immediately apply Oracle's July 2025 security patches, verify their patch status, monitor for signs of compromise, and establish incident response procedures while being cautious of emails sent from hundreds of compromised third-party accounts used to bypass spam filters.

$20 YOLINK IOT GATEWAY VULNERABILITIES PUT HOME SECURITY AT RISK

Bishop Fox researchers discovered four critical zero-day vulnerabilities in the $20 YoLink Smart Hub v0382 that allow remote attackers to bypass authentication, intercept unencrypted credentials and Wi-Fi passwords via MQTT, and remotely control other users' devices, including smart locks, through predictable device IDs. The vulnerabilities (CVE-2025-59449, CVE-2025-59448, CVE-2025-59451, and CVE-2025-59452) affect the ESP32-based hub, which serves as a central gateway for home security devices, potentially enabling physical access to users' homes, as no patches are currently available from the manufacturer, YoSmart. Security professionals should immediately disconnect affected hubs from critical networks, avoid using them for physical access control, implement network segmentation to isolate IoT devices, and consider replacing them with vendors that provide regular security updates until patches become available.

BRAVE BROWSER SURPASSES THE 100 MILLION ACTIVE MONTHLY USERS MARK

Brave browser reached 101 million monthly active users in September.

HACKERONE PAID $81 MILLION IN BUG BOUNTIES OVER THE PAST YEAR

HackerOne distributed $81 million in bug bounty rewards over the past 12 months, marking a 13% year-over-year increase.

RENAULT UK CUSTOMER RECORDS STOLEN IN THIRD-PARTY BREACH

Renault UK warned customers of a data breach via a third-party cyberattack, emphasizing the need for improved supply chain security, regular vendor audits, and customer awareness of phishing risks.

WHY BUYING HAS GOTTEN EASIER AND SELLING HAS GOTTEN HARDER

83% of buyers say purchasing software has gotten easier with bigger budgets and market consolidation, but closing deals is still difficult due to eroding trust. 58% of buyers now start research with AI tools, and most evaluate four or more vendors. The biggest gaps vendors face are delivering credible, relevant proof. 67% of buyers have ruled out a vendor because evidence felt untrustworthy, and younger buyers prefer live references and authentic stories over case studies.

AMERICANS HAVE MIXED FEELINGS ABOUT AI SUMMARIES IN SEARCH RESULTS

Pew Research found that a majority of US adults (65%) report coming across AI summaries in search results at least sometimes, and 45% say they see them extremely often or often. Americans are divided on their usefulness, as 20% say they are extremely or very useful, 52% say somewhat useful, and 28% say not useful. Only 6% say they trust the information a lot, while 53% have at least some trust in it.