Search the archive

PHONES

DEVALUATION

PAYPAL HAS A NEW CHIEF DESIGN OFFICER

Former Global Head of Design at Expedia Group, Rachel Kobetz, has joined PayPal as Senior Vice President and Chief Design Officer (CDO). The new executive will be responsible for the design strategy and execution at scale across all end-to-end experiences for consumers, merchants, developers, and employees globally.

APPLE DENIES LOW DEVELOPER INTEREST IN VISION PRO

A report from last month claimed that the developer workshops for Apple’s Vision Pro headset were very poorly attended. Developers have mixed expectations about Apple’s new product, considering it a risky investment. Apple denies these claims and says that the downloads of the SDK have exceeded its expectations.

WHEN YOU START TO DOUBT YOURSELF, DESIGN FROM THE INSIDE OUT

What is your worth as a designer? What is your value? T. Robert Roeth asks himself those questions in a personal look at his 25-year-long career in design. Learn from his experience and see how his beliefs turned out to be misbeliefs.

PAYMENT METHOD UX: DESIGNING PAYMENT SELECTION

Research conducted by Baymard showed that 21% of e-commerce websites have issues related to payment selection. However, there are easy wins that lead to significant results. Learn why you should consider offering more payment methods and updating buttons for third-party payment options instead of redesigning your entire checkout.

EQUIVALENT EXPERIENCE CAN CUT BOTH WAYS

The term “equivalent experiences” is often used to communicate why accessibility is important. It implies that the experience should be the same for everyone. A closer look at Google’s use of the “three dots” button unintentionally proves another, more subtle point the phrase implies: poor design can confuse everyone.

SETTING UP A DESIGN SYSTEM FROM SCRATCH

This interactive guide covers everything relevant to building design systems. It includes design audit, structure, design tokens, collaboration, and metrics. A playbook completes the package, outlining all the questions you should ask when creating a product foundation.

THE MACOS APP ICON BOOK

A Kickstarter campaign was launched to fund an illustrated book about macOS iconography. The book features hundreds of icons designers and developers created over a decade.

MAKING THE WORLD A BETTER PLACE FOR THE COLORBLIND

More than 300 million people are colorblind. Covering this audience is a precious skill. This website brings several tools and resources to ensure designers are paying attention to them.

OPEN SOURCE COLLECTION OF DESIGN PRINCIPLES AND METHODS

Solid design principles are usually a common trait among good products. Check out more than a thousand design principles based on the best real-life examples.

THE DATA DELIVERY CHECKLIST: PRINCIPLES TO DESIGN DATA PRODUCTS

Data is a product, not a commodity. It is used by people, not computers, so it should be designed, not built. Data delivery should be available, informative, accurate, intuitive, and familiar.

KILL YOUR PERSONAS

A persona is not a person.

TEN ADVANCED TIPS FOR A DESIGN PORTFOLIO

Even the best designers are susceptible to creating poor portfolios that fail to represent them. In this case, the hiring managers are the users, so designers need to create portfolios that are easy to scan, focus on telling a story, keep the right balance of text and visuals, and include the “non-fancy” stuff.

WHAT TO EXPECT FROM WEB CONTENT ACCESSIBILITY GUIDELINES 2.2

When around 1.3 billion people experience significant disabilities, standards are needed for more inclusive products. With WCAG's version 2.2, six new guidelines were released to improve digital experiences for users with vision, motor, and cognitive disabilities.

LET’S MAKE A RUBBER BUTTON WITH HTML, CSS, AND SVG

Tyler Sticka uses simple CSS and SVG animations to create a button with a rubber-like animation on hover.

ACCLAIMED ILLUSTRATOR

Featured in The New Yorker, National Geographic, and The New York Times Magazine, Christoph Niemann's work ranges from ink illustrations to clever conceptual drawings. Here's a list of the ten rules he follows.

THE EVOLUTION OF OPEN SOURCE BUSINESS MODELS

Tomasz is at it again giving a great overview of the ever-changing open source business models and that will continue to evolve with AI now in the picture. There are so many opportunities out there right now to adopt these models for new businesses. It’s a long play but clearly a good one.

ARM SEEKS $52B VALUATION FOR IPO

Arm on Tuesday submitted an updated filing for its upcoming blockbuster initial public offering on the Nasdaq stock exchange, setting a price range between $47 and $51, which could value the company up to $52B.

CHANGING LANDSCAPE OF RETAIL

It’s true that the retail landscape is ever-changing and Gotham Gal always has an interesting perspective on these things. If you’re thinking at all about retail in this day and age, there are a bunch of variables that are coming to bear that need to be thought through.

CONFIDENCE VS. ARROGANCE

Don’t confuse confidence with arrogance. A quick level-set on the difference for a few specific examples. Never hurts to check in with yourself.

KELLOGG

Long read but full of lots of great tidbits from working with those that bring energy to managing your board and expectations. Always a great read coming off a holiday weekend (here in the US).

MENTORSHIP BUSINESS

An exhaustive read about moving from a corporate job to spinning up your own gig from Marian Kamenistak. If you’re thinking of going it alone, there are some really solid tidbits in here.

STARTUPS NEED BOTH PROFOUND BELIEFS AND CUSTOMER INPUT

Steve Blank has always had great feedback on building companies and products and his recent return to regular writing again has been welcomed by many (us included). Having a profound belief is critical when thinking through customer input. Must read if you’re building a nascent product.

DEAR SAASTR: WHEN SHOULD THE CEO STEP AWAY FROM SALES?

Quick one on when to step out and more importantly how to gauge if you’re doing it right. I’ve always been a fan of being in LOTS of customer meetings.

UNPACKING INSTACART’S IPO

This is a deep, deep dive into Instacart’s IPO and such a great lens on not only how it built its business but also on finding a way to IPO in this kind of market. It’s never the “perfect” time to IPO and reading the tea leaves on when to do it is nearly impossible.

EVERY BILLABLE HOUR IS AMATEUR HOUR

The article makes the case that if you’re looking to elevate yourself from an amateur to a professional, ditch billing clients by the hour.

REDDIT FACES CONTENT QUALITY CONCERNS AFTER ITS MOD PURGE

Reddit, everybody’s favorite search engine, is dealing with content quality concerns following its moderator civil war.

EIGHT YEARS OF ORGANIZING TECH MEETUPS

Meetups are a great way to meet people in the industry. Here are some thoughts on how to do it right.

GRAFANA SECURITY UPDATE

Grafana released an alert that one of its GPG private keys and passphrases was leaked. In response it has revoked the affected certificate and users will need to update their GPG trust relationships if they utilize package repositories.

4,500 OF THE TOP 1 MILLION WEBSITES LEAKED SOURCE CODE, SECRETS

Security researchers collaborated to scan the Alexa Top 1 Million Websites for leaked secrets and discovered that 4,500 of the most heavily visited websites in the world publicly exposed their git directory, which often contained the entire private source code for a given website. AWS and GitHub keys accounted for 45% of all leaked credentials and third-party email marketing services accounted for a large percentage of the leaked keys.

ALL FREECYCLE USERS IMPACTED BY DATA BREACH

Freecycle.org, a platform that allows users to recycle their belongings, has prompted millions of users to reset their passwords after credentials were compromised in a data breach. The breach of data includes usernames, User IDs, email addresses, and passwords.

HUNTING C2S WITH NUCLEI

This is a blog post detailing a method to repurpose Nuclei, a common DAST tool, for threat hunting. The author outlines the steps that they used through other tools and manually to threat hunt and then the high-level process for automating their process with Nuclei. The post also includes an example of hunting for Nimplant.

REVISTING BLISTER: NEW DEVELOPMENT OF THE BLISTER LOADER

BLISTER, a malware loader associated with financially-motivated intrusions has been growing over the last two years under the radar. It now integrates techniques to remove any process instrumentation hook. BLISTER has modified its configuration with multiple revisions, now encompassing additional fields and flags. This post dives into the advancements of BLISTER.

USING OPEN-SOURCE SOFTWARE COMPOSITION ANALYSIS TOOL FROM GOOGLE

This article dives into how you can set up and configure osv-scanner, an open source SCA tool, to identify vulnerabilities in popular open source projects.

STRATUS-RED-TEAM

Stratus-red-team is a tool for emulating offensive attack techniques in a controlled manner on cloud environments for the purpose of testing detection and response. Attacks are organized by cloud provider and category of attack. Each attack has a comprehensive wiki page with a MITRE ATT&CK mapping, description, and example detections. The recently released v2.9.0 includes new techniques for ransomware simulation.

CALDERA-OT

A collection of plugins that extend Caldera (adversary emulation platform) to the Operational Technology (OT) environment.

MERCATOR

Mercator is an Open Source web application to manage the mapping of an information system as described in the Mapping The Information System Guide of the ANSSI.

GETTING INTO AWS CLOUD RESEARCH

A comprehensive guide to beginning to research AWS cloud security. The guide suggests ways to gain more foundational knowledge, leaders in the field to follow, and different ways to dive deep. The guide concludes with reporting methods and assorted tips.

COST OF A DATA BREACH REPORT 2023

IBM's 2023 installment of their annual "Cost of a Breach" report has brought up some interesting trends such as the average cost of a breach rose once again to $4.45 million, increasing 15% over the last three years. It also has an industry-specific focus and breakdown of breaches.

POP-UPS

A security researcher who asked to be referred to as only Anthony demonstrated an attack using a Flipper Zero where a small device can be programmed to perform wireless attacks on devices in its range, such as iPhones, as well as car keyfobs, contactless and RFID cards, and more.

OKTA CROSS-TENANT IMPERSONATION: PREVENTION AND DETECTION

Threat actors are using social engineering to convince IT desk personnel to reset multifactor authentication (MFA) for highly privileged Okta enterprise accounts, gaining access to the cloud-based identity access management (IAM) service and moving laterally through targeted networks from there. Okta warns about how common this threat is and how to prevent it.

MULTIPLE NOTEPAD++ FLAWS LET ATTACKERS EXECUTE ARBITRARY CODE

Several Buffer Overflow vulnerabilities have been discovered in Notepad++ that can be exploited by threat actors for malicious purposes.

CHROME EXTENSIONS CAN STEAL PLAINTEXT PASSWORDS FROM WEBSITES

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

US APP STORE DOWNLOADS ARE DROPPING, NEW DATA INDICATES

Many apps are seeing their downloads decline, even as overall App Store revenue grows. Data suggests that some of the biggest apps on the market are losing their appeal in the face of increased competition.

SHOPIFY INTEGRATES BUY WITH PRIME FEATURE

Shopify merchants will soon be able to offer Buy with Prime as a payment method. Prime members who use Buy with Prime on Shopify can access free delivery and easy returns via Amazon’s network. It will be available for all US-based Shopify sellers who use or want to use Amazon’s fulfillment network by the end of September.

The legality of AI use is in question, including companies training AI models on copyrighted works, the copyright eligibility of AI-generated content, and how to handle machine-made outputs mimicking human artists’ work. The public comment period is open until November 15th.

8 POWERFUL TAKEAWAYS FROM EYE TRACKING STUDIES

It is possible to identify where viewers look on a web page and for how long with eye tracking, providing valuable insights for optimizing web pages. Tips gained from eye-tracking insights include breaking down information into short paragraphs or bullets, putting CTAs at the bottom of the page, and using pictures of people to grab attention.

SHOW PRODUCTS NEXT TO THE PROBLEM THEY SOLVE

Show images of your product close to either the problem it tackles or the “after” image of the solved problem. Researchers found that this makes people more likely to believe in its effectiveness and ultimately choose it. For example, kitchen towels shown next to clean or dirty countertops.