Search the archive

POINTING FINGERS

A neat trick to read way faster. Just don't tell your teacher.

OPENAI IS MAKING MONEY

OPEN-BANKING POPULARITY IN THE UK

MOONPAY LAUNCHED A VENTURE ARM

RTO THAT EMPLOYEES ACTUALLY LIKE

YOUR CUSTOMERS HATE MVPS. MAKE A SLC INSTEAD

It’s often advised that startups build minimum viable products (MVP), but MVPs come with the problem of not being very useful to your customers. So consider building simple, loveable, and complete (SLC) products instead.

THE EVOLUTION OF MIRO’S USER ONBOARDING

GOOGLE’S DUET AI

ARE PEOPLE GENEROUS WHEN THE STAKES ARE HIGH?

MEASURING DEVELOPER PRODUCTIVITY? A RESPONSE TO MCKINSEY, PART 2

AUGUST

X WORKING ON SHARING SUBSCRIBER EMAILS WITH CREATORS

DOXXING NEARLY ANYONE IN AMERICA FOR $15

An investigation from 404 Media details a category of bots that utilizes credit headers to dox nearly anyone in America. Hackers seem to have acquired access to this data and are selling it for $15-$40. 404 Media has confirmed that at least some of the extensive data is accurate. Data that the tool provides include addresses, mobile phone numbers, email addresses, driver's license numbers, and even names and birth years of the target’s relatives.

SOURCEGRAPH DISCLOSES DATA BREACH FOLLOWING ACCESS TOKEN LEAK

Code search and navigation platform Sourcegraph on Thursday announced that it has experienced a data breach after an engineer accidentally leaked an admin access token. Sourcegraph account email addresses for community members and license owners were obtained. No other customer info, including private code, passwords, usernames, or other PII, was accessible.

ANDROID GOES ALL-IN ON FUZZING

The blog post details the Android team’s massive investment into fuzzing and the fuzzing pipeline that they’ve built. It highlights how the Android team writes and detects fuzzers, how those bugs get routed and examined for vulnerabilities, and examples of CVEs that were detected by fuzzing.

CAMPAIGN

The Classiscam scam-as-a-service program has reaped criminal actors $64.5 million in illicit earnings since its emergence in 2019. This blog includes a detailed analysis of how Classiscam campaigns have changed over the past four years. Would-be cybercriminals can now leverage a range of automated tools to create new Classiscam schemes – including phishing sites — in a handful of minutes.

AND SYSTEMD

Using the vulnerability described in this blog, an attacker may take control of an encrypted Linux computer during the early boot process, manually unlock TPM-based disk encryption, and either modify or read sensitive information stored on the computer’s disk. This blog post runs through how the vulnerability was identified and exploited - no tiny soldering required.

JS-X-RAY

JavaScript & Node.js open-source SAST scanner. A static analyzer for detecting most common malicious patterns.

CHERRYBOMB

Cherrybomb is a CLI tool written in Rust that helps prevent incorrect code implementation early in development. It works by validating and testing your API using an OpenAPI file. Its main goal is to reduce security errors and ensure your API functions as intended.

CHROMEAUDIT

ChromeAudit is a plugin for the nuclei vulnerability scanner for Chrome Extension. It allows you to download the Chrome extension as a zip file and supply it to nuclei to find any vulnerabilities in the Chrome extension.

UNMASKING TRICKBOT

Trickbot was formed in 2016 and rose to become one of the world’s top cybercrime gangs. An investigation into the leaked internal messages, known as Trickfiles, from this group reveals the identities of key players, ties to the Kremlin, and insights into their internal organization.

REVEALING THE TARGETS AND RULES FOR THE FIRST PWN2OWN AUTOMOTIVE

The Zero Day Initiative (ZDI) this week announced that it will be offering more than $1 million in cash and prizes at Pwn2Own Automotive, the first Pwn2Own hacking contest focused on car systems.

NETWRIX HYBRID SECURITY TRENDS REPORT 2023 - EDUCATION SPECIAL

Netwrix survey shows 69% of education organizations suffered a cyberattack in the past year, higher than other sectors. Phishing and compromised on-prem user/admin accounts were top attack vectors, unlike others. Highlights increased threats and account risks facing the education sector.

REPAIR

The Church of Scientology's Author Services filed a letter with the US regarding the triennial review of the DMCA. In this letter, Author Services contests the changes that Right to Repair advocates are seeking. Representatives from iFixit speculate that the Church is concerned with the hacking community digging into the Church’s E-meter devices.

RUST MALWARE STAGED ON CRATES.IO

Yet another supply chain attack campaign on Rust programmers. Libraries that were named similar to popular libraries like postgress, if-cfg, xrvrv, serd, oncecell, lazystatic, and envlogger were malware uploaded to get the developer’s operating system information and transmit the data to a hard-coded Telegram channel.

CRIME GANG

The Key Group ransomware family was first revealed on January 6, 2023. It is a financially motivated threat group using Telegram channel keygroup777Tg for the negotiation of ransoms. Cyber intelligence firm EclecticIQ on Thursday announced the release of a free decryption tool to help victims of the Key Group ransomware recover their data without having to pay a ransom.

FROM SUBSCRIBERS

X is working to implement direct contact sharing, which would benefit creators and brands looking to engage with their audiences outside the platform. Based on the report, a new checkbox would be added to the subscribe pop-up window asking the subscriber if they want to share their personal email.

‘SUNSET’

Google’s Universal Analytics was supposed to stop processing data on July 1, but many marketers still see new data flowing in today. GA4 is UA’s replacement. As tempting as it may be, it would be unwise to rely on UA for analytics purposes as it could stop processing data at any minute.

3 COPYWRITING EXERCISES TO WRITE COPY THAT SELLS

Copy is fundamental to marketing and growth — but so often overlooked. This guide contains 3 exercises to make your copy more effective: removing “we” statements, in-depth customer storytelling, and addressing customer objections.

HOW TO CRAFT AN IMPECCABLE GO TO MARKET STRATEGY

Having a go-to-market strategy is important to successfully launch a product or service. This article highlights different types of strategies, steps to create one, best practices, and success stories from Slack and Fitbit.

SCHEMA MARKUP: WHAT IT IS & HOW TO IMPLEMENT IT

Schema markup is structured code that helps search engines understand the information on a page. Google can use it to show rich results, which can earn a page more clicks. Schema types include Article, Breadcrumb, Product, plus many more.

HOW DID CLICKUP BECOME A $150M REVENUE MACHINE?

Since launching in 2017, Clickup has grown rapidly and reached a customer base of 85K. They made this possible with a rigorous product and marketing strategy. Its tactics included conversion-focused content marketing, daily blog posts for SEO, community engagement, customer referrals, and “purple cow” advertising.

WHEN CUSTOMERS CARE ABOUT QUALITY BUT JUST NOT YET

Assembly quality was assumed to be a necessity for car sales, yet Tesla succeeded while delivering cars with issues. This illustrates the effectiveness of the brand’s positioning, as well as the importance of understanding what a brand actually competes against. Tesla’s product isn’t just a vehicle to get you from point A to point B, but rather a set of exclusive features that no other car brand offers.

DECENTRALIZED MEDIA FOR CREATORS: THE RUG RADIO STORY

Web3 is transforming how creators engage with their followers by empowering them to directly own and monetize their audiences. Different from traditional platforms, decentralized autonomous organizations (DAO) like 'Rug Radio' are owned and operated by creators and fans. Decisions are voted by all token holders and the organization has its own treasury with proceeds from NFT sales.

Laguna Beach Textile Company saw a 400-500% increase in sales since the meme took off and they capitalized with paid advertising.

PLAN

The campaign centers on four core areas: making fashion accessible, offering a compelling loyalty program, supporting varied local and cultural communities, and reinforcing a commitment to positive change.

BÉZIER CURVES - AND THE LOGIC BEHIND THEM

Bezier curves are used during SVG illustrations and front-end animations. This article breaks down various aspects of Bezier curves with animated examples. It goes over linear path animations, Cubic and Quadratic Beziers, Bezier handles, and more.

COMPLETE VUE SUSPENSE GUIDE WITH EXAMPLES

This comprehensive guide goes over Vue Suspense. Vue Suspense allows you to handle async components easily and provides a better user experience while components are loading. To use Vue Suspense, you need to define an async component, dynamically import it, and have Vue take care of the rest. The guide gives detailed code examples in real-world scenarios for clarity.

INTERNALS OF ASYNC / AWAIT IN JAVASCRIPT

In JavaScript, async and await are just wrappers over JavaScript’s Promises API. To better understand how these two common keywords work, this article implements async and await in JavaScript from scratch. It provides code examples and explains how these keywords work under the hood, such as showing how generators work.

THE WORST PROGRAMMER I KNOW

Developer productivity metrics like lines of code are not always accurate for senior engineers. Since senior engineers often spend more time architecting designs and mentoring others, this leads to lower lines of code output. However, senior engineers generally cause the team overall to output more lines of code, so these metrics might be better as a team-wide metric rather than an individual one.

HOW TO BE THE MENTOR YOU WISH YOU HAD

Mentorship is one of the biggest opportunities for career growth, both as a mentor and mentee. As a mentor, there are a few actionable steps you can take to both be an amazing mentor and also grow from the experience. For example, you should build a career growth plan for your mentee, make sure to validate their circumstances, and give advice in a relatable, palatable way.

COLA

Cola is a Conflict-free Replicated Data Type specialized for real-time collaborative editing of plain text documents. It allows multiple peers on a distributed network to concurrently edit the same text document, making sure that they all converge to the same final state without relying on a central server to coordinate the edits.

MARADNS

MaraDNS is an open-source Domain Name System (DNS) server. It’s implemented in C++ and can be run on any machine.

TECHNICAL METRICS TO TRACK IN ENGINEERING ORGS

While it’s hard to get a measure of productivity in engineering organizations, there are some technical metrics that can help track productivity indirectly. These metrics include service uptime, the number of flaky tests, developer ramping time, and code review timing.

HOW I BECAME A TECH CONFERENCE SPEAKER AND HOW YOU CAN TOO

There’s no clear path to becoming a tech conference speaker. While everyone’s journey is different, there are a few actionable steps you can take to become one. First, you need to find a topic that you enjoy talking about. Then, create an interesting presentation of the topic. Finally, create a speaker profile on various conference websites and apply when the time comes.

TYPESCRIPT TYPE SYSTEM HACKS

Template literal types were introduced in TS 4.1, making it easy to do string manipulation within the type system so that you can concatenate, compare, and pattern-match types.

YEAR

Google blocked hundreds of millions of URLs last year before they appeared in the search engine. These preemptive takedowns are part of a broader strategy that also deals with advertisements for streaming piracy.

FEATURES

Tesla has officially unveiled its Model 3 refresh. Updates include a 'facelifted' front-end design, more screen space, and increased range. The company claims that more than half the parts of the vehicle were replaced. It appears that the photo of the new vehicle leaked in April was real. The refreshed Model 3 is now available for order on Tesla's European sites. More details about what was updated are available in the article.

OPENAI’S MOONSHOT: SOLVING THE AI ALIGNMENT PROBLEM

OpenAI is dedicating 20% of its computing power to solve the AI alignment problem by 2027. The AI alignment problem is the idea that AI systems might not have goals that align with those of humans. This may become a significant issue in the future if superintelligent AI systems are developed. This article features an interview with Jan Leike, OpenAI's head of alignment research, where they talk about solving the AI alignment problem and OpenAI's subgoal of building an aligned AI research tool to help solve the alignment problem.

CAN SAMSUNG FOOD USHER IN A NEW ERA FOR THE SMART KITCHEN?

Samsung Food is a culmination of everything that Samsung has been working towards since it released a smart fridge with an Android tablet in 2016. The software can scan food, offer up tailored recipes, and sync kitchen appliances together to create meals. It uses generative AI to create meal plans and build grocery lists. Samsung is planning to create compatible cooktops, microwaves, refrigerators, water filters, and other cooking devices.