Despite flat estimates, software stocks saw a 6% median multiple expansion and 9% returns in 2024. Several factors could drive further multiple expansion in 2025: stabilizing macro conditions, AI revenue potential, low rate risk, and policy tailwinds. The risk leans to the upside, with more potential positives than negatives ahead. Software's "reversion to the mean" could be the next big trade, though Big Tech AI winners may still be underrated. Overall, it's an exciting time to invest in tech.
2024.12.16·cloudedjudgement.substack.com·4 min read·TLDR Founders First-party data on user demographics and firmographics is crucial for personalizing experiences and analyzing the right segments. Collect it directly from users in onboarding with a 3-step flow: 1) About the user 2) About their company 3) Invite team members. Ask multiple-choice questions on intent, role, seniority, and use cases. Show the team invite to everyone, setting the admin as default. Then ask about their goals to broaden their perspective. Keep it simple, use logic, and only ask what you'll use. A 15% drop-off is worth the data.
In the 1980s, IBM's decision to outsource the DOS operating system to Microsoft and hardware to Intel laid the foundation for the dominance of both companies. However, the rise of mobile technology, signaled by Apple's iPhone launch in 2007, shifted the focus to efficiency, breaking Microsoft's and Intel's long-standing hold on the market as ARM and RISC architectures took precedence. Intel missed critical opportunities in the mobile space and is now facing challenges competing against TSMC's advanced manufacturing capabilities, with calls for U.S. government intervention to support Intel's foundry capabilities as a matter of national security.
uses a proprietary peer recommendation system, originally developed at MIT, combined with the power of AI matching to create the best free tech recruiter on the planet. Get 3 vetted and interested candidates
Sponsored
Ship more than you ever dreamed you could by hiring timezone-aligned,
A web browser for your AI.
Write clear, well-formatted text using only your voice.
Successful AI companies will offer highly customized, vertically-integrated solutions in 2025 - "Model-Applications as a Service.” Winners will offer deep expertise, seamless integrations, and robust, secure infrastructure. AI-native startups will gain ground with agility and customer-centricity. The shift to "agentic" AI doing multi-step tasks will blur the lines between software and services.
A lot of founders jump into the role of manager without much practice. We maintain a high bar for quality, and when things don't meet that bar, we often have the urge to just do that thing ourselves. This post provides some keen insights on how to provide the right frameworks for your employees by being super clear on the desired outcome, and less clear on the path to get there.
Plaid has benefited from several tailwinds in the fintech space.
Do this 30-minute exercise to focus a scattered startup: list your best customers, detail why they bought, then make the obvious decisions that emerge.
Startup investments are limited to a specific class of individuals the Securities and Exchange Commission (SEC) classifies as “accredited investors.”
Apple is collaborating with semiconductor developer Broadcom to create a server chip optimized for artificial intelligence workloads.
Sponsored
In 2024, Flashpoint identified 123 skimming breaches, which could have potentially cost companies $80 million in fraud losses [4].
A sophisticated supply-chain attack has been targeting security and technical personnel for a year using Trojanized open-source software from GitHub and NPM to steal login credentials. The campaign employs infected packages and spear phishing techniques to infiltrate researchers' devices with a stealthy backdoor.
Rhode Island's RIBridges public assistance system was taken offline after a cyberattack potentially exposing personal data of hundreds of thousands of people. The state plans to provide call center support, credit monitoring, and alternative application methods while investigating the breach.
A GitHub repository hosting a WordPress tool was used to steal over 390,000 credentials by a threat actor named MUT-1244. The attacker targeted security researchers and pentesters, exfiltrating sensitive data like SSH keys and AWS access keys. The malicious campaign involved phishing, trojanized GitHub repositories, and a cryptocurrency miner payload.
2024.12.16·thehackernews.com·3 min read·GitHub repository·TLDR InfoSec This post discusses different methods to establish persistence with a Linux loadable kernel module type rootkit. Two simple methods that are briefly touched upon are to use a user space persistence mechanism that runs with root privileges to load the module or add the module to /etc/modules. Instead, this author explores using a systemd-modules-load file with the Diamorphine LKM rootkit which will hide any file that contains a given magic string from the kernel to hide the configuration file. The author then describes how timestamps or checking for a tainted kernel can be used to detect this attack.
The Ultralytics Python project was recently targeted in a supply-chain attack through compromised GitHub Actions workflows and PyPI API tokens. PyPI experts were able to analyze the attack and emphasize the importance of securing software forges and building workflows for open source projects. To improve PyPI security, developers are advised to use trusted publishers, audit workflows for security vulnerabilities, and follow best practices like using 2FA and rotating secrets.
Many detection rules rely on artifacts that are mutable by the attacker. This author sought to investigate detections that relied on immutable artifacts with the example of an attacker that enumerated WiFi networks and dumped passwords directly via the WinAPI as opposed to using tools such as netsh. The author initially ran into issues as the program they wrote to enumerate networks did not cause any obvious registry calls, spawn netsh, or read the Wlansvc\Profiles\Interfaces file. The only method that the author found to detect the attack was by enabling the noisy Sysmon Event ID 7 where a rule can be created by searching for an event where the ImageLoaded is wlanapi.dll and the Image contains an unfamiliar .exe.
Sponsored
Datadog analyzed security posture data from thousands of organizations on AWS /Azure / GCP. The findings [11] suggest ongoing challenges with long-lived credentials and risks related to Kubernetes distributions, alongside adoption of proactive cloud security mechanisms such as S3 Public Access Block or IMDSv2 in AWS. Read the
Silent Push proactively detects potential cyber threats using an automated global intelligence system to monitor and predict attack patterns, helping organizations defend against various digital threats through advanced monitoring and data enrichment techniques.
Vanir is a source code-based static analysis tool that automatically identifies the list of missing security patches in the target system. By default, Vanir pulls up-to-date CVEs from Open Source Vulnerabilities (OSV) together with their corresponding signatures so that users can transparently scan missing patches for an up-to-date list of CVEs.
A CLI tool to encode and decode JWTs, written in Rust. It works as a pipe command and can be helpful to decode access tokens from other commands like curl.
Optum restricted access to an internal AI chatbot after it was found publicly accessible online. The chatbot, designed to help employees handle insurance claims, did not contain sensitive data but raised concerns about AI's role in claims processing.
Germany's cybersecurity agency reported that 30,000 media devices were infected with BadBox malware before sale. The agency has sinkholed communication with command servers, advised internet providers, and recommended users disconnect and scan potentially compromised devices from pre-infected Android equipment.
To ensure the security of its customers' secrets, 1Password utilizes end-to-end encryption to ensure that the data is not accessible by anyone, even at 1Password. To achieve this goal, 1Password utilizes AWS Nitro Enclaves to create a cryptographically verifiably, isolated confidential compute environment. 1Password publishes each enclave release to a public transparency log and then verifies the attestation when the client opens an encrypted channel. This ensures that no 1Password or AWS employees can access the code or communications running in the enclaves.
CISA and EPA urge water facilities to protect online interfaces for HMIs that help operators control industrial machines remotely from cyberattacks.
Amnesty International has reported that Serbian authorities used Cellebrite to unlock a journalist's phone and plant spyware for surveillance.
The FTC warns about a rise in online job scams, called "task scams," that resemble gambling, where victims are lured into earning money by completing simple tasks and depositing their own money for higher earnings.
The December 2024 Google Core Update, rolled out on December 12, is causing volatility in search results. Many sites are experiencing drastic ranking changes. SEO tools indicate this update may be larger than the November update. The SEO community reports major traffic drops, particularly for retail and grocery sites, and a shift favoring authoritative sites over newer ones.
This year's social media rewarded the loudest and most divisive voices. Algorithms pushed memes and controversy into the front page. Brands leaned into this shift, using memes to try to connect with audiences and designing campaigns around viral moments. The new marketing playbook prioritizes cultural fluency - knowing when to engage and when to stay out.
40–60% of users abandon an app after signing in just once. Instead of jumping to product tours, start with user research and align marketing messages to meet user expectations. Tailor experiences to user needs, like Duolingo adapting to skill levels or Miro suggesting templates by role. This reduces friction and guides users to their “aha” members faster. Behavior-driven emails, like celebrating milestones or following up on errors, can also turn churn risks into loyalty.
The funniest marketing ideas thrive on unexpected twists. Turn flaws into features, like a ring designed to break. Use overlooked spaces, such as usernames or app release notes, for ads. Viral stunts, like KFC's chicken-scented Crocs or Taco Bell weddings, create stories people share. Clever tactics include counterintuitive messages, celebrity-name tricks like Surreal's “Michael Jordan,” and minimal investments, like Reddit's 5-second Super Bowl ad.
Track competitors' email campaigns using Zapier and ChatGPT in 5 steps: sign up for competitors' emails, forward them to the Zapier email parser, extract relevant data with ChatGPT, load the data into tools like Google Docs or Airtable, and analyze it in a business intelligence dashboard. Sign up multiple times to capture segmented messaging. This approach allows marketers to monitor competitor email timing, personalization, subject lines, and promotional structures.
Blog posts that emulate social media feeds - such as using multiple contributors, visuals, videos, and timely updates - perform better than those that don't. The average blog post takes 3 hours and 48 minutes to write, and longer posts (2K+ words) yield stronger results. High-quality blogs need frequent updates, with bi-weekly posting as a minimum for strong performance. AI adoption in blogging has risen to 80% but hasn't yet shown a strong link to improved results.
Duolingo's streak feature, refined through 600+ experiments, drove growth to 600M users and a $14B valuation. Simplifying streak mechanics to one lesson per day and adding streak duration options improved retention by making the experience intuitive and user-focused. The team's iterative approach, tied to DAU and retention metrics, shows the value of aligning product efforts with growth goals.
40% of Gen Z users prefer TikTok or IG over Google for product searches. TikTok users prioritize authenticity, with 4 in 10 preferring relatable creators over traditional ads. Pinterest excels in lifestyle and DIY searches, with 31% focusing on inspiration. YouTube Shorts generate over 70B daily views and are a growing tool for video discovery.
Americans perceive Amazon as the brand to be the best value overall.
46% of US teens aged 13-17 say they're online almost constantly.
Long waits signal quality and reduce reneging.
This article goes over various front-end application architectures. The “classic” approach organizes projects into basic folders like pages, components, and helpers, but can quickly become chaotic and hard to maintain as the app scales. The “modular” approach divides applications into layers (pages, modules, components, and UI), making sure of encapsulated logic and clear separation of responsibilities. The “feature-sliced design” approach is a more refined modular approach that structures the project by functional features instead of layers.
Semantic HTML can be important for accessibility, as shown by the difference between using a `button` element versus a `div` styled as a button. By comparing the accessibility tree representations and keyboard behavior of both genuine and fake buttons, this article shows how using a `div` requires extra code to achieve proper accessibility, whereas a `button` inherently provides the necessary features.
While basic web components (using `template` and custom elements) can be easily rendered on the server, true isomorphic rendering (running the same code client-side and server-side) requires more sophisticated techniques. Libraries like Lit and Enhance offer SSR capabilities, but often introduce dependencies and deviate from "vanilla" web component development. Instead, a direct isomorphic approach using a DOM emulator like Happy DOM is probably better.
Instead of creating design docs before coding, a similar, but better, approach might be to create a prototype instead. This involves creating a draft pull request (PR) as a prototype, seeking early feedback, and iteratively refining the code into production-ready PRs, potentially discarding the initial draft. PRs are then used as living documentation, compared to design docs which often go out of date.
A Redditor asks what the hype is about Tailwind CSS. While many users initially found it unintuitive, they found that it helped them develop much faster after they got used to it. The inline styling eliminates the need for separate CSS files and it also makes responsiveness much easier to implement.
Sponsored
Clerk announces beta support for React Router, including pre-built UI components, server utilities, and low level utilities for any of your custom flows. You can use React Router both as a framework or library