Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The gig economy is a roughly $1 trillion industry in the US. Gig working provides a flexible way to make money, but it’s increasingly becoming less reliable and the net growth of new gig workers is declining. Valuable insights if you’re building a gig working platform.
From the Cerebral Valley AI Summit in November, this podcast combins two interviews with tech titans Reid Hoffman & Vinod Khosla, gathering their views on the future of AI and its impact on society.
Why did Google, arguably the pioneer of all things generative AI, feel the need to juice its marketing around the launch of Gemini? It boggles the mind and shows just how much is at stake here in the game of winner-takes-all in AI.
Researchers from IIIT Hyderabad discovered a vulnerability that allows malicious apps to expose credentials when a user autofills with a password manager on Android. The attack involves tricking password managers into autofilling into the app as well as a Login with Google WebView.
Researchers have discovered a new flaw, tracked as CVE-2023-45866, that allows for remote code execution on Android, iOS, macOS, and Linux Devices. The attack deceives the target into thinking that it’s connected to a Bluetooth keyboard by taking advantage of an unauthenticated pairing mechanism that’s defined in the Bluetooth specification. No specialized hardware is needed for the attack, which allows attackers in Bluetooth proximity to inject keystrokes into a vulnerable device.
Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.
This post breaks down a process for hunting malicious open-source infrastructure by identifying hardcoded headers or static strings that are included in the application. It includes two worked examples using Responder and Havoc C2. This is part of a series of posts on techniques to hunt malicious infrastructure.
This post goes step by step on how the author identified three Symfony RCEs. Symfony is a free and open source PHP framework that makes web development faster and easier.
This post analyzes the 2017 WannaCry ransomware attack which rapidly spread by exploiting Windows vulnerabilities, encrypting files, and demanding cryptocurrency payments to decrypt them. It reviews key indicators of WannaCry's behavior, a YARA rule to detect it, and discusses the malware's unorthodox "kill switch" domain check which ultimately halted its spread.
TInjA is a CLI tool for testing webpages for template injection vulnerabilities. TInjA currently supports 44 different templating engines and can scan for SSTI and CSTI.
Bambdas is a new feature of Burp Suite that allows for customization of the Burp Suite UI from the GUI using Java snippets. Bambdas is meant to allow users to customize the functionality of Burp Suite and add in utility that is needed for them. Examples of Bambdas and helpful snippets are provided in the post.
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM platforms and in CI environments.
This report found that AppSec chaos reigns, with 78% of CISOs responding that today’s AppSec attack surfaces are unmanageable and 90% of responders confirming that relationships between their security and development teams need to improve. Surprisingly, 77% of CISOs believe software supply chain security is a bigger blind spot for AppSec than Gen AI or open source.
Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.
The total number of data breaches more than tripled between 2013 and 2022 — exposing 2.6 billion personal records in the past two years alone — and has continued to get worse in 2023. Ransomware and vendor attacks contributed in a major way to the sharp increase in data breaches and resulting compromise of sensitive records. The number of ransomware attacks in the first nine months of 2023, for instance, was 70% higher than the same period in 2022.
EDR-Telemetry is a project that lists telemetry features from EDR providers and other endpoint agents. The motivation of this project is to allow security practitioners to quickly compare and evaluate the telemetry potential of those providers.
The Australian and New Zealand Nissan Corporation and Financial Services has advised that its systems were subject to a cyber incident. Nissan is working to investigate the extent of the incident and whether any personal information has been accessed.
Hacktivists hacked a small water utility in the Erris area of Ireland and interrupted the water supply for two days. The cyber attack impacted 180 homeowners and the Eurotronics water pumping system. The attackers defaced the user interface of the water-pumping system.
TikTok is on track to potentially claim the majority of ad budgets that marketers targeting Gen Zers are diverting from linear TV in 2024. In-game advertising will be the fastest-growing media channel. Ad agencies are anticipated to permanently integrate AI into all their operations next year.
Fashion companies are set to revive brand marketing in 2024, steering away from the dominance of performance marketing. With increased privacy regulations and higher costs, 72% of fashion marketers plan to spend more on brand advertising to engage shoppers. Other trends gaining traction are identity revamps to cater to younger generations, an increase in storytelling and emotional affinity, and a focus on cross-funnel strategies in developing long-term brand stories.
HubSpot uses a Hierarchy of Customer Delight framework to ensure it meets its users’ needs. Survival and support are at the foundation—it’s making sure the product works and providing support if something goes wrong. The next level is community and making customers feel seen and heard. The highest level of the hierarchy is understanding what motivates your biggest fans and enabling them to become even better versions of themselves. For example, HubSpot enables passionate customers to "become their final form" by having them teach boot camps for HubSpot Academy.
Companies often leave money on the table by setting prices solely based on costs. An alternative to that is to use Value-Based pricing, where the price is set by the value to the end customer. 'Value Walks' is a method to define the price based on how much customers value your product. Starting from the price of the next best alternative (NBA), you can add or remove a certain dollar amount depending if your features are better or worse than the NBA.
This post contains 8 core elements for structuring a LinkedIn ads campaign for a B2B SaaS company. It includes objective, targeting, ad format and placements, conversions, budget, bidding, ad visuals, and metrics.
Link-building tools help marketers research potential link opportunities and reach out to owners, editors, or content managers. This article reviews 15 tools, lists key features that set them apart, and provides pricing options in addition to links for a free trial or sign-up.
This post contains 100 characters that can be used on ChatGPT, from Jerry Seinfeld to Don Draper to Indiana Jones - just add “Write like [insert character]” at the start of the prompt.
Good display ads capture attention and can translate into more clicks or actions. Examples include LinkedIn focusing on recruiting pain points, Spotify employing the power of FOMO, and Asana showcasing measurable benefits through key data points.
Shopify went from $1.5 to $5.6 billion in annual revenue in 3 years. It did this by addressing a booming industry with an affordable option, including a trial. It also reduced the "Time to Value" to increase activation and retention rate. Passive buyers were converted into active ones through educational content. Finally, it implemented a merchant-focused customer success strategy to activate the growth flywheel.
Resale platforms like GoodwillFinds and Poshmark are ramping up holiday marketing to earn a place on shoppers’ wish lists.
The emotional pull of an advertisement can make or break performance. Brands should test running static ads, each with an emotional message, to see which ones resonate best.
Political ad spend is expected to hit $15.9 billion, up 30% compared to the 2019-2020 election cycle. It’s poised to become the 10th largest singular ad market next year.
Sponsored
Alerting as a standalone tool can be mad pricey and those old-school legacy brands just can't keep up with how software is built today. But with Signals, we're merging alerting and incident management into one slick platform, tailor-made to revolutionize how modern engineering teams handle alerts. SAVE UP TO 70% on your alerting bill when switching to Signals.
Thoughtful URL design strikes a balance between the needs of computers and humans. For example, StackOverflow’s URLs combine a unique identifier and a human-readable slug, so both computers and humans can understand a URL without having to visit it. Slack incorporates natural language sentences into URLs. GitHub and NPM map well to their respective domain semantics, making navigation efficient.
Earlier this year, Google announced that INP (Interaction to Next Paint) is going out of experimental mode and will replace First Input Delay (FID) as a Core Web Vital in April 2024. This post takes real world data to attempt to correlate INP with real user behavior and business metrics. The short conclusion is that as INP gets worse, business metrics, like conversion rates for sales, tend to suffer.
This article explores the effects of CPU requests and limits in Kubernetes and the differences between the default CPU Manager policy and the static policy. To demonstrate these concepts, the article uses scenarios where setting CPU limits is advisable, such as benchmarking, multi-tenant environments, predictability, and Quality of Service (QoS) guarantees. It delves into the details of the CPU Manager's static policy, including how it assigns CPU cores to containers and the associated metrics to monitor.
It’s common for software projects to lack adequate quality assurance measures, leading to last-minute QA sprints and unreliable software releases. Budget constraints frequently lead companies to cut QA efforts, resulting in rushed and error-prone releases. In order to convince management of the importance of QA, it’s important to frame it in terms of cost savings and efficiency gains and start with a minimal effective dose of QA measures.
Shortly after being promoted to mid-level engineer, this author made a subtle mistake by focusing on tasks that, while technically impressive, didn't align with the company's priorities for senior-level engineers. He received an "exceeds expectations" rating but didn’t make progress towards a promotion. To progress from mid-level to senior, it's crucial to consider the "why" behind your work and ensure it aligns with what's most important to your personal interests, team, and company all at once.
One effective strategy to reach the senior level as an engineer is to become an expert in a specific area, whether it's a technical skill or a product domain. To determine your expertise, consider what aligns with team or company impact, what you're good at, and what you're passionate about. To become known as an expert, focus on being visible and adding value, such as giving presentations, leading projects, solving challenging problems, and actively contributing to your team's success.
Sponsored
Nothing drives users away faster than a slow site. Join the Sentry [13] workshop this Thursday [13] to learn how to solve frontend performance issues, speed up your LCP, and keep users happy. Topics covered: Interpreting your app’s Performance Score | Taking action on Web Vitals | Finding code-level bottlenecks in Browser JavaScript.
SecureAI Tools offers private and secure AI tools, such as AI chat functionality, the ability to chat with documents (currently supporting PDFs), and local AI model inference with support for various open-source models. It’s a self-hosted platform that comes with built-in authentication for online access, user management for sharing with family or colleagues, self-hosting optimization for quick setup, and a lightweight web app that uses an SQLite database to avoid the need for a separate container for the database. This allows data to stay local and secure.
Rot is a command-line tool for managing secrets. It can generate keys and values and rekey secrets with the latest encryption standards. Rot allows for the sharing of secrets with others, provides one-way encryption for production secrets, and allows for secure storage of secrets in Git.
Tool sharpening refers to the process of improving or upgrading the tools and software one uses for work. This author shares a personal experience of transitioning from one text editor (NEdit) to another (Vim) and later to Neovim, highlighting the considerations, challenges, and benefits of such transitions. As engineers, there is a cost of time and effort in adopting new tools. At the same time, it’s important to periodically reevaluate tool choices and configurations to ensure they enable one to be as productive as possible.
Good documentation enables smoother project handovers, reduces dependencies on core team members, and simplifies onboarding for new team members. This is a playbook for creating intuitive documentation, including the importance of creating a simple manifesto or vision, establishing an intuitive folder structure, and automating documentation creation where it adds value. It includes practical examples and templates for organizing documentation, covering topics like architecture, onboarding guides, and specialist path guides.
Tracing helps track and understand what is going on within a program or software system. This post covers one engineer’s favorite tracing tools, which include eBPF, QEMU, Perfetto, and some custom-built ones.
Meta is introducing end-to-end encryption (E2EE) by default for personal conversations on Messenger to enhance privacy and security. It has published technical whitepapers explaining the cryptographic protocols for message transmission and encrypted storage.
Gooey is a way to turn a Python 3 console program into a GUI application with one line of code.