Search the archive

FIDELITY SPOT BITCOIN ETF LISTS ON DTCC WEBSITE EVEN AS KEY TRADFI MEMBERS ATTACK CRYPTO

While awaiting approval alongside several other spot bitcoin ETF applications, Fidelity's Bitcoin ETF was listed on the DTCC.

BUILDING A DESIGN SYSTEM THAT BREATHES WITH HEADSPACE

Headspace, the meditation company, has made meditation and mental health more accessible through its flagship app, serving over 100 million members globally. It adopted Figma's advanced features, including variables, to streamline its design system and accommodate growth.

PIMENTO TURNS CREATIVE BRIEFS INTO VISUAL MOOD BOARDS USING GENERATIVE AI

Many creative workers use Pinterest, Instagram, Behance, Canva, and Figma to find images online and create mood boards. Pimento aims to simplify and speed up this process by letting creatives enter instructions alongside image references, returning them suggestions like images, text, colors, and other visual elements.

GOOGLE CALENDAR WILL MAKE IT A LOT EASIER TO CREATE A TASK INSTEAD OF AN EVENT

With an upcoming update, Google Calendar for Android is set to become more user-friendly with a quick switcher feature that allows users to seamlessly switch between creating a calendar event and a task in Google Tasks within the same page. This change eliminates the need to back out and tap a dedicated "task" button, making it easier for users to manage their events and tasks within Google Calendar.

DEAR (FUTURE) DESIGNER: DON’T LEARN HOW TO CODE

FIVE-SECOND TESTING: TAKING A CLOSER LOOK AT FIRST IMPRESSIONS

Despite the lack of concrete evidence, five-second testing is often taken at face value with the idea that five seconds is just the right amount of time to gauge first impressions. This article examines how first impressions are affected by time, cognitive abilities, and the visual complexity of the tested picture and how product owners and UX researchers can ensure their users' first steps are on the right track.

HOW TO ACHIEVE CONSISTENCY IN DALL-E IMAGES

ChatGPT is now integrated with Dall-E, allowing users to ask it to modify images based on feedback. This gives users more control for creating consistent images by using seeds.

UI SCORE LIBRARY

UI Score’s Library is the ultimate resource hub for designers and developers. Projects and resources can be filtered by category or search.

GENERATE UNIQUE PATTERNS FOR YOUR PRODUCT

PatternedAI Searches and creates thousands of royalty-free patterns for any surface you can imagine.

TRANSFORM ANY WEB DESIGN SCREENSHOT TO CLEAN HTML/CSS CODE

Using the new GPT4 vision model and an OpenAI API Key, this tool converts designs from sketches, wireframes, Figma, XD, and more into pixel-perfect code. It also allows you to add follow-up instructions to fine-tune and fix errors.

WHY DESIGNERS QUIT — 2023 REPORT

A report looking into the reasons why designers leave their jobs found that 14.3% of them were laid off, 10.2% of them were unhappy with the work they had to do, 9.6% lacked career progression opportunities, and 8.9% struggled with the low UX/Design maturity of their employer.

HIDDEN WORKSPACES IN FIGMA

As of next week, Enterprise accounts in Figma will be able to designate workspaces as "hidden" for better control over sensitive content. Non-members of the hidden workspace won’t see it but will still be able to interact with individual documents they've been added to.

THE BRAUN + PAUL SMITH WATCHES ARE WORTHY OF DIETER RAM’S APPROVAL

The Braun watch follows Dieter Ram's ethos by being minimalist, uncluttered, and clean. Braun + Paul Smith BN0279 Watches feature a matte gunmetal stainless-steel case, black PU straps, and a monochromatic design.

DESIGN SYSTEMS DATABASE

Best-in-class Design Systems with components and foundations references from top-tier tech companies and leading UI teams.

USERINTERFACETYPOGRAPHY

A free online book about how to do good user interface typography, from basic things and principles to building layouts and various design elements.

YOUR REFERRAL LINK - https://tldr.tech/design?ref=2613930

BIG IDEAS IN 2024

Smart energy grids, voice-first companion apps, programmable medicines, AI tools for kids, and the next Disney being a gaming company. a16z asked over 40 partners to preview one big idea they believe will drive innovation in 2024.

SOFT POWER IN TECH

Collective human activity is often the product of storytelling. A handful of investors and companies within tech have mastered the art of storytelling, leveraging brand and soft influence as a way to get people to work for them, invest in them, and believe in them. This article explores how soft power works, and provides some in-depth examples of companies doing it well.

ELON MUSK'S X.AI AIMS TO RAISE $1 BILLION

Are we even remotely surprised at this point?

METRIC TO KNOW BEFORE YOUR NEXT INVESTOR MEETING

Getting caught out and not knowing something important when an investor asks is an awkward feeling. Here’s a checklist of the things you should have top of mind before you do your regular sync with an existing investor.

TIPS FOR BUILDING A SUCCESSFUL HARDWARE COMPANY

Software has a lot of playbooks by now, hardware doesn’t. Increasingly, investors look to hardware in the climate space, and even software companies view it as a way to build a moat and extend their activity into the real world. Here are some thoughts on how a founder can position themselves to build a successful hardware company.

THE PITFALLS OF PATTERN RECOGNITION

“We tried that before”. Everyone knows that phrase at a startup, right? It’s true - if you hear hooves it’s likely a horse - but sometimes it’s a zebra. Relying on pattern recognition to make decisions can only get you so far. Here are some tactics on how to make sure you’re not wrongly relying on defaults.

YOU’VE SEEN ONE, YOU’VE SEEN ONE

It’s easy to get complacent and jaded in the face of so many seen-one-seen-’em-all companies/people/products. This post gives a pretty good formula for how to make sure you’re seeing the forest for the trees.

DOVER AI APPLICATION SORTING (PRODUCT)

Review job applications 10x faster.

&FACTS (PRODUCT)

AI-powered product research for DTC brands.

VIZZLY (PRODUCT)

Customer-facing analytics for modern SaaS companies.

VERTICAL AI

Horizontal software, software designed to solve a user's pain regardless of the type of user that feels it, has defined the last 10 years of SaaS. Vertical SaaS, by contrast, is designed for a single or narrow user set, enabling the solution to be tailored to their needs. In this article, a Greylock partner forecasts that moving forward, users’ expectations around tailored services will govern how we build software.

WHY STABILITY AI IS LAUNCHING A SUBSCRIPTION FEE

WHEN SHOULD I EXPECT A NEW SALES HIRE TO BE ON TARGET?

With some variance depending on product complexity, it should still be within 1.5 sales cycles.

IN LIKE A LAMB, OUT LIKE A LION

Large software companies like Datadog and Mongo are growing at 30% YoY. Looking back on previous years, this might not seem stellar, but in the current market, that’s top percentile. Many feel the sentiment in the room is that this signals a solid year ahead for software.

NEW YEAR, NEW COMPANY - 10 ADDITIONAL SPOTS IN W24 FOR LATE APPLICANTS

If you’ve got an idea and a team, now might be the time to take advantage of YC opening up 10 more spots for W24 class. Now is the PERFECT time to build something.

YOUR REFERRAL LINK - https://tldr.tech/founders?ref=2613930

Start with an exclusive offer for TLDR readers today!

KIDSECURITY’S USER DATA COMPROMISED AFTER APP FAILED TO SET A PASSWORD

A popular parental control app for Android, KidSecurity, provides parents with the ability to set app limits, track their children, and listen to sounds around their children. Researchers discovered an ElasticSearch instance belonging to the app that had no authentication configured. This led to the exposure of private information including phone numbers, email addresses, and portions of credit cards.

EXPERTS WARN OF SNEAKY FAKE LOCKDOWN MODE ATTACK

Researchers from Jamf have discovered that an attacker could run a trojan on a compromised iPhone running iOS 16 to hook into Lockdown mode and bypass its security mechanisms. This post-exploitation technique could allow an attacker to continue persisting on a compromised device while providing users with a false sense of security. Jamf notes that Lockdown mode was moved to the kernel level in iOS 17 which would prevent their attack.

ATLASSIAN ANNOUNCES FIXES FOR FOUR CRITICAL RCE VULNERABILITIES

Atlassian has released fixes for four different vulnerabilities in various products that each could be utilized to achieve RCE. The flaws include a vulnerability in a third-party deserialization library, a template injection flaw in Confluence, an Assets Discovery flaw that could allow RCE on any machines with the agent installed, and a flaw that could allow for RCE via WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper.

DETECTING RUNTIME SECURITY THREATS IN ECS

Amazon GuardDuty has launched a new feature for runtime monitoring on ECS clusters. Runtime Monitoring for ECS checks hundreds of threat vectors to produce 30 different finding categories that can be sent to EventBridge, Security Hub, or Detective. Runtime Monitoring is supported on Fargate and on EC2-based clusters.

CUEING UP A CALCULATOR: AN INTRODUCTION TO EXPLOIT DEVELOPMENT ON LINUX

This blog post focuses on writing a one-click malicious webpage that exploits CVE-2023-43641, an out-of-bounds array access vulnerability in libcue that allows attackers to overwrite the memory of a process. It explains the challenges of bypassing mitigations such as no-execute memory, ASLR, and stack canaries. The post provides insights into ASLR, heap layout, and the development of an exploit targeting libcue in tracker-extract.

UNICODE XSS VIA COMBINING CHARACTERS

This gist demonstrates a variant of unicode XSS using character combinations. It also demonstrates how such an attack works and provides the root cause, as well as suggesting approaches for detecting unicode normalization, and flagging such occurrences to be manually inspected.

WHEN: December 20 - join here ↗️

APK.SH

apk.sh makes reverse engineering Android apps easier. It automates some repetitive tasks like pulling, decoding, rebuilding, and patching an APK.

DECOMPILER EXPLORER

Decompiler Explorer allows you to see decompile output for various decompilers like angr, binary-ninja, and Ghidra. There's a hosted website at dogbolt.org that serves as a frontend but it retains any uploaded binaries.

ADOKIT

ADOKit is a modular toolkit that helps build attacks against Azure DevOps Services using their REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance.

HOW THE FIRST GEN IPOD WAS REVERSE ENGINEERED TO RUN #ROCKBOX

This thread discusses how the original iPod was reverse engineered using a specially crafted HTML webpage to run Rockbox.

GMAIL’S AI POWERED SPAM DETECTION IS ITS BIGGEST UPDATE IN YEARS

Google announced that its new text classification system, RETVec, has been integrated into Gmail’s spam filters. RETVec is designed to combat adversarial text attacks such as those which utilize homoglyphs to bypass detection. It has been open sourced and can be run locally on lower-powered devices.

ANALYSIS OF NORTH KOREAN HACKERS’ TARGETED PHISHING SCAMS ON TELEGRAM

Slowmist, a blockchain security company, conducted an analysis of the North Korean hacking group Lazarus' tactics in Telegram. They found that the hackers employ various tactics, such as convincing project teams to download malicious scripts or inserting malicious links on event pages. Users should take immediate action in case of malware infection and to protect accounts.

APPLE CONFIRMS GOVERNMENTS USING PUSH NOTIFICATIONS TO SURVEIL USERS

Apple has confirmed that unidentified Governments have been using push notifications to surveil users.

23ANDME UPDATES USER AGREEMENT TO PREVENT DATA BREACH LAWSUITS

Genetic testing provider 23andMe has updated its Terms of Use to make it more difficult for customers to sue the company in response to multiple lawsuits following a data breach.