Search the archive

AIRTABLE AI

Newly designed Airtable with AI and agents at the core.

JANUS

Janus battle-tests AI agents with thousands of simulations to catch hallucinations, rule breaks, and failures. It surfaces risky outputs and delivers clear, actionable improvement insights.

LONG

Long is a permissionless platform with fair pricing and anti-hype protections that lets anyone invest in startups early.

THE WAITLIST DELUSION

Waitlists should only exist when you have genuine supply constraints (hard product limits, quality issues, or service capacity), not for hype or brand building. Data shows waitlisted signups convert at 3x worse rates than immediate access, with performance decaying sharply over time, making extended waitlists a growth killer disguised as a growth tactic.

CAPITAL INTENSITY ISN'T BAD

Hard tech startups using asset-backed financing achieve lower dilution than software companies burning equity on customer acquisition. Crusoe Energy proved this by raising just $1.59B in equity to build massive data centers by securitizing generators and GPUs separately. Mastering structured finance turns capital intensity into a competitive advantage since physical assets create deeper moats than expensive customer acquisition in crowded software markets.

WHEN AI HAS BETTER TASTE THAN YOU

AI is conquering not just our capabilities (skills) but potentially our taste (preferences), leaving only human agency—our will to act on our values—as our unique advantage. While AI can learn to predict and replicate even "great taste" through pattern recognition, only humans possess the subjective drive to determine what problems matter and what's worth pursuing.

BEAUTY IS OBJECTIVE

Beauty in design follows universal principles—not arbitrary personal preference—like hierarchy, symmetry, and proportion, which create coherence and trust.

THE PREEMPTIVE FUNDING OFFER

Entrepreneurs should weigh such offers' pros and cons, considering future funding potential and strategic fit with investors.

AI MAKES BAD MANAGERS

Relying on AI for performance assessments prevents managers from developing crucial skills.

Watch the video (03:13 minutes)

SPARKKITTY SWIPES PICS FROM IOS, ANDROID DEVICES

SparkKitty is a new mobile malware that harvests photos from users' devices. The malware is delivered via fake or trojanized applications on the App Store and a trojanized version of the TikTok app that users are prompted to install via an Enterprise profile. Once installed, the apps prompt users to grant the app access to their galleries and then exfiltrate images to extract crypto seed phrases.

NEW FILEFIX ATTACK WEAPONIZES WINDOWS FILE EXPLORER FOR STEALTHY COMMANDS

FileFix, a variant of ClickFix attacks, is a new social engineering attack vector on Windows devices. In ClickFix attacks, a user is prompted by a website to execute a copied command in PowerShell to fix a bogus error. However, in the FileFix attacks, the user just needs to paste the command in the Windows File Explorer address bar, which is a much more familiar environment. The FileFix ruse informs users that a file was shared with them and prompts them to click a button that will launch File Explorer and copy a PowerShell command that contains a file path in a PowerShell comment to the clipboard. When the command is pasted into the File Explorer address bar, only the path will be displayed.

THREAT HUNTING INTRODUCTION: COBALT STRIKE

Cobalt Strike servers can be found online by scanning for their distinctive HTTP response signatures - specifically 404 Not Found responses with zero content length and text/plain content type. Researchers can download executable payloads from these servers using checksum-based URLs (like /tdN6 for x86 or /ZrJG for x64) and extract encrypted configuration metadata that reveals how red teams and malicious actors configure their command-and-control infrastructure. This post provides a Rust tool called SigStrike to automate this discovery and analysis process at scale across millions of potential servers.

NO AGENT, NO PROBLEM: DISCOVERING REMOTE EDR

The Performance Logs and Alerts DLL holds various DCOM interfaces that allow someone to interact remotely with Event Tracing for Windows (ETW) providers, trace sessions, configurations, etc. This post demonstrates how these capabilities can be used to detect various attacks without an agent and suggests ways that an attacker can use them to maintain stealthy persistence.

AUTOMATICALLY PRIORITIZE SECURITY ISSUES FROM DIFFERENT TOOLS WITH AN LLM

Security issue prioritization is a complex and time-consuming process that takes away time from resolving issues. This blog post proposes three scoring strategies that an LLM can use to rank security issues to combat this. The first strategy is to have the LLM assign a score based on provided criteria to each issue and sort the issues based on that score. The second strategy is to have the LLM use bubble sort and compare each issue pair-wise, which is more thorough than the first strategy but slower. The third strategy is to use an Elo system where a random sampling of issues is compared.

UNEXPECTED SECURITY FOOTGUNS IN GO'S PARSERS

Go's parsers for JSON, XML, and YAML have risky default behaviors such as case-insensitive fields, duplicate key acceptance, and lenient garbage data handling, which attackers can exploit to bypass security. These differences lead to conflicting interpretations across services processing the same input, causing vulnerabilities like CVE-2020-16250 in HashiCorp Vault. The new JSON v2 spec aims to fix these with secure defaults, but current measures rely on custom validation and static analysis.

demo

CYBERSECURITY AI

CAI is an open-source framework for building AI tools for cybersecurity bug hunting and vulnerability testing. It uses agents and tools to automate tasks, but lets humans guide and control the process.

TNOK – NEXT GENERATION PORT SECURITY

Tnok is a port security tool that employs time-based one-time passwords (TOTP) as dynamic port knock sequences. It encodes 6-digit 2FA codes into network packets sent to the target port: for UDP, the code is included in packet data, and for TCP, codes are encoded in TCP options (like MD5 and Mood) or distributed across multiple SYN packets via MSS values to avoid requiring root privileges. The system keeps protected ports closed until a valid TOTP code is received, after which it temporarily grants access without additional firewall configuration.

KALI LINUX 2025.1C FIXES KEY ISSUE, ADDS NEW TOOLS AND INTERFACE UPDATES

Kali Linux lost its software signing key in April, causing update errors for users with systems installed before that date and potentially exposing them to security risks. Version 2025.1c fixes this issue by including a new repository key. Older installations will require manually downloading and installing the new key via a wget command. The update also introduces a redesigned menu following the MITRE ATT&CK framework and adds over a dozen new security tools, including Azurehound, binwalk3, and bopscrk.

WINDOWS 11'S CRUCIAL RESTORE POINTS NOW SELF-DESTRUCT AFTER 60 DAYS

Microsoft announced that as of the June update, Windows 11 24H2, restore points will only be stored for 60 days. Restore points are used to restore a system to a known good state in the event of system corruption. Before this update, restore points were stored for 90 days.

POLICE WARN OF SMS ‘BLASTER' SCAMS

Police warned about SMS "blaster" devices after Chinese student Ruichen Xiong was jailed for over a year for using one to send fraudulent messages while driving in London in March. These radio devices lure phones from legitimate networks with stronger signals, enabling criminals to send texts without phone numbers and bypass anti-spam measures to conduct "smishing" attacks that steal personal info. Experts suggest Android users disable 2G and iPhone users filter unknown messages. Report suspicious texts to 7726.

CRYPTOMINERS' ANATOMY: SHUTTING DOWN MINING BOTNETS

Akamai developed two techniques to shut down cryptomining botnets by exploiting mining pool topologies and policies - submitting "bad shares" (invalid hash calculations) that trigger automatic bans from mining pools. The first technique targets mining proxies by connecting as a fake miner and submitting consecutive bad shares, causing the proxy to get banned and shutting down the entire botnet operation (they reduced one campaign's hashrate from 3.3 million to zero). The second technique floods public pools with thousands of fake login attempts to temporarily disrupt direct pool connections, though this method is less permanent than targeting proxies.

NEW U.S. VISA RULE REQUIRES APPLICANTS TO SET SOCIAL MEDIA ACCOUNT PRIVACY TO PUBLIC

The U.S. now requires F, M, and J visa applicants to make their social media accounts public.

ANDROXGH0ST BOTNET EXPANDS REACH, EXPLOITING US UNIVERSITY SERVERS

The Androxgh0st botnet is attacking more targets, including US universities like UC San Diego, by exploiting weak servers and software.

THE U.S. HOUSE BANNED WHATSAPP ON GOVERNMENT DEVICES DUE TO SECURITY CONCERNS

The U.S. House has prohibited the use of WhatsApp on official devices due to security and data protection concerns, requiring staff to use approved alternatives such as Microsoft Teams and Signal.

version

AI VISITORS VISIT FEWER PAGES AND BOUNCE MORE OFTEN THAN TRADITIONAL SEARCH VISITORS

AI visitors view 1.2 fewer pages than search users and bounce at a rate 4.1% higher. Despite spending slightly more time on site, their sessions are narrower in depth, indicating more focused intent or faster drop-off. These patterns suggest AI users often arrive with specific goals or expectations that websites may not yet be optimized to meet.

FREE RETURNS ARE OFTEN A DEAL BREAKER FOR CONSUMERS

Nearly 9 in 10 consumers expect free returns, and 47% have stopped shopping at a retailer due to an unfavorable return policy. Return experiences now shape purchase decisions, especially in fashion where over two-thirds of consumers returned clothing or footwear last year. Retailers face rising return costs, totaling $890 billion in 2024, driven by poor fit and consumer mistrust in product descriptions.

HOW SUPERPOWER BUILT A 150K WAITLIST (IN 6 MONTHS)

Superpower built a 150,000-person waitlist in six months by prioritizing distribution before product. It used a strong brand foundation, viral referral mechanics, and shareable user-generated content like digital health cards to drive organic growth. Strategic acquisitions and creative product drops fueled PR and attention, while creators and employees became embedded brand advocates. One tweet drove 7,000 signups, and organic content consistently reached hundreds of thousands.

INSIDE SHARKNINJA'S “SOCIAL-FIRST” MARKETING STRATEGY

SharkNinja grew net sales by 14.7% in Q1 by using a social-first strategy that combines influencer partnerships, social listening, and agile content creation. The brand's TurboBlade fan, featured in a lo-fi TikTok clip with over 32 million views, reflects its focus on consumer relatability over polish. Led by a dedicated in-house creative team and weekly “Obsessed with Winning” reviews, the company rapidly iterates on social feedback, turning viral interest into product enhancements like the Ninja Swirl. Influencers not only promote but also shape product direction, with early seeding and summits used to refine names, features, and launch plans.

HOW TO COLLECT CUSTOMER SUCCESS STORIES WITH 1 EMAIL

This tactic used a simple email to gather 24 customer stories without offering any incentives. Framed as a request to spotlight user wins, not collect content, it came from a well-known in-house expert with the subject line “Small favor”. The tone was conversational, and the typeform felt more like a dialogue than a form. This approach filled a refreshed story hub, generated weeks of social content, and even sparked a creative campaign. People are eager to help when they feel recognized.

CHATGPT PROMPT TO OPTIMIZE YOUR SITE FOR AEO

Fewer than 7% of websites are optimized to appear in ChatGPT and other AI search results, creating a huge opportunity for those who act quickly. This post includes a templated prompt that reviews content to identify missing elements like headings, FAQs, schema, tone, and internal links to make pages AI-answer-ready.

SURFER

Surfer analyzes top-performing pages and provides recommendations for keyword usage, structure, and internal links. Its features include an AI writing assistant, Auto-Optimize tools, and real-time SEO suggestions. The platform also offers a Content Audit tool that identifies the best opportunities within existing content, monitors ranking performance, and delivers weekly updates for quick SEO wins. Surfer's AI Tracker adds visibility into how content performs in AI-driven search and LLM platforms.

1,001 SELLS MORE THAN 1,000

Marketers can increase consumer interest by using numbers that slightly exceed familiar boundaries. Across nine experiments with 2,081 participants, people were willing to pay 219.5% more for a watch limited to 1,001 units versus 1,000, and a book titled "1,001 Places" saw 33% more selections than "1,000 Places." The effect draws attention and increases desire but weakens with larger deviations or when paired with other persuasive tactics. It does not work for pricing or when used in combination with tactics like social proof.

HOW TO CUT THROUGH IN A SOCIAL-FIRST WORLD

Brands need to leverage culture and trends to produce timely content to stand out on social. They must also adapt above-the-line campaigns such as TV and out-of-home ads to match social platforms' native formats. Seamlessly integrating brand elements into engaging content without interrupting the user experience is crucial. Collaborating with creators who offer authentic storytelling and genuine social proof, rather than relying on traditional influencers, helps create a stronger impact.

8-POST FLYWHEEL FOR LINKEDIN

A structured 8-post system that attracts clients through authentic, strategic LinkedIn content over 4 weeks.

SERP PSYCHOLOGY DONE WELL

A screenshot that shows how MP Activewear is breaking through the noise on the SERP without any over-engineering.

NONSTOP NEWS ALERTS ARE DRIVING PEOPLE TO DISABLE THEIR PHONE NOTIFICATIONS

Nearly 80% of smartphone users have disabled news notifications due to alert fatigue.

⚒️ Build for free with Nylas APIs

BUILDING THE TWITTER 1.0 WEB EXPERIENCE

Twitter Lite was a Progressive Web App designed to provide a fast, responsive, and data-efficient Twitter experience across all devices, especially in emerging markets with low-end devices and unreliable internet. Starting in 2015, Twitter Lite aimed to create a universal web app from a single codebase, leading to a 65% increase in pages per session and a 75% increase in tweets sent. This article goes over the technical aspects, like code splitting, service workers for caching, image optimization, lazy loading, and responsive design principles.

FAST(ER) REGULAR EXPRESSION ENGINES IN RUBY

This article compares the performance of different regular expression engines in Ruby, including the default Onigmo, re2 (Google), rust/regex, and pcre2. Benchmarks show that rust/regex is the fastest overall, while re2 is generally faster than Ruby's default, except when dealing with Unicode text.

WORKER THREADS IN NODE.JS: A COMPLETE GUIDE FOR MULTITHREADING IN JAVASCRIPT

Worker Threads allow you to spawn multiple threads of execution within a single process, with each worker running in its own isolated V8 environment to execute heavy JavaScript code without blocking the main event loop. They are ideal for CPU-intensive tasks like image processing, data parsing, complex mathematical computations, and machine learning inference.

WRITING TOY SOFTWARE IS A JOY

Writing "toy programs" is a way to rekindle joy in software development, especially as AI and commodification threaten the craft. These programs focus on 20% effort for 80% functionality.

PROGRAMMER YELLING AT THE CLOUDS ABOUT VIBE CODING

While AI can be helpful for simple tasks like auto-completion, it struggles with complex problems and often provides solutions no better than existing resources like StackOverflow. Reviewing AI-generated code requires a deep understanding, potentially more than reviewing code from human colleagues.

WHY ENGINEERS HATE THEIR MANAGERS (AND WHAT TO DO ABOUT IT)

Engineers often have frustration towards their managers due to common management anti-patterns. These include disrupting focus with frequent meetings, making uninformed technical decisions, taking credit for engineers' work, and scheduling excessive unnecessary meetings.