Search the archive

TECH STACKS OF 100 START-UPS

Responses from 100+ founders about their tech stacks.

SPEEDLEGAL

Your personal AI contract negotiator.

THE SIMPLE SECRET OF PRODUCTIVE PEOPLE

Productive people are able to focus and work deeply, which allows them to accomplish more in a day than others can in a week. The key to increasing productivity is to minimize shallow work and distractions, embrace boredom, and be intentional about social media use.

DON'T GIVE YOUR INVESTORS COMMON STOCK

Issuing common stock to early investors can cause problems for startups such as overvaluing the common stock price, which makes equity compensation very expensive for employees. It's generally best to issue preferred stock to investors who contribute money, issue common stock or options to those who contribute effort, and use convertible instruments like SAFEs for very early fundraising.

LIFE IMITATES ART

This author expresses frustration with the lack of depth and originality in contemporary science fiction films, criticizing them for prioritizing special effects and star power over meaningful storytelling and character development. They advocate for science fiction that not only entertains but also provides a visionary roadmap for the future, emphasizing the importance of positive narratives that inspire innovation and reflect the human experience in relation to technology.

WHY I LOVE "MEDIUM STAKES"

A common struggle for successful founders after exiting their companies is finding a sense of purpose and satisfaction, often leading them to pursue angel investing and venture building.

FIND A MENTOR WHO BELIEVES IN YOU

A mentor who believes in an entrepreneur's potential can make a significant difference in their journey, providing guidance and support through the challenges of building a successful business.

> Automate compliance tasks with AI-powered capabilities

> Demonstrate your commitment [4] to security and compliance with readiness reports, automated questionnaires, and Trust Centers

Secureframe in action

HEALTH INSURANCE GIANT KAISER WILL NOTIFY MILLIONS OF DATA BREACH

Kaiser is notifying 13.4 million current and former members and patients of a data breach. After conducting an investigation, Kaiser found that certain online technologies previously installed on its websites and mobile apps may have transmitted personal information to third-party advertisers. The data shared includes member names and IP addresses, whether the members were signed into a Kaiser Permanente account, how members navigated the website and mobile apps, and search terms used in the health encyclopedia.

BOGUS POST OFFICE TEXTS DELIVER A SHOCKING AMOUNT OF TRAFFIC TO SCAM WEBSITES

According to research done by Akamai, fake USPS smishing attacks delivered traffic to fake USPS sites that were on par, or even exceeding, traffic to the legitimate USPS website. Akamai conducted a fairly conservative analysis by deriving a malicious domain list from one smishing text that an employee received. The attacks have been successful, despite many public awareness campaigns to protect users from them.

OVER 1,400 CRUSHFTP INSTANCES VULNERABLE TO EXPLOITED ZERO-DAY

A critical zero-day vulnerability (CVE-2024-4040) in CrushFTP, a managed file transfer software, remains unpatched in over 1,400 instances. The flaw allows remote code execution by escaping the VFS sandbox. CrushFTP is urging customers to update after disclosing in-the-wild exploitation.

S3 BUCKET ENCRYPTION DOESN'T WORK THE WAY YOU THINK IT WORKS

S3 Bucket Encryption options all equate to access control more than encryption. In nearly every S3 encryption option (default SSE, KMS, and SSE-C), the user can either download the decrypted file if they have permissions to the encryption material or cannot download the file. Since a user never actually interacts with the encrypted file, the encryption feels more like access control.

REMEDIATING AWS IMDSV1

This article provides an overview of the benefits of IMDSv2 vs IMDSv1. It covers detection methods to identify EC2 instances with IMDSv1 enabled and CloudWatch queries to identify access to the service. It also details how to disable the service and place guardrails to prevent instances being launched with it enabled.

AUTOMATING API VULNERABILITY TESTING USING POSTMAN WORKFLOWS

This blog post discusses automating API vulnerability testing using Postman Workflows, a feature that streamlines the process of demonstrating API vulnerabilities without programming. By creating sequences of HTTP requests within Postman, users can automate tasks like identifying Broken Object-Level Authorization (BOLA) vulnerabilities and retrieving sensitive data. Postman Workflows offer a visual drag-and-drop approach to building automated flows for API testing and exploitation.

OPENAI SECURITY BOTS

A collection of Slack bots from OpenAI that integrate with OpenAI's APIs to streamline security teams' workflows.

PROPHET SECURITY (PRODUCT LAUNCH)

Prophet AI for Security Operations filters incoming alerts and, for each of them, gathers, correlates, and analyzes data from multiple sources to provide a determination and a detailed summary of the investigation.

CARGO-AUDITABLE

Know the exact crate versions used to build your Rust executable. Audit binaries for known bugs or security vulnerabilities in production, at scale, with zero bookkeeping.

MICROSOFT NEEDS TO WIN BACK TRUST

Microsoft is grappling with a series of high-profile security incidents that have undermined trust in the tech giant. Hackers have spied on Microsoft's senior leadership emails, exploited Microsoft Exchange and Cloud services to access business and government email accounts, and stolen source code despite efforts to improve defenses. The company's security culture is inadequate and requires an overhaul.

UK'S INVESTIGATORY POWERS BILL TO BECOME LAW DESPITE TECH WORLD OPPOSITION

The UK's controversial Investigatory Powers (Amendment) Bill 2024, dubbed the "snooper's charter", has received royal assent and will expand the digital surveillance capabilities of intelligence agencies, police, and others under the existing Investigatory Powers Act 2016. The amendments allow authorities to gather more data from citizens, including telecoms activity, to tackle "modern threats", including national security and child abuse. Critics have raised privacy concerns over the widened powers.

HOW WE BUILT THE NEW FIND MY DEVICE NETWORK WITH USER SECURITY AND PRIVACY IN MIND

This blog post from Google Security describes how the Find My feature was built with privacy and end-to-end encryption while utilizing crowdsourcing. Safety-first protections, such as aggregation by default and at-home protection, help prevent unwanted tracking and ensure user safety. Users also have full control over their device participation in the network, providing options to contribute to aggregated location reporting or opt-out completely.

HOW TO DELETE THE DATA GOOGLE HAS ON YOU

Simple guide on how to get your data off Google.

LESSONS FROM BUILDING AN AUTOMATED SDK PIPELINE

PCI DSS 4.0; CERTIFICATE TRANSPARENCY MONITORING IS MANDATORY!

PCI DSS 4.0 now requires Certificate Transparency Monitoring to ensure all trusted certificates are accounted for.

CHINESE OFFICIALS VOW TO OPPOSE TIKTOK SELL OFF

Chinese officials have declared that they vehemently oppose the mandated sale of TikTok by the US, condemning it as unfair competition. They promise to resist the app's full divestment, a stance that may influence TikTok's recommendation algorithm and its valuation as the sale process unfolds.

AI IS ABOUT TO MAKE APP SUBSCRIPTION FATIGUE EVEN WORSE

Consumers now have subscriptions for everything — streaming services, software, and grocery delivery. App subscription fatigue is about to get even worse with AI. Major tech companies are using the AI boom to push consumers toward pricier subscriptions. They're also using consumers' data to help train various gen AI tools, meaning the consumers are effectively paying for these tools twice.

VIDEO AD SPEND EXPECTED TO RISE 16%, SURPASSING LINEAR TV THIS YEAR

US digital video ad spend is expected to hit $63B in 2024, a 16% increase from the previous year. For the first time, digital video — which includes CTV, social video, and online video — will claim a higher share of budgets than linear TV. Cable subscriptions have continued an annual decrease of 6% each year.

IS OPTIMIZING FOR ONE SPECIFIC KEYWORD AN OUTDATED SEO PRACTICE?

There are scenarios where a narrow keyword focus works and others where a broader topic-based SEO strategy makes more sense. Optimizing for one specific keyword is a bad idea when it's seen as the single key to SEO success or if the goal keyword doesn't match search intent. In general, it's better to target multiple keywords relevant to your core service offering to maximize qualified traffic. Specific keyword optimization does make sense when it's about a niche or single topic or when you know that ranking for a single keyword will provide significant ROI.

IT'S NOT ABOUT BENEFITS

Most marketing guides will tell you “sell benefits, not features.” It's the reason why “1,000 songs in your pocket” is an iconic slogan for the iPod. However, to make a marketing campaign even better, go a layer deeper and ask yourself why people want this benefit. For an iPod, the answer could be to get through their commute or to motivate them during their workout. Show these experiences in your campaign to help consumers connect to it. Apple's modern-day advertising for AirPods leans into this strategy.

10 VISUAL DESIGN TOOLS

Fotoram.io is a free photo editor and collage maker. Easel is a drag-and-drop editor that offers thousands of design templates. Photopea is a web-based graphic editor that can be used for web design, image editing, and converting image formats. Animaker can be used to make videos, short videos, or edit live videos.

MUST-HAVE GPTS

An infographic that categorizes 25+ GPTs by productivity, writing, programming, and education. Links to each GPT are provided in the post.

META'S ‘SET IT AND FORGET IT' AI AD TOOLS ARE MISFIRING AND BLOWING THROUGH CASH

Advertisers are facing challenges with Meta's automated ad platform, Advantage Plus, as costs skyrocket and performance declines. This has led to frustration and uncertainty among marketers, who are struggling to get support from Meta amidst ongoing issues and glitches. The inability to effectively manage ad budgets and achieve desired results has left many questioning the reliability of Meta's ad tools.

THE QUICK WAY TO UNDERSTAND WHAT YOU'RE REALLY SELLING

People don't buy what you do — they buy what you do for them. However, most brands never quite manage to separate these two things. There are 4 different buckets of value a business can really offer: serving a particular group, serving a particular need, below the status quo, and above the status quo. Brainstorm ways your brand offers value in each of these buckets, then identify which feel the most true, unique, or exciting.

HOW TO PRIORITIZE GROWTH LEVERS?

This article discusses the drawbacks of conventional growth prioritization frameworks such as Impact + Confidence + Ease (ICE) or Potential + Importance + Ease (PIE). These frames tend to prioritize quick wins over larger strategic projects, which can be detrimental in the long run. Simplify the framework and focus only on business impact and implementation effort. By creating a 2x2 matrix with the 2 factors, growth initiatives can be categorized in 4 boxes: 'Big Bets', 'No Brainers', 'Quick Wins', and 'To consider but not prio'.

THE MARKET-BASED ASSETS THEORY OF BRAND COMPETITION

This report outlines the dominant 'Segmentation, Targeting, Positioning' (STP) theory of brand competitiveness. It shows how STP theory does not predict or fit with the empirical laws that describe how brands compete, grow, and decline. The report presents evidence that covers many countries and a number of product/service categories which supports a market-based asset theory of brand competitiveness. This theory and evidence provides an explanation of why some brands are bigger than others.

19 STARTUPS THAT MIGHT JUST CHANGE THE WORLD...OR NOT

19 startup ideas, each with a unique marketing twist.

THOUSANDS OF EXPLICIT AI 'GIRLFRIEND' ADS FOUND ON META PLATFORMS

The issue underscores challenges in content moderation and the need for more robust enforcement mechanisms.

MARKETING TO THE 50+ CROWD: A BOOMING OPPORTUNITY

From quality of life to autonomy and community involvement, this cohort values experiences over material possessions, making them receptive to messaging that resonates with their values and aspirations.

A BRIEF HISTORY OF WEB DEVELOPMENT. AND WHY YOUR FRAMEWORK DOESN'T MATTER

Web development started with simple HTML and CSS. Eventually, client-side JavaScript allowed for more dynamic websites. The need for SEO and performance led to the creation of server-side rendering and frameworks like Next.js. JavaScript's shortcomings led to TypeScript and Svelte. At the end of the day, the core goal of all these evolutions was to create enjoyable user experiences, so the tools being used don't matter much.

HIDDEN GEMS OF TAILWIND CSS

Tailwind CSS has some lesser-known features that can make developing web UIs easier. This article goes over a couple of them, such as using gap-* to add space between elements, accent-* utilities to change the color of checkboxes/radio buttons, and peer-* modifiers to style elements based on the state of sibling elements.

SPEEDING UP C++ BUILD TIMES

C++ build times at Figma were getting so long that it was reducing dev productivity. Figma was able to reduce build times by 50% by using libclang's Python bindings to identify and remove unnecessary header file inclusions, reducing the amount of code the compiler needs to process. It also used a tool to track and address build time regressions over time and “fwd.h” files to centralize forward declarations within code directories.

WE WERE WRONG, WE NEED A DATABASE

This author built a web game called "Binary Duel" using only Go and claimed that features like a cache, queue, and database weren't necessary. However, he admitted that his initial claim was premature and wrong. For better user retention, he decided to add features like a database, login, leaderboard, and ranking system, using Go to implement solutions like in-memory caching and bulk database writes efficiently.

WHY READING WHITEPAPERS TAKES YOUR CAREER TO THE NEXT LEVEL (AND HOW TO DO IT)

Reading academic whitepapers can help engineers build a strong foundation of technical expertise and keep up with industry trends. To get the most out of reading them, devs should use a three-step process to internalize them: first do a high-level skim of the paper, then go through it in a slower, detailed manner, and lastly, write down your takeaways to fully internalize your understanding.

PYSHEETS

PySheets provides a spreadsheet UI for Python in the browser. Users can load any Python package and JS module and perform exploratory data science, use Pandas, create charts with matplotlib, import Excel sheets, analyze data, and create reports.

TEABLE

Teable is a no-code database built on Postgres. It uses a simple, spreadsheet-like interface to create enterprise-level database applications.

COHERE TOOLKIT

A collection of prebuilt components allowing developers to quickly build and deploy RAG applications.