Search the archive

GET SH*T DONE

Get Sh*t Done is a meta-prompting and context engineering system for AI coding assistants that enables reliable, spec-driven development by managing context and streamlining complex project workflows.

TEMPORAL: THE 9-YEAR JOURNEY TO FIX TIME IN JAVASCRIPT

Temporal replaces Date with a suite of immutable, timezone- and calendar-aware types.

↗️ Get the playbook ↗️

THE MARGINAL COST OF ENTREPRENEURSHIP IS TRENDING TOWARDS ZERO

Shopify is increasingly becoming the core infrastructure for modern commerce. The platform dramatically reduces the barriers to starting a business by unifying payments, logistics, and software. The company is embedding AI directly into its entrepreneur stack to lower the time and labor required to build and run a company. Shopify is making entrepreneurship increasingly frictionless, and the data reflects it.

HOW MUCH OF THE SOFTWARE SLOWDOWN IS JUST BUDGETS FLOWING TO ANTHROPIC AND OPENAI? MAYBE AS MUCH AS 70%

Almost every major public software company has printed lower growth rates every single year since the 2021 peak. The conventional explanation is that vibe coding is eating software, but what's actually happening is simpler and more damaging: companies have finite budgets, and they're pouring an unprecedented share of those budgets into AI infrastructure and foundation model providers. The software budget pool is now shared with a new category that went from zero to over $40 billion in two years. This structural rebalancing will take several years to sort itself out, and it is going to hurt a lot of software companies before it does.

WHY THE WORLD STILL RUNS ON SAP

Upgrading from SAP ECC to S4HANA costs $700M, takes 3 years, and requires a team of 50 from Accenture. Lidl scrapped its transition after blowing $500M. Workers toggle between apps ~1,200 times per day, and 47% can't find the information they need. Startups like Axiamatic, Conduct, and Tessera are wrapping legacy systems in AI instead of replacing them, targeting the $380B system integration market.

WHY FOUNDERS CAN'T DELEGATE STORYTELLING

Storytelling is strategy, and the founder is the only person who holds the full context: why the company started, which experiments failed, what those failures taught, and where the company is heading. When storytelling gets delegated, marketing, sales, and product each fill in the gaps with their best guesses, creating subtle misalignment that compounds across every function until customers are closed on the wrong story and the product builds toward the wrong vision.

THE MOST UNDERRATED HIRE RIGHT NOW IS A GREAT PRODUCT PERSON

When building was hard, engineering was the bottleneck, and the status hierarchy reflected that. Now that building is easy, the variance in outcomes has shifted almost entirely to judgment on what to build, how to sequence it, and how to talk about it. The rarest version of this hire sits at the intersection of culture and deep technology, genuinely bilingual between what is technically possible and which cultural currents are real versus ephemeral.

SHOW CUSTOMERS THEIR WINS

Retention is half a perception problem - customers don't churn because they stopped getting value, they churn because they stopped noticing it. The fix starts on day one by cementing their "before" state so every improvement has a visible benchmark. Rilla went from $0 to $70M ARR in 7 years as the 7th fastest-growing SaaS company, built entirely on consumer tactics like streaks and goals that most B2B companies ignore.

REFGROW

Launch affiliate and referral programs in minutes.

KIPPS AI

AI agents for lead qualification and outreach.

OPENVIKTOR

Open-source AI employee that lives in Slack.

SPENDING OTHER PEOPLE'S TIME

Asking for someone's time is virtually free for the asker, yet enormously expensive for the person being asked. The trade is asymmetric, with the askee having to rebuild whatever mental state they were in before the interruption, while the asker just gets on with their day. The problem compounds with AI as people are effectively shifting their 'productivity' onto other people's shoulders. Organizations need to make these costs visible and put friction in the right places so that the default path protects attention instead of consuming it.

THE COLLAPSE OF TERMINAL VALUE - WHAT HAPPENS IF AI MAKES EVERY MOAT TEMPORARY?

$58 trillion in S&P 500 market cap repriced at 5x free cash flow instead of today's 20x means a 75% drawdown - roughly $44 trillion evaporating. That's the math if AI makes every competitive moat temporary instead of durable. Newspapers went from 12-15x EBITDA to 2-4x in a decade, retail followed, and taxi medallions went to zero. The $300-500B/year in AI capex only pencils out if returns are durable, but AI itself is the thing making returns short-lived.

25-28% OF TWO-FOUNDER STARTUPS LOSE A COFOUNDER BY YEAR FOUR

Data from 18,920 US startups on Carta shows 25-28% of two-founder teams lose a cofounder by year four.

WHY AND HOW TO BUILD A RESEARCH ORG

This is the moment for concentrated research ambition in every vertical.

YOU ARE RESPONSIBLE FOR YOUR AGENT

Companies are liable for the actions of employees' personal AI agents, akin to past challenges with personal devices.

_Read the full report (ungated)_

CHINA'S BIGGEST CYBERSECURITY FIRM ACCIDENTALLY LEAKED AN SSL KEY IN A PUBLIC INSTALLER

Qihoo 360, one of the largest cybersecurity companies in China, accidentally shipped a highly sensitive wildcard SSL private certificate in the public installer for its OpenClaw wrapper product. The key can be retrieved by anyone with a basic extraction tool. This comes after the founder of Qihoo promised that the platform would never leak passwords.

DEPARTMENT STORES AND ONLINE RETAILERS EXPOSED IN AI CHATBOT LOGS AND AUDIO RECORDINGS DATA LEAK

Security researcher Jeremiah Fowler discovered three publicly exposed, unprotected databases containing a total of 3.7M chat logs, audio recordings, and text transcripts of phone calls from 2024 to 2026. All of the files contained references to Sears Home Services. Public access was removed upon the researcher's request, and his report was forwarded to the person who manages the AI chatbot.

ROBOTICS SURGICAL BIZ INTUITIVE DISCLOSES PHISHING ATTACK

Intruders used a phishing attack to steal an Intuitive employee's credentials and access internal IT business apps, pulling some customer, employee, and corporate data. The company says robotic platforms, segmented networks, and hospital systems stayed unaffected and online.

NOW YOU SEE MI: NOW YOU'RE PWNED

TASZK Security Labs' research on the Xiaomi C400 smart camera uncovers three vulnerabilities in the proprietary miIO setup protocol: an authentication bypass in the handshake, a cryptographically weak PRNG, and a heap buffer overflow leading to controlled heap metadata corruption and reliable RCE over Wi‑Fi. By exploiting protocol design flaws and allocator behavior, an attacker in radio range can first win the setup race or abuse a factory reset, then pivot from packet parsing to full root access, implant a persistent “cloud jailbreak,” and reroute video/control through self‑hosted infrastructure while firewalling Xiaomi's cloud.

FANCYBEAR EXPOSED: MAJOR OPSEC BLUNDER INSIDE RUSSIAN ESPIONAGE OPS

An OPSEC failure on a NameCheap VPS exposed FancyBear/APT28's active C2 infrastructure, revealing a modular webmail exploitation toolkit targeting Roundcube and SquirrelMail via XSS to silently exfiltrate 2,800+ emails, steal 240+ credential sets including TOTP secrets, and deploy 140+ persistent Sieve forwarding rules redirecting all incoming mail to advenwolf@proton[.]me — all triggered without victim interaction beyond opening a spearphishing email. The exposed open directory on port 8889 contained server-side C2 source code, full telemetry logs, and lure PDFs targeting Ukrainian prosecutors, the Romanian Air Force, the Greek GEETHA, and the Serbian MoD across six countries. Defenders should audit Roundcube and SquirrelMail instances for unauthorized Sieve rules, block zhblz[.]com and 203.161.50[.]145, rotate credentials and TOTP secrets for any organization in the victimology, and disable ManageSieve where not operationally required.

NGSOTI: BUILDING AN INTEGRATED THREAT INTELLIGENCE AND INFORMATION SHARING ECOSYSTEM FOR THE NEXT GENERATION OF SOC ANALYSTS

NGSOTI (Next Generation Security Operator Infrastructure) is an initiative designed to train analysts not only on tools, but also on real-world workflows, collaboration models, and operational constraints. The ecosystem has several integrated tools that provide threat intel sharing, vulnerability enrichment, data filtering, endpoint visibility and detection engineering, and collaborative rule sets. The full platform is tied together by SkillAegis, which provides a structured environment for exercises, simulations, and evaluation.

OPENSHELL

OpenShell is a safe, private runtime for autonomous AI agents. It provides sandboxed execution environments governed by declarative YAML files.

BOLD SECURITY (PRODUCT LAUNCH)

Bold runs an AI agent on every available endpoint to spot and stop user-based threats, prevent data loss, and govern AI tool usage in real time, without sending data to the cloud.

REARM

ReARM is an abbreviation for "Reliza's Artifact and Release Management". It is a DevSecOps and Supply Chain Security tool and SBOM/xBOM repository and evidence store that organizes product releases with their metadata, including various Bills of Materials (SBOMs/xBOMs) and security findings.

MALICIOUS NPM PACKAGE REACT-REFRESH-UPDATE DROPS CROSS-PLATFORM TROJAN ON DEVELOPER MACHINES

SafeDep identified react-refresh-update, a typosquat of Meta's react-refresh (42M weekly downloads) that injected a two-layer XOR-obfuscated dropper into runtime.js — executing silently on require() with no install hooks — and attributed the C2 domain malicanbur[.]pro and secondary IP 173.211.46[.]22:8080 to Lazarus Group's DeceptiveDevelopment campaign, with the second-stage binary independently classified as PylangGhost RAT by multiple AV vendors. The payload is OS-aware: on Windows, it fetches a 28.71 MB self-extracting archive via chunked axios range requests and executes start.vbs via a hidden, detached wscript process. On Linux and macOS, it downloads and executes /var/tmp/macspatch.sh with TLS verification disabled. The encrypted-in-memory eval() execution pattern evades static analysis tools scanning for child_process references, making this campaign a notable escalation in AI coding agent supply chain targeting, where inflated version numbers and mirrored codebases can pass automated package selection without human review.

HACKERS TARGET CYBERSECURITY FIRM OUTPOST24 IN 7-STAGE PHISH

Attackers sent a JPMorgan-themed phishing email to an Outpost24 executive that passed DKIM checks and existing email security controls. The link chained through Cisco Secure Web, Nylas tracking, a compromised Indian firm, an expired-reused domain, and a Cloudflare-hosted site before a Microsoft 365 credential page.

GOOGLE, MICROSOFT, AMAZON, AND OTHERS UNITED UNDER NEW ANTI-SCAM PACT

Ahead of the UN Global Fraud Summit in Austria, eleven tech platforms, including Google, Microsoft, Amazon, and OpenAI, joined to create the new Online Services Accord Against Scams. The agreement involves the platforms agreeing to share intelligence and best practices about threats on their platforms and integrate defensive tools. The pact is voluntary and does not include any enforcement measures.

NEW CLICKFIX ATTACK LEVERAGES WORKFLOWY FOR STEALTHY MALWARE DELIVERY

Atos researchers identified a ClickFix variant that trojanizes WorkFlowy's .asar archive to execute a C2 beacon with user privileges before the legitimate application initializes, bypassing Microsoft Defender for Endpoint by avoiding scripting engines and living-off-the-land binaries.

MICROSOFT PHOTODNA IS VULNERABLE TO FALSE POSITIVES AND DATA LEAKAGE

Researchers from Ghent University and KU Leuven published the first white-box analysis of Microsoft PhotoDNA, revealing that its piecewise-linear hash function can be exploited within seconds on a standard laptop to produce exact collisions, generate false positives matching CSAM hashes, evade detection, and partially reconstruct source images.

APPLE PUSHES FIRST BACKGROUND SECURITY IMPROVEMENTS UPDATE TO FIX WEBKIT FLAW

Apple patched CVE-2026-20643, a Same Origin Policy bypass in WebKit's Navigation API, via its new Background Security Improvements channel across iOS, iPadOS, and macOS without requiring a full OS update.

SEE HOW AHREFS DOES AI

WHY LINKEDIN MIGHT HAVE 2 ALGORITHMS & WHY MARKETERS SHOULD CARE

LinkedIn likely runs two separate systems that work together to determine what shows up in the feed. Retrieval decides if a post is shown at all by matching it to a viewer using signals like profile clarity and past positive engagement. If a post never enters this pool, it will not be seen. Ranking then orders those posts based on predicted interest, factoring in relationship strength, dwell time, early engagement, and content relevance. This also explains why some posts seem random when they take off. The system may need time or new signals to identify the right audience, allowing a post to gain traction later or outperform larger accounts if it is highly relevant to a specific group.

THE ATROPHY PARADOX

Aviation research found that overreliance on automation weakens pilots' manual skills, prompting calls to keep practicing them. A similar pattern is emerging with AI. While it boosts productivity, it can erode writing and domain expertise, the same skills needed to use it well. Studies show reduced cognitive engagement and weaker thinking with heavy AI use. As more people offload work, output starts to converge, creating sameness. The key distinction is between routine tasks, which can be automated, and judgment, which must be actively practiced to avoid skill atrophy.

I STOPPED GUESSING WHAT TO WRITE AND STARTED EAVESDROPPING INSTEAD

Instead of relying on keyword research, gather real audience conversations from communities, calls, or support data, and analyze them systematically. Extract verbatim signals like pains and objections, then cluster them into recurring themes and prioritize based on frequency and emotional intensity. Build detailed theme profiles with motivators and anti-patterns, then layer in insights on emotion and competitors. Finally, turn themes into content ideas mapped to funnel stages, ensuring each topic is grounded in real demand and uses the audience's own words.

HOW OPENAI ADS AFFECT ORGANIC STRATEGY

The launch of ChatGPT ads in February 2026 reinforces the importance of organic strategy rather than replacing it. Ads appear below the AI's answer and only on Free and Go tier accounts, meaning paying subscribers see brands exclusively through organic citations. With zero-click searches now at 60%, the priority has shifted from driving site visits to being the source AI models repeatedly reference. Brands with thin third-party coverage or poor technical accessibility for LLMs are especially vulnerable, as competitors can place ads directly beneath unfavorable AI-generated mentions.

PAYWALLS: EXPERT TIPS FOR TECHNICAL AND EDITORIAL SEO

Publisher paywalls require both editorial and technical alignment to avoid damaging SEO performance. Engagement signals like Navboost penalize pages with high bounce rates, and paywalled stories tend to have shorter visibility in Top Stories as a result. A strong editorial approach links free top-of-funnel content to locked premium pieces, creating a second click that moves readers closer to converting. Technically, the most common issue is missing or incorrect structured data, particularly the "isAccessibleForFree" attribute and CSS selectors that help Google properly crawl gated content.

THE AI MARKETING PLAYBOOK (WEBINAR)

This webinar will cover using AI to understand customer needs, improve campaign effectiveness, and guide prioritization and experimentation. The session will break down practical ways to apply AI as part of a structured growth system. It will take place on March 26 at 9 AM PT.

BRINGING THE POWER OF PERSONAL INTELLIGENCE TO MORE PEOPLE

Google is expanding Personal Intelligence across AI Mode in Search, the Gemini app, and Gemini in Chrome for free-tier users in the US. The feature connects Google apps like Gmail and Google Photos to deliver personalized responses without requiring users to provide extra context. Use cases include tailored shopping recommendations based on past purchases, travel itineraries drawn from booking confirmations, and schedule-aware suggestions during layovers. Users control which apps are connected and can turn connections on or off at any time.

UTILITY-WRITING: ADD STRUCTURE TO LANGUAGE; NOT THE OTHER WAY AROUND

Writing should embed structure directly in language so machines can extract meaning without relying on technical markup. Tests show about 99% of sentences fail to stand alone, and systems like Gemini may use only about 380 words per page or 15.5% of content, so unclear or buried information becomes invisible. Content performs better when it includes named entities, explicit relationships, clear conditions, and self contained statements that answer specific questions. Dense and precise passages outperform longer pages because only 12% of very long content may be used, so adding more text can reduce visibility. The most effective approach is to write sentences that machines can quote directly while still giving humans clear and useful information.

EMAIL PERSONALIZATION HAS AN OVERUSE PROBLEM

Hyper-personalized email campaigns are creating subscriber fatigue as recipients grow numb to tactics like cart reminders and name-filled subject lines that thousands of brands use simultaneously. The argument is not to abandon personalization but to deploy it more selectively, reserving it for moments where it genuinely adds value, such as early access for loyal customers or contextually relevant offers. Not every campaign needs personalization. Product launches, for example, often work better as broad sends. The key distinction is between making subscribers feel understood versus reminding them how much data a brand holds on them.

OPTIMIZING A SITE WITH 1.5M PAGES

How an SEO consultant approached site organization, linking, and content differentiation for a massive website.

YAHOO CEO JIM LANZONE ON REVIVING THE WEB'S HOMEPAGE

An interview with Jim Lanzone on how Yahoo escaped its Verizon death spiral and became profitable again.

AI JOB LOSS RESEARCH IGNORES HOW AI IS UTTERLY DESTROYING THE INTERNET

Studies commonly ignore AI's most disruptive real-world effects, including AI-plagiarized books, synthetic music, and businesses shutting down after losing search rankings to AI slop.