Search the archive

THE WORLD'S SHORTEST B2B COPYWRITING GUIDE

Steal words from job descriptions, turn them into headlines with power words and emotions, and focus on how the product will make the buyer look good to their boss.

WHAT DO YOU DO WHEN YOUR STARTUP IS NOT GROWING ANYMORE?

If a company's growth has significantly slowed down, it should first honestly assess the reasons, such as falling out of product-market fit or being less competitive than before, then focus on making its existing customers extremely satisfied, as they are the primary source of new customers.

MY FAVORITE USES OF AI

Some of this author's favorite AI tools are Gemini for book summaries, Claude for understanding academic papers, Google Android Recorder and Whisper for dictation and transcription, and Ollama for summarizing podcasts.

↗️ Read the full article on the Orca Blog

↗️ Find out how AI-driven cloud security [5] simplifies investigations and accelerates remediation

↗️ Get a demo of Orca Security

PUTTY SSH CLIENT FLAW ALLOWS RECOVERY OF CRYPTOGRAPHIC PRIVATE KEYS

A vulnerability in PuTTY 0.68-0.80 could allow attackers with access to 60 cryptographic signatures from a user to compute the private keys offline. These signatures could come from an attacker-controlled SSH server or signed git commits. The vulnerability arises from the way that PuTTY generates ECDSA nonces, which lacks robust cryptographic random number generators on specific Windows versions.

IVANTI WARNS OF CRITICAL FLAWS IN ITS AVALANCHE MDM SOLUTION

Ivanti fixed 27 vulnerabilities in its Avalanche MDM solution, including critical flaws that allowed remote attackers to execute commands. These security updates are crucial for protecting over 100,000 mobile devices from potential attacks. It is recommended that customers update to the latest Avalanche 6.4.3 version to stay secure.

OPENJS FOUNDATION TARGETED IN POTENTIAL JAVASCRIPT PROJECT TAKEOVER ATTEMPT

Security researchers discovered a takeover attempt targeting the OpenJS Foundation similar to a recent incident with the XZ Utils project. Suspicious emails urged OpenJS to update a JavaScript project and designate new maintainers without proper involvement. Maintainers of open-source projects should be cautious of social engineering attacks targeting their sense of duty and community.

“ALL YOUR SECRETS ARE BELONG TO US” - A DELINEA SECRET SERVER AUTHN/AUTHZ BYPASS

Delinea Secret Server is a PAM that helps organizations secure, manage, and monitor privileged accounts. This post delves through the process of hunting for an AuthN/AuthZ bypass, decompiling the relevant code sections, and crafting the exploit. It includes detailed reproduction steps and a proof of concept for obtaining admin access.

DEPLOYING TAILSCALE FOR A REMOTE ONLY COMPANY

This post describes the reasoning and process followed to deploy Tailscale for a fully remote company. It goes over the motivation for this deployment, its advantages, and some tips and potential pitfalls in this setup. The post concludes with some features that were introduced since the original deployment that would have been helpful for future deployments.

UNRAVELING SIEM CORRELATION TECHNIQUES

This post provides an overview of SIEM correlation techniques. It begins by defining correlation, introducing the MITRE ATT&CK framework, and presenting an example of a simple correlation rule. The post then continues to work through an example of detecting a Brute Force Okta Login, while combining multiple TTPs and log sources.

AWESOME-SECURE-DEFAULTS

A repository of libraries in different languages that provide secure-by-default functions to eliminate bug classes.

CVENOTIFIER

CVENotifier is a customizable notifier for CVEs based on keywords. This tool scrapes the CVE feed from vuldb.com, filters it based on keywords, and notifies via Slack about the latest CVEs only for the technology or the products you have listed as keywords.

CLOUD-KEY-ROTATOR

Cloud-Key-Rotator is a program written in Golang that helps manage cloud service account key rotation. Not only does it support many different services, the tool also attempts to verify its actions as much as possible and aborts immediately if it encounters an error.

AWS TOOK 6 MONTHS TO FIX STS BUG - IAM POLICY INADEQUATE

Stedi discovered a vulnerability in AWS STS that arose from its usage of IAM role trust policies that relied upon resource tags and request tags. AWS first denied the issue, then found that the scope of the problem was larger than initially believed, but still took 6 months to deploy a fix. A major issue is that the AWS IAM Policy Simulator lacks many IAM features, which makes it difficult and time consuming to properly test IAM policies.

A QUICK POST ON CHEN'S ALGORITHM

Cryptographer and Professor Matthew Green addresses the new e-print authored by Yilei Chen, “Quantum Algorithms for Lattice Problems," which could potentially threaten current lattice-based encryption schemes. Despite the significance of this discovery, it may not immediately affect widely used schemes like Kyber or Dilithium. The cryptography community is closely monitoring this development for potential implications for future encryption security.

FTC FINES MENTAL HEALTH STARTUP CEREBRAL $7 MILLION FOR MAJOR PRIVACY VIOLATIONS

The FTC fined Cerebral $7 million for sharing users' sensitive health data with third parties without consent. Cerebral misled consumers about its privacy practices and failed to protect their information. The company must now improve its privacy policies and delete unnecessary consumer data.

CHIRP SYSTEMS VULNERABILITY

Chirp Systems' smart locks have a security flaw allowing remote access to 50,000 homes - the company hasn't fixed it despite being notified in 2021.

NSA PUBLISHES GUIDANCE FOR STRENGTHENING AI SYSTEM SECURITY

The NSA has released guidance aimed at national security and defense companies deploying AI systems for securing AI systems to prevent malicious activities.

DDOS THREAT REPORT FOR 2024 Q1

Cloudflare's DDOS Threat Report for 2024 Q1 contains interesting tidbits like how Sweden experienced a 466% surge in DDoS attacks following its acceptance to the NATO alliance.

Launch your first campaign now

DIGITAL AD REVENUE DEFIED ECONOMIC CHALLENGES TO GROW 7.3% IN 2023

Digital ad revenue hit $225 billion in 2023, up 7.3% from the year prior, defying many negative economic indicators. Q4 saw the largest jump in spending, up 12.3% to $64.5 billion, likely due to increased holiday spending. The ad channels with the highest growth are audio advertising revenue (+18.9%), retail media (+16.3%), and video (+10.6%). Channels with “privacy by design solutions” will likely outpace the market going forward.

REPORT FINDS THAT BIG TECH'S AD MONITORING TOOLS ARE FAILING MISERABLY

The failure of Big Tech's ad monitoring tools underscores the urgent need for substantial improvements in ad transparency and accountability. Marketers face the daunting task of navigating through convoluted and inadequate tools, which hampers efforts to combat scams and disinformation effectively. Some of the monitoring issues reported include ads missing from repositories, poor search functionality, and inconsistent public access to information.

3-STEP PRODUCT MARKETING STRATEGY FRAMEWORK

Before even using this framework, ensure your product has PMF. Then conduct research on your target customer, competitors, and market. This will help to power positioning and messaging. Positioning is the place a product occupies in people's minds. Messaging is used to communicate the positioning to customers. A narrative is a story that stitches everything together to make it stick. Create a GTM plan that considers the specific channels customers are most likely to find your product, price and package the product to ensure it matches the perceived value, and enable internal teams to communicate the value of the product to customers.

VEED.IO'S HIGH-CONVERTING SAAS LANDING PAGE ANALYSIS

A breakdown of Veed.io's landing page, which is optimized for SEO. The page contains a clean site structure with easy navigation, social proof from top brands, multiple H2s breaking down key features and benefits, and a FAQ section with tutorial videos for users at different awareness stages.

12 FATHER'S DAY MARKETING EXAMPLES TO INSPIRE YOUR NEXT CAMPAIGN

This year's Father's Day falls on June 16. This guide contains 12 examples to help you plan your next Father's Day email or SMS campaign. Jeni's Splendid Ice Cream uses a Father's Day opt-out campaign to recognize difficult emotions as the day may stir up feelings of loss and distress for some. The company uses a sign-up form to collect email addresses for a suppression list. For brands that don't sell products that typically suit dads, Function of Beauty (a shampoo brand) does a great job conveying through email copy that “hair goals know no gender”.

FEATURE VS. PRODUCT VS. SOLUTION VS. PLATFORM

There are differences between features, products, solutions, and platforms. One or the other can change the intensity of a launch strategy or change the audience, scope, and angle of messaging. This post contains a table that breaks down the definition, persona, messaging emphasis, and success metric for each item.

USE "SEARCH MARKET SHARE" TO GET SEO BUY-IN FROM C-SUITE

Marketers often use metrics such as links, site speed, and monthly search volume when trying to get buy-in for particular initiatives, but these terms may not land with an executive team. Using "Search Market Share" is a better way to communicate the value of investing in search and directly pits your search performance against competitors. This post explains how to calculate this metric for your website and competitors using tools like Ahrefs.

HOW A SUCCESSFUL WEBSITE MIGRATION LED TO A 20% INCREASE IN KEYWORD RANKINGS

This article discusses the successful transition from YNAP (YOOX Net-a-Porter) to Shopify for a luxury fashion brand. The move resulted in a notable 20% increase in keyword rankings by enhancing scalability and addressing platform limitations. By optimizing the website architecture, the brand not only maintained its domain authority but also positioned itself for sustained organic growth. The article covers in detail each step of the transition highlighting the close collaboration between marketers and developers.

DIALPAD'S AREA CODE SEO MOAT: HOW TO RANK FOR 50K KEYWORDS

Dialpad is a cloud-based voice call platform that has reached $200 million in annual recurring revenue. One of the brand's growth levers has been its hundreds of area code pages, which bring in new SEO traffic and valuable leads. The page template is highly structured with concise and accurate information, which allows these pages to rank so effectively despite not having a significant word count, high domain rating, or many backlinks. The brand maximizes conversions from this traffic by using unambiguous CTAs, running A/B tests, and customizing the content for higher-value area codes.

HOW PPC MARKETERS CAN STAY RELEVANT AND THRIVE IN THE AGE OF AI

AI automates much of the fundamentals in PPC at this point, so marketers can bring the most value to ad campaigns by developing a deeper understanding of the business funnel and building complementary marketing skills outside of PPC.

TIKTOK TEAMS WITH AXS TO LET ARTISTS, VENUES, AND FESTIVALS SELL CONCERT TICKETS IN THE APP

TikTok's partnership with AXS will enable users to discover and purchase live event tickets directly within its app.

WHAT'S THE POINT OF LAVISH INFLUENCER TRIPS?

This post explains how and why brands like Tarte Cosmetics spend hundreds of thousands of dollars on influencer trips.

TEN YEARS OF IMPROVEMENTS IN POSTGRESQL'S OPTIMIZER

PostgreSQL's query optimizer has improved massively over the past decade. Using the Join Order Benchmark (JOB), this author shows that tail latency has been nearly halved between PostgreSQL versions 8 and 16, with each major version offering an average 15% performance increase. One of the best decisions teams can make to make their database query speeds faster is to simply keep their Postgres instances up to date.

HOW PAYPAL SERVES 350 BILLION DAILY REQUESTS WITH JUNODB

JunoDB is a highly reliable database developed by PayPal with an architecture that supports near-constant availability and efficient handling of massive data request loads. Its architecture includes a client library, a proxy with load balancing, and storage servers using RocksDB.

UPGRADING 3 MILLION VARIABLES TO ENVELOPE ENCRYPTION

Railway, a cloud deployment platform, used to rely heavily on Google Cloud's Key Management Service (KMS) for encrypting sensitive user configuration variables. To improve performance, security, and reduce dependency on a single provider, Railway implemented envelope encryption, which encrypts data with a data encryption key that is itself encrypted with a key encryption key. This change reduced KMS usage and allows Railway to have potentially no dependencies on external cloud infrastructure in the future.

FASTER CONNECTIVITY !== FASTER WEBSITES

Despite the increase in internet speeds, the user experience on many websites has not proportionally improved due to bloated websites and performance issues. Websites designed to load static content all at once remain the most accessible universally and often outperform all other websites. Modern websites that prioritize complex features over basic usability like scrolling and search are often slower than average.

BUILDING SOMETHING REAL IN YOUR SPARE TIME

To bring a side project to completion, start by defining specific goals, then break the project into smaller milestones to maintain motivation. Work on it consistently but sustainably by prioritizing features properly.

MENTAL HEALTH IN SOFTWARE ENGINEERING

This article shares a tech co-founder's struggle with anxiety and burnout, which stemmed from the intense work environment in the startup world. Neglecting mental health can take a heavy toll. To manage his anxiety better, the author set boundaries and prioritized self-care.

→ Schedule a QA Wolf demo to learn more

PAPER CODE

Paper Code is a fast and performant C++ IDE.

READER

Reader converts any URL to an LLM-friendly input.

MIKROORM 6.2

MikroORM is a TypeScript data-mapper ORM. Recently released MikroORM v6.2 introduces support for Microsoft SQL Server and libSQL, along with better handling of collection updates and pagination.

FAILURES, MISTAKES, CONFUSION

In programming languages, failures are systemic limitations that come from constraints and might be recoverable. Mistakes are code-based errors that violate program logic and usually need safe termination. Failures and mistakes should be handled differently by software.

DISTRIBUTED AUTHORIZATION

Authorization is complex and creates problems in microservice-based applications. Existing approaches either mix authorization logic with application code (making it hard to understand and update) or centralize authorization data, leading to tough data synchronization. A new service called Oso Cloud solves these issues with policy-based logic and a new distributed authorization architecture, allowing developers to define logic centrally while still using local data to make authorization decisions.

A BLUEPRINT FOR MAKING QUANTUM COMPUTERS EASIER TO PROGRAM

MIT researchers have identified a major challenge in quantum programming: the lack of control flow instructions like those in classical computers. To address this, they proposed a new model called the quantum control machine which includes modified instructions that make quantum computers easier to program.

HOW I SETUP MY TERMINAL FOR MAX PRODUCTIVITY

A detailed guide to customizing your terminal setup to use productivity-oriented plugins, themes, aliases, and command-line utilities.