Search the archive

TIPTAP

Headless and open source editor framework.

ATLAS

Tickets, AI chat replies, help-center docs, and customer session recordings in one support dashboard.

SKARBE

AI tool that captures sales interactions, summarizes them, updates your pipeline, and drafts follow-ups.

COORDINATION CRISIS IN MODERN TECH WORK

A new survey revealed that over half of tech workers waste 25-50% of their time on "work about work" like meetings and approvals. Contrary to expectations, in-office teams report more coordination waste than hybrid workers. Solutions include better delegation, embracing async work, and using AI to summarize meetings and analyze workflow bottlenecks

THE STATE OF STARTUP MEDIA

Tech stories once belonged to gatekeepers like TechCrunch. Now a revolution is brewing—a modern "Republic of Letters" where founders, investors, and builders tell their own tales. This movement exploded during COVID when Packy McCormick, Lenny Rachitsky, and others built massive audiences seemingly overnight. This was because people craved optimism and insider truths instead of journalist skepticism. The secret isn't fancy credentials or connections—just pick one simple idea, take it seriously, and start creating. Even with just a few readers at first, your ideas will sharpen, your network will grow, and you might just find your tribe along the way.

EUROPE'S FASTEST GROWING STARTUP?

Swedish AI startup Lovable skyrocketed to $30M ARR in 120 days with a team of just 18, leveraging viral growth from rebranding and improvements on a robust initial product. Its growth strategy involved targeted social media engagement and launching on platforms like Product Hunt, capitalizing on word-of-mouth. Lovable's hybrid pricing strategy combines subscriptions with usage limits, maintaining profitability while investing in product development.

STOP SOLVING CHAMPAGNE PROBLEMS

Too many founders burn precious runway fussing over fancy domains, slick logos, and perfect org charts.

FOUNDER CEOS ARE MASSIVELY UNDERPAID

Experienced founder CEOs typically make less than 20% what outside CEOs would earn for the same job—a completely unreasonable imbalance.

A NEW SOCIAL NETWORK QUIETLY BUILT TO HEAL THE DIGITAL WORLD

Everle is a new subscription-based social network without ads or data harvesting focused on genuine connection and mental well-being.

and Agentic AI, in one unified platform.

With SentinelOne, AI isn't just a buzzword—it's the unifying force and underlying strategy that gives you holistic autonomous protection.

Learn more about SentinelOne Cloud Security

PLANET TECHNOLOGY INDUSTRIAL SWITCH FLAWS RISK FULL TAKEOVER – PATCH NOW

Multiple Critical Vulnerabilities have been identified in Planet Technology's industrial switches. CVE-2025-46275 and CVE-2025-46271 allow complete control of the router, while CVE-2025-46273 reveals hard-coded communication credentials between the NMS and managed devices, enabling remote interception and configuration changes. There are also vulnerabilities affecting specific switches. Researchers also found lax security practices, including the use of default or weak credentials for MQTT and MongoDB.

SAP ZERO-DAY VULNERABILITY UNDER WIDESPREAD ACTIVE EXPLOITATION

SAP Netweaver software has an unrestricted file upload vulnerability identified by CVE-2025-31324. After querying internet server search engines Shodan and Censys, Onapsis estimates that about 10,000 SAP instances are potentially vulnerable. It is a CVSS 10 vulnerability, remotely exploitable through HTTP unauthenticated, that allows for complete system compromise.

NOVEL UNIVERSAL BYPASS FOR ALL MAJOR LLMS

A new technique called "Policy Puppetry” can bypass safety guardrails in all major generative AI models. The attack involves crafting prompts that appear as policy files, tricking AI systems into interpreting them as instructions that override safety alignments. This universal vulnerability demonstrates fundamental flaws in AI model training and security.

CROSS-SITE WEBSOCKET HIJACKING EXPLOITATION IN 2025

Cross-Site WebSocket Hijacking is a vulnerability that arises from WebSockets being unprotected by the Same Origin Policy, allowing malicious sites to connect to targeted sites impersonating the user. Modern browsers have implemented security features that make CSWSH harder to exploit, such as Chrome's SameSite=Lax default cookie and Firefox's Total Cookie Protection. However, proper Origin validation during the server-side WebSocket handshake is the most reliable defense, as browser settings can change, and Chrome still permits CSWSH under certain conditions.

USING AI TO ANALYSE CYBER INCIDENTS

This post shows how to use AI to create a timeline of the April 2025 Marks & Spencer cybersecurity incident, which impacted contactless payments and click-and-collect services, ultimately escalating to a suspension of online orders by April 25. The timeline details the progression from initial reports on April 19th to April 26th, documenting customer experiences, official communications, and media coverage with timestamps. Although M&S has not confirmed the nature of the attack, the company's response involved taking processes offline and consulting cybersecurity experts, causing operational disruptions across over 1,000 stores and a temporary 5% drop in their share price.

IO_URING IS BACK, THIS TIME AS A ROOTKIT

ARMO researchers exposed a critical security gap where Linux runtime security tools fail to detect malware using the io_uring interface. Their proof-of-concept rootkit, "Curing," bypasses traditional system call monitoring, affecting tools such as Falco and Microsoft Defender. While some vendors have implemented fixes, most security solutions remain vulnerable to this evasion technique.

CLOUD SNITCH

Cloud Snitch is a tool inspired by Little Snitch for macOS that visualizes AWS account activity with a focus on security and exploration. It's able to map activities, filter by AWS region, principal, IP addresses, etc, and also highlight any errors in prominent colors so that issues can be surfaced more easily.

JERICHO SECURITY (PRODUCT LAUNCH)

Jericho enables organizations to run AI Agent-based, hyper-realistic, personalized attack simulations to train employees to identify real-world threats, track their progress, and escalate difficulty and rewards based on completion.

SCARY-STRINGS

Flag potentially dangerous API calls in source code, a.k.a.. lines containing scary strings from a security perspective.

SOUTH KOREAN COMPANIES TARGETED BY LAZARUS VIA WATERING HOLE ATTACKS, ZERO-DAYS

North Korean APT Lazarus targeted six South Korean organizations in finance, IT, semiconductors, software, and telecommunications through Operation SyncHole. They employed watering hole attacks and exploited zero-day vulnerabilities in security software, targeting Cross EX and Innorix Agent for online banking and government sites. The attack utilized malware such as ThreatNeedle, wAgent, SignBT, and CopperHedge for reconnaissance and access maintenance, while Lazarus further developed tools to evade detection.

“YOU WOULDN'T STEAL A CAR” ANTI-PIRACY CAMPAIGN MAY HAVE USED PIRATED FONTS

The anti-piracy campaign "You Wouldn't Steal a Car" appears to have used XBand Rough, a knockoff of the FF Confidential font. This ironic discovery highlights the complex nature of typeface copyright law, where typeface designs have limited protection but font files can be copyrighted as software.

NORTH KOREAN IT WORKERS SEEN USING AI TOOLS TO SCAM FIRMS INTO HIRING THEM

In coordination with US authorities and third parties, Okta has tracked the behaviors and usage of GenAI by DPRK workers. Okta found that North Korean workers are utilizing GenAI tools at all stages in the process, from drafting resumes, to deepfake interviews, and even utilizing GenAI to maintain multiple jobs at the same time.

LATTICA EMERGES FROM STEALTH WITH FHE PLATFORM FOR AI

Lattica emerged with a platform that utilizes fully homomorphic encryption (FHE) for AI to process encrypted data without requiring decryption.

FBI SEEKS HELP TO UNMASK SALT TYPHOON HACKERS BEHIND TELECOM BREACHES

The FBI is seeking help to identify the Chinese Salt Typhoon hackers who breached U.S. and global telecom providers, accessing the private communications of government officials.

ROMHACK 2025 CONFERENCE CALL FOR PAPERS

RomHack 2025 is seeking presentations from individuals with a strong information security (infosec) background who wish to share interesting topics.

ALL THE THINGS PEOPLE USE AI FOR IN 2025

AI is now predominantly used for emotional and life support, including therapy, life organization, and finding purpose. It also plays a major role in content creation, enhancing learning, generating code, and fostering creativity. Unlike in 2024, when AI was primarily used for idea generation and specific searches, the focus has shifted to mental health support and personal assistance. The use of AI for research and fun activities has declined, while its role in technical and creative tasks has expanded.

PERPLEXITY CEO SAYS ITS BROWSER WILL TRACK EVERYTHING USERS DO ONLINE TO SELL ‘HYPER PERSONALIZED' ADS

Perplexity plans to launch its own browser, Comet, to collect user data beyond its app for premium ad sales. CEO Aravind Srinivas stated that tracking users' online activity, including purchases and browsing habits, will help build better user profiles and deliver more relevant ads. The browser is set to launch in May.

UNDERRATED STRATEGY: BUILDING INDUSTRY JOB BOARDS

YOUR #1 MARKETING CHANNEL IS PEOPLE'S EGOS

Wiz boosted its social shares by 300% by giving out personalized "Cloud Security Excellence" certificates after challenges. It made recipients' names the largest element on the certificates, tapping into people's desire for status and recognition. 50% of Wiz's customers joined its “Zero Critical Club” after receiving certificates for eliminating critical security issues. The personalized certificates worked because they triggered pride, created a sense of community, and required almost no effort to share.

EMAIL MARKETING COPY DASHBOARD (NOTION TEMPLATE)

This dashboard simplifies email campaign management by organizing onboarding sequences, resource newsletters, and quarterly product updates. It includes QA checklists, audience insights, performance tracking, and key metrics. With strategic content creation, timing, and segmentation guidelines, plus automated tracking, the dashboard helps teams create data-driven, engaging campaigns.

CHATGPT BRINGS “DEEP RESEARCH” TO FREE USERS

OpenAI is expanding access to its deep research capabilities by launching a lightweight version of the tool for free users. Free users can now complete up to 5 research tasks per month with responses that maintain depth and quality. Premium subscribers will retain full access to the original model - the free version will be powered by the o4-mini model and will provide shorter outputs.

THREADS IS GOING ALL IN ON ADS

Meta is expanding ads on Threads, ending its mostly ad-free experience that had only shown limited ads to users in the US and Japan. Threads is also adding features like a ‘+' button for easier post creation, the ability to copy posts as images, and a multi-column view for web users. New menu buttons for Liked and Saved posts, tabs for custom feeds, and a feature to import followers from other platforms are being introduced. Threads has also switched its domain from Threads.net to Threads.com.

HOW TO BUILD THE PRODUCT MARKETING CAREER YOU WANT

Promotion is not the only way to grow a product marketing career. Alternative paths like freelancing, consulting, and pivoting to related fields are valid and often better suited to personal goals. Career growth is a loop, not a ladder, and includes stages like learning, mastery, and reinvention. The author recommends writing a future vision story, brainstorming 2-3 paths to reach it, and taking small real-world steps to test them.

THE LENNY RACHITSKY PLAYBOOK: PROMPTS, GROWTH FRAMEWORKS, AND STRATEGIES

Lenny Rachitsky grew from writing free essays in 2019 to over 1M newsletter subscribers and $2M+ annual revenue by 2024. He prioritized giving value, moved to Substack for email control, launched paid subscriptions, and built a 20K+ member Slack community to boost retention. Growth came from using Substack's Recommendations, launching a top tech podcast with 10M+ downloads, and offering bundles to drive upgrades. His freemium model converted about 5%, with content, community, and podcasting fueling self-reinforcing growth loops.

SHARE OF VOICE: THE KEY TO WINNING IN GOOGLE'S AI-DRIVEN SEARCH

A brand's Share of Voice on Google measures how often its URLs appear in search results compared to competitors.

AI FRIENDS ARE A GOOD THING, ACTUALLY

AI companions, when used properly, can supplement human relationships.

SMARTER SEARCH AT AIRBNB: HOW EMBEDDING-BASED RETRIEVAL WORKS

Airbnb improved its search system using Embedding-Based Retrieval, which represents both listings and search queries as vectors in a shared space to find relevant matches. The system used a two-tower model architecture, where one tower processes listing information and the other processes search query information to create embeddings that were compared to quickly narrow down results. Airbnb trained this model using contrastive learning, pushing similar queries and listings closer together while distancing dissimilar ones.

BEST PRACTICES FOR REDUCING LAG IN EXPO APPS

One of the best ways to reduce lag in Expo apps is by focusing on JavaScript performance and thread management. Modern JavaScript features like TypeScript and ESM syntax, with tools like ESLint for React rule enforcement, help make code more efficient. React Compiler also adds for automatic memoization and optimization. For advanced optimization, using React 19's `use` API and multi-threading with Reanimated worklets for complex animations are good options to explore.

BUSINESS FOUNDERS ARE LESS VALUABLE THAN THEY THINK

Non-technical business founders often overestimate their value in tech startups and struggle to find technical co-founders because they lack the skills to execute their ideas. While ideas are important, execution, primarily driven by technical expertise in the early stages, holds greater value. Business founders can become valuable by focusing on their strengths: customer acquisition, relationship building, and their ability to create a significant customer base or get strategic partnerships.

THAT'S HOW WE'VE ALWAYS DONE THINGS AROUND HERE

Software teams often follow outdated and unnecessary practices without questioning their purpose. These practices in software engineering, such as limiting line width or adhering to outdated team rules, can slow down teams for no good reason. Instead, devs should ask clarifying questions, suggest alternatives, and test the relevance of existing processes.

STARTUP WEEKEND: HOW WE WON THE COMPETITION

A team won an Italian startup weekend competition. In this post, they talk about what they learned, such as the importance of validating a real-world problem by talking to potential users. Their solution to the problem was also reasoned well, with their pitch deck being clear, clean, and concise.

TILT

Tilt is a tool that automates microservice development on Kubernetes, making the process of building, deploying, and updating applications easier.

MAGNITUDE

Magnitude is an open-source, AI-native testing framework for web apps that utilizes visual AI agents to adapt to UI changes. It allows devs to build test cases with natural language. Magnitude uses a strong reasoning agent for planning and a fast visual agent for execution.

LOGCHEF

Logchef is a high-performance log analytics platform for efficient log management and analysis. It uses ClickHouse for fast log storage and querying, with schema-agnostic exploration and flexible query options, including both simple search syntax and full ClickHouse SQL. It also has team-based access control and is deployed as a single binary.

HOW A SINGLE LINE OF CODE COULD BRICK YOUR IPHONE

A vulnerability in iOS was discovered related to Darwin notifications, a low-level message exchange system. Any app could send these notifications, even sensitive ones, without proper authorization. This developer created an app that repeatedly triggered a "Restore in Progress" state by sending a specific notification, soft-bricking the device.