When making new products in your company, be careful about who you tell and when. Start by only telling your direct boss during the early idea stage. Once you have something to test, let some coworkers try it but meet with important team leaders before making big announcements. Only after your product is working well and customers like it should you share regular updates with everyone. Don't worry if some people wish they knew sooner - that always happens no matter what you do.
A major new benchmarking study reveals how successful B2B marketers track their impact. Smart founders should focus on cost-per-revenue instead of just pipeline numbers to see which marketing actually creates customers, not just leads. Your tracking should grow with your company—count deals by hand when small, watch where leads come from as you grow, then use systems that show the full customer journey once you're bigger.
Angel investing offers benefits like learning from founders and networking but poses high risks with low chances of substantial financial returns. The practice is best approached with clear intentions and a structured strategy to mitigate the inherent risks. This comprehensive guide, based on insights from experienced investors, outlines steps for effective angel investing, including establishing motivations, structuring investments, sourcing deals, and building a network.
Opendoor removed its arbitrary two-year limit on re-engaging past customers with email offers, doubling contracts and generating an extra $1 billion in revenue.
Product managers should pick one simple way to explain their product and stick with it.
PayPal's FP&A team utilized sophisticated forecasting models that hinged on Total Payment Volume, consumer spending, and economic cycles to manage its $2 trillion transaction flow.
…all led by a team of expert certified testers.
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
Microsoft Incident Response researchers report on a new RAT, StilachiRAT. This RAT can steal crypto wallet data, clipboard credentials, and Google Chrome local state files. It also features enhanced persistence, anti-forensics, and C2 command execution capabilities.
Hackers exploited an SSRF vulnerability in ChatGPT's pictureproxy.php file, enabling unauthorized requests. There were over 10,000 attacks from one IP focused on the US government and financial institutions in a week.
Researchers found server hosting tools for cyber attacks on South Korean entities, notably using Cobalt Strike Cat. The attacker targeted government and commercial organizations with open-source tools like SQLMap and Web-SurvivalScan. The malware campaign utilized Rust-compiled loaders and a modified Cobalt Strike for post-exploitation.
Trail of Bits' TRAIL (Threat and Risk Analysis Informed Lifecycle) is a threat modeling process that merges aspects of Mozilla's Rapid Risk Assessment, NIST SP 800-154, and NIST SP 800-53 to identify design-level security flaws. TRAIL constructs a model of system components and trust boundaries, documents threat scenarios of potential adversary exploitations, and generates actionable findings with short- and long-term mitigation recommendations. It addresses root causes at the architecture level, allowing clients to adapt their threat models as systems evolve and offering vital security insights throughout the software development lifecycle.
This blog explores how to exploit GitLab Enterprise through ruby-saml vulnerabilities using round-trip attacks and namespace confusion for unauthorized admin access. The technical details are provided for security education and understanding these attack vectors.
This article describes how to defeat string obfuscation in Node.js malware through Abstract Syntax Tree (AST) parsing, focusing on the Nebula Stealer sample. It outlines a method using the Babel library to safely analyze, extract, and execute obfuscated code in a VM context while replacing obfuscated strings with their decoded values. The author includes code snippets for renaming variables, extracting code segments, executing parts of the code to reveal hidden strings, and enhancing readability.
2025.03.19·links.tldrnewsletter.com·14 min read·TLDR InfoSec Sponsored
Businesses are cautiously optimistic about AI agents for SOC triage and investigation. This buyer's guide will help you understand what to look for in an AI SOC analyst [11], from a business and technical perspective. It also includes an RFP template that you can use as a
In the wake of the tj-actions and reviewdog supply chain attacks, this action scans GitHub Actions logs for exposed secrets and credentials.
AI HTTP Analyzer is a Burp App that provides an advanced security analysis assistant integrated into Burp Suite.
Dojo-101 is a project for capturing experience and knowledge in cybersecurity.
Amazon RDS IAM DB Authentication enables IAM principals to access RDS databases with their IAM credentials, eliminating the need for separate database credentials. It also reports IAM DB Auth error logs to CloudWatch and publishes authentication metrics automatically.
A JA4 TLS client fingerprint contains a 36-character fingerprint of the TLS Client Hello which can be used for identifying known bad actors. JA4 fingerprints are now supported in match statements in AWS WAF. Additionally, AWS WAF has added support for both JA3 and JA4 fingerprints to rate-based rules.
The UK's Online Safety Act enforcement began, requiring tech platforms to remove dangerous content or face fines up to 10% of global turnover. Elon Musk hopes Trump will intervene to weaken the law, but UK officials insist it will remain intact and may even expand, particularly to combat AI-generated CSAM.
Google has announced a definitive agreement to acquire cloud security platform Wiz, Inc. for $32 billion in cash.
Cybercriminals used infostealers to steal 2.1 billion credentials last year, leading to ransomware attacks and data breaches.
Sponsored
5Tales, a digital marketing agency managing 100+ WordPress sites, was struggling with slow load times, unreliable hosting support, and constant security headaches, making it difficult to scale and meet client expectations.
The creator economy is too significant for brands to ignore, as creators build communities and turn fans into customers. Despite YouTube's reach, many brands have yet to fully embrace creator partnerships, leaving a “white space” for early adopters. Creator-led content delivers 12X more impressions and 17X more engagement than brand-owned content, with Shorts playing a key role in this growth.
Roku's test of startup video ads, which play before the home screen loads, caused backlash from users, with many threatening to switch to competitors. While Roku framed it as a test, angry reactions flooded forums. The company may pull back on this experiment, but the broader trend of increasingly aggressive streaming ads does not seem to be slowing down.
Cloudflare uses radical transparency to build customer trust by publicly sharing detailed post-mortems of incidents, even highlighting internal failures. Its System Status page provides real-time, granular updates on service performance and offers APIs that allow customers to integrate notifications into their own systems. Cloudflare also publishes in-depth research on its security techniques, which positions itself as a thought leader and attracts top talent. This strategy creates a trust-driven cycle where transparency boosts adoption, fuels innovation, and enhances security.
Smiling in profile photos increases bookings for hospitality services. Research with 9,248 Airbnb hosts showed that smiling hosts were rated 16% more competent, 44% warmer, and 8% more likely to get booked. Male hosts benefit more because they are generally perceived as less warm, making smiles more reassuring. For maximum trust, place smiling photos on “About Us” or CTA pages and adjust smile types based on cultural preferences.
Sponsored
The smartest marketers don't guess. They listen. Social listening helps you track trends, understand competitors, and capture demand. Join our free webinar [11]to see how it's done.
This webinar will cover how to build authority in an AI world, create content that AI cites, and steps to thrive in a post-SEO world. The event will take place on March 20 at 11 AM PT and is free to attend.
Fotor is an online photo editor that allows image enhancement, graphic design, and AI-powered editing. It's meant for non-designers and has customizable templates for social media, marketing, and personal projects. Users can access it via web or mobile app, with both free and premium options available.
Google's Gemini 2.0 Flash can generate and edit images directly in chat, removing objects, altering angles, and even erasing watermarks. Unlike previous models that relied on separate diffusion systems, this multimodal model integrates text and image generation into a single neural network. The results are still not perfect, but they signal a shift toward AI-powered media manipulation that could drastically change how digital content is created.
Pinterest's transformation from a content-sharing platform into a discovery-driven shopping engine is gaining traction. Its Paid Partnerships program and ML-powered recommendations are helping brands connect with creators in ways that drive measurable sales, rather than just impressions. Unlike competitors that rely on audience targeting via digital IDs, Pinterest's approach is based on search behavior and purchase intent, making it less vulnerable to shifts in data privacy regulations.
The chaos around AI agents stems largely from marketing, as companies dilute the term for hype and differentiation. Originally a technical concept, "agent" now lacks a clear definition. OpenAI, Microsoft, and Salesforce all have conflicting definitions. While this gives companies room to tailor agents to their needs, the lack of clarity makes it harder to set expectations and measure success.
Apple's struggles with AI and product execution signal deeper issues in its innovation cycle. The delayed Siri update is concerning, but the bigger issue is that Apple seemingly didn't anticipate the delay. This is part of a broader pattern of missteps, including the premature Vision Pro launch. It is unknown whether Apple still has the ability to redefine industries or if it is slipping into systemic poor execution.
Most people read at an 8th-grade level, so use simple language to make content more accessible without sacrificing meaning.
B2B social growth comes from founder-led content, bold takes, narrative-driven posts, and well-timed product launches.
Canva can auto-generate video captions, translate ads into 100+ languages, and add interactive polls and quizzes into presentations.
Amazon EBS volumes have frequent performance degradations, even though complete failures and data loss are rare. These "slow" periods, where volumes operate below their provisioned performance, can cause application failures and downtime, impacting users. The documented 1% downtime expectation is significant for real-time workloads and users can expect at least some downtime if they run enough shards.
The standard Ubuntu jq package is slow for processing large GeoJSON files. Rebuilding jq from source with compiler optimizations and the mimalloc allocator can improve performance a lot. Preloading mimalloc dynamically can also give a notable speedup to the standard Ubuntu binary.
Netflix tackled the challenge of storing massive amounts of viewing data by evolving its time-series data storage system. Initially relying on Apache Cassandra, its team faced scalability issues with increasing data volume from video previews and global expansion. They redesigned its architecture by categorizing data into Full Title Plays, Video Previews, and Language Preferences, and sharding data by type and age.
Charisma is a learnable skill. In the context of work, it means focusing on how you make others feel and becoming someone people enjoy working with.
2025.03.19·utopianengineeringsociety.substack.com·14 min read·TLDR Web Dev Stamina is often associated with physical endurance, but it's also the ability to consistently uphold values and commitments even when facing adversity. It's demonstrated through persistent effort in various aspects of life, like teamwork, problem-solving, and relationships, despite challenges and exhaustion. Stamina is cultivated by maintaining focus, patience, and an open mind while working towards long-term goals, even without immediate progress, which is valuable when working on long-term projects, like a startup.
Verification-First Development (VFD) involves establishing a method of verifying code correctness before writing the code itself, using tests, type invariants, or formal models. The benefits of VFD include preventing skipped verification, double-checking verifier functionality, and detecting errors early. However, VFD can slow down development, and exert pressure on code design to follow the chosen verification method.
Gemini Canvas is an interactive workspace where users can collaborate with Gemini to create documents and code, iterate rapidly with real-time feedback, and share their creations. It's similar to Claude Artifacts and ChatGPT's Canvas.
Query Tables is an AI agent tool that allows users to analyze structured data from various sources using SQL queries. It can connect with data sources like Notion, Google Sheets, and enterprise data warehouses like Snowflake and BigQuery. Query Tables maintains a unified abstraction layer that represents all data sources as tables with a unique ID, schema, and source URL so data can be joined from different sources easily.