Search the archive

SECURECODEBOX

secureCodeBox is a Kubernetes-based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.

CRADLE

CRADLE is an open-source web app that empowers Cyber Threat Intelligence (CTI) analysts by streamlining threat analysis with collaborative note-taking, visual mapping, and report generation.

QUASAR

Quasar is a modified version of the original Quasar RAT, now featuring HVNC, webcam support, and better remote desktop streaming, enhancing its remote administration and misuse potential.

AMAZON IS STILL HOSTING STALKERWARE VICTIMS' DATA WEEKS AFTER BREACH ALERT

Three stalkerware apps—Cocospy, Spyic, and Spyzie—stored victims' stolen data on Amazon Web Services. Although notified by February with specific bucket locations, Amazon hasn't removed the data due to procedural issues, claiming the notifications aren't formal abuse reports.

APPLE TO APPEAL UK GOVERNMENT BACKDOOR ORDER ON FRIDAY

The UK government faces criticism as its appeal hearing against Apple over a 'backdoor' order will be held secretly on March 14. The Technical Capability Notice would force Apple to provide access to encrypted iCloud data of users worldwide. Several MPs demand the hearing be public, warning about global privacy risks and dangerous precedents for authoritarian regimes.

MEDUSA RANSOMWARE HIT OVER 300 CRITICAL INFRASTRUCTURE ORGANIZATIONS UNTIL FEBRUARY 2025

The Medusa ransomware targeted over 300 U.S. critical infrastructure organizations until February 2025, leading the FBI, CISA, and MS-ISAC to issue a joint advisory for network defenders. The ransomware developers recruited access brokers via cybercriminal forums and used techniques to evade detection, executing double extortion schemes that demanded payment for decrypting files and preventing data leaks.

NEW SUPERBLACK RANSOMWARE EXPLOITS FORTINET AUTH BYPASS FLAWS

New ransomware SuperBlack exploits two Fortinet vulnerabilities to breach firewalls and deploy itself.

MICROSOFT APOLOGIZES FOR REMOVING VSCODE EXTENSIONS USED BY MILLIONS

Microsoft reinstated VSCode extensions after mistakenly flagging them as malicious due to obfuscated code, which led to the banning of publisher Mattia Astorino.

NORTH KOREA-LINKED APT GROUP SCARCRUFT SPOTTED USING NEW ANDROID SPYWARE KOSPY

ScarCruft, linked to North Korea, used KoSpy spyware to target Korean and English users, disguising it as utility apps to gather SMS, calls, location, files, audio, and screenshots.

ORACLE EMERGES AS MOST LIKELY PARTNER FOR US TIKTOK DEAL

With the US mandating TikTok's divestment, Oracle has emerged as the top choice for a partnership, mostly due to its past work on TikTok's US data separation project. While Trump claims multiple bids are in play, Oracle's close ties to his administration give it a strategic advantage. The main sticking point is China's refusal to allow the transfer of TikTok's core algorithms as part of the deal.

SPEED OF SOUND: HOW DIGITAL INNOVATION IS ACCELERATING THE AUDIO ADVANTAGE FOR ADVERTISERS

Commercial audio in the UK is rapidly growing, reaching 76% of adults weekly and generating 627.5 million listening hours per week. Digital audio, particularly podcasts, is a major driver of growth, with podcast ad revenues increasing by 43% over two years, making up 47% of digital audio ad spend. Audio advertising is highly effective, boosting ad awareness by 49%, brand relevance by 24%, and brand trust by 32%, while also increasing purchase consideration by 18%. Digital audio enhances targeting, engagement, and real-time measurement, allowing advertisers to optimize campaigns efficiently. Multi-platform audio strategies, including broadcast and digital formats, maximize reach and ROI, with research suggesting allocating at least 20% of media budgets to audio for better campaign performance.

NEW FAVORITE B2B AD FORMAT

LinkedIn's Thought Leader Ads are native posts with ad spend behind them, making them blend seamlessly into users' feeds. The best-performing ads feel organic, use images, and subtly mention the product without making it the focus. To maximize success, advertisers should use hyper-targeting, exclude irrelevant audiences, and set a low cost cap (often $1). Videos tend to underperform, while posts with strong headlines like “How X Did Y” drive higher engagement.

YOUR ONBOARDING ISN'T BAD, IT ENDS TOO EARLY

Imprint overhauled its onboarding to reduce drop-offs after the paywall, replacing the default home screen with a personalized learning journey. Users get custom course recommendations, motivational nudges, and interactive tutorials to familiarize themselves with the app. Gamification elements like XP rewards, daily streaks, and an "Aha" moment strategy encourage users to complete two lessons on their first day, which boosts retention.

SPARKTORO WORKSHEET: TURN AUDIENCE RESEARCH INTO CONTENT IDEAS (GOOGLE DOC)

This worksheet helps you document your audience's questions, pain points, and content consumption habits. It provides frameworks for creating content around problems, how-to guides, and trends. The process is organized into 4 steps to guide you from research to content planning.

GOOGLE'S RSA UPDATE CHANGES THE RULES FOR SITELINKS

Google is expanding how it creates Responsive Search Ads, allowing AI to omit elements, mix formats, and reuse headlines as secondary sitelinks. This update increases visibility for ad assets but also shifts control, requiring advertisers to refine their RSA final URLs to avoid misdirected traffic. With Google removing restrictions on duplicate sitelink URLs, advertisers must closely monitor ad variations in the combinations report.

50% OF UNILEVER'S AD SPEND WILL GO TO SOCIAL MEDIA. WILL AN INFLUENCER-FIRST STRATEGY WORK?

Unilever's new CEO, Fernando Fernandez, is shifting the company's marketing strategy to prioritize social-first advertising, increasing social media spend from 30% to 50% and expanding influencer partnerships by 20x. The company will focus marketing efforts on India and Latin America, aiming for hyper-local influencer reach. Industry analysts note that while this is a major shift, other large companies are unlikely to follow at the same scale immediately. Potential risks include influencer marketing's challenges with attribution, loss of brand control, and consumer fatigue. Despite these concerns, the move signals Unilever's belief that social commerce, particularly on platforms like TikTok, will be key to future growth.

THE TIKTOK TV CONUNDRUM

Despite regulatory uncertainty, TikTok continues to grow faster than Meta and is becoming a major digital ads platform. However, its limited presence on TV reduces the appeal to some buyers who prioritize the channel. Meanwhile, TV networks are struggling to integrate real-time shopping in a way that engages viewers, something that TikTok Shop excels at. The conundrum lies in whether TikTok must adapt to TV's format to unlock ad dollars, or if TV networks should integrate TikTok-like commerce features to avoid losing younger audiences.

NEXT-GEN GTM INSIGHTS

B2B GTM has shifted beyond marketing generating pipeline and sales closing it. Now, marketing, sales, product, and ops all contribute. The MQL model is outdated, leading to wasted spend and poor targeting. A better approach is account-based, focusing on high-fit ICP accounts and tracking their journey with unified metrics. Companies should map ICP accounts across key buying stages to measure progress. Marketing can lead all pipeline efforts, including SDRs and AI-driven outreach.

INSIDE TOWER 28'S NEW SKETCH COMEDY SERIES

Tower 28 broke through the typical beauty content by launching an original sketch comedy series on social.

AI SEARCH ENGINES GIVE INCORRECT ANSWERS AT AN ALARMING 60% RATE

A study found that some AI search models like Grok 3 fail up to 94% of the time.

PLAY AROUND WITH PERSPECTIVE

Product shot inspo with exaggerated sizing to create thumb-stopping visuals.

WHY IS PRODUCT SO HARD?

Building successful products is difficult due to three major challenges: uncertainty and complexity, divergent needs and misalignment, and organizational culture. To overcome these obstacles, companies must embrace adaptive development strategies, align internal and external stakeholders through a clear strategic direction, and actively shape a culture that supports innovation and collaboration.

THE DEFINITIVE FRAMEWORK TO FIND YOUR NEXT SCALABLE USER ACQUISITION CHANNEL

Early-stage growth teams often struggle by spreading their efforts across too many acquisition channels instead of focusing on one or two that align with their product's natural strengths. By identifying whether a product thrives on product-driven sharing, social incentives, or existing demand, companies can strategically match their strengths to the most effective growth channels, test them efficiently, and refine their approach for scalable success.

PRODUCT PITCH TO SALES PLAY

A successful product launch requires more than just awareness—sales teams need structured enablement to position the product effectively. By providing targeted materials, coaching early sales interactions, and fostering long-term sales independence, product managers can ensure their product gains traction without micromanaging every deal.

PRODUCT ANALYSIS: HOW TO ASSESS A PRODUCT

Product analysis is essential for evaluating a product's strengths, weaknesses, and market position to drive strategic improvements. By leveraging market research, competitor insights, and customer feedback, product managers can refine their offerings, optimize the user experience, and maintain a competitive edge through data-driven decision-making.

GOOD AND BAD GROWTH JOB DESCRIPTIONS

Many "growth" roles today are a mix of unrelated responsibilities—blending marketing, product, RevOps, and analytics—leading to unrealistic expectations. Companies misuse the "growth" label due to misunderstandings of the role, rebranding hard-to-fill positions, or under-resourcing teams. In contrast, well-defined growth job descriptions, like those from GitLab and Future, focus on performance marketing, data-driven experimentation, and optimizing user journeys.

THE POWER OF REFRAMING TO CHANGE YOUR CAREER TRAJECTORY

The biggest growth area for aspiring executives isn't strategy or communication, but mindset—how they interpret situations and filter information. Leaders can transform perceived setbacks into opportunities by reframing their perspectives. Mindset shifts can drastically alter career trajectories and unlock new possibilities.

VIBE CODING, SOME THOUGHTS AND PREDICTIONS

Vibe coding embraces AI-driven development, where users guide code generation with natural prompts instead of traditional programming. As AI advances, coding will shift towards "vibe designing," making software creation more accessible, moving bottlenecks to creativity and distribution, and reshaping developer roles in a rapidly evolving landscape.

THE LOOKING GLASS: OUR SOULS NEED PROOF OF WORK

Happiness isn't found in effortless comfort but in the challenges that shape us. True fulfillment comes from struggle, growth, and becoming the person we aspire to be—our souls need evidence of effort to thrive.

WHY YOU SHOULD NOT DESIGN FOR YOUR USERS

True innovation anticipates needs rather than relying solely on user feedback.

MY TEAM MEMBER IS PARALYZED BY PERFECTIONISM. HOW DO I HELP THEM CROSS THE FINISH LINE?

By using the BRAVE framework—breaking perfection paralysis, reframing risk, anchoring milestones, validating fears, and establishing completion rituals—a VP helped a teammate shift from avoidance to productivity, making her one of the team's most reliable contributors.

BEYOND REACT.MEMO: SMARTER WAYS TO OPTIMIZE PERFORMANCE

Many React performance issues are from unnecessary re-renders caused by state changes propagating through the component tree. Instead of relying on React.memo, optimize component structure by moving state down and using composition patterns to prevent excessive re-renders. This requires devs to truly understand React's rendering model and use the `children` prop to pass components, as it prevents unnecessary re-renders because React compares element references.

A SOFTWARE ENGINEER'S GUIDE TO READING RESEARCH PAPERS

A good way to properly read research papers is by using a multi-pass strategy. First, get the big picture by focusing on the Abstract, Introduction, Results, and Conclusion. Second, go deeper into the remaining sections, noting unfamiliar terms and references. Lastly, conduct background research and revisit the paper to connect the dots.

HTTP/3 IS EVERYWHERE BUT NOWHERE

Despite standardization and browser support, HTTP/3 adoption is uneven, which creates a divide between hyperscale and long-tail web users. Hyperscale companies are implementing HTTP/3 and QUIC (Quick UDP Internet Connections) for performance gains, while standard libraries and open-source tools lack support. This fragmentation is partly due to OpenSSL's incompatible QUIC API.

WHY "NORMAL" ENGINEERS ARE THE KEY TO GREAT TEAMS

Focusing on individual brilliance, such as on mythical "10x engineers," distracts from building effective systems that allow "normal" engineers to contribute meaningfully. A great engineering organization empowers average engineers to consistently deliver value, make progress for the business, and eventually be world-class talent.

AS AN ENGINEER, I'D RATHER BE CALLED STUPID THAN STAY SILENT

Embracing vulnerability and asking "stupid" questions is necessary for growth in an engineering career. Staying silent out of fear can lead to miscommunication, delays, and suboptimal work, negatively impacting both individual performance and team efficiency.

the Security Journey blog

GOOGLE IS GIVING AWAY GEMINI'S BEST PAID FEATURES FOR FREE — HERE'S THE TOOLS YOU CAN TRY NOW

Google is offering several new Gemini features for free, including personalized responses based on users' Google Search history. Deep Research, an AI research assistant that generates detailed reports, is also now free. Gemini can now connect with Google apps like Calendar, Notes, and Tasks, allowing for complex multi-app requests. It is expanding to Google Photos soon. Custom AI assistants called Gems are being rolled out for free.

AVID

Avid is an AI-powered platform that allows users to quickly and easily create mobile apps in Flutter with prompting.

CARBON

The Carbon Design System is an open-source design system by IBM. This repository has working code, design tools, resources, and guidelines for building UIs.

HOW ENGINEERING TEAMS ARE USING AI

Current AI tools are optimized for greenfield development and single-player workflows, which don't translate well to complex codebases and team environments. Instead, teams use AI as "augmentation" tools that help human developers develop faster rather than replacing them. AI helps reduce toil in areas like testing and documentation.

IO DEVICES AND LATENCY

Non-volatile storage has evolved from tape drives to hard disk drives (HDDs) and solid-state drives (SSDs). While tape storage is cost-effective for large-scale archiving, HDDs and SSDs provide faster access speeds, with SSDs eliminating mechanical components for lower latency. Cloud computing introduced network-attached storage, which is scalable, but introduces latency and IOPS limitations compared to directly attached storage. PlanetScale Metal is a hybrid, using directly-attached NVMe SSDs in a replicated Vitess+MySQL cluster to overcome the shortcomings of network-attached storage.

EVERYONE IN AI IS TALKING ABOUT MANUS. WE PUT IT TO THE TEST

Manus is a general AI agent developed by Butterfly Effect that is gaining attention for its ability to autonomously tackle complex tasks by combining multiple AI models and agents. While still imperfect, it's great for tasks like research and analysis. It gives users a collaborative, transparent experience with the ability to intervene in its process.

I'M TEACHING DATABASES THIS SEMESTER AT BERKELEY

OPENAI ASKS WHITE HOUSE FOR RELIEF FROM STATE AI RULES

OpenAI is urging the Trump administration to offer AI companies relief from state regulations in exchange for voluntarily sharing their AI models with the federal government.

WHY YOUR ‘HARMONIOUS' TEAM IS ACTUALLY FAILING

HOW THE NEW YORK TIMES SYSTEMATICALLY MIGRATED FROM ENZYME INTO REACT TESTING LIBRARY

The New York Times migrated from Enzyme to React Testing Library using a piecemeal approach, starting with simple files and building momentum over time.

GOOGLE ANNOUNCES GEMINI ROBOTICS FOR BUILDING GENERAL PURPOSE ROBOTS

Gemini Robotics is a vision-language-action (VLA) model by Google DeepMind that aims to bring Gemini and AI to the physical world. It was created to make general purpose robots that can perform a wider range of real-world tasks than ever before. The VLA is built on Gemini 2.0 and has physical actions as an additional output modality for the purpose of directly controlling robots. Google built its robotic AI model to be able to understand and respond quickly to instructions or changes in the environment, capable of the kinds of things people can generally do with their hands and fingers, and adept with dealing with new objects, diverse instructions, and new environments. A video showing some of the model's capabilities is available in the article.