A post from Checkmarx on a technique that it discovered to intercept messages from malicious Telegram bots that attackers utilize for info-stealing operations. Checkmarx's team extracted the bot details from a malicious package. They then utilized the /getUpdates endpoint to retrieve details of a specific message or all messages by looping through message IDs. The post also details two methods for redirecting messages when an attacker utilizes a webhook.
This app is a tool for analyzing Bluetooth (BLE) environments. It scans for BLE devices in the background, notifying you if the device you are looking for is near you or if some unknown device has been following you for a long time.
StunCheck is a set of tools for scanning, testing, and exploiting STUN and TURN servers.
Jira-Lens is a fast and customizable Python-based vulnerability scanner for Jira. Jira-Lens performs 25+ checks for vulnerabilities against target Jira servers.
RustDoor is a new backdoor that has been targeting Apple macOS since November 2023, masquerading as a Visual Studio update. It has Intel and Arm versions and unknown initial access. RustDoor is being actively developed. It can gather/upload files and system info to its C2 server.
Raspberry Robin operators are utilizing fresh 1-day exploits for privilege escalation, suggesting the team has access to exploit sellers or in-house development. The rapidly evolving QNAP malware acts as an initial access vector for payloads like ransomware.
BGPWatch is a comprehensive platform built by APNIC for detecting and diagnosing hijacking incidents in BGP routing. It allows users to browse, view, and search for hijack events in real time, providing detailed information about each event. BGPWatch offers routing path analysis and subscription services for operators to monitor via email.
$89 billion was invested across approximately 6,400 deals in Q4 2023, the lowest figure in the past five years.
Google has agreed to pay $350 million to settle a shareholder lawsuit related to a 2018 Google+ bug exposing private data associated with as many as 500,000 accounts.
The National Cyber Security Centre has provided an overview of the threats involved in scanning QR codes and prescriptive guidance for evaluating QR code safety.
Meta announced changes to Instagram and Threads in response to concerns about the spread of misinformation and polarization, limiting the proactive recommendation of political content. It is trying to distance itself from the intense political debates seen on Twitter and other social media sites. Users will have the option to enable political content recommendations through their settings.
Pinterest’s new ad partnership with Google aims to enhance ad revenue by broadening brands’ reach and engagement with active consumers through Google Ads. The integration allows ads to be served on Pinterest via Google’s Ad Manager, directing users to advertisers’ websites for potential increased ROI and conversions.
Some users will not watch fancy onboarding videos and cute carousels. The average completion rate for product tours is 61% and this will decline as users become more confident in jumping in without training wheels. To prepare for this, ensure navigation uses jargon-free labels, offers search, and sequences items based on usage frequency. The product should have clear titles and descriptions for each screen and copy should be helpful, empathetic, actionable, and linear.
Branded search involves specific keywords mentioning your brand or product. It’s essential to assess factors like search volume, competition, and budget before deciding on a paid search approach. This will have a significant impact on your bottom line by improving search rankings, enhancing user experience, and building brand reputation.
Having a growth organization requires a level of cross-functionality that creates complexity. Leaders should expect more from employees in their growth and product teams, but should also give them room to do more. Teams not being empowered to go beyond their silo is both a structural and a leadership issue.
Mobile represents 65% of traffic on LinkedIn. The best-performing content types on the platform are polls, carousels, text and image, text only, and videos. Polls get 2X the reach of the median post - they should include "Other" for a 25% increase in visibility. Carousels get 1.6X the reach of text and image posts - the ideal number of slides is 12.4. This post includes additional findings and a link to the source report.
Mimecast and Barracuda are top-ranked email security products that were both founded in 2003. Both brands invested a significant amount of money in paid advertising during the early 2020s, but their PPC strategies have since diverged. Mimecast appears to have shifted its investment into organic content to help boost its brand and solidify its organic position in the SERPs. Barracuda is still investing just under seven figures each month in paid advertising traffic to increase visibility in the SERPs. Neither strategy is necessarily better — it depends on which one has a better conversion rate on this incoming traffic.
Businesses implement customer service tiers to streamline assistance and address issues effectively. Tiers enable companies to route issues based on complexity to ensure skilled agents handle appropriate challenges. They enhance both agent expertise and customer satisfaction. This article provides examples of tiers and how to approach each one for the best customer experience.
Marketing is a strategic full-funnel function. Getting a seat at the table starts with leaders taking accountability for every revenue problem and empowering their teams to feel that way too.
Advertisers are adjusting their strategies to focus on online and social media platforms as Gen Z’s interest declines in traditional Super Bowl ads. They are leveraging influencer partnerships and social media campaigns to engage this demographic beyond traditional TV commercials.
Some of your site visitors will end up buying from your competitors. If you don’t have a strategy for winning in spite of competitors, you are at a disadvantage.
Aha! transitioned JavaScript code into a monorepo to streamline development. Initially, the company used private npm packages for code reuse, but the process required them to make changes to private npm packages, which quickly slowed them down. Its team evaluated several tools to do the repo migration efficiently, ultimately choosing Turborepo in conjunction with pnpm. This setup maintained git history, simplified its codebase, and enhanced the development workflow without adding unnecessary complexity. The transition has led to significant time savings and reduced frustration for its engineering team.
A team was looking to optimize GraphQL query time and explored several options like pagination, reducing the number of nested queries, caching, filtering, and more. However, one approach was the most effective and reduced large GraphQL query time from 20 seconds to 1 second. They did this by optimizing SQL queries against the database and it’s very simple - instead of using SELECT *, specify the columns you want. This will reduce payload size and reduce database overfetching.
This article covers in-depth service testing, optimizing startup and shutdown, avoiding global state, handling common request types, and controlling the environment through flags, and environment variables. When writing HTTP services in Go, the author only uses one HTTP handler per service and relies on HTTP routes to divert traffic to the right handlers within each service. Functions are used as handlers and dependencies are passed as arguments.
The excessive complexity and size of modern software leads to vulnerabilities and security breaches. Okta, Microsoft, and Apple users have been hacked multiple times over the past few years due to the amount of code surface area available for hackers to exploit. A return to minimalistic yet functional software development practices can help reduce security issues in modern software.
After being laid off, this author had trouble finding a new job. He detailed all the ways he made himself open to new opportunities, utilizing LinkedIn, job ads, and specialized platforms. Throughout the process, he maintained meticulous tracking of applications and learned to navigate salary negotiations and technical assessments. The author details his entire journey from start to finish, with transparency and tips along the way.
Agile methodologies in corporate environments ("Corporate Agile") commonly have bloated processes and misplaced priorities, shown by excessive meetings and too many middle managers. A return to "Basic Agile," with an emphasis on principles over rigid processes, will allow teams to self-organize and adapt under uncertainty. Basic Agile done right has a focused, quick daily meeting to discuss potential blockers, short sprint planning sessions, and immediate issue resolution.
React Native is now available for developing applications for the Apple Vision Pro.
Hurl is a command line tool designed to execute HTTP requests specified in a straightforward plain text format. It offers features such as request chaining, value capturing, and query evaluation on response headers and bodies, making it suitable for both data retrieval and HTTP session testing. Hurl supports working with various types of APIs, including HTML, REST, SOAP, GraphQL, XML, and JSON.
Leo is a functional, statically typed programming language designed for creating private applications. It abstracts low-level cryptographic concepts, facilitating the integration of private apps into existing systems by compiling to circuits, making zero-knowledge proofs feasible. Leo offers developers tools for circuit sanity checks, including unit tests, integration tests, and console functions.
A system called "epitaphs" at a company this author worked at had entries for departed employees. The company’s employees also created their own system to track changes in the employee directory, allowing for insights into departures and other events. The author provides technical details for implementing similar systems which can be created informally at other companies to help employees have a better sense of layoffs and departures.
RSS (Really Simple Syndication) feeds are useful for consuming high-quality content with minimal noise. They are a good way to access thoughtful long-form content without the distractions often found on social media platforms. Despite some criticisms, such as a lack of discoverability and non-tech-savvy user-friendliness, RSS remains a valuable tool for content consumption due to its control, reduced low-value content, and just-in-time access to information. They are a relic of the “old web” in today’s algorithm-dominated world, but as AI floods algorithms, RSS may make a comeback.
Small optimizations can go a long way in improving performance. There are three categories of optimizations: architecture, algorithms and data structures, and source code. To find opportunities for small optimizations, one can use profiling applications and try utilizing things like hybrid algorithms.
Web development has an overwhelming number of frameworks and tooling available today, but that doesn’t necessarily mean it’s gotten more complex. It’s becoming easier to over-engineer web applications.
Hacker News commenters offer advice on sales, such as developing strong branding and understanding the client’s purchasing authority. They also suggest books like Never Split the Difference and Draw to Win.
Many organizations are moving their cloud-based workloads back to on-premises infrastructures due to security concerns, unmet expectations, and unexpected costs - 43% are finding cloud migration more expensive than anticipated.
Google has retired the Bard name and rebranded it to Gemini for the launch of Gemini Ultra, its most capable large language model yet. Gemini Ultra is available through a new $20 Google One tier that also includes 2TB of storage as well as the rest of Google One's feature set. The feature will work in Google Workspace apps. More information about API access for the Ultra model will be shared in the coming weeks.
2024.02.09·techcrunch.com·4 min read·TLDR SpaceX is using its drone ships, designed to act as landing pads for rockets, as gateway stations to bolster Starlink's cover at sea. The company applied for a temporary FCC license last month to test operating up to 12 earth station antennas over the drone ships. SpaceX hasn't revealed details about how the drone ships will serve as backhaul without dedicated fiber connections. The FCC is still weighing the application.
2024.02.09·pcmag.com·2 min read·TLDR Brilliant Labs' Frame smart glasses feature an integrated multimodal AI assistant. It lets users navigate and interact with the physical world with multimodal generative AI agents. The glasses use a wide range of AI models to answer questions. Frame has a front-facing sensor to capture images to answer questions, but it discards the data shortly after. It requires a smartphone with an internet connection to operate. A video introducing the device is available in the article.
2024.02.09·zdnet.com·4 min read·TLDR Low Latency Runtime (LLRT) is a JavaScript runtime designed to address the growing demand for fast and efficient Serverless applications. It offers up to over 10x faster startup and up to 2x overall lower cost compared to other JavaScript runtimes running on AWS Lambda. LLRT only supports a fraction of Node.js APIs and is not a drop-in replacement for Node.js. It conserves both CPU and memory resources by not incorporating a JIT compiler.
2024.02.09·github.com·GitHub repository·TLDR Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session. Microsoft has open-sourced the project and added the feature to the Windows 11 Insider Preview Build 26052. The feature currently supports three configuration options (In a new window, Input closed, and Inline) that can be set through a drop-down menu in the Settings page for the feature. A link to gsudom, an alternative implementation of sudo with additional functionality, is available.
2024.02.09·devblogs.microsoft.com·5 min read·TLDR OpenAI co-founder Sam Altman recently said that a one-person billion-dollar company may soon emerge. This will supposedly be made possible with AI tools as work could be outsourced to an army of artificial intelligence agents. The size of the distribution required, coupled with the ability of anyone to make anything with the same AI tools, makes the one-person billion-dollar company incredibly challenging if not impossible. There's a significant opportunity for ambitious people to build solo businesses in the $1-10 million ARR range, but after that, it's probably best to hire people to help grow anyway.
2024.02.09·every.to·13 min read·TLDR Gemini Advanced, recently rebranded from Bard Advanced, is a $19.99/month service (with a two-month free trial) available in 150 countries in English. It is multimodal and has data analysis capabilities and improved reasoning compared to Gemini Pro, the free version of the model. Gemini Advanced is a GPT-4 class model, but it doesn't obviously blow away GPT-4 in the benchmarks. It is better than GPT-4 in some cases, but GPT-4 is still more sophisticated about using code and accomplishes a number of hard verbal tasks better. Both models still fail and hallucinate at times.
2024.02.09·thealgorithmicbridge.substack.com·9 min read·TLDR This post shares learnings from working with distributed consensus in transactional databases.
2024.02.09·notes.eatonphil.com·15 min read·TLDR Ollama now has built-in compatibility with the OpenAI Chat Completion API.
2024.02.09·ollama.ai·4 min read·TLDR There's no point in worrying if we're living in a simulation.
2024.02.09·scottaaronson.blog·12 min read·TLDR