Search the archive

YOUR EASIEST GO-TO AVATAR TOOL

Humva provides free customized spokesperson videos and thousands of video presenters for social media content, testimonials, product introductions, and more.

TURN COMPLEX DATA INTO PRESENTATIONS

Presenton is an AI buddy that turns reports, data, insights, analytics, and all the boring, confusing stuff into simplified, fun, and interactive presentations in just a few clicks.

NEW YORK CITY FC DEBUTS NEW IDENTITY BY GRETEL

New York City FC has revealed a refreshed identity designed by Gretel that aims to capture the city's eclectic spirit and the club's passion for soccer. The new visual identity features a refined badge, a custom typeface inspired by the New York City subway, and an electric color palette.

HOW DESIGNERS AND BRANDS ARE MORPHING THE NEXT ERA OF MOTION DESIGN

Our consumption of culture is driven by constant motion across various screens, and motion design reflects this behavior. Once meditative, motion design now defines brand identity through dynamic elements. The rise in motion design demands scalable, efficient solutions that balance creativity and guidelines. Designers and clients navigate this evolving field with mutual respect for creative processes.

WHY GOOD DESIGN COMES FROM BAD DESIGN

Discovering his passion for design at Carnegie Mellon, a former Computer Science student realized the value of iteration. Initially embarrassed by bad ideas, he learned that exploring alternatives leads to better solutions. Emphasizing process and revisions, he highlights that even renowned creators like Hemingway and Einstein embraced imperfect drafts to achieve excellence.

PLEASE DON'T FORCE DARK MODE

Forcing dark mode can cause discomfort due to high contrast ratios - users should have the option to choose their preferred mode.

THE NEW JACK DANIELS BOTTLE DESIGN IS LEAVING A BAD TASTE FOR SOME

Radical packaging changes can confuse customers, as seen with brands like Bahlsen and Tropicana.

FOUR NOKIA DESIGNS THAT NEVER BECAME A REALITY

The Nokia Design Archive, now at Helsinki's Aalto University, offers over 700 curated artifacts and 20,000 items, including designs never made public.

THE FIVE EXECUTIVE ORDERS YOU NEED TO KNOW

Trump's first-day executive orders - attempting to end birthright citizenship despite constitutional protections, reviving Schedule F to enable civil service dismissals, pardoning January 6 rioters, and launching investigations into the Biden administration - signal major policy shifts. While some orders face clear legal hurdles, others, like Schedule F, create tools whose impact depends on implementation. This piece examines how each order tests different aspects of democratic institutions.

WHAT DEEPSEEK'S MODEL MEANS FOR AI

DeepSeek's new open-weights R1 model, trained on a modest budget, points to an emerging split in AI development: high-speed models for immediate tasks versus research models for complex reasoning. Download data shows strong market interest in both approaches. AI is bifurcating between quick, lightweight models and more deliberate thinking engines, with each serving distinct use cases.

FINDING PURPOSE

In 1958, Hunter S. Thompson wrote a profound response to a friend seeking life advice. Rather than pursuing fixed goals that shift as we grow, he argues we should strive to be ourselves by choosing paths that maximize our abilities and desires. The letter emphasizes that the journey matters more than the destination - "look for a way of life" instead of specific goals. When standard options feel limiting, Thompson urges, "you must find a ninth path."

$500 FOR ONE COLOR?!

RemoteOK has turned job postings into a money machine through smart upsells. Companies willingly pay $500 for custom colors and highlighted listings to stand out in a crowded market. The strategy works by preselecting premium options and using loss aversion - unselecting features triggers warnings about missed opportunities. Average revenue per job post "skyrocketed" after RemoteOK implemented these psychology-driven pricing tactics.

WHAT WE LEARNED ABOUT AI FROM 7 ACTIVE STARTUP INVESTORS THIS YEAR

AI companies saw a significant funding increase totaling $99.6 billion in 2024. With a focus on both foundation models and applied AI sectors, investors are increasingly interested in AI applications with impactful sector-specific benefits, moving beyond mere infrastructure investments. While AI funding is up, experts anticipate a decade-long maturation period for AI's full potential in transforming software development and business processes.

DAVID SENRA'S IDEAS FROM THE GREATEST FOUNDERS IN HISTORY

David Senra from Founders Podcast shares key insights from studying prominent founders. Key maxims include focusing on service, exploiting earned secrets, and leveraging information. Successful founders emphasize intense focus, problem-solving, and harnessing the power of relationships and simplicity.

SOUTH PARK COMMONS FOUNDER FELLOWSHIP (FUNDING & FELLOWSHIP)

Fellowship for founders in -1 to 0: pre-revenue, pre-product, or even pre-idea.

PMF METHOD (RETREAT)

A free, intensive 4-day experience for B2B founders early in building epic companies by First Round.

SWALLOW

Build, test, and deploy pricing models with AI.

THE MOST POWERFUL TAX BREAK IN AMERICA

QSBS tax exemptions let startup founders, employees, and investors pay zero federal taxes on up to $10M in gains or 10x their initial investment. This piece details key requirements like holding shares for 5 years and having less than $50M in assets, while revealing how founders use trusts and gifting strategies to multiply their exemption beyond the base $10M limit. One founder managed to shield over $100M using these techniques.

HOW WE MAKE MONEY HERE

Most employees don't understand their company's revenue model, creating misaligned decisions across teams. This article outlines a framework for explaining business models on day one: who pays, what they pay, when they get paid, market size, and future opportunities. Engineers react differently when they learn they're working on products generating millions in revenue - knowledge breeds motivation and agency.

BENCH TO BE ACQUIRED AFTER ABRUPTLY SHUTTING DOWN

Bench, an accounting startup, was acquired by Employer.com after suddenly shutting down, leaving many customers locked out. Employer.com plans to revive Bench's platform, allowing customers access to their data and the option to continue service. The acquisition ensures Bench's service continuity and includes plans to rehire some employees.

BLINDSPOTS

Founders often can't see their own limiting behaviors, even when pointed out by well-meaning advisors.

QUESTIONS FOR VCS

Most founders waste the opportunity to interrogate potential investors deeply.

ON HOTKEY STARTUPS

A new breed of companies eliminates artificial interfaces rather than improving them.

Download the Gartner report from SUSE →

BITBUCKET SERVICES “HARD DOWN” DUE TO MAJOR WORLDWIDE OUTAGE

Atlassian reported a major outage affecting Atlassian Bitbucket Cloud customers. Impacted services included the website, API, git via HTTPS and SSH, Webhooks, source downloads, pipelines, git LFS, email delivery, purchasing and licensing, and signup. Bitbucket has managed to restore services and disclosed that the issue was due to saturated database connections. A full postmortem will be published.

7-ZIP FIXES BUG THAT BYPASSES WINDOWS MOTW SECURITY WARNINGS

7-Zip has released a patch for a vulnerability that could allow maliciously crafted archives to bypass Windows MotW protection. Mark of the Web (MotW) is a flag that alerts users and the operating system that a file may have come from an untrusted source and prompts for permission before running. In this vulnerability, 7-Zip failed to propagate the MotW from the archive to the extracted files.

WINDOWS BITLOCKER - SCREWED WITHOUT A SCREWDRIVER

This blog post discusses how to exploit a vulnerability in BitLocker-encrypted Windows systems through a bootloader downgrade and Secure Boot bypass. By downgrading the bootloader, attackers can gain full read/write access to the encrypted disk without changing the target system. The exploit highlights the importance of Secure Boot and the potential risks associated with default BitLocker configurations.

UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

Archive Path Traversal is a vulnerability that can occur when extracting an archive file if the implementation does not properly check that filename sequences don't exit the archive (ex: ../../evil). An intern at Doyensec created a project that provides Semgrep rules as well as a playground with various malicious archive files and vulnerable implementations to demonstrate this vulnerability. The post concludes by discussing path sanitization and path validation as possible mitigations.

UNIQUE 0-CLICK DEANONYMIZATION ATTACK TARGETING SIGNAL, DISCORD, AND HUNDREDS OF PLATFORMS

An attacker discovered a method to find a person's location within a 250-mile radius through a unique 0-click deanonymization attack on platforms like Signal and Discord. By exploiting Cloudflare caching, the attacker could pinpoint a target's location by causing them to load a resource that gets cached in a local datacenter. While Cloudflare patched the bug, the attack shows how infrastructure designed for performance can be used for tracking, highlighting ongoing risks for users.

SUMMITING THE PYRAMID: BRING THE PAIN WITH ROBUST AND ACCURATE DETECTION

Summiting the Pyramid introduces a methodology to score analytics for robust detection against adversary behavior, aiming to make it harder for adversaries to hide. The framework helps defenders build accurate and resistant detections using a combination of specificity and exclusion criteria. It also provides guidance on creating robust detections for both host-based and network data.

EVILKNIEVELNOVNC

EvilKnievelnoVNC can be used for scalable and semi-automated MFA-phishing through a "browser-in-the-middle" approach. It includes features like concurrent sessions, victim-specific URLs, and real-time monitoring. Users are advised to use the tool responsibly, customize settings, and conduct tests before usage.

CYBERBRO (WEB APP)

Cyberbro is a user-friendly application for checking the reputation of online observables like IP addresses and URLs. It integrates with multiple services like VirusTotal and Google Safe Browsing to provide detailed reports efficiently. Users can easily deploy Cyberbro using Docker and customize it with API keys from different services.

GLIBC_HEAP_EXPLOITATION_TRAINING

This GitHub repository offers resources for a glibc Malloc heap exploitation course by Maxwell Dulin and Security Innovation. It includes free videos, slides, and exercises for learning about heap exploitation. The training covers various techniques and modules.

3 TAKEAWAYS FROM RED TEAMING 100 GENERATIVE AI PRODUCTS

Microsoft founded its AI red team in 2018 to address the growing landscape of AI security and threats. Generative AI systems can be vulnerable to both existing/traditional security vulnerabilities as well as novel ones. Humans will be necessary to augment Generative AI systems with subject matter expertise, emotional intelligence, and cultural context. Both technical and nontechnical, defense-in-depth approaches will be necessary to protect Generative AI systems.

PRODUCT SECURITY BAD PRACTICES

A list from CISA of product security bad practices for software manufacturers with recommendations on how to fix the issues. The first set of product practices focuses on using memory-unsafe languages, usage of default or hardcoded credentials, usage of dependencies with critical vulnerabilities, and unsafe cryptography. The second set focuses on security practices such as supporting MFA and providing access to logs that would enable intrusion detection. The last set focuses on organizational practices such as having a VDP and publishing CVEs and EoL timelines.

MALICIOUS EXTENSIONS CIRCUMVENT GOOGLE'S REMOTE CODE BAN

This blog post discusses how malicious extensions found ways to hide their harmful functions in Chrome Web Store, despite Google's restrictions. Several extensions, like Phoenix Invicta and Sweet VPN, were discovered using obfuscated code and accessing sensitive data. Domain names associated with these malicious extensions were identified, hinting at potential spying and fraud activities.

CLOUDFLARE MITIGATED A RECORD BREAKING 5.6 TBPS DDOS ATTACK

Last October, Cloudflare mitigated a 5.6Tbps UDP-based DDoS attack from a 13k Mirai botnet that lasted 80 seconds.

MICROSOFT TEAMS VISHING ATTACKS TRICK EMPLOYEES INTO HANDING OVER REMOTE ACCESS

Ransomware groups are conducting sophisticated social engineering attacks by bombarding employees with spam emails and then posing as IT support on Microsoft Teams to trick them into granting remote access to their computers.

REDLINE, VIDAR, AND RACCOON MALWARE STOLE 1 BILLION PASSWORDS IN 2024

Over 1 billion passwords were stolen by malware in the past year, including commonly used weak passwords like "123456."

META LURES TIKTOK CREATORS WITH $5K BONUSES, CONTENT DEALS, FREE VERIFICATION

Meta is offering TikTok creators up to $5,000 in bonuses over three months for posting Reels on Instagram and Facebook. It is also granting select creators access to monetization programs, content deals, and a free one-year Meta Verified trial. Additionally, it is making changes to give Reels more prominence, like extending the maximum playtime for Reels up to three minutes and increasing their visibility.

THE BUSINESS OF TRADWIVES—AND WHY BRANDS KEEP WORKING WITH THEM

The "tradwife" trend on social media features women portraying traditional homemaker roles while monetizing through brand deals and personal ventures. Creators like Nara Smith and Hannah Neeleman have gained millions of followers by blending nostalgic domestic aesthetics with modern entrepreneurship. Critics highlight the privilege behind their curated lives and caution against unrealistic expectations and the cultural implications brands may unintentionally support.

STOP WRITING BRAND NEW WEEKLY NEWSLETTERS

The "Immortal Newsletter" strategy involves recycling 50% evergreen content while including 50% fresh insights. This approach increases engagement and open rates, reduces workload, and avoids subscriber complaints about repeat content. It's faster to produce and more efficient, as many subscribers miss your best content, making it a better alternative to constantly creating new content.

HOW TO TIME YOUR PRODUCT LAUNCH FOR MAXIMUM SUCCESS

Out of over 30,000 products launched annually, 95% fail due to poor timing. Research shows there are four timing scenarios based on firm coordination and stakeholder readiness. Antagonistic Timing, where both coordination and readiness are low, usually leads to failure due to misaligned product expectations. Synergistic Timing, with high coordination and readiness, maximizes chances of success. Flexible Timing occurs when stakeholders are ready, but firms lack coordination, requiring swift action to meet demand. Lastly, Inflexible Timing happens when firms are well-prepared but must invest heavily in educating and building trust among resistant stakeholders.

RESEARCH: AI PRODUCES BETTER SEO CONTENT

Using a hybrid approach of AI-generated and human-edited content improves SEO rankings while cutting costs and saving time. Research shows AI-assisted content outperforms human-only content in rankings, with 17 pages appearing in top search results daily compared to 2 for content created entirely by humans. This approach reduces labor costs by 91% and maintains similar readability and credibility. Companies can implement this by using tools like Ahrefs or Semrush to analyze keywords, training AI models on top-ranking content and ensuring human editing for tone and accuracy. The method is most effective for industries like IT and education, but may be applicable across sectors.

ALTERNATIVETO

AlternativeTo is a free web-based platform for discovering alternatives to apps and services. Recommendations are based on user votes and submissions. You can filter results by platform, features, and privacy preferences. Many options are free or open-source. The site is easy to use, requires no sign-ins, and doesn't collect personal data.

ULTIMATE LANDING PAGE GUIDE: HOW TO BUILD ONE + EXAMPLES

A high-performing landing page converts visitors into leads by targeting a single action, unlike websites or product pages, which serve broader purposes. Landing pages minimize distractions by eliminating navigation bars and focusing on persuasive, goal-oriented content, such as strong headlines and visuals. Tools like Instapage and Leadpages offer drag-and-drop simplicity for building pages, while A/B testing and heatmaps can help refine to improve performance based on how customers are interacting with it.

NEW DATA SUGGESTS AI PREFERS HIGH DA PUBLISHERS

A study by Ziff Davis shows that large language models like GPT prioritize data from authoritative, high-domain-authority (DA) publishers. Highly curated datasets, such as WebText and OpenWebText2, contain a higher concentration of URLs from these publishers. Companies like OpenAI have established partnerships with many high-DA publishers, such as News Corp and Vox Media, which align with the datasets used for training. To increase the likelihood of being included in AI-generated responses, brands should focus on securing links and mentions from high-DA publishers through digital PR and link-building strategies. However, content should prioritize engaging human readers, as machines are tools, not the ultimate audience.

DEBUNKING BLUE MONDAY: HOW A PR STUNT BECAME A GLOBAL MYTH

Blue Monday, often called the "most depressing day of the year", began as a marketing gimmick in 2005 by UK travel company Sky Travel to boost post-holiday sales. The campaign used a pseudo-scientific formula that combined variables like weather and debt to sell the idea that January was the perfect time for a getaway. Despite lacking scientific credibility, the concept resonated, becoming a cultural phenomenon that continues to captivate media and brands. For marketers, it highlights the power of creating a catchy narrative to create buzz.

AI MUSIC FOR BUSINESS: HOW TO GET STARTED

The high costs and licensing challenges kept custom tracks out of reach for most marketers until recently. Now, AI tools like Suno.ai and Udio make it more accessible, enabling marketers to produce original tracks for videos, ads, and podcasts in under two hours and for a much lower cost. Applications include creating customized jingles for specific campaigns, background music that matches brand tone, and even audio branding elements like signature sounds for app notifications.