Search the archive

A FRIENDLY GUIDE TO FRONT-END DATE PICKERS

Simpler date selection methods are preferred over complex JavaScript date pickers due to better usability and accessibility.

TYPESCRIPT'S RISE IN THE AI ERA

TypeScript became the most-used language on GitHub in 2025, surpassing JavaScript and Python, with over a million new developers contributing (a 66% year-over-year increase).

LEARNING TO MODEL THE WORLD WITH LANGUAGE

Dynalang is an agent that learns to understand and uses multiple types of language by predicting future text, images, and rewards within a multimodal world model.

WHY EFFORT SCALES SUPERLINEARLY WITH THE PERCEIVED QUALITY OF CREATIVE WORK

Achieving higher perceived quality in creative work requires a disproportionately larger effort because the search space for acceptable refinements shrinks, verification latency increases, and the process involves a lot of exploration and exploitation.

Read more on the Metronome blog

THE FIRST $100,000,000 ARR AT DATADOG

It's hard to imagine what real customer focus looks like before a company has revenue, but Datadog built it in from the start. The founders spent six months interviewing users before writing code, opened betas so customers could self-select, and sold month to month to spot churn immediately. That approach scaled to 700 employees and $100 million ARR. Engineers still rotate through support, pricing talks double as product feedback, and leadership treats every complaint as a signal. The result is a culture designed to find bad news fast and fix it before it compounds.

FOUNDERS AND INVESTORS SLAM UK “EXIT TAX”

The UK government is considering a 20% “exit tax” on founders who build businesses in Britain but move abroad to avoid taxes. More than 150 entrepreneurs and investors - behind companies like Beamery, Cleo, and funds including Dawn Capital and 20VC - have pushed back, warning it would punish success and drive talent out. They say Britain already feels less competitive after capital gains hikes, and another tax like this could be the final push for many to leave.

STARTUP OPERATING PRINCIPLES

Sam Gerstenzang grew from a fine to a good operator in three and a half years of working at Stripe. This post shares how Stripe approaches decision-making and communication. Operating well is a state. Peak performance is a constant process of tweaking, iterating, and tuning.

STRATEGISM: MASTERING THE FOUNDER LETTER

In an era of formulaic marketing and AI-written content, the founder letter stands out as one of the few tools that still feels human. It works because it earns trust through story instead of shouting for attention - naming a problem, stirring emotion, and only then offering the solution. From Jason Fried's product launches to the plainspoken clarity of Jeff Bezos and Warren Buffett, the format proves that narrative still builds belief and conviction. Even small tests show it moves results: pages using a founder's voice convert higher because readers can tell when something was written by a person who actually means it.

HOW TO ACTUALLY RAISE YOUR ROUND

Genomines' founder spent 14 months doing exactly the same thing: he pitched the same company over hundreds of conversations, facing the same objections and polite rejections. Then he closed $45 million from 12 funds. This post looks at what it really takes to raise a round. It's a messy and non-linear process.

Claim your offer today

KARUMI

The first agentic product demo platform where prospects receive personalized demos, in a video call, instantly.

GENERATECH AI

Generatech AI is an all-in-one dashboard that gives users access to the latest AI models worldwide through a single subscription.

CONTEXT

Context is an AI-powered office suite that generates docs, slides, and spreadsheets using your data, tools, and preferences.

THE COMPANY AS A MACHINE FOR DOING STUFF

Companies are machines for doing the stuff a founder really wants to do, but bigger. The company is a vehicle to accomplish a goal that would otherwise be impossible alone. Many founders have found wealth, yet they reinvest it to reach further. Many people work for the fruit - it is rare to find people who work for the work itself.

THE COMPOUNDING STARTUP

An analysis of 6,525 software companies revealed that outliers and "normies" had nearly identical metrics at $1M ARR (the top 25% of failures actually grew faster than half the eventual winners). The difference emerged in relentless operational improvement: 86% of outliers increased expansion revenue by 10%+, 72% boosted ARPA significantly, and 51% improved retention - all while “normies” stayed mostly flat. The compound effect is staggering as a 50% improvement in pricing for new customers doubled annual growth rates from 11% to 24%, while combining better pricing and retention took growth "off the charts."

SOFTWARE IS THE NEW ART FORM

Just as furniture, fashion, and food progressed from essentialist basics to art forms that make you feel something, software is speedrunning the same transformation. The frontier is now defined by software that either expands what's possible or makes you feel - and occasionally does both.

COMPOUNDING OFFDEAL

Investment banking is a system that can be deconstructed, measured, and optimized, something software engineers are uniquely positioned to do exceptionally well.

WHEN WORK STOPPED BEING A PLACE

Remote work gave us flexibility, but killed the "learning by osmosis" that happened when juniors could watch seniors read a room, make tough calls, or answer dumb questions during a coffee break.

OPTIMIZING THE LANDING PAGE

Tweaking and obsessing over your conversion rates won't save you if the wrong people are showing up.

QUANTUM ROUTE REDIRECT PHAAS TARGETS MICROSOFT 365 USERS WORLDWIDE

The Quantum Route Redirect phishing-as-a-service platform leverages ~1,000 pre-configured domains with automated bot filtering to steal Microsoft 365 credentials across 90 countries (76% US-targeted), using specific URL patterns matching "/([\w\d-]+.){2}[\w]{,3}/quantum.php/" and hosting on legitimate compromised domains to evade detection. The platform redirects humans to credential-harvesting pages while sending security scanning tools to benign sites. Security teams should implement URL filtering that targets the identified pattern, deploy account compromise monitoring, and recognize phishing lures that mimic DocuSign, payment notifications, and QR codes. Quantum Route Redirect represents an evolution in PhaaS sophistication similar to VoidProxy and Tycoon2FA campaigns.

HITACHI-OWNED GLOBALLOGIC ADMITS DATA STOLEN ON 10K CURRENT AND FORMER STAFF

GlobalLogic, owned by Hitachi, suffered a significant data breach that exposed the personal and financial data of over 10,000 current and former staff members. The attack, attributed to the Clop ransomware group, exploited vulnerabilities in the Oracle E-Business Suite. Clop focuses on stealing and leaking data while pressuring victims for payment. Oracle has issued emergency patches to counter these attacks.

HACKERS EXPLOIT TRIOFOX ZERO-DAY TO DEPLOY MALICIOUS PAYLOADS USING ANTI-VIRUS FEATURE

Researchers from Mandiant discovered a critical zero-day in Gladinet's Triofox file-sharing platform. The vulnerability allowed unauthenticated attackers to login to the platform by changing the HTTP host header to localhost. The attackers then configured the anti-virus scanner path to a malicious batch script.

HOW GLASSWORM WORMED ITS WAY BACK INTO DEVELOPERS' CODE — AND WHAT IT SAYS ABOUT OPEN SOURCE SECURITY

The GlassWorm self-propagating worm resurfaced two weeks after eradication, infecting three new OpenVSX VS Code extensions (with over 10,000 downloads) and GitHub repositories using invisible Unicode characters and a blockchain-based C2 infrastructure, with victims including global enterprises and Middle Eastern government entities. The Russia-based attack steals GitHub credentials, pushes malicious AI-generated commits appearing as legitimate code changes, and exploits OpenVSX's lack of manual code review resources. Security teams should whitelist only trusted extension publishers, disable auto-updates, monitor for credential harvesting and abnormal outbound connections, and treat developer toolchains with the same security rigor as production infrastructure, as automated scanning alone cannot reliably stop these supply chain attacks.

TIPS FOR RELIABLE SPLIT-SECOND DNS REBINDING IN CHROME AND SAFARI

DNS rebinding attacks occur when an attacker can trick a victim into leaking data by having the victim first communicate with the attacker's public server and then switching the DNS record to point to a private server. In Safari, a private IP address will be prioritized over a public IP address, but an attacker can circumvent this by delaying the DNS response with the private IP address. In Chrome, IPv6 will be prioritized over IPv4, allowing an attacker to send an IPv6 response with a public IP address and then an IPv4 response with a private IP address. In both cases, the attacker blocks the user from their server after connection, forcing the browser to rebind to the private IP.

NO PLACE LIKE LOCALHOST: UNAUTHENTICATED REMOTE ACCESS VIA TRIOFOX VULNERABILITY CVE-2025-12480

Mandiant has uncovered a significant security flaw in the Triofox file-sharing platform (tracked as CVE-2025-12480), which allows attackers to bypass authentication by manipulating the Host header to impersonate “localhost.” This gave unauthorized access to critical admin configuration pages, enabling the creation of privileged accounts. Attackers can exploit this to upload and execute arbitrary files, abusing Triofox's anti-virus feature to run malicious scripts with high privileges. The vulnerability is now patched, but organizations using Triofox should urgently update, check for rogue admin accounts, audit anti-virus configuration, and monitor for unusual administrator and SSH activity.

and more. Get a free demo

FLARE (PRODUCT LAUNCH)

Flare provides a threat exposure management platform that uses intelligence from the clear and dark web to help organizations prevent ransomware, data breaches, and other incidents, leveraging AI and machine learning for tailored cybersecurity insights and credential exposure detection.

UNIX-LIKE ARTIFACTS COLLECTOR

Unix-like Artifacts Collector (UAC) is a tool that automates the collection of forensics artifacts from a wide range of Unix-like systems.

AWESOME ANNUAL SECURITY REPORTS

A curated list of annual cybersecurity reports.

EUROPEAN COMMISSION MOVES TO LOOSEN GDPR FOR AI AND COOKIE TRACKING

The EU's leaked "Digital Omnibus" proposal would shift cookie tracking from opt-in to opt-out by moving regulation from ePrivacy Directive to GDPR, explicitly permit AI training on personal data under "legitimate interest" without consent, and narrow sensitive data protections to only data that directly reveals protected characteristics. Companies would no longer need consent management for most cookies, but must document legitimate interest justifications, while privacy advocates warn this fundamentally weakens GDPR's core protections. Security professionals should prepare for the November 19 formal unveiling by reviewing data processing practices, documenting AI training justifications, and reassessing compliance frameworks for the shift from explicit consent to legitimate interest models.

APT37 HACKERS ABUSE GOOGLE FIND HUB IN ANDROID DATA-WIPING ATTACKS

North Korean APT37/KONNI actors are targeting South Koreans via KakaoTalk spear-phishing with digitally-signed MSI files that deploy AutoIT scripts which establish persistence, deliver RemcosRAT/QuasarRAT/RftRAT, and steal Google/Naver credentials to access Find Hub for GPS tracking and remote Android device wiping. The attackers are exploiting stolen credentials to execute factory resets three times, preventing recovery, use GPS data to time attacks when victims are outside, then hijack compromised KakaoTalk PC sessions to spread malware laterally through contacts. Organizations should enforce MFA on Google accounts, verify messenger file senders via direct calls before opening attachments, and maintain accessible recovery accounts. This attack abuses legitimate Find Hub features rather than exploiting vulnerabilities.

OLLAMA, NVIDIA FLAWS PUT AI INFRASTRUCTURE AT RISK

Security researchers have uncovered critical vulnerabilities in Ollama and NVIDIA Triton Inference Server that could allow for remote code execution, exposing companies to significant risks in their AI infrastructure. These flaws, now fixed, reflect a shift in AI security research from attacking models to probing the underlying infrastructure.

THE "NOVEL TURING TEST" DETECTS AI WITH UP TO 80% ACCURACY

A computational Turing test achieves 70-80% accuracy in detecting AI-generated social media content by analyzing affective language patterns.

OWASP TOP 10

Updated list of the OWASP Top 10 that adds two new categories, consolidates SSRF into Broken Access Control, and expands supply chain scope.

SYNOLOGY FIXES BEESTATION ZERO-DAYS DEMOED AT PWN2OWN IRELAND

Synology urgently patched CVE-2025-12686, requiring immediate upgrade to BeeStation OS 1.3.2-65648, as no mitigations are available.

Watch on-demand →

TIKTOK SHOP REACHES EBAY SALES VOLUME DESPITE REGULATORY HEADWINDS

TikTok Shop reached $19 billion in global quarterly sales, matching eBay's volume, as its US market grew 125% quarter-over-quarter despite regulatory pressure. The platform's rapid growth stems from its “discovery e-commerce” model, where 83% of shoppers find new products and 70% find new brands through shoppable videos and livestreams. Livestream shopping remains limited in the US, accounting for only 2% of traffic, although livestream sessions rose 72% year-over-year in September. Southeast Asia continues to outperform the US in adoption, while over 171,000 small businesses now sell on TikTok Shop as it tightens merchant vetting and expands across key retail categories.

SMALL BUSINESS OPTIMISM TAKES A SMALL STEP BACK AS UNCERTAINTY EASES IN OCTOBER

Small business optimism fell slightly last month, with the NFIB Index dropping 0.6 points to 98.2 as owners reported lower sales and declining profits. Hiring remains difficult, with 32% of firms unable to fill job openings and 27% citing labor quality as their top problem. Inflation, supply chain issues, and rising costs continue to challenge businesses, though fewer cited financing or insurance as major problems.

FAQ PAGES ARE COOLER THAN EVER

Adding FAQ sections to Webflow's template pages drove large traffic growth, especially from non-branded queries. Treated pages saw up to 8% lift while non-FAQ pages declined. FAQs captured high-intent, long-tail searches like “template website free” and increased AI search engagement. Clear and structured content can outperform traditional SEO tactics, making FAQs a powerful tool for discoverability.

THE GROWTH STRATEGY MOST STARTUPS OVERLOOK: ENGINEERING-AS-MARKETING

Engineering-as-Marketing turns product or engineering time into a growth engine by creating free tools that attract and convert users through usefulness instead of promotion. It builds trust and organic reach by giving value upfront, leading to long-term traffic and compounding returns that paid ads cannot match. Examples like HubSpot's Website Grader, Shopify's Hatchful, and Ahrefs' free SEO tools show how offering helpful resources drives leads, backlinks, and brand awareness. Startups can apply this by building small, practical tools that solve real problems, launching them strategically, and optimizing for SEO to generate lasting growth.

HORSE

Horse Browser replaces tabs with a “Trails” system that organizes every link you open into a clear path in the sidebar. It helps users stay focused by tracking browsing history, bookmarks, and notes in one place. The browser includes ad blocking, a password manager, and dark mode. It aims to make web research more organized and less cluttered.

WHEN AI GUIDES THE SHOPPING JOURNEY

About 40% of US consumers now use AI for shopping. Over 70% say AI anticipates their needs, 85% find its recommendations personalized, and 83% say it makes shopping more enjoyable. While AI helps people compare products and make decisions faster, 95% of shoppers still take extra steps to confirm what it suggests, showing a clear trust gap. Brands must prioritize accuracy, clear sourcing, and human validation to maintain confidence throughout the AI-shaped shopping journey.

TURN EVERY EVENT INTO A GROWTH ENGINE WITH LINKEDIN EVENTS

LinkedIn introduced new enhancements to LinkedIn Events to help B2B marketers prove ROI, scale events efficiently, and reach the right audiences. Marketers using Event Ads see up to 31x more viewership, and brands such as Impact.com have doubled attendance. New integrations with ON24, Cvent, and Integrate allow event data, lead generation, and CRM connections to flow seamlessly for better targeting and measurement.