cddotdotslash

My best guess is that it's referring to a bunch of VC-backed companies who all buy one another's products to both get a customer testimonial for their website and juice the ARR numbers. Whether that's actually happening at significant scale is conjecture; I'm just interpreting the parent comment.

I started a side project turned bootstrapped B2B SaaS that was eventually acquired, so I can share a bit of what I learned. Some day I’ll write up a longer list of lessons.

Security - complexity will absolutely kill you. I know it’s fun to experiment with Kubernetes and multi-region infrastructure deployments, but that does nothing but increase your attack surface. When we were acquired, I had a single static website hosted on AWS S3, one RDS database, and a handful of Lambda functions behind an API Gateway. You still need to follow best practices: use TLS for all connections, encrypt customer data, properly segment application users, OWASP top 10, etc. but that’s much easier to do with a simple application. Minimize application dependencies, scan them for venerabilities using free tools like Snyk, and keep things up to date.

Compliance: Depending on your domain, you may need to get a SOC II report at some point. Don’t do it until you need it, but when you do, just pay a company like Secureframe (full disclosure: I’m an advisor for them, but there are other similar companies).

Single Sign On: we used Auth0, which was great until we reached 10(?) enterprise connectors and it went from free to $15k/yr. We then migrated to AWS Cognito. If I did it again, I’d just use Cognito to begin with, but wouldn’t build the integration until you actually have customers asking for it.

Marketing: my weaker spot. I was a developer, so had a skeptical view of marketing. We tried a lot of things (agencies, paywalled content, contract writers, etc). I’m still convinced that the highest impact marketing was deeply technical content (doesn’t even need to be about the product, just the same problem space) that was published on our blog for free with a link at the bottom to our product. Simple and effective. Reddit ads on niche subreddits were helpful, especially with getting early users. Marketing agencies are probably overkill until you’ve got actual PMF.

Sales: you need to do the selling. Don’t hire a salesperson until you’ve got a significant number of users. “But I won’t have time to develop if I’m selling.” Yes, exactly. And you won’t have anyone buying if you spend all your time developing and not talking to users. It’s critical that you personally talk to every user as much as possible.

Pricing: I made the mistake of underpricing the product for a long time. I thought developers would love the low cost model. In reality, their companies were paying, and, when you give someone a company credit card, they’re a bit more willing to pay more for a good product. You can still price lower than the competition to get users in the door, but don’t try to be the bargain app. Monthly subscriptions are good, annual are better, but bring tougher sales cycles (enterprises will want to negotiate the contract, add their own legal terms, etc).

It’s a bit tough to give much more advice without knowing what domain you’re operating in, but hopefully that was helpful!

The readership of this site is for some reason primed to immediately surface negative feedback for almost anything creative that gets posted. It happens for basically every “Show HN.”

I wrote one about a year ago for a company that was in a space in which I have experience and who found me via a mutual contact. They paid me $5,000 for a 3,000 word whitepaper. Ultimately, it took me about 40 hours of work, between the initial meeting, emails, research, writing, and later updates (so about $125/hr). I probably wouldn't do it again, as it was more time consuming than I planned, but I did learn quite a bit about a niche topic.

I'm working on SourceShield (https://sourceshield.io) - a software supply chain security platform that's fully integrated into developer workflows/tooling (GitHub, AWS, etc.). I just started working on it a few weeks ago, so it's more of a set of tools/PoCs at this point. I'm focusing less on dependency security (which is quite a saturated market - think products like Snyk) and more on the other components of the supply chain: SCM, pipelines, build tooling, integrity validation, etc.

I block people on LinkedIn or report them as spam on Gmail if I get more than 3 unsolicited messages. 7 just feels borderline ridiculous.

I've bootstrapped a side project before (in the B2B security space) which was later acquired. I had a _lot_ of ups and downs, but the "up" that consistently outweighed the downs was getting a new user and seeing them convert from free/trial to paid. There is something incredibly tangible and rewarding about seeing MRR increase.

Because of this, I approach side projects from the perspective of getting to revenue as quickly as possible, as opposed to, for example, hacking away at something just for fun or learning something new. Those are entirely valid reasons to start side projects, but I personally don't get the same motivation from them and have found myself quickly getting bored.

My personal preference is to focus on SMB/mid-size B2B SaaS with the goal of eventually replacing full-time job income. For me, consumer SaaS is too small - you're making $5-$20/month/user and therefore need 100s or 1000s of users to reach that goal. Enterprise SaaS is too difficult for a side project (sales cycles are too long/complex). Most mid-size companies are willing to pay a few hundred/month for a good service. As an example, if I can charge $300/month, I only need 50 customers to generate the equivalent income of a decent-paying tech job. The challenge, of course, is finding an idea that meets those requirements!

TikTok is also suspiciously missing.

Decision makers at companies need to start calling this behavior out to companies. "Oh, I saw you were #1 on CIOReview's 'Top 10 Solution Providers 2020' list, did you pay for that?"

I cannot fathom how easy it is for these sham "award" companies to make money; it seems every security startup has at least 3 or 4 of them plastered on their home pages. But it begs the question: how did CIOReview and similar companies become so popular (or trusted?) to the point where a feature on their website is _worth_ $3000?

Gah, seems I missed one of the most load bearing words in the title!

That being said, I’ve worked with, and hired folks who had startups that fizzled out and they didn’t seem to feel that they were at a disadvantage. As a hiring manager now, I’d certainly view any founder experience positively (although I’m admittedly biased).

Anecdotal, but I did not experience this at all. I bootstrapped a B2B SaaS company to exit, worked for the acquiring company for two years, and then applied to (and got offers from) ~5 companies in the startup and FAANG-adjacent space. Not a single one seemed to consider my experience negatively. In fact, most commented on it positively and it seemed to help make the initial phone screen rounds go quite well (recruiters and hiring managers were really drawn to asking about my experience as a founder).

I mean… it’s the state that implemented this law. So we’re not talking about Montana or something here.

It does make me wonder whether we’re headed towards some kind of “breach via chaos” scenario. Clearly the attackers have the cell phone numbers of employees. Suppose they started mass texting conflicting information? It’d be noisy as hell, but take 1000s of employees getting a never ending stream of texts, purporting to be from their employer, saying “don’t use Slack,” “don’t use email,” “here’s a Zoom bridge for incident response,” “oh and here’s an MFA notification you should accept.”

This could lead to a scenario where no one knows what to believe, internal systems are down, attackers are setting up fake IR channels to get even more info, etc. There’s no way most companies could weather an onslaught like that.

They could be fake, of course, but this thread[1] of screenshots is pretty bad... internal tools, Slack Admin, Google Workspace admin, an AWS account showing admin permissions.

[1] https://twitter.com/Savitar0x01/status/1570580235716014081

I think you might be on to something here, but not for the reasons you think.

VCs are constantly scanning GitHub these days to find open source projects and new tools (ones that might evolve into SaaS products or ones that might indicate a trending product area). IMO, you should charge for _that_ type of feature - maybe a weekly newsletter that summarizes all of the trending repos from the past week for a certain keyword.

To be fair, it’s likely due to European regulations that a US newspaper has about zero interest in complying with, or even bothering to pay a lawyer to figure out.

Return to Office

> Most of these doctors would encourage the staff/volunteers who do the billing to put as many relevant billing codes as possible in the system

Is there any way to fight back against this? I've personally experienced getting a bill after a routine office visit with tons of charges I didn't recognize and procedures they absolutely did not perform. In some cases, it equates to $0 after my insurance pays, but in others it results in quite a bit of extra expenses (especially since I'm on a HDHP).

The article literally says that they use pre-roll ads to avoid disruption.

Every review I’ve left that’s under 5 stars has been rejected for trivial technical reasons. I received a trash can that was heavily scratched and with poor quality hinges. Review rejected because it contained references to “issues that might have occurred during shipping.”

Every product on the site seems to be rated 4.5+, which makes sense if they’re rejecting reviews in this way.

This is neat! Small (I guess it’s a bug?): in NYC it lists Bellevue Hospital on 1st Ave in Manhattan as a “space,” which I guess technically it is, but I’m not sure they want you working from the lobby of the hospital.

Except no company is going to give you the equivalent of 4 years of salary upfront. That’s the part you’re missing; companies that give 4-year RSU grants are effectively giving you an (illiquid) advance on your pay that grows until you vest and cash out.

This is a helpful writeup in terms of specific queries to look out for, but any RCE on a host with privileged IAM access is going to lead to this scenario.

> The AWS account takeover was possible because a highly privileged IAM role had been assigned to the EC2 instance running the vulnerable Docker container app

This attack isn't unique to Log4Shell; it's a symptom of giving your (compromised) EC2 instance global admin access.

Interesting! Feels similar to CloudQuery[1] which is also open source.

[1] https://www.cloudquery.io/

Stripe | Cloud Security Engineer | Remote (US/Canada) | Full-time

The Cloud Security team defines security primitives and guardrails to allow our colleagues to quickly and confidently build for Stripe’s users. Our scope includes cloud security architecture, data-driven definition of security baselines, centralized controls, and strategic direction of security efforts for our cloud environment.

Our team is working on some really interesting and cross-cutting projects! Recently, we've been exploring AWS SCPs to enforce proper service usage across our fleet of accounts, writing detections to flag misconfigured cloud resources, and integrating Terraform scanning tools in our CI/CD pipelines to prevent those misconfigurations in the first place.

We have two roles open: Software Engineer[0] and Staff Engineer. These roles do require software development experience.

Applying: If you're interested, please apply directly via the links below (you can also email me at "fuller" @ [company name] so I can tag your application internally). I'm happy to answer questions via email as well (I am the hiring manager for these roles).

[0] Note: The Software Engineer, Security role is a generalist role in which you'd be considered across multiple teams (including Cloud Security). You can discuss your preferences with the recruiter during the initial call.

Links:

Staff Engineer: https://stripe.com/jobs/listing/staff-engineer-cloud-securit...

Software Engineer: https://stripe.com/jobs/listing/backend-engineer-security-in...

Tags: cloud, security, infrastructure, AWS

I think they missed the hype train for this one. Anecdotal, but every person I know who used Clubhouse during the height of the pandemic has completely or nearly completely stopped using it in favor of outside or in-person socialization now.

It seems that this is a difficult problem to solve. These kinds of tools don't provide a lot of value unless they have a significant portion of your financial picture. Providing that picture takes a lot of manual data entry. I suppose it could ask more generic questions first (e.g., "enter total cash," "enter total investments," etc.) but that wouldn't be very accurate.

No, they weren't. The ads listing that were clearly in on the joke (evidenced by the fact that the companies responded directly to the original joke Tweet).

How does ordering via QR code change the quality of the food itself? Just because you clicked a button to order the food instead of telling a server what you want who then wrote it in a notebook and went back to a terminal to enter it, should not have any bearing on how the food tastes.

Turning on Google phone screen (if you're on Android) has been helpful for me. It doesn't block everything, but a decent number of spam calls get picked up by the Google bot and then hang up.