the_bear
The result is that instead of building one app that works on all platforms, software companies need to build three apps: Web, iOS, and Android. I'm sympathetic to why most software companies (including my own) choose to just build a web app wrapped in a native wrapper. If a company does decide to build a totally separate iOS app, I dunno, it seems reasonable not to build support for every single niche feature that the web app has. I'm not sure I get the outrage here, especially since Google has a long track record of preferring web apps to native.
[1]The "reasons" primarily are that Apple refused to support PWAs, hamstrung mobile Safari, and refused to allow third-party browsers. So while it's true that native apps can offer a better experience than mobile web apps, that's mostly just because Apple artificially restricts web apps.
Even the things you named (brand reputation, goodwill, etc.) are prioritized by companies because they're upstream of shareholder value. Many companies have a float in the Pride parade, an employee volunteer day and post on social media about how they're reducing their carbon footprint. Most of those companies are doing those things because they believe they ultimately increase shareholder value, not because shareholders have decided to sacrifice money because they care more about other things.
For example, my brother and I co-own a smallish (~$5 million/year revenue) software business. We do care about money to some extent, but we regularly agree to do things that work against shareholder value because we also care about things other than money. With two people, it's easy for our values to be aligned on those other things.
With dozens or more shareholders, that's basically impossible. A publicly traded company couldn't realistically be like "hey shareholders, can we agree that we care a lot about this niche local political issue in the town the company was founded?" The more shareholders you have, the more the only commonality between them is "we want more money".
There are many family-owned businesses that are only in it for the money, but "family-owned" can be a proxy for "not very many shareholders" which at least opens the door for the company to have non-financial priorities.
Most of those contacts are probably random leads that got imported, not actual clients that would have uploaded their passport info, but it seems reasonable to think that a CRM of our size (which, again, is not very big) that served exclusively travel agents would have millions of actual "clients" with passport info. 1 million passports across 25k users would just be 40 per user. If you assume a typical trip is for a family of four, that would mean the average user has just booked 10 international trips ever which seems pretty low to me.
I want to reiterate that we're not travel-specific and we don't have a feature for capturing passport info, etc., so I'm really just commenting on the volume of records that might be impacted by something like this.
My understanding is that there's a thing called the "conduit exception" which basically says that if data is transiently passing through a channel and it's not being looked at, it's ok. But wherever the data lands must be HIPAA-compliant.
This seems crazy to me, but that's how it works I think. For example, if you encrypt PHI and store it in AWS without signing a BAA with them, that's a HIPAA violation, even though the data is encrypted and Amazon can't see it. But if you send encrypted data through AWS without actually storing it, that's fine.
Mail is specifically mentioned as a thing that qualifies for the conduit exception. I'm not totally clear why it isn't a HIPAA violation the moment it arrives at a destination (it's not in-transit at that point, and it's potentially not in the possession of the intended recipient either), but it seems pretty well accepted that it's not.
All that to say: I think encrypted email would still require a BAA because it's being stored, not just transmitted.
- BIMI (I hadn't heard of that before) which seems like a very minor thing to be calling "the future of email"
- AI might be easier to trick that humans
On that second point, here's the exact text:
> A person reading a suspicious email might notice that the sender’s domain has an extra character, or that something about the request feels off. An AI assistant scanning your inbox for items that need action may not slow down to check those things.
That seems wrong (AI should be better at this than the average human), but let's assume that assertion is correct. It then says "authentication is the safeguard that should stop it before it ever reaches your mailbox". Except then, a few paragraphs down, it says "A scammer with a convincing look-alike domain and a properly configured DMARC record will still pass sender authentication checks." Ok, so authentication isn't a solution to the stated problem at all (it does solve a different problem). And unless I'm missing something, no solution is proposed. No statement is made about what the future actually looks like.
Like you said, what is the point of this article?
It's extremely difficult to accurately identify which emails have health info and which ones don't (even something like a person's name or IP address could count depending on the context) so they just default to sending everything through their message center. No amount of email security could change that.
No, putting an explanation on the help article that this feature is only available to admins doesn't work. No one reads anything.
I can't speak to why Stripe's fraud protection is so expensive. Is it because they're a target? Or maybe because they realized people will pay for it (it seems valuable for something like ecommerce)? I dunno, but I can confidently say that as of ~5 years ago, it wasn't required by any regulation, and my business was perfectly fine without it.
Now we use Paddle, and they also try to sell us a bunch of stuff we don't need at ridiculous prices. We're just using them because we wanted a merchant of record (where they handle taxes and stuff), but no, I'm not going to pay a % of my revenue for basic dunning emails, fraud prevention, vague "optimizations" that "increase conversions" (lol no they don't), etc.
The first time we switched to Cloudflare which saved us. Even with Cloudflare, the DDoS attempts are still damaging (the site goes down, we use Cloudflare to block the endpoints they're targeting, they change endpoints, etc.) but manageable. Without Cloudflare or something like it, I think it's possible that we'd be out of business.
Unless you're a monopoly, I don't see how AI will lead to these massive cost savings everyone is hoping for.
There's no question that Paper is a better pure writing experience. If you're viewing Notion as just a note-taking app and nothing else, I think you're misunderstanding what it's for.
For starters, it's way easier to organize stuff in Notion than Paper. This is less a feature of Notion, and more of a terrible limitation of Paper. Paper was stuck with the "files within folders" model. Just the fact that Notion lets you control what shows up in the navigation sidebar was a huge time saver for me. And being able to create pages within pages within pages (which is very different from having sibling documents inside a folder) made it much more flexible for organizing everything.
But the real power of Notion is when you start to treat it as a database builder rather than a note-taking tool. Yes, it's useful for taking notes, but those notes are about something, and with tools like Paper, Obsidian, etc., the thing is always living somewhere else.
With Notion, I was able to make a database of projects and another database of tasks which linked to those projects. Each developer on my team has a custom dashboard showing just the tasks that are assigned to them and currently in-progress. I have a totally different view showing all the projects going on right now. And then each of those tasks have a pretty good (I admit it's not great) note-taking feature. The notes are living within the actual object you're taking notes about, which is totally different from Paper.
I even use Notion for personal stuff. I have a Notion form that my wife and I use to enter things we need to buy next time we're at the store. And there's a view showing the things we need to buy from each separate store with checkboxes next to each one so it's easy to remove them when we're done. There's a separate database listing the movies we want to watch, with a view for all the ones we previously watched, and when. I have a database of cocktail recipes along with ingredient lists (so I can easily filter by ingredient), formulas to calculate different volumes based on how many drinks you're making, a rating system, etc.
Basically, if you look at Notion as a bucket of unstructured notes with a markdown editor, I agree, it's nothing special. But that's not what it really is.
One (seen elsewhere in these comments) is any small business. I personally don't like that definition because there is a pretty big difference between a local coffee shop and the thing we all mean when we say "startup".
The other one which is more common here is a company that is currently small, but the business model involves getting much much larger. There's a blurry line between a small business and a startup with this definition, but it seems to be a "you know it when you see it" type of thing.
Companies like Mailchimp and Atlassian (in their early days) clearly qualified as startups even though they hadn't raised VC. You might say they're outliers, but so are the VC-backed companies that reach that level of success. If a small company is growing quickly and on pace to become a multi-billion dollar company, it seems weird to say they're not a startup just because they didn't raise money from the right people.
The short prompt leaves a lot of room for interpretation. The code itself leaves zero room for interpretation (assuming the behavior of the coding language is well understood). I don't agree that AI will allow us to start relying on code that isn't fully defined just because it might allow our emails to remove fluff that didn't contribute to the meaning at all.
The other versions of recaptcha show the annoying captchas, but v3 just monitors various signals and gives a score indicating the likelihood that it's a bot.
We use this to reduce spam in some parts of our app, and I think there's an opportunity to make a better version, but it'd be tough for it to be better enough that people would pay for it since Google's solution is decent and free.
Letting everyone do what they want is not a path towards everyone being happy. I think a better approach is for companies (or at least teams) to land somewhere on the spectrum from full in-person to full remote, and then employees can work at the place that fits them best.
The reason for having security documentation isnt so that it can answer the questions the client has. No one will actually read it. The thing is, people have an unlimited appetite for wasting your time if it's free for them to do so. By pointing them at documentation and having them get back to you with questions, you're now making it their problem instead of yours. Some clients will say no, fill out the questionnaire. You can politely bow out with those clients. Others will glance at your docs and decided it's not worth it to them to figure out if you actually answer all their questions, so they'll just check the "security review complete" box in their buying process.
I wonder what the ideal time is in a company's arc to start their eventual replacement. Render just raised a series B which probably means they're still many years away from step 3, so it's probably too early. But maybe when they're raising a series C or D, it's time to start thinking about making their replacement.
I feel like Stripe is entering that territory right now. Not that they're worse than alternatives, but they no longer have that "wonderful experience" magic because they've started to turn on the maximize shareholder value engine.
And in the past, every time I've wanted to cancel a subscription, I've had to spend ~30 minutes with their support. How are you able to turn it on and off so easily? I'd love to figure out a way to avoid their normal cancelation flow.
I can see both the creators and consumers of content being happier if the lead gen and delivery of the premium content could happen in the same place. This especially makes sense if Twitter integrates this further with their Revue acquisition.
A few examples I could imagine: - This could be used as an alternative to Substack/paid newsletters. - I could see this being popular with people who share tips like crypto/stocks, etc. Get the basic tips for free, pay to get the good stuff (note: I don't endorse this, I'm just saying I bet it'll happen). - This is a bit different from everything else I'm mentioning, but I bet celebrities could get their hardcore fans to pay for inside access to various things (e.g. backstage videos).
It seems very reasonable to me that they're not designing for the use case of people who are trying to host images for their website directly from their Dropbox folder. That was never what Dropbox was meant for.
It has the best WYSIWYG markdown editor I've ever used which makes note-taking super simple. Good search, a few nice features like assigning tasks to people within documents, etc. but otherwise it just gets out of your way.
I hear they're about to move it into the core Dropbox file system which could be great (it's always been a bit annoying that Dropbox's main offering is basically just an online file system and yet Paper had a totally different folder structure) but I'm also worried that it might make the experience a bit heavier which would negate the main reason I use it.
When a company makes a profit, it essentially means that they're capturing wealth that could have otherwise gone to the customer. The more wealth the customer captures, the more they want to use your product or service. This is why so many startups are unprofitable for so long. They burn money in order to compete with more established players until eventually they dominate the market, and then they turn the knobs to become profitable. All else being equal, profit is at odds with competitiveness.
Of course if you have outside investors (especially institutional investors) they'll eventually require you to start optimizing for profit. But it's not to be competitive, it's because the competition is now over because they've effectively monopolized their space, and now it's time to cash in.
I'm a big proponent of bootstrapping, and this is why. In the early days, you have to be a little bit profitable (you can't burn money for years like a Softbank-backed company would) but once things start working, you can stay in the "a little bit profitable" world which allows you to treat customers and employees well, instead of moving into the "maximize profit" world that most successful companies end up in.
So given that, the difference between "we offer free health insurance" and "we pay you extra and let you opt in to health insurance" is purely academic for someone who wants to be on the group plan. Both the company and the employee end up with the same amount of money in the end, and the insurance is the same.
The reason I'd prefer letting people opt in is because it gives employees more choice. Maybe they want to use a different carrier. Or they get free insurance through their spouse's work. Or they're on Medicare. At the end of the day, it seems really paternalistic for a company to say to its employees "here are the things we want you to have, and instead of letting you choose, we're just going to buy it for you." All else being equal, I prefer a world where employees get money and spend it how they want.
Having said that, since there's no way to do that while also getting the convenience and tax benefits of a group plan, we decided to compromise and go with the employer-subsidized group plan rather than giving employees total freedom.
I think the closest possible thing to this is for the company to offer to pay 50% of the cheapest plan possible and then let employees opt-in to better plans, add dependents, etc. at their own expense. That way the majority of the expense is "optional" to the employee, but whatever the company pays still isn't.
Note: this only applies to health benefits. We do compensate employees who decline other benefits e.g. a parking pass
All of those things seem like relatively minor costs when spread out across a large employee base, but I could see it being prohibitive for a smaller company. Or maybe this is a solved problem and you can just find some boilerplate stuff online that takes care of the whole process.
I run a 17 person company and I've heard employees mention that they think all companies should be unionized even if there aren't currently any problems that the union would seek to address. I strongly support the big tech companies unionizing and so it would be hypocritical of me to be opposed to it for my own company, but at the same time it seems like the overhead for such a small company would be really significant and I'm not sure what it would accomplish given that I'm not aware of current employees having any demands that we haven't satisfied already.
Even if nothing comes of it, I think it's an interesting thought experiment.