c0nrad

First company was csper.io (2019), took maybe 3 months till I had my first customer, and then around month 6 I started getting ~1 customer/week, and continued scaling after that. Felt pretty comfortable with the idea and didn't need to pivot/drop.

Second/current one, dmarcdefender.io (2025), took maybe 6 months till I had my first customer, but now it's growing much slower. There's a lot more competition and still trying to figure out where I fit in / how to market it among all the competition. I was originally positioned as a security focused product, but now pivoting to more of a marketing/deliverability product. But to be honest not really sure where it's going, but still fighting the fight.

Thanks for the feedback! The domain checker tool is completely free and unrelated to the subscription. The subscription is for dmarc monitoring (I collect the dmarc aggregation reports and provide insights). I'll see if I can make that more clear.

https://dmarcdefender.io. DMARC service focused on api/integrations. Currently thinking about (1) writing an ml classifier to classify sources, and (2) using rag to automatically generate spf/dkim fix advice for different sources.

Two free dmarc tools: * dmarc domain scanner https://dmarcdefender.io/tools/domain-check * dmarc xml analyzer: https://dmarcdefender.io/tools/xml-analyzer

https://battlecode.org/ is in January, I look forward to it every year.

Building a cheaper DMARC service with no ssotax. https://dmarcdefender.io

Base health counter for Star Wars Unlimited https://blog.c0nrad.io/posts/swu-health-counter/

I do security Capture The Flag (CTF) writeups on YouTube. It's been fun, I've learned a lot, just published my 100th video.

https://youtube.com/@SloppyJoePirates

Not sure if this is interesting to the HN crowd, but some challenge writeups from a recent security Capture the Flag competition.

Going back to school for Physics (age 30). It'd be cool to understand why the universe exists before I die.

Ah thanks for the heads up. We'll wrap it in a html picture block. (Google's https://web.dev/measure/ recommends webp, but I should have done more research)

Thanks for the insight!

Interesting article. How much requests can you support for 20/month before losing money with this stack?

Ha, I haven't profiled it yet. I'm not too sure. But, I think a decent amount. If a slack team with 10000+ physicists signs up, I may need to talk to them offline.

I do plan on doing some stress testing in the future for fun, I'll try to remember to reply here.

partner frontend

Yep, to repeat what steve_adams_86 said, she did the frontend completely. Usually I'm forced to do the frontend, it was very nice having someone else just do the whole thing without me.

Disclosure: I used to work at MongoDB, left 2 years ago.

True, it probably would have made sense to stay completely within AWS. If I didn't know MongoDB very well, I would have used DynamoDB.

But I know MongoDB well, and MongoDB Atlas (the hosted platform) also has a free tier, and it's hosted in ec2, and you can setup VPC peering (so network speed _should_ be comparable to dynamo, but not sure).

Also, Atlas (MongoDB's Cloud Platform) has a really nice "charts" product (sort of like a built in web based tableau) which I use for my internal dashboards (it takes <5 minutes to setup, for stuff like "how many customers do I have", "at what stage in the pipeline are they", "how many renders does each customer average", etc), and they have a nice web based "query explorer", which I randomly use when debugging something, when I don't feel like connecting with terminal.

But yeah, if I wasn't already biased, I would have used DynamoDB.

(Profitable Solo founder)

Thankfully lots of tools do most of the heavy lifting. I use k8s, GKE does most of the work for me. It's very nice to have autoscaling for traffic spikes. Same with database (MongoDB Altas), dead simple autoscaling. I would never run my own k8s nor database.

I wrote more details about some of the Ops stuff I do here in a previous similar question: https://news.ycombinator.com/item?id=26204402

Coincidentally I also wrote some architecture notes about a new product last night: https://blog.c0nrad.io/posts/slack-latex/

I think everyone's milage will very, but as general principles, staging is nice, reading docs saves time overall, tests help you sleep at night and make it easier to make changes 6 months in the future, simple health checks (or anything on a critical path) help you catch the real issues that need immediate attention.

Good luck!

https://cloud.google.com/monitoring/uptime-checks

If I remember correctly you can specify a bunch of regions for the health checks to originate from. It was super simple to setup (point and click) and it's nice that it's decoupled from the rest of my infrastructure. When there's a failure I get a notification.

I've been solo running/building a startup (csper.io) for over the last year, it just hit profitability a few months ago.

It's easier said than done, but if you can prevent issues in the first place, things will be much more enjoyable.

Some things that worked well for me:

  * GKE on GCP is pretty smooth. When there's a spike in traffic everything autoscales up, so I don't have to do anything. Nice observability, things just work. Just make sure to set container cpu/mem limits.
  * Along that same note, I use MongoDB Atlas which also autoscales very nicely. It autoscales both up and down very well, saving both money, and making my infra resilient
  * GCP has a lot of monitoring/alerting/dashboards that I take advantage of. Health checks around the world, easy integration of logs/metrics. I find structured logging (json), makes setting up alerts pretty easy
  * Good consolidated logging for when there is an issue you know exactly what went wrong
  * GCP also support application tracing which can make timing issues easy to debug (although it requires a bit of work to setup) (for example if you are missing an index on some db)
  * Automatic deployments (thanks to k8s), there's no checklist for doing a deploy, I just run a single make command. I can't screw that up
  * A staging environment that's a match of production. Plenty of times I've crashed staging, it's worth every penny. It also makes life much less stressful
  * Lots of tests. The tests aren't important for when I'm writing the code, but for months later when I make changes and want to know I didn't mess something else up. I find a good test suite can really help you sleep at night, specially if the test suite covers the critical paths
  * An easy way for users to contact you if there is an issue. No one is perfect, but being able to respond quickly is usually forgiven.

Hope that helps!

I built a little tool to turn the dial on my thermostat. It's called the Thermoshat.

https://blog.c0nrad.io/posts/thermoshat/

I run https://csper.io. It's a web app that simplifies some web security stuff Content Security Policy (CSP).

I helped setup CSP at a company back when I was an intern (2013). I learned that CSP can be an unpleasant experience.

A year ago I decided I wanted to do something new with my life so I quit my job and Csper was born. Hopefully it makes CSP easier for other people.

It's not super profitable, but it almost pays my rent, no complaints.

  Location: Michigan, USA
  Remote: Yes
  Willing to relocate: Yes
  Current Position: CEO/Founder of profitable startup
  Previous: Yahoo! MongoDB
  Resume/CV: https://c0nrad.io, https://github.com/c0nrad
  Email: c0nrad@c0nrad.io

Making an angular cms for my blog

Video Demo: https://www.youtube.com/watch?v=6S8fl24001s

MongoDB | Senior Product Security Manager | NYC

MongoDB is looking for an outstanding Product Manager with strong Information Security experience to take on a senior role in our products organization. This role will live at the center of sales, marketing, and engineering for a company that is disrupting a $40B market. This role will be responsible for managing strategy and best practice continuity across all MongoDB products from a security perspective. The position is based in New York City. Requirements:

* 5+ years of product management experience with a complex technical product

* A strong understanding of Information Security fundamentals Experience and demonstrated success in delivering software products to market

* Ability to communicate complex technical issues simply to different audiences

* Ability to write, defend, and execute on findings

* Familiarity with open source technologies

* B.Sc. in Computer Science. M.Sc. or Ph.D. in relevant domain a plus

Apply Here: http://myjob.io/ctyhw

Questions? stuart@mongodb.com

https://c0nrad.io Interested In AppSec/Dev role

Location: NYC

Remote: No

Willing to relocate: Most likely not

Technologies: Go/NodeJS/AngularJS, Pentest Tools

Résumé/CV: http://c0nrad.io/resume.pdf

Email: c0nrad@c0nrad.io

It's Backbone.js with HTML5 canvas.

http://github.com/c0nrad/conks

Meh. It's not really interesting or news-worthy. But it's an example of how you can have fun learning. If it inspires someone else to pick up their old game they were making, I'd be more than ecstatic.

Chrome-Extension: https://github.com/c0nrad/enforcer

Aggregator/Analyzer: https://github.com/c0nrad/caspr

Heroku's launch button is sick nasty awesome. I'm actually considering switching all my stuff from Digital Ocean to Heroku because of it. No one wants to spend time deploying someone else's application.

And np! If you find anything else (or have any idea to make it better) please let me know! I'm just sitting here watching logs and refreshing HN/reddit every 5 seconds =P

Oops, yea. Looks like someone was sending caspr empty csp reports, fixed.