relaunched

I'm much more concerned with a new hire, especially revOps, that shows up and their day 1 recommendation is to change productivity tooling for the whole company. Typically these big changes on day one kinda folks are tone def to the organization and culture, and don't always survive the backlash / fallout of their changes.

Encourage this person to start a little smaller, build a track record of impactful wins and use that track record to make bigger and bigger changes.

To answer your stack questions, people are successful with all sorts of tools - one stack isn't better or worse.

You are making a lot of assumptions that I'd encourage you to not. Also, this isn't a big bounty dilemma. There was no program.

What are you trying to accomplish? You hacked a site (probably not legal).You reach out and reported it (nice gesture). They fixed it (the site is more secure (yay!). They offered to pay you $1k pounds (awesome!). You are rejecting the offer based on lies you tell yourself (they can pay more and if rather share it with the world be cause good things will happen for me if I do).

Bad things can happen too. They can reach out to authorities. Your current or future employer could reach your future post and decide you aren't the right person for them. The underlying company could respond to your post and confirm you weren't authorized to test and a good portion of the security community would never seriously consider you for employment.

Sure, you might be able to negotiate a little more, if you take the right approach. How much do you want? 1200, 10,000, 50,000? When you do something wrong, even with good intentions, and now you aren't happy with the amount they graciously offered to compensate you with, your approach to publicly expose them if you don't get what you want because "they can pay more" seems less like they won't pay for my expertise and more like extortion.

When in doubt, choose the path you'd be proud to talk about in a courtroom.

Ouch. What a cruel, but not completely unfounded, description of my life's work.

For context, I don't have the time to meet with everyone that reaches out. I was thinking I could hold office hours and people could show up and ask questions.

You and I don't have a meeting of the minds for what a founding engineer is. I understand it to be the first, non-cofounder, salaried engineer. This is the highest-equity receiving engineer-focused early employee. They should be getting a market-ish for a startup salary. In this day and age, in the US, it's probably 150-180k + 1% equity + healthcare.

If you are not making a salary / a well below market rate salary (50k for an engineer), you are a co-founder, not a co-founding engineer.

I'd think about the role as a role. Is there a job description? If so, what are the specific responsibilities. What would you pay for the role - comp it to market and company hiring practices. Then, determine if you need the role. Then, open the req and recruit for the role / encourage her to apply. Then, put her through the same interview process as everyone else.

You have to treat your business as a business. If you need the role, are paying a fair rate (salary, bonus, equity) and she's the best candidate, hire her. Then, you have a process that you can be transparent about and is fair.

Don't be bullied into something like this - it could be the beginning of the end.

My first thought was snide / next level anti-Semitic trolling. But, then I reminded myself that you shouldn't infer tone to comments online.

The former weapons of mass destruction 404 message comes to mind - https://w3dev.net/stuff/error/404.html

This article understates how big the content discovery problem was on the web, at those times. Delicious, Digg, Stumbleupon, Reddit and a million others.

Reddit is the Craigslist of content discovery, in so many ways.

I think he's talking about Yishan Wong and Ellen Pao. BTW, true or not, that's a hell of a way to refer to them, respectively.

Find an employment lawyer. The United States and Colorado have FMLA / FML laws to protect employees from losing their job. An attorney will be able to advise.

Except their legal fees. Whenever you close a round, make sure you negotiate a cap on the legal fees you are willing to cover. The company pays for VC legal fees - SURPRISE.

It's a faulty premise. Very few people actual want to discover startups, for the sake of discovering startups. The reason no one has heard of your startup is because the people who have heard about it don't care. Startups grow when customers / users care about the startup.

Every startup "just needs more eyeballs." So startups will sign up for the promise of free / low cost users. But, they won't get them. And even if you get the exposure, the users won't stick.

I understand why you want to build this product, but you can't scale getting startups large numbers of sticky users like this.

There is a lot of patting themselves on the back and no acknowledgement of wrongdoing. They got caught violating trust for an inconsequential revenue stream, at the expense of their biggest revenue stream's customer - so, we'll shut down the conflict.

Also, 409a is a conflict of interest, but since it doesn't negatively impact our biggest revenue streams, we'll keep doing it (at the expense of tax revenue).

It's a hard reality, but imagine you are the one re-capitalizing this venture. They have a team, no customer, no product, but a new idea they want to pursue. There are a lot of early teams with ideas in search of money that you could invest in. This particular team comes with 10% dead weight on the cap table, which essentially means everyone else is getting diluted out of the gate, by someone that will bring no future value.

That makes this investment worse than anything else you could invest in, by a factor of that non active founder.

I do a fair bit of investing and advising (both for startups and venture funds). If you are the founding CEO and you are looking to leave, the most likely outcome for a company that's early, and without any sort of product market fit, is the company will die.

If you don't tell investors you want out, raise money, and leave shortly thereafter, you will burn all of those relationships and damage your reputation - it's a small world. It's also very disingenuous. Investors are betting on a committed team, that will go through hell and high-water to try to make this venture work - you already know you aren't that committed. And no one can be more committed than the CEO.

If you can't get behind the pivot, the only other thing you can do is work with existing investors (at the seed stage this isn't really an option) or find a founder with previous exit, an EIR looking to step into a company, our an early employee / non CEO cofounder who exited and wants to do it again - and see if they'd be interested in the CEO role - It's a find your own replacement scenario.

As far as your equity goes - you'll get diluted a bunch, but that's okay. It's going to be hard to hear, but no real investors will allow a non-participating, former founder, of a company that doesn't have a product or any traction (in your case your starting over with a pivot) to keep 10%. That's just too much of the cap table for not enough of a business / individual contribution. It's sucks, but if you stuck around and made it to a priced round, all of your equity would get clawed back and be subject to vesting again anyway (most likely). It's just the way it goes. You deserve something for your troubles and work, but it's not going to be 10%, not going to be anywhere close.

Good luck.

Every few years this story resurfaces and always makes me smile.

Admitting defeat is the wrong way to frame the situation. You have learned a lot and gained a lot of experience. There has never been a better time to market your skills, to companies all over the world, and see what is out there.

Your company compensates you for work that you've already done. You are not paid in advance. You owe them nothing. Be respectful, professional and polite... but, always do what you feel is the best thing for you.

It might be my security hat speaking, but I see it as insecure, regardless of who is man in the middling the connection.

I'm not a tinfoil hat, but security can't hang it's hat on the kindness of strangers.

You will inevitably give the best deal to your first enterprise customer, embrace it.

Enterprises negotiate. So, no matter what you propose, they will want a better deal. The simplest way to start is extend the current best pricing you offer to small businesses and throw in a modest 10-20% discount. It's a stake in the ground and shows you want their business.

Now, here's the key. Make sure you specify what that covers. For example, if small companies don't get weekly meeting during onboarding and monthly / quarterly meetings with a TAM, say that. If the enterprise wants that, they'll pay for it.

Does the enterprise want professional services? Do they want support with an SLA? Make sure they know it doesn't come with it or what it comes with is standard for all. If they want more, they should pay for it.

Once you tell them what's baked into the price, you'll find yourself with a list of things that they want, that don't come with it. Then, figure out what you can do for them and what it's going to cost.

Even after all of that, you'll look back to find they got the best deal and rightfully so. They are taking a huge risk on you. Off the cuff, if a single seat costs $49, if you can land them at $30 per user with 10-15% on top for enterprise support, it's a huge win.

Licenses in the enterprise vary, but seat-licenses are common. Multi-year agrees, for additional discounts are great, some take them and some don't. But, larger companies tend to have generous termination rights.

A lot goes into enterprise contracts. I'm happy to talk offline and congrats!

I am not a lawyer and this isn't legal advice.

This isn't gonna end well, in the short-term. However, you can prepare yourself for the longer term. Many companies, especially startups, just don't care.

Document, or send a recap email, acknowledging that you talked with your boss about the parental leave. Anything not in writing, didn't really happen - an email that they don't respond to or agree with is still good. Point out your concerns, based on this performance feedback and state that you believe it's related to bringing up parental leave - "I believe I am being retaliated against for expressing my intent to go on paterbity leave". Then, loop in HR. Then, continue to raise the concerns as they arise. The more appropriate people that get these emails, the less likely the company can claim ignorance. A pattern of behavior and negligent / discriminatory practices is what you are trying to establish. If one manager is bad that's unfortunate, if all of HR / legal / founders / CEO all know this is going on and do nothing or are complicit, that's way worse.

All the while, consult a plaintiff side employment attorney and start looking for another job. Now that I think about it, you might want to talk to an attorney first - there could be FMLA issues or CRA issues in play.

Best case, everything is documented (keep copies of your emails / slack / etc, for your records) and the company changes their ways. Worst case, you get fired and your attorney takes it from there.

Good luck and I'm sorry this is happening to you.

Re-negotiating is all about leverage and after signing, you have none. SAFE's are pretty standard, so I presume you aren't happy with the Cap or discount. Here are a few things to consider, before you become a huge problem for the CEO:

- If you invested at the tail end of the good times and are upset that everything re-priced, that's just how things go sometimes.

- If you are a part of a round with other investors, you all have the same terms. Changing just your terms will create problems. Changing everyone's terms will create problems.

- Early investing is about swinging for the fences. No matter what the terms, as long as they are somewhat reasonable, will have great upside. If the company is a bust, your investment is worth nothing. If there is a small / non-existing exit, you have blah returns. A little more or a little less doesn't really matter.

Unless there is more to it, you're probably having buyers remorse. It sounds like you weren't really mentally prepared to invest in startups and that's a tough place to be.

Best of luck.

Dear young friend,

A couple things:

At this point in your career, no one is paying you to explain anything to them, u less they ask. Your unsolicited opinion is only doing you harm.

Your are the most inexperienced and, likely, the lowest paid. You will get the grunt work.

The fact that you are overqualified is of no consequence to them.

Not all jobs are like this one. But, many are. Just do the best job you can do, until you find another one.

Don't burn any bridges. The best outcome is making everyone love you and think you are a huge asset. Trying to reason them out of their plan will make you an ass^at, not an asset.

Good luck.

Hyper inflation would be a catastrophic risk to the entire economy. If it happened in the US, it would be a catastrophic risk to the world economy.

Insofar as everyone should be worried, startups should be worried. However, the only way to manage that risk would be to focus on markets that would be insolated from such a risk. That would be economies like Russia, Iran, North Korea, etc... many of which US startups can't operate in anyway.

One should be aware, but there isn't much you can do against hyperinflation in the US and the world.

Modern security is all about enabling modern engineering and allowing them to go ask quickly as responsible. Responsible has always been a function of risk / risk profile, always defined as likelihood * impact.

Please don't build a security product without having any experience or validating any real problems. This is especially true in security, where not every potential problem gets prioritized and solved.

My implication is that ultimately crypto will go to zero - because it is worthless. When you sell something that is worthless to someone, that is a zero sum game.

Bigger doesn't prove the game is not zero sum. There is no valid underlying use for any cryptocurrency for the average person. If you take away early adopters, crypto-zealots, shills, criminals organizations and suckers, what's left is far from clear. Is cryptocurrency some transformative, post-governmental currency, controlled by the people - or the next speculative de jour - or a scam - with a better marketing strategy?

What seems clear is that when you confound speculative utopian societal changes with the underworld's dream currency, crazy things happen.

That logic suggests that blue-collar workers have contempt for anyone that isn't a blue-collar worker. Is there any evidence to support that?

Yes. The purpose of this sort of password convention is to make it more human friendly (easier to remember or dictate), while maintaining security.

Password strength / entropy is all about how long would it take an attacker to brute force. Practically, we think about this in terms of S(p) = number of possible tries / tries per second. This yields how long it would take an adversary to crack your password, in the worst case (that your password was the last possible guess.

The set size of all possible characters varies by system. But, typically, we see set sizes up to about 95 (lower case, upper case and special characters). Let's say everyone knows that bitwarden creates passphrases that are all lower case and have spaces. Passphrases use a word set of (let's say) 170,000.

Your (let's assume) 20 character password has a max number of guess of 95^20 whereas bitwarden has a complexity of 170,000 (choose) 5. However, if the adversary didn't know you used bitwarden, the complexity would look more like 95^40. It's obvious that the more an adversary knows about your password, the faster they can guess it.

You can use a site like security(dot)org to determine how long it would take a computer to crack it (they don't really define what "A computer" is). In either case, either password would take longer than the existence of the universe, by far.

On a side note, I'd love to see a "How secure is my password?" that calculate the cloud compute cost of cracking the password, say in a year. It would be cool to know it would take $5,000,000,000,000,000,000... to crack your password in a year.

Be really careful with these types of businesses. It's not that they don't or can't make good money - it's that they do require a decent amount of work, especially at the beginning and if you are trying to turn them around. Machine failures are sorta frequent (and if you can't or won't do the repairs yourself, it gets very expensive), the stores have to be stocked / cleaned / maintained and theft is a real issue.

Most businesses are easy in theory, that's why people invest in them. The reality is much different.