the_bear

I run a small CRM company that serves some travel agents (we're not travel-specific, but we have a lot of small broker/agent businesses using us). We have ~11,000 customers with ~25,000 users between them, and our database stores ~100 million contacts, so about 4k contacts per user.

Most of those contacts are probably random leads that got imported, not actual clients that would have uploaded their passport info, but it seems reasonable to think that a CRM of our size (which, again, is not very big) that served exclusively travel agents would have millions of actual "clients" with passport info. 1 million passports across 25k users would just be 40 per user. If you assume a typical trip is for a family of four, that would mean the average user has just booked 10 international trips ever which seems pretty low to me.

I want to reiterate that we're not travel-specific and we don't have a feature for capturing passport info, etc., so I'm really just commenting on the volume of records that might be impacted by something like this.

I'm not a lawyer, but I'm currently working on getting my company HIPAA-compliant, so I know more than the average person about this.

My understanding is that there's a thing called the "conduit exception" which basically says that if data is transiently passing through a channel and it's not being looked at, it's ok. But wherever the data lands must be HIPAA-compliant.

This seems crazy to me, but that's how it works I think. For example, if you encrypt PHI and store it in AWS without signing a BAA with them, that's a HIPAA violation, even though the data is encrypted and Amazon can't see it. But if you send encrypted data through AWS without actually storing it, that's fine.

Mail is specifically mentioned as a thing that qualifies for the conduit exception. I'm not totally clear why it isn't a HIPAA violation the moment it arrives at a destination (it's not in-transit at that point, and it's potentially not in the possession of the intended recipient either), but it seems pretty well accepted that it's not.

All that to say: I think encrypted email would still require a BAA because it's being stored, not just transmitted.

I was going to say the same thing. I only saw two things that are sort of about the future and not the past:

- BIMI (I hadn't heard of that before) which seems like a very minor thing to be calling "the future of email"

- AI might be easier to trick that humans

On that second point, here's the exact text:

A person reading a suspicious email might notice that the sender’s domain has an extra character, or that something about the request feels off. An AI assistant scanning your inbox for items that need action may not slow down to check those things.

That seems wrong (AI should be better at this than the average human), but let's assume that assertion is correct. It then says "authentication is the safeguard that should stop it before it ever reaches your mailbox". Except then, a few paragraphs down, it says "A scammer with a convincing look-alike domain and a properly configured DMARC record will still pass sender authentication checks." Ok, so authentication isn't a solution to the stated problem at all (it does solve a different problem). And unless I'm missing something, no solution is proposed. No statement is made about what the future actually looks like.

Like you said, what is the point of this article?

Those "message centers" aren't just about security, they're also about compliance. For example, insurance companies need to be HIPAA-compliant which requires that they can only send health-related info to other HIPAA-compliant systems, which means signing a BAA (a contract) with those other systems. There's no way to do that with email (your insurance company can't sign a contract with every potential email host in the world, and they don't even know where the email will ultimately end up after they send it) so practically speaking, they're not legally allowed to send any health info via email.

It's extremely difficult to accurately identify which emails have health info and which ones don't (even something like a person's name or IP address could count depending on the context) so they just default to sending everything through their message center. No amount of email security could change that.

Agreed. Unless it's a really frequently used UI, my company defaults to showing all options to all users regardless of permissions. It's better to see "Manage users" in the settings menu which takes you to a page explaining that you don't have permission as opposed to seeing nothing and wondering why it's not there even though the help article says it should be there.

No, putting an explanation on the help article that this feature is only available to admins doesn't work. No one reads anything.

I think that's the point though. The AI companies can't compete without hiring very talented employees and raising lots of money from investors. Neither the employees nor investors would participate if there weren't the potential for making mountains of money. So these AI companies fundamentally can't be non-profits or true B-corps (I realize that's a vague term, but the it certainly means not doing whatever it takes to make as much money as possible), and they shouldn't pretend they are.

When we used Stripe, we opted out of all their fraud prevention stuff to save money (not sure if that's still an option). As a b2b SaaS where payment happens after a free trial (not at signup), we're just not a target for fraud, so it was totally fine.

I can't speak to why Stripe's fraud protection is so expensive. Is it because they're a target? Or maybe because they realized people will pay for it (it seems valuable for something like ecommerce)? I dunno, but I can confidently say that as of ~5 years ago, it wasn't required by any regulation, and my business was perfectly fine without it.

Now we use Paddle, and they also try to sell us a bunch of stuff we don't need at ridiculous prices. We're just using them because we wanted a merchant of record (where they handle taxes and stuff), but no, I'm not going to pay a % of my revenue for basic dunning emails, fraud prevention, vague "optimizations" that "increase conversions" (lol no they don't), etc.

My small SaaS app has been DDoSed a handful of times, always accompanied by an email asking for a ransom in the form of bitcoin.

The first time we switched to Cloudflare which saved us. Even with Cloudflare, the DDoS attempts are still damaging (the site goes down, we use Cloudflare to block the endpoints they're targeting, they change endpoints, etc.) but manageable. Without Cloudflare or something like it, I think it's possible that we'd be out of business.

This is the main thing that's been bugging me about the AI discussion. People seem to forget that capitalism is competitive, and if everyone gains the same advantage, then it's not an advantage. If the cost of labor goes down, it means companies will either need to lower their prices or increase their investment in other areas (e.g. hiring even more people now that they're cheaper).

Unless you're a monopoly, I don't see how AI will lead to these massive cost savings everyone is hoping for.

As someone who switched from Dropbox Paper to Notion...

There's no question that Paper is a better pure writing experience. If you're viewing Notion as just a note-taking app and nothing else, I think you're misunderstanding what it's for.

For starters, it's way easier to organize stuff in Notion than Paper. This is less a feature of Notion, and more of a terrible limitation of Paper. Paper was stuck with the "files within folders" model. Just the fact that Notion lets you control what shows up in the navigation sidebar was a huge time saver for me. And being able to create pages within pages within pages (which is very different from having sibling documents inside a folder) made it much more flexible for organizing everything.

But the real power of Notion is when you start to treat it as a database builder rather than a note-taking tool. Yes, it's useful for taking notes, but those notes are about something, and with tools like Paper, Obsidian, etc., the thing is always living somewhere else.

With Notion, I was able to make a database of projects and another database of tasks which linked to those projects. Each developer on my team has a custom dashboard showing just the tasks that are assigned to them and currently in-progress. I have a totally different view showing all the projects going on right now. And then each of those tasks have a pretty good (I admit it's not great) note-taking feature. The notes are living within the actual object you're taking notes about, which is totally different from Paper.

I even use Notion for personal stuff. I have a Notion form that my wife and I use to enter things we need to buy next time we're at the store. And there's a view showing the things we need to buy from each separate store with checkboxes next to each one so it's easy to remove them when we're done. There's a separate database listing the movies we want to watch, with a view for all the ones we previously watched, and when. I have a database of cocktail recipes along with ingredient lists (so I can easily filter by ingredient), formulas to calculate different volumes based on how many drinks you're making, a rating system, etc.

Basically, if you look at Notion as a bucket of unstructured notes with a markdown editor, I agree, it's nothing special. But that's not what it really is.

I think there are two common definitions of startup, and neither require VCs to be involved.

One (seen elsewhere in these comments) is any small business. I personally don't like that definition because there is a pretty big difference between a local coffee shop and the thing we all mean when we say "startup".

The other one which is more common here is a company that is currently small, but the business model involves getting much much larger. There's a blurry line between a small business and a startup with this definition, but it seems to be a "you know it when you see it" type of thing.

Companies like Mailchimp and Atlassian (in their early days) clearly qualified as startups even though they hadn't raised VC. You might say they're outliers, but so are the VC-backed companies that reach that level of success. If a small company is growing quickly and on pace to become a multi-billion dollar company, it seems weird to say they're not a startup just because they didn't raise money from the right people.

I agree that LLMs turn short prompts into long code blocks, but I don't agree that it's fluff in the same way that email pleasantries are fluff.

The short prompt leaves a lot of room for interpretation. The code itself leaves zero room for interpretation (assuming the behavior of the coding language is well understood). I don't agree that AI will allow us to start relying on code that isn't fully defined just because it might allow our emails to remove fluff that didn't contribute to the meaning at all.

This is basically what Google's reCAPTCHA v3 does: https://developers.google.com/recaptcha/docs/v3

The other versions of recaptcha show the annoying captchas, but v3 just monitors various signals and gives a score indicating the likelihood that it's a bot.

We use this to reduce spam in some parts of our app, and I think there's an opportunity to make a better version, but it'd be tough for it to be better enough that people would pay for it since Google's solution is decent and free.

Many people who want to work from the office are mostly interested in doing so because they want to be around their coworkers. If their coworkers are remote, they won't get what they want. Similarly, remote people might not be happy at a company that allows remote work but primarily has an in-person culture.

Letting everyone do what they want is not a path towards everyone being happy. I think a better approach is for companies (or at least teams) to land somewhere on the spectrum from full in-person to full remote, and then employees can work at the place that fits them best.

I think this is the right answer, and I especially want to call out the second part, because it can be a bit counterintuitive.

The reason for having security documentation isnt so that it can answer the questions the client has. No one will actually read it. The thing is, people have an unlimited appetite for wasting your time if it's free for them to do so. By pointing them at documentation and having them get back to you with questions, you're now making it their problem instead of yours. Some clients will say no, fill out the questionnaire. You can politely bow out with those clients. Others will glance at your docs and decided it's not worth it to them to figure out if you actually answer all their questions, so they'll just check the "security review complete" box in their buying process.

That's an interesting thought. Any company that raises money from VCs will ultimately either fail or end up publicly traded (via IPO or acquisition), and at that point it's just a matter of time before they start squeezing their users.

I wonder what the ideal time is in a company's arc to start their eventual replacement. Render just raised a series B which probably means they're still many years away from step 3, so it's probably too early. But maybe when they're raising a series C or D, it's time to start thinking about making their replacement.

I feel like Stripe is entering that territory right now. Not that they're worse than alternatives, but they no longer have that "wonderful experience" magic because they've started to turn on the maximize shareholder value engine.

From what I'm seeing, Photoshop only costs $20/month (actually $20.99) if you commit to an annual plan. It's $31.49/month if you want month-to-month.

And in the past, every time I've wanted to cancel a subscription, I've had to spend ~30 minutes with their support. How are you able to turn it on and off so easily? I'd love to figure out a way to avoid their normal cancelation flow.

Right now, a lot of "creators" use Twitter to generate leads to sell premium content of various sorts (e.g. paid newsletters, ebooks, etc.). But the premium content has to live somewhere else, and there's a challenge getting people from Twitter to those other platforms.

I can see both the creators and consumers of content being happier if the lead gen and delivery of the premium content could happen in the same place. This especially makes sense if Twitter integrates this further with their Revue acquisition.

A few examples I could imagine: - This could be used as an alternative to Substack/paid newsletters. - I could see this being popular with people who share tips like crypto/stocks, etc. Get the basic tips for free, pay to get the good stuff (note: I don't endorse this, I'm just saying I bet it'll happen). - This is a bit different from everything else I'm mentioning, but I bet celebrities could get their hardcore fans to pay for inside access to various things (e.g. backstage videos).

Yeah. I'd argue this is quite a bit better. People can comment on the image, add it to their dropbox, view entire galleries, preview things like word files that couldn't open natively in the browser. And it doesn't make it any harder to just look at the image if that's what you want.

It seems very reasonable to me that they're not designing for the use case of people who are trying to host images for their website directly from their Dropbox folder. That was never what Dropbox was meant for.

Since people are commenting on how they hate Dropbox offering additional products beyond the basic file syncing, I feel compelled to say that I really like Paper. I use it for all my personal note-taking, and our company wiki is in there since they make it really easy to share folders with the whole team. It's basically Google Docs but waaaay faster (both in terms of the actual page speed, and the speed with which I can use it due to the more streamlined UI).

It has the best WYSIWYG markdown editor I've ever used which makes note-taking super simple. Good search, a few nice features like assigning tasks to people within documents, etc. but otherwise it just gets out of your way.

I hear they're about to move it into the core Dropbox file system which could be great (it's always been a bit annoying that Dropbox's main offering is basically just an online file system and yet Paper had a totally different folder structure) but I'm also worried that it might make the experience a bit heavier which would negate the main reason I use it.

This is still a feature. It's actually "Copy dropbox link" but it's very much still there. Here's a screenshot of the feature I'm sharing with the feature itself: https://www.dropbox.com/s/w2wju3uzvz2jont/context%20menu.png...

I agree with a lot of what you're saying, but I don't think it's true that optimizing for profits makes you more competitive.

When a company makes a profit, it essentially means that they're capturing wealth that could have otherwise gone to the customer. The more wealth the customer captures, the more they want to use your product or service. This is why so many startups are unprofitable for so long. They burn money in order to compete with more established players until eventually they dominate the market, and then they turn the knobs to become profitable. All else being equal, profit is at odds with competitiveness.

Of course if you have outside investors (especially institutional investors) they'll eventually require you to start optimizing for profit. But it's not to be competitive, it's because the competition is now over because they've effectively monopolized their space, and now it's time to cash in.

I'm a big proponent of bootstrapping, and this is why. In the early days, you have to be a little bit profitable (you can't burn money for years like a Softbank-backed company would) but once things start working, you can stay in the "a little bit profitable" world which allows you to treat customers and employees well, instead of moving into the "maximize profit" world that most successful companies end up in.

The tax benefits and better rates (which I think is a myth btw, but it shouldn't effect the argument either way) would be there regardless of who pays. It's still a group plan, the question is just about who is paying for it.

So given that, the difference between "we offer free health insurance" and "we pay you extra and let you opt in to health insurance" is purely academic for someone who wants to be on the group plan. Both the company and the employee end up with the same amount of money in the end, and the insurance is the same.

The reason I'd prefer letting people opt in is because it gives employees more choice. Maybe they want to use a different carrier. Or they get free insurance through their spouse's work. Or they're on Medicare. At the end of the day, it seems really paternalistic for a company to say to its employees "here are the things we want you to have, and instead of letting you choose, we're just going to buy it for you." All else being equal, I prefer a world where employees get money and spend it how they want.

Having said that, since there's no way to do that while also getting the convenience and tax benefits of a group plan, we decided to compromise and go with the employer-subsidized group plan rather than giving employees total freedom.

I believe that this is not possible in America. I'm a founder and we just started offering health benefits earlier this year. I tried really hard to figure out a way to let employees effectively pay 100% of their premium (either by paying them more if they opt out or just having the company share be 0%). I talked to a number of people, looked into different types of plans (HRAs, etc) and at the end of the day, I couldn't figure out legal way to do what you're suggesting.

I think the closest possible thing to this is for the company to offer to pay 50% of the cheapest plan possible and then let employees opt-in to better plans, add dependents, etc. at their own expense. That way the majority of the expense is "optional" to the employee, but whatever the company pays still isn't.

Note: this only applies to health benefits. We do compensate employees who decline other benefits e.g. a parking pass

Not as well as I'd like which is why I'm asking about this. I meant this as a discussion starter about unions at smaller companies, so even if I'm not the one paying the overhead, it's still relevant to the topic of whether or not a union makes sense.

I'll admit I'm not very knowledgeable about the logistics of unions, but I imagine there's some kind of up-front legal overhead. Like, maybe there are contracts between the union and the company, or within the union itself to determine how it's governed? I also get the impression there is some overhead in an ongoing basis in the form of extra meetings, more complicated negotiations, etc.

All of those things seem like relatively minor costs when spread out across a large employee base, but I could see it being prohibitive for a smaller company. Or maybe this is a solved problem and you can just find some boilerplate stuff online that takes care of the whole process.

Is anyone aware of an example where (a) a really small company unionized and/or (b) a workforce unionized without any real demands?

I run a 17 person company and I've heard employees mention that they think all companies should be unionized even if there aren't currently any problems that the union would seek to address. I strongly support the big tech companies unionizing and so it would be hypocritical of me to be opposed to it for my own company, but at the same time it seems like the overhead for such a small company would be really significant and I'm not sure what it would accomplish given that I'm not aware of current employees having any demands that we haven't satisfied already.

Even if nothing comes of it, I think it's an interesting thought experiment.

I've picked my fair share of colors for various businesses, and something that annoys me is that you pretty much always end up with green or blue being the main color.

I tried to figure out why, and I think it's a really dumb reason: like this article says, if you don't really know what you're doing with design, you want a spectrum of light-to-dark colors to choose from. Light green -> normal green -> dark green.

For some weird reason, we call light red "pink". And dark orange/yellow is "brown". If you pick one of those as your main color, it becomes much harder to just use lighter or darker shades without it becoming something else entirely. Great designers can make pink or brown work, but if you're a programmer who's just trying to find a "good enough" color scheme, it's way easier to go with green or blue.

I don't really have a good reason why we all think of pink as a different color from red, but we do.

I love it, but that's sort of because it's not a real tech scene. I was in SF for five years before moving back to STL and while I love the city, the tech culture kind of wore on me. Things are a bit less like an echo chamber here I think.

St. Louis has a tech community, but it's pretty small, and there aren't very many people who have already experienced success. As a result, while there are a lot of the normal startup things like co-working spaces, networking events, etc., it isn't a particularly big part of life unless you really want it to be. It's easy to meet people who work in other industries, and I think people generally don't link their personal identity to their employer as much. I also think more people find satisfaction in non-tech work (like customer service, teaching, etc.). I consider this to be a more healthy and hopefully sustainable environment.

Having said that, it's a bit funny because many people in the tech scene here haven't experienced the Bay Area and they think STL is sort of "the next silicon valley" which is just so hilariously not true. I view that as a good thing because I left SF for a reason, but I do wish people would stop pretending that it's a first-class tech hub. It's just a great mid-sized city with roughly the same number of tech jobs as any other mid-sized city.

That's part of it, yes. The other part is that we pay engineers roughly market rate for our area, but we pay support significantly above that. Our philosophy is basically that everyone who works here should make a good living regardless of what their job is, so we're going to pay everyone that baseline. Certain employees (like engineers) might make more because the market demands it.

To be more specific, we start our support people at $53k/year and guarantee $10k/year raises for their first five years. We start engineers at $71k and guarantee the same $10k raises. So engineers are definitely making more, but in terms of the fully loaded costs to us, they're not that different.