BC SOFTWARE
Saved by @Alex1Powell

One of the big promises of software is composability. You can build rich, powerful experiences out of basic building blocks.

APIs add new things to the toolbox. For example: Treasury, which lets an app/platform store, move, and track a business’

 I've been a small business owner and can talk at length about SMB banking, and will later, but let's put on the software developer hat right now.

Lots of software talks about money, keeps records about money, does calculations about money, but can't *touch* money.
This is extremely frustrating when you're building SaaS apps for businesses, because you have total control over your UX right until your app needs to touch money... at which point all data about it lives in a silo you can't access.

So you generally push work to the operator.
For example, suppose you’re writing a business-in-a-box system for electricians, including an invoicing feature.

You need to be able to read bank transactions to reconcile. You probably can't. The owner can. So you ask the owner to do mind-numbing work a computer does better.
It sure would be great if your business customers had bank accounts you could actually introspect and operate on their behalves! You could just get the list of incoming payments and match against the invoices.

There is some software to write but it is not rocket science.
Stripe Billing goes to some crazy lengths to do this (virtual bank accounts, bespoke contracts with banking partners, etc); most SaaS companies offering invoicing as a feature probably shouldn't. You would want to spend your developer time elsewhere.
Stripe Treasury, now in limited beta, will allow software companies to provision money management accounts for their users, and then operate on those accounts like they expect to operate on data, servers, Stripe charges, or anything else you have an API for.
What’s the difference between a money management account and e.g. a standard banking checking account? As a user, not that much. You get a card to buy things with and get cash, and the ability to send ACH payments, bill payments, and the like.
The distinction is mostly implementation-layer concerns in banking-land.
It's difficult to envision what you can create given powerful primitives. Almost everything you see on a screen sits on top of NAND gates; looking at a NAND gate doesn't show you Twitter.

But let me speculate a bit:
B2B SaaS which deals with money, which is most of it, just got a whole lot more interesting, because it can directly operate on the money.
Take Shopify, for example. Shopify gives users an online storefront, and naturally needs to keep track of the total in the virtual register.
But with Stripe Treasury API, Shopify launched Shopify Balance, which lets them build a much better register. They always know the real total inside of it, not just what "should" be there.

They can automate its operations.

https://t.co/fMOqHh2Tlv
And because of Stripe's global payments and treasury network, we didn't just make these capabilities *accessible* to developers.

We made it *better* for your users than many business bank accounts.
What does every small business care about? Cash flow. What's a top 10 customer support request for every business which sees funds flows, like Shopify?

"When do I get my money?"

Can you imagine needing to email Google to ask when that email that you know was sent will arrive?
If the money just arrived faster, there would be less angst for users whether it would arrive at all. Less tickets opened. Less questions you can’t usefully answer.

Why is money *so slow* and *so opaque*?
*sigh* That is a complicated topic, but at the end of the day, you're generally rate limited by the slowest rail between where the money comes in and where it goes out.

In the U.S., you’ll often be blocked on the ACH network. Fast compared to stagecoach; slow compared to email.
But with Stripe Treasury, money doesn't have to lag its way through the ACH network between a customer paying it and a business receiving it.

Stripe has an arrangement with the banks that ultimately hold the business users’ funds.
So when your software says "OK, disburse the money they've earned from the platform", it's in their account (and spendable!) on the same day.

(We are working on making that even faster by default. It’s not called HTTP 200 Check Back In An Hour.)
SaaS platforms are one use case for Stripe Treasury, but you can envision another one: novel fintechs, with different UXes, brands, and target business users, built on a core set of primitives.

Putting together fintech products is historically a pain in the keister.
Every significant feature you add requires an integration with a banking partner, often a *new* banking partner, often *several* banking partners.
That integration requires lengthy negotiations, bespoke legal work, approvals, etc just to unblock your engineering team.

Then your engineering team receives the spec, and the *real* fun begins.
We did away with most of that for Stripe Treasury, just like we did for Payments before it.

No negotiation required. No bespoke legal work. More of the necessary levels of complexity in touching money businesses depend on; less of the overhead.
And, of course, the care and attention to the developer experience that you'd expect from us.
A day may come when Stripe forgets what is was like to build software, when we ship a 400 page PDF file as the sole documentation for an API, but it is not this day.
So if you want to build a vertical fintech targeting carpenters? Offering payments in and out, a place to hold insured funds, and a card to spend them with?

You can build all of that on Stripe APIs now.
And if your users need financing? Snap in Stripe Capital for Platforms and we can facilitate access to loans based on their predicted future revenue through your platform. https://t.co/Ye28gyMPRh (This also came out this week.)
And now, back to being an erstwhile small businessman who has had bank accounts for many years.

AAAAAAAARGH.
Small business banking has a poor UX, because of structural issues.

It is managed at most banks as an offshoot of personal banking, because the userbase is basically the same people who show up at the branch.

But the needs are quite different.
Banks specialize in one-size-fits-most products. The basic checking account you have is designed to cover more than 60% of the total population. It functions effectively the same for almost all of its users.
This kinda makes sense for individuals. Financial circumstances differ, but tend to rhyme: money in from a job or pension; money out to housing, utilities, debit card payments; some cash management.

(Narrator: This is not, in fact, an adequate spec for a checking account.)
But the needs of businesses are _wildly different_ from each other!
A small scale landlord cares quite a bit about mortgages and timely rent collection (and super-timely notice of non-payment), but rather little about payroll or expenses for consumables, and probably almost nothing for cash management.
A pizzeria, on the other hand, thinks it is inconceivable to make almost all the money on one day a month, spends most of revenue on payroll and consumables, and cares quite a bit about cash management.
These businesses deserve fundamentally different application-layer experiences from their banking. And they don't get them, because banks are incapable of offering hundreds of vertical software solutions.
(Just making the one-size-fits-most personal banking and mobile apps *actually good* is hard enough! It seems like we’re just getting there in the last 5 years!)
Who does offer hundreds of vertically-specialized application experiences? The software industry. Shopify specializes in e-commerce merchants and understands them, thoroughly. They don't sell to dentists.
Dentists have thriving ecosystems of firms that live and breathe every aspect of their practices.

So do graveyards. And hotels. And landlords. And spas. And tutors. And yoga teachers. And...
Why is software so varied but banking so… not? One reason is that businesses pay an awful lot for software, but pay relatively little for banking. Banking is a scale game.

Not enough dentists pay not enough dollars for banks to put software teams against dental practice UX.
But because a software company can address dentists by the nation, not by the square-mile-around-a-branch, and because they charge more, a software company serving dentists can reliably generate enough money to pay an engineering team.
Here Stripe acts as an aggregator: we can gather up *many* businesses attached to *many* software companies. These product teams understand their customers’ businesses *thoroughly*.

We can then take that package to leading banks. That reach is *very interesting* to them.
That is why Goldman Sachs, Citi, Barclays, and Evolve Bank and Trust partner with us.

A pizzeria can't walk into Goldman Sachs and walk out with a bank account.

A software company serving pizzerias could if they had, uh, a lot of dough.
But a material chunk of the software industry, that's a different story altogether.

And so our partner banks have made great products available, at pricing and terms that small businesses just don't usually get in direct banking relationships.
Take account maintenance fees. Please.

I know exactly how many times I paid the $14 account maintenance fee for my software businesses, ten years later. That’s how much I hated them.
I had gone below $X,000 in deposits (I was bootstrapped! Rent was due!) and hadn’t managed to spend at least $250 on the debit card because, whoops, mis-timed a billing cycle by two days.
(Being a bit older and wiser I probably should have just considered that $14 a cost-of-doing-business and spent my time on sales, not timing debit card transactions, but my emotional state at the time was closer to “Gah I feel like a chump.”)
We have agreed, with our partners, on a pricing structure where a SaaS company or fintech doesn't need to charge an account maintenance fee.
(As the software company, you *could*, because you control your pricing, but presumably you will make better choices, and your users will not say, ten years later, “I trusted you, and you made me feel like a chump. Six times.”)
How is this possible, and why didn't the banking system do it years ago?

One way to think of it is that banks have huge expenses to attract SMB deposits, including marketing campaigns and branch networks, and those drive the pricing of SMB banking.
The cost of *servicing* SMB accounts has gone down over the years, now that account statements are not calculated by highly-trained artisans, but the cost of *acquiring* them is increasing over time.

Nationwide advertising, branches, and sales reps aren’t as cheap as cron jobs.
Since the software industry is doing their own customer acquisition, and there is sharply less need for the branch network (itself more a sales tool than a servicing tool), some banks are happy to pass the savings back to Main Street.
There's obviously a lot more detail here (hosted onboarding flows, KYC and AML compliance workflows built for you, all accounts have deposit insurance, etc), but I have to end this tweetstorm somewhere.

I'm very excited to see what software people do with the Stripe Treasury.
Anticipating a FAQ: "Is this the product you were referring to here?"

No. This was my number two. You're welcome to your guess at the number one. (Though, who knows, I heard of a new project last week and might steal the zeroth spot for it.)

https://t.co/osjjx8gNM0

More from Patrick McKenzie

Patrick McKenzie
Patrick McKenzie
@patio11
If an employer is willing to be abusive to you prior to hiring you, when you have maximum leverage and they are maximally incentivized to play nice, I think that gives you *extremely actionable* signal as to how they'll treat you when you're working there and dependent on them.

For candidates: evaluate prospective employers accordingly.

For startups employing e.g. engineers: given that your candidates should evaluate you accordingly, be *extra special* careful to operate like professionals with regards to e.g. interviewing, offers, and negotiation.

"Can you be more explicit about 'abusive' here?"

Not without violating a confidence, but as someone who has been on hiring side of table and is a capitalist, there are *clearly* things you could do which would be "sharp operating, but we're all sharp operators" in some contexts.

Hiring employees is often not one of those contexts. The nature of the relationship, the asymmetry in power, and the social contract strongly counsel you to be a lot better there than you are minimally required by law / contract.

A thing which aesthetically frustrates me is that a lot of the things I've heard companies do here serve *no legitimate business purpose.* In some cases it's getting tens of dollars of advantage. TENS! On an engineering candidate!
ALL
Patrick McKenzie
Patrick McKenzie
@patio11
I like this heuristic, and have a few which are similar in intent to it:


Hiring efficiency:

How long does it take, measured from initial expression of interest through offer of employment signed, for a typical candidate cold inbounding to the company?

What is the *theoretical minimum* for *any* candidate?

How long does it take, as a developer newly hired at the company:

* To get a fully credentialed machine issued to you
* To get a fully functional development environment on that machine which could push code to production immediately
* To solo ship one material quanta of work

How long does it take, from first idea floated to "It's on the Internet", to create a piece of marketing collateral.

(For bonus points: break down by ambitiousness / form factor.)

How many people have to say yes to do something which is clearly worth doing which costs $5,000 / $15,000 / $250,000 and has never been done before.
ALL
Advertisement
Patrick McKenzie
Patrick McKenzie
@patio11
My friends @robwalling and @einarvollset just launched TinySeed, an accelerator for software companies where a successful outcome is a healthy, sustainable business rather than attempting to ride the rocketship trajectory. https://t.co/LSHqZNcVid

I have some thoughts:

As somebody who bootstrapped ~4 companies, I feel like I had to make some clearly suboptimal decisions early in them for lack of what is, in hindsight, not all that much money. But there's a huge gap in the product space for investment options.

It's weird: you can get $25k from Amex trivially, and angels are very willing to write a check for that much, but you have to make representations about your goals/ambitions/market/etc which don't really apply to everyone.

And so you see the traditional angel/VC ecosystem fund companies where honestly the returns are probably not there, and this is knowable pretty early, but the chase of them will wreck what could have been a perfectly happy business.

(To make the math work for traditional VCs the company has to at least have a market-appropriate shot of $100 million a year. There are a lot more $10 million a year companies than $100 million a year companies. That is *not* a bad terminal outcome for founders/employees.)
ALL
Patrick McKenzie
Patrick McKenzie
@patio11
Most software founders, particularly in B2B, need to get radically better at sales. @Steli , who is the best person for explaining the scrappy stages in the beginning and then building out a team with scripts and processes, wrote a guide to:

For technical founders it is irrationally, obscenely hard to reverse years of programming (ba dum bum) that sales is a value-destroying activity. Sales is CLEARLY a value-creating activity, contingent on you have a value-creating product.

The world will not drop what they are doing to adopt your work. This is particularly true in B2B, where simply building a better mousetrap won't overcome the activation energy required to get people with additional non-mice problems to prioritize changing mousetraps today.

This is very non-obvious for founders because founders are not often people who *want* to be sold to. We often come from a background where trying out tools is a bit of a fun hobby. We like looking at all the options, making charts, and ripping out partially complete tests.

"This week I unsuccessfully trialed four software options for automating that thing that has been killing us. Our actual production process remains the same as last week. Don't worry; this was a great use of time." is not a thing you want to write in a progress report to manager.
TECH
Patrick McKenzie
Patrick McKenzie
@patio11
The payments wars in Japan are heating up and one of the battlegrounds is convenience store coffee.

“Coffee? What does that have to do with payments?” I’m glad you asked.

Convenience stores are low net margin businesses, which sell some high gross margin goods/services but a lot of low ones, and have high fixed costs and a low ticket size. The typical transaction is under 500 yen ($5) and many are about $1.

They need repeat custom.

A few years ago, all of the chains had a good idea for increasing frequency of use: make a minor capital investment in automatic coffee machines. Sell access to them for the price of a cup / ice; customers self-serve with the machine.

The price point is $1 to about $2.

Coffee quickly became one of the most frequently repurchased items at convenience stores, in no small part because it’s the one thing they can sell which is phameceutically habit forming but totally unregulated. (Just telling it like it is.)

But the coffee is not very defensible

The problem, such that it is, is that competing chains are everywhere and *all* of them serve Thoroughly Adequate Coffee at similar prices, so you’re back into the brutal economics of “Who is 3 meters closer to 40 customers at 1 office?”

Enter payment apps.
FINANCE

More from Software

GSK | https://secure.actblue.com/donate/ab_mn
GSK | https://secure.a...
@gosokkyu
forgive my indulgence but 2020's been a big year for @shmuplations, so here's a look back at everything that went up over the last twelve months—there's a lot of stuff I'm sure you all read & other things you'd be forgiven for missing, so let's recap (thread)

the year kicked off with shmuplations' first big video project: a subtitled translation of a 2016 NHK documentary on the 30th anniversary of Dragon Quest which features interviews with Yuji Horii, Koichi Nakamura, Akira Toriyama, and Koichi Sugiyama https://t.co/JCWA15RTlx


following DQ30 was one of the most popular articles of the year: an assortment of interviews with composers Yuzo Koshiro and Motohiro Kawashima concerning the music of Streets of Rage 1, 2 & 3 https://t.co/QUtyC9W12Z their comments on SoR3 in particular were full of gems


Game Designers: The Next Generation profiled six potential successors to the likes of Shigeru Miyamoto & Hironobu Sakaguchi, some of who you may recognise: Kazuma Kaneko, Takeshi Miyaji (1966-2011), Noboru Harada, Kan Naitou, Takashi Tokita & Ryoji Amano https://t.co/lWZU3PLvwX


from the 2010 Akumajou Dracula Best Music Collections Box, a subbed video feature on long-time Castlevania composer Michiru Yamane https://t.co/NMJe4ROozR sadly, Chiruru has since passed; Yamane wrote these albums in his honor

https://t.co/orlgPTDsKK

https://t.co/QnQl8KI9IX
SOFTWARE
Eric Seufert
Eric Seufert
@eric_seufert
Facebook -- having taken out full-page ads in the NYT, Washington Post, and WSJ -- is generally seen as the primary victim of the new app privacy controls coming in iOS14. But Google is perhaps even more vulnerable to ATT. Why has Google remained silent? (1/X)

2/ First, background: here's a high-level overview of how ATT / IDFA deprecation impacts advertisers and ad networks, and why this whole ordeal has put advertisers and ad networks into a state of panic:

3/ Google is equally as susceptible to harm from ATT as Facebook. Google's UAC product -- esp its tROAS and tCPA campaign objectives -- relies as much on IDFA-indexed monetization and engagement data as FB's mobile product does. But Google has one big weakness wrt ATT: YouTube

4/ Broadly, view-through attribution accounts for a disproportionate % of conversions from YouTube app install impressions. This means: user sees the YT ad, doesnt click, downloads app later, & Google is able to claim it by reconciling IDFA seen at impression to IDFA seen in app

5/ View-through attribution is nonexistent in the ATT paradigm as it relies on the IDFA; some significant portion of YT's attributed conversions will evaporate. So why isnt Google vocally opposing ATT? Two reasons: consumer optics and its duality as ad network / mobile platform
INTERNET , SOFTWARE
Advertisement
Pratham \U0001f468\u200d\U0001f4bb\U0001f680
Pratham 👨‍💻🚀...
@Prathkum
Let's create Phineas using CSS in few simple steps😄

THREAD🧵


STEP 1. Create a head

create a triangle and rotate it so that it looks like a head


STEP 2. Create smile and ear

We have a pseudo elements in CSS, so we can create smile and ear using head::after and head::before


STEP 3. Create eyes

This is the most trickiest part because in order to make an eye we have to create

- One bigger white circle
- then a small black pupil inside white circle
- then a small white reflection in black pupil

Let's create a outer white circle first


STEP 3(I). Create a black pupil

We can create pupil using pseudo element
SOFTWARE , SNIPPETS
Matt Bennett
Matt Bennett
@LongvueMatt
There is real opportunity to:

- scale a HoldCo
- focused on a portfolio of software & digital-forward assets
- serving niche and/or traditionally sleepy verticals

A playbook to follow...

But first... why is there opportunity?

- software is eating the world (& APIs are eating software)
- there are great product opp's for those who know where to look
- theres no real competition
- SaaS/subscription is the best delivery model out there (build once, sell twice+)

And why now?

We’re entering what I call the ‘Deployment Era’ ... where more traditional (sleepy) businesses will increasingly leverage software/tech to improve their model

And the best part is... we're on the front-end of riding this longer-term wave

So what does this mean?

Software (& other digital-first products) will eat more of the ‘traditional SMB’ stack

But most aren’t focused here bc it isn’t sexy or cool…

Which is where the opp is for those who have the right deal nose & know what to build & for who

There is big opportunity to build/scale in overlooked places...

Where you can build/acquire assets that have the best econ delivery model (SaaS/sub), w/ low competition, where you have an inside edge/know everyone in industry, & can do it when no one is looking
SOFTWARE
Harsh Bothra
Harsh Bothra
@harshbothra_
#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)

(2/n)
1. CVE-2020-14179 (Information Disclosure)
a. Navigate to /secure/QueryComponent!Default.jspa
b. It leaks information about custom fields, custom SLA, etc.

2. CVE-2020-14181 (User Enumeration)
a. Navigate to /secure/ViewUserHover.jspa?username=

(3/n)
3. CVE-2020-14178 (Project Key Enumeration)
a. Navigate to /browse.
b. Observe the error message on valid vs. invalid project key. Apart from the Enumeration, you can often get unauthenticated access to the project if the protections are not in place.

(4/n)
4. CVE-2019-3402 (XSS)
a. Navigate to /secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search

5. CVE-2019-11581 (SSTI)
a. Navigate to /secure/ContactAdministrators!default.jspa

(5/n)
6. CVE-2019-3396 (Path Traversal)
7. CVE-2019-8451 (SSRF)
a. Navigate to /plugins/servlet/gadgets/makeRequest?url=https://:[email protected]
8. CVE-2019-8451 (SSRF)
a. Navigate to
SOFTWARE

You May Also Like

Michael Dearing
Michael Dearing
@mcgd
An irony of facebook's situation.

Sheryl got her MBA at Harvard. One of the most famous cases (Extra Strength Tylenol) in one of the most famous classes (Business History) she took: in 1982, someone put cyanide in Extra Strength Tylenol capsules and killed 7 people in Chicago.

What do you do when someone turns your product into a weapon? When they use the system you built to harm? James Burke, CEO of J&J, was shockingly open with the public, he pulled the product and made significant packaging changes to make product safer (but not tamper-proof).

He over-shared every step along the way re investigation, redesign, stood up as both CEO and human. The reintroduction of new Extra Strength Tylenol succeeded. Burke saved the brand.

But four years later it happened again. A killer put cyanide in the capsules, this time a woman in Yonkers died. Same CEO, Burke, pulled the product again, completely changed the form factor from capsule to caplet and relaunched *again*. It worked *again*. How'd they do that?

Burke (CEO) tapped J&Js goodwill bank account w/ the public. Two big withdrawals from that bank account in four years + 8 dead bodies! But his honesty, openness, humanity (choked up about the deaths more than once), humility kept the goodwill bank balance positive the whole time.
TECH
Damodar Hegde
Damodar Hegde
@DamodarHegde4
MUST READ TILL END:
FB POST BY MR PRABEER BASU,
IAS-1976(BIHAR)
" Received a hurtful post from an old friend and colleague. He was on my daily Broadcast list of WhatsApp. He requested that I do not send him any of my posts on 'political' issues. I gave him a long explaination
>2

2/29
on why I write and what I write. But he was not convinced.

Being alerted by him thus, I felt I should clarify to all who read my posts on what exactly I think and do.

The charge against me is that I wrongly support our current Prime Minister, Shri Narendra Modi..
>3

3/29
and that it establishes I am not rational and impartial anymore.
Let me try and explain.First and foremost,I do not write on 'political' issues. I write on 'national' issues. For example, I have no opinion on whether Rahul Gandhi should be President of his party or not.
>4

4/29

Similarly, I have no views whether BJP is a better party than Congress or vice versa.
Even after 36 years in the IAS I have no MLA, MP or anyone involved in politics whom I can classify as my friend or even acquaintance.
>5

5/29
So, naturally I don't care which party wins or loses as long as the winning party runs an honest government doing good to my nation.
Now, why I speak in favour of Shri Modi:

1. Ever since the beginning of my service I realised that Planning Commission was not serving..

>6
INDIA
Advertisement
Guillaume Chaslot
Guillaume Chaslot
@gchaslot
The YouTube algorithm that I helped build in 2011 still recommends the flat earth theory by the *hundreds of millions*. This investigation by @RawStory shows some of the real-life consequences of this badly designed AI.


This spring at SxSW, @SusanWojcicki promised "Wikipedia snippets" on debated videos. But they didn't put them on flat earth videos, and instead @YouTube is promoting merchandising such as "NASA lies - Never Trust a Snake". 2/


A few example of flat earth videos that were promoted by YouTube #today:
https://t.co/TumQiX2tlj 3/

https://t.co/uAORIJ5BYX 4/

https://t.co/yOGZ0pLfHG 5/
TECH , FLAT EARTH
We The Inevitable
We The Inevitable
@WeTheInevitable
This is from the official Under Secretary of Defense for Intelligence DOD account on Twitter. Ezra Cohen-Watnick - after being appointed by Trump to chair an influential declassification board - "likes" a tweet that implies he is "Q."
119/7 = 17 & Q = 17

https://t.co/LQShObYZqn


I can’t find the like , or it appears to have been “unliked” but here’s a video of someone who claims it was there just a few hours ago


This comes from the JFK grandchildren video singing “Timber”

@ 0:50 👀

https://t.co/AmjDZ74kCl


Check the domino. Posted to 4ch it has zero returns on tineye


Now check the domino
Posted to 4ch it has zero returns on tineye
TWITTER
Zach Weinersmith
Zach Weinersmith
@ZachWeiner
Hey, for people interested in this stuff, here's a thread about a change we made to running our facebook account:

So, about 5 years ago, we got on facebook. Why? Well, facebook has a big audience and they like to consume on facebook. So, we started posting comics there, even though we got paid nothing and facebook made money off the free content.

Why? Because back then, once in a while, you would say "also hey, I sell books" or "hey, I'm going to be signing at this event" and your facebook followers would actually see it.

Effectively, the implicit old arrangement was "facebook lets me reach readers efficiently, and I supply facebook with free content they run ads on."

Over time, like a bad business partner, facebook basically made it impossible to reach your audience without *paying them*. Thus, you supply them free content on which they run ads, and you get nothing in exchange.
MARKETING