Werd I/O

As part of the ongoing mid-life crisis that brought me electric blue hair and a new car, I’ve been thinking about getting a tattoo. Of course, if I’m going to mark my body, I’d like it to be the most meaningful (and potentially the nerdiest) image possible.

I have parameters. Given my family history, and the history of the twentieth century, I’d rather not use any kind of barcode, QR code (can you imagine?), or identifier. I also don’t really want words or any kind of quote. I thought about a waveform of my mother’s voice, but honestly, I don’t think she would have approved, and it feels a little like the 21st century equivalent of drawing “mom” in a heart. I qualify for a semicolon tattoo, but I don’t want one of those either.

Maybe an and gate? A symbol representing Earthseed’s God is change? A TARDIS? It all feels very stereotypical.

Maybe I’m just too fickle. It seems so permanent, and the me I am now is not the same person I’ll be in two, five, twenty years. On the other hand, I like the idea of marking life like rings in a tree.

Do you have a tattoo? Is it meaningful to you? What did you get?

Startup culture as popularly described is a sham. You can read all the books you want on the subject, but the most successful companies build their culture from the ground up based on the same kind of learning cycle that they use on their customers. To succeed, you’re going to have to attract the best people - people who have a ton of options, many of which probably pay better than you do - and you’re going to have to find ways to keep them there.

Particularly in today’s market, if you’re not treating people well, they’re going to find something better. If you create a hustle-rich, competitive, aggressive environment that makes people feel like they’re under attack, they’re going to go find a place where they don’t. If you create a culture of long hours peppered with inflexible meetings, you’re going to lose the parents and carers who likely also happen to be your most experienced colleagues (as well as one where women, who largely still bear the brunt of parenting, are less likely to feel welcome). Your culture has to be one of deeply-held respect: not just of the expertise of every employee, but of what they bring as a three-dimensional human, and of their lives outside of work. If you think of people as a fungible resource, they’re going to feel it.

There’s no glory in working nights and weekends, and there’s nothing laudable about asking people to do so. Startups are a marathon, not a sprint. All your employees have lives beyond work. None of them are anywhere near as invested - in the literal, company-ownership sense, but also emotionally - as you are. As a founder, you might be burning the candle at both ends, but when the startup exits, you have the most to gain. Generous options help here, but if employees don’t feel like they have a strong say in the direction of the company, they’re little more than a lottery ticket from their perspective; a get-rich-quick scheme. If they lose trust in you, if they don’t have enough options to make a meaningful difference in their lives even in the event of an exit, or if the option price is so high that executing them is out of reach, or if there aren’t meaningful triggers, any kind of motivating factor that options could have brought is lost.

Even for founders, those long days come with diminishing returns: most knowledge workers can muster six hours of focused work at best. After that, anyone’s work is low-quality. In a small team, that means you’ve got to focus on building the smallest, simplest thing you can: a clearly-defined plan you know you can execute well with the time, team, and resources at your disposal. Because all of those things come at a premium, built-in ways to fail fast and learn quickly are incredibly important. A growth mindset and a nimble approach are more important than an “agile” one: paint-by-numbers scrum ceremonies aren’t going to save you, but short work sprints built around learning loops might.

That also means optimizing your workday for flow: removing meetings and interruptions so people can actually get work done. (Talking in meetings isn’t work; at best it’s a tactical huddle, and at worst it’s the performance of doing work.) As Steve Galevski put it in HBR a few years ago:

By cultivating a flow-friendly workplace and introducing a shorter workday, you’re setting the scene not only for higher productivity and better outcomes, but for more motivated and less-stressed employees, improved rates of employee acquisition and retention, and more time for all that fun stuff that goes on outside of office walls, otherwise known as life.

People have to think and reflect on their work to do it at a high quality. To be able to do that, they need time, emotional safety, and rest. If you create an environment of constant interruptions, long hours, and a lack of emotional safety, you’re shooting yourself in the foot and then some. Yet that’s exactly what a lot of startup porn advocates for, and where work has begun to go during the pandemic: a world where you can’t escape work, with numerous interruptions, long hours, and an underlying aggressive culture of hustle.

What modern startup employees are looking for is an inclusive place where they can do great work, live well, be treated with respect, and be compensated accordingly. It’s not hard, as long as you stop to really think and care about them. The catch is that many founders don’t.

Rewriting software from scratch is usually a terrible idea. But I’m thinking about it.

The Known open source codebase is now 9 years old; a PHP kludge that I wrote while my mother was recovering from a double lung transplant still powers my site and many others. It became the foundation of my second startup, and is still an open source project today. But there were a number of years when I didn’t pay attention to the codebase, and there’s a lot to unpick.

Meanwhile, the hosting landscape has completely changed. It used to be that you’d buy some space with a shared host and upload files via (S)FTP; these days virtual hosts are commonplace and getting easier to use. There are one-click installation buttons for Heroku and other hosts.

I’d like to clean PHP Known up, and I’m trying my best in between all the other things that are going on in my life. Probably that should mostly be about getting to another stable release: a lot of the architecture has been changed (by other developers) and a lot of users are having trouble installing it. So bringing that back to accessibility would be nice.

I also want to fix import / export, so that people can take their Known content and use it elsewhere. A lot of folks, rightly, would like to migrate to WordPress or Ghost in particular. They should be able to do that with ease.

But I also like the idea of going back to basics with Idno, the underlying platform, and thinking about it again. The original core idea was that you could create a stream of arbitrary content, set fine-grained permissions on it, and both post to it and consume from it in a bunch of different ways. If you wanted to post via the web, great; via a webhook, API endpoint or common standard like Micropub, also great. Likewise, reading via the web, JSON, RSS, MRSS, ActivityStreams, and so on would all be easily possible. Permissions would limit both reading and writing to a customizable set of people, from everyone on the internet down to one person.

That’s not really where Known ended up going, but I still find that potentially interesting as a project. Instead of PHP, I’d be more inclined to write it as a Node service these days (or use it to learn something I’m less familiar with, like Go).

I wish I had more time to work on these sorts of projects. But it’s something I’d love to figure out how to fit in: I want to clean Known up, and return to Idno as a way to write scalable streams of arbitrary content. In the meantime, it’s fun to think about.

I just (almost) got phished! It’s a little embarrassing, but I’m hopeful that sharing this will help others.

I got a pretty call on our landline (yes, we still have one) telling us we were about to have our power disconnected for non-payment. They had our address, PG&E account number, and account name.

To deal with the issue quickly, they had me call a separate 877 billing number. It sounded like PG&E: they had the call system set up and a convincing-sounding address check.

We genuinely had a late payment, because the account was in my mother’s name, and I didn’t get the notification. So I asked to make an emergency payment to prevent the disconnection. Everything up to this point sounded legitimate, except that they hadn’t seen my previous payment in their account system - and I just brushed it off as being a legacy business not having its shit together. Because PG&E is legendarily awful, I was prepared for the information they gave me to not quite add up. Were it a professional, modern organization, it would have been harder to convince me.

It was only when they tried to get me to Zelle a payment to an individual that I became suspicious, asked some verification questions, and disconnected the call. Even then, I didn’t consider it beyond the bounds of possibility that PG&E had a super-janky payment system for emergency payments, so I was worried. But yes, to date, the power has not been disconnected.

I didn’t give them any payment or personal information. But they clearly had some of mine already, so I’m going to be checking my accounts and resetting some details.

I’ve been involved in a few projects that involve sensitive information and vulnerable communities (and a few others that involve potentially large sums of money). My own security stance directly affects the people I’m involved with. These attackers just wanted some money, but there are others who could easily want to harm others by getting through me. This was a wake-up call that wherever I think I’m at with my security mindset and practices, I need to do more.

Obviously, I feel like an idiot. It also made me realize how much PG&E’s shoddiness added to my vulnerability. If I felt that it was a company I could trust to do the right thing, I would have cottoned on far earlier in the process. But when a company already feels like a scam when it’s operating its day-to-day business, it’s really hard to distinguish an imposter. It’s another reason for every company to operate at a very high quality, and to only pick very high quality suppliers (and to not allow undemocratic monopolies in California’s energy markets).