Will Hawkins 🚀

@founderschoolhq for solo founders trying to bootstrap profitable web apps.

[Will Hawkins 🚀 @WillLovesNoCode]

Here's the entire curriculum of FounderSchool (https://t.co/SvjnCTstPU). It's everything I've learned about software development in the last 10 years. All written from scratch. Mostly wisdom born of experience (i.e., mistakes). Not a task list. An execution system. No bullshit. No fluff. Waitlist open.

[Will Hawkins 🚀 @WillLovesNoCode]

@fiveoutofnine It was a long day.

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[Will Hawkins 🚀 @WillLovesNoCode]

@denk_tweets On the one hand, experienced engineers can rotate keys, audit logs, and secure their apps faster and more thoroughly than novice vibe-coders.

On the other hand, nothing accelerates a noob’s learning curve quite like panic, necessity, and a security breach.

[Will Hawkins 🚀 @WillLovesNoCode]

@Railway

[Will Hawkins 🚀 @WillLovesNoCode]

Rough day for @Railway users. And on the same day as #php2shell no less. Afraid we're in for a lot more of these in the near future. Buckle up.

[Will Hawkins 🚀 @WillLovesNoCode]

@danshipper @every Newsletters are dead bc email is dead. I write off about 99.9% of what hits my inbox 📥 .

Newsletters don’t stand a chance when they have to compete with 76,329 other unread emails.

[Will Hawkins 🚀 @WillLovesNoCode]

Same. I saw it in my SEO results before I saw it in my pipeline, both of which AI demolished over a period of about 6 months last year.

IMO the very clients who could afford $10k+ for an MVP (talented freelancer territory, but not yet agency territory) realized that they could build 80% of what they wanted by themselves with a $100/mo Claude code or codex subscription. And I don’t blame them. And unless you’re actively trying to build a production grade sass that you really intend to sell, the 80% build is good enough for a LOT of uses (internal tools especially).

Software may or may not be dead. Jury’s still out on that. But freelancing sure seems like it’s dying.

[Klaas @forgebitz]

stop selling to indiehackers

build software for companies already making money

a successful startup/company is not interested in vibe coding everything; they want stuff to work

they don't mind paying saas prices for things that add value

indiehackers will spend days replacing software to save $50/m (and that is totally fine)

yes a lot of internal tooling will be vibe coded, but there is so much opportunity right now to build software that just works and within an agent stack

i am a really big fan of building things in house (especially with ai now) but we are growing fast and we have no time to waste; we are not trying to save a few hundred $ a month

everything is moving faster, growing startups don't want to waste any time

[Will Hawkins 🚀 @WillLovesNoCode]

When the godfather of @Linux and git says “use AI”, seems wise to listen.

This is not an argument for slop. Just that AI is a legit tool in the toolbox 🧰 .

[Nikita Bier @nikitabier]

Technical moats are mostly over at this point. If you’re building something that is meant to be durable, the only moats now are:

• Proprietary data
• Network effects
• A physical component

[Will Hawkins 🚀 @WillLovesNoCode]

Indie devs always forget to value the time they spend building something that replaces an $8/mo SaaS.

Software is definitely not dead yet.

[Klaas @forgebitz]

"software is dead"

as a buyer and maker of saas i dont see this (yet?)

yes, i could vibe code my own crm, my own cms, ats etc.

but thanks to ai everything is moving faster, that means even wasting a week on making my own ats i would be a week behind

i can also just buy an ats, pay 200-400 a month and not have to deal with all the little details of running an ats (hint its a lot more complex than you think it is)

when you are running a small indie shop chances are that you can just run your crm in excel anyway; same with hiring

once you scale an org you have a lot of other things you have to deal with, meaning that vibe coding or even maintaining these tools becomes a nightmare (don't get me wrong, you can do this!)

imagine onboarding a sales team to your vibe coded crm, that will not be fun

but there is still a lot we build inhouse (which we probably would not have done 5 years ago)

but its more around giving ourselves an edge, what can we build that helps us improve the business, often its not a different crm but something added to the crm

i think most saas is already aggressively priced, i find ai much more interesting to build on top of these systems not replace them, i want ai to maximise them

[Will Hawkins 🚀 @WillLovesNoCode]

This is so true. And so frustrating if you’re a tinkerer.

[dax @thdxr]

a weird inversion with LLMs is the models improve faster than the tinkerers

when i see people with custom workflows and setups they're all addressing problems that don't exist anymore

the person naively using vanilla codex is more likely to be experiencing state of the art

[Will Hawkins 🚀 @WillLovesNoCode]

@JasonPynn Call me old fashioned but I think a president should know how to . . . use words.

[Will Hawkins 🚀 @WillLovesNoCode]

@johnrush The physical world was overdue for a comeback anyway.

[Andrej Karpathy @karpathy]

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks:

Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better:

Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better:

Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better:

Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work!

In summary:
- As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding.
- Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.

[Will Hawkins 🚀 @WillLovesNoCode]

@forgebitz Prolific and definitely worse is a bad combo for indie makers. Harder and harder to stand out now even if you do make something that is a good wedge in a small niche.

[Will Hawkins 🚀 @WillLovesNoCode]

ASD-STE100 is the way.

[Andrej Karpathy @karpathy]

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks:

Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better:

Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better:

Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better:

Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work!

In summary:
- As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding.
- Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.

[Will Hawkins 🚀 @WillLovesNoCode]

@robinebers This is one of agents’ more peculiar habits for sure.

[Olly @helloitsolly]

Lots of founders are crashing out

A year ago AI felt like an incredible opportunity.

Most of us were able to ship faster, remove admin, and get time back.

Lots of engineering founders were even able to explore marketing for the first time: SEO, organic social, outbound.

Building complex systems that felt extremely productive.

But since then, a lot has happened.

Here’s some of the themes I’m seeing:

AI marketing isn’t working. At first it feels impressive and it looks good but for most it’s not driving results. This is made worse by the fact everyone has access to the same tools. Inboxes are flooded, buyers are fatigued, the economy is flat.

Engineers are fried. Yes you can ship more but for many the flow state has gone. It’s a new way of working and it’s not for everyone. The speed leaves many of us exhausted before 11am.

There’s a feeling of what’s the point? Is my product’s next feature going to be redundant in a year, or a month? Can’t AI do what my business does, better?

SaaS valuations have collapsed. From 3-4x revenue to 1x. There’s a sinking realisation that a large number of SaaS companies will go to 0 in the next few years. Building to exit seems almost crazy right now.

There’s far fewer buyers and far more sellers. These include vibe coders cloning products without the care or craft, contributing to the distribution challenges from people doing it the right way.

Lots of people are trying to make money by selling shovels. This just adds to the frenzied energy.

Build in public stopped being fun. A few makers realised that the new game is attention, and now everything feels insincere and stunt-driven. They are influencers not founders. Changes to the X timeline compounded the issues.

There are exceptions and there are still moats remaining, but the challenges feel existential