BuildZoom is a better way to remodel. We connect homeowners to the most reliable general contractors in their area and make remodeling simpler, cheaper and more predictable. Our technology harvests public data on every licensed contractor in the United States, including license information, building permits, bond and insurance information and other government records. We also collect homeowner reviews, peer endorsements from contractors and partner with private groups to help consumers make the right decisions. Contractors get tools to upload project photos, additional information about their business and connect with new clients. Meanwhile our home improvement forum lets them build credibility and improve their BuildZoom ranking by answering homeowners’ questions.

BuildZoom

Zoom has been in news a lot lately. It has gone from being an enterprise solution to a household name pretty fast. Its daily users have risen from 10mn to 300mn in the last 4 months. Its stock price has also risen significantly up. While Zoom is growing exponentially (much like the number of corona cases), let’s dig a little bit deeper into what laid the foundation of such an overnight success. I am ignoring all the security issues Zoom has been bomb blasted with here. Zoom and the Red Ocean Strategy Zoom was founded in 2011 when Eric Yuan decided to quit WebEx after working there for 14 years. 10 years he spent at WebEx and subsequent 4 years at Cisco WebEx (after $3.2bn acquisition of WebEx by Cisco). WebEx was, in fact, one of the first SaaS (Software as a Service) companies ever. They had the SaaS model even before Salesforce, which many consider as the first SaaS company. WebEx was a videoconferencing solutions company and Eric was one of its earliest employees (9th engineer). After working so long at the company, he wanted to build a new video conferencing solution for Cisco. He felt that there were a lot of legacy issues with the current solution and new-age customers had different needs. Even though he was VP Engineering he could not build it inside the company. The Cisco leadership then felt that “it would cannibalize the existing market.” Wow! Talk about missing out on an amazing opportunity. Eric went on to quit the company and raise a bunch of money. He decided to build a new video conferencing app in a market full of big incumbents. The list included big companies like Skype, GoToMeeting, WebEx as well as well-funded startups like BlueJeans. This goes against a lot of startup advise. Conventional wisdom states that one should try to find a market with lesser incumbents or have a very differentiated/unique value proposition. Zoom did none of that. Let’s try to understand why would he not adhere to conventional wisdom: He had managed to raise $3mn from people who were willing to invest in him (as opposed to the business). A lot of the investors did not even know what Eric was working on. This would definitely have provided him with enough confidence/firepower to power through When you look top-down on the video conferencing market, you do see a lot of competition. But whenever Eric talked to his customers, none of them were happy with their videoconferencing solution. Customers were deeply dissatisfied in spite of so many solutions. I can attest to that as well. Video conferencing never used to work seamlessly. But just because users are unhappy, does that mean a new startup can be built on top of that problem? What if it’s technically not feasible? If Google/Cisco of the world, with all their technical might, can’t solve this problem perfectly, how can a small startup do that? That’s what most of us would think. I believe what made Eric think otherwise would be the fact that he had already done that for 14 years. That too for one of the top companies in the space and from scratch. I think another example of the same approach would be . Almost everyone I know hates email but can’t do away with it (in spite of Slack). Even though there were a bunch of email clients already, both by big companies as well as startups, Superhuman founders thought they could solve this problem better than them. Superhuman Lesson here. Sometimes it’s a good idea to not be too bothered by competition. If the users still feel the problem, and you have the belief that you can solve it. It’s probably a better idea than most others (given it’s already validated that a problem exists). A lot of times, we try to solve problems that don’t even exist for a large userbase. Zoom and its MVP When Eric left WebEx and raised $3mn before even starting with Zoom, he also hired 40 of his ex-colleagues. All of them engineers. Basically, from Day 0 he had a huge team of engineers. A lot of Silicon Valley products are built with “Move fast and iterate” philosophy, just like Reddit (which we covered in ). Eric was from a different school of thought entirely. our last edition of Product Stories He was in a building phase for about 2 years. He launched Zoom in 2013. Towards the end of these 2 years, he also had an engineering team of 130. That is a lot of engineers and a lot of time, especially in the startup world. According to Eric, if you are building a completely innovative product like Uber or Airbnb, then the “move fast and iterate” model of building products makes sense. But if you are building a product that competes with a bunch of other products, you need to make sure that your product works (and is better than everything else out there). A corollary of this (although it implies that one should build products with a more unique value proposition; the exact opposite of what Zoom did): 2 years is a large amount of time working on a product with no validation from outside. Eric himself agrees that he has had the urge to launch early many times but he had to fight that urge, to make sure that the product was right. Few of the finer product features they wanted to nail before launching: Maximum latency of 150ms even in choppy internet connections (150 milliseconds is the maximum latency before conversations feel unnatural) Even in cases of up to 40% packet loss, Zoom should seem to work fine. They prioritize audio over video in order to do that. In a meeting, choppy video is fine but intermittent audio makes the meeting intolerable No password and cross-device joining of the meeting (this was a big pain point with the current solutions of the time. Almost everyone required the new joinees to join via a password) Security features built-in to set them up for going to enterprise customers later on This worked fantastically for Eric but I am not sure if this is a lesson that is translatable to most other founders. Eric could do this because he had whole-heartedly believed in the problem and was playing the long-game. “Move fast and iterate” model is for times when you are not 100% sure whether you are working on “something people want”. In case you are not, it helps you to cut your losses and spend your time building something which people actually want. During these 2 years’ time, he also planned a lot around the business model and the go-to-market which I will cover in the next edition of this mail. But one example of extreme meticulousness would be the freemium limit in Zoom. Zoom one-to-one meeting are always free but for group meetings, it is limited to 40 minutes. 40 minutes is not just a random number. According to Eric and his WebEx experience, 45 minutes is the duration of most effective meetings and hence wanted to keep the free limit below that. Note that he did have to waste time doing A/B tests to figure out if this limit is the best for conversion or not. This enabled him to focus more on new features for the customers rather than optimizing this conversion funnel. If you look at Zoom’s growth post-2013, it is nothing short of a dream. It’s not just because of the fact that they are customer-obsessed. A lot of founders are customer-obsessed but they don’t see the kind of dream success that Zoom sees. What you work on is sometimes much more important than who you are. Also, a lot of the foundation of that hypergrowth was built in those 2 years. Lesson here. There is no one correct way of building products. It all depends. On the founder’s individual constraints as well as the market constraints. SMB vs Enterprise While Zoom did do some things that didn’t scale, a lot of things it did in its initial 2-year “product building phase” did end up scaling. One example of that would be their go-to-market strategy. While Zoom (like most of their contemporaries) wanted to serve the enterprise market, Eric knew it would be a difficult battle to begin with (especially in a market filled with biggies). As a result, he started with a heavier focus on the freemium model, which is generally meant for SMB customers. He figured he would start with the SMB market and simultaneously, keep on getting enterprise customers (where the sales cycles were much longer). Note that he never wanted to go to the consumer market as then he would have to rely on advertising as a business model; which according to him doesn’t make sense for a video call application. His freemium model (of keeping one-on-one chat completely free and a 40 max cap on group calls) provided him with enough leads to grow sustainably; while he kept going after the enterprise customers. In fact, his first paying customer was an enterprise customer (Stanford Continuing Studies) even though he started with more focus on SMB first. Zoom also did a bunch of billboards and NBA ads later on when his focus shifted on the enterprise more. that brand advertising is expensive but something one needs to do in order to shorten the sales cycle. If your company is something one has never heard of, it is very difficult to convince all the stakeholders involved in an enterprise sales deal. Eric believes This is the same strategy Slack followed. Provide a free product that works seamlessly, thereby providing with enough leads to you to build for the SMB market organically while you inorganically try and close enterprise deals. But there are very few problems that hit SMBs and enterprises alike. Zoom as well as Slack were lucky enough to find those. Early Metrics Talking about early metrics of Zoom might be a moot point because they were so good from the start that it’s practically of no viable learning for others (at least the numbers disclosed publicly). Metrics actively tracked by Eric during the initial days: NPS Score Daily number of meeting participants Number of minutes While 2 (or 3) are what can be constituted as North Star Metric, is a good check metric to ensure growth doesn’t come at the cost of existing users. NPS score essentially is a measure of how much your existing users like your product. NPS Score After couple of years of launching the product, Zoom’s NPS was 68 (30 is the average SaaS NPS score and 40 is a good score). Major video conferencing products were at 20 at that time. Zoom’s growth has always been fantastic. Probably one of the reasons why Eric does not pay much attention to it. They launched their product via a Wall Street Journal article and got 60k users in 1 day (this is even more than Instagram which got 25k users in a day on its launch). Cumulative user growth since inception: 0.5 years: 500,000 1 year: 3,000,000 1.5 years: 6,000,000 2 years: 10,000,000 2.5 years: 40,000,000 Their total users grew 40% month on month since their inception. This is a phenomenal feat to achieve. While there is very little visibility of Zoom’s revenue early on, it has grown from $61m to $331m in annual revenue in the past three years. 11% MoM growth rate in revenue in the last 3 years. One negative data point we do have is that a few VCs passed on Zoom early on because they felt that it had higher than normal churn. Eric explains that it was because customers were changing their individual plans to company-wide plans but we would never know. P.S. ICYMI Below's a video endorsed by . Product Stories

Zoom's Nine Year Path to Overnight Success 

The three keys outlined in this article will help product managers in agency settings implement Agile more effectively. Most modern tech companies rely on Scrum and Agile to create flexible, efficient and results-based digital customer experiences. While the core principles behind the Agile framework provide needed boundaries for effective and on-track project management, I've learned that restricting teams to all “ivory tower” protocols can actually be counterproductive and even impossible at times. This is especially true for product agencies, as opposed to product-based businesses. What are Product Agencies, Exactly? (And Why Pure Scrum Doesn’t Always Make Business Sense) In my 13 years of experience in senior product management, I’ve learned that business objectives should drive methods, not the other way around. In their purest forms, Scrum and Agile were designed for product-based companies operating full design and development teams on their own. These mature companies have reached the point in their business life cycle where it is most cost effective to build and maintain their products in-house. Their teams usually have multiple types of leaders, all employed under the same roof: product owner, product manager and Scrum master. The company’s sizable workload justifies this level of investment in human capital. Product agencies, on the other hand, help product companies that don’t yet have the bandwidth, capital or business economics to move production in house. To remain effective in an agency setting, agile methods must adapt in response to these simple facts: Multiple teams work across multiple projects, and individuals often fill multiple roles. Clients don’t have the budget to pay for by-the-book Agile development. That’s why they are hiring an agency. The 3 Keys of Adapting Agile A product agency's aim in using Agile methodology is to address the unique needs of established but digitally immature product-based companies. Agencies have to design and build software a cost that’s lower for their clients than building and retaining an in-house team. Over the years of working in this context, I've learned to adapt Scrum and Agile to each unique client and project while staying true to the principles that best serve business and user goals. Along my journey, I've found there are three general keys to making Agile work in a product agency setting. 1. Adapt to client needs. Paying customers don’t care about what the Agile handbook says. They just want to do what will achieve the best long-term results for their user base while earning most value for their investment. Adjusting Team Sizes & Roles Each role in Agile is critical to performance. These roles include developers, delivery leads, product owners, product managers, Scrum masters and more. Each role assumes accountability for a particular focus in the product development life cycle. If one role is missing, that area of focus will be neglected, producing a negative ripple effect on the whole project. That being said, sometimes a project or budget is small enough that it doesn’t require a full-time team with a different leader assuming each position. We’ve found it’s helpful to train team members and leaders across disciplines and roles. That way, one leader can assume multiple roles if needed. Another sometimes helpful adjustment is combining full-time with some part-time roles, such as part-time delivery leads or part-time developers, as needed. The goal and challenge of adjusting team sizes and roles is to maximize value to the client without compromising on the quality each role delivers. Needs-Based Scheduling You save teams time and clients money by adjusting the recommended Agile and Scrum schedules based on what’s truly needed. For example, with part-time engagements, I alternate daily standups and use Slack to stay in touch with developers between meetings. This helps my teams meet the objectives intended for daily standups by compromising on face-to-face time. Alternating Scrum and Kanban Scrum and Kanban are two different types of Agile development. My teams generally default to Scrum, but sometimes we pivot to Kanban based on a client's need. For clients who are transitioning from development to maintenance, switching from Scrum to Kanban is an obvious step that saves time and eliminates unnecessary meetings and processes. Instead of milestones and sprint goals meant to manage consistent progress toward an MVP deliverable, Kanban runs on ad hoc delivery expectations with teams or individuals working on one story at a time. Merging Product Owner & Product Manager In digitally mature product-based companies, in-house product managers find and prove product market fit. Their job is to determine what product concept and design best meets customer needs in the market while achieving positive unit economics. In-house product management is ideal because it places the work of user research and product concept validation into the hands of people who are generally already familiar with the customer experience. Most companies who hire a product agency, however, often don’t have the expertise or the staff to do user research or other jobs that would fall under the product manager role. In these cases, we step in to coach and implement core concept and validation activities like user research, forecasting lifetime value of a customer, defining MVP and creating product roadmaps. In an agency setting, this means some product owners also become product managers and product strategists. (Sometimes, these multi-talented leaders are also Scrum masters.) 2. Balance specialization with SWARM. Specialization is key to Agile: each core focus of production is intentionally driven forward by a leader dedicated to their focus area. Without balance, however, overly focused roles can lead to narrow-minded thinking, isolated work, and territorialism, all of which stifle innovation. Specialization yields the best results when complemented by a team that is swarming to deliver. Cross-training individuals allows teams to fill in the gaps of a project, making sure that every critical piece of the Agile machine is intact. This requires each team member to understand user experience, business requirements and big picture vision. Build Shared Vision: SWARM Design with Development Even across design and development, each specialized team member must be able to problem solve and step in at any given point to provide insight to their teammates. Radically effective products are the result of radically collaborative teamwork that’s centered around the user. Helping design and development teams to align around shared vision for the user is one of a product manager’s hardest responsibilities. SWARMing design and development teams together can help overcome common barriers that designers and developers face when collaborating. SWARM cultivates cross-disciplinary understanding while bringing needed technical input into design plans and needed design input into development. For a full picture on how SWARM works in a product agency setting, check out “ Human-Centered Design: How Designers, Developers & Businesses Work Together .” 3. Take care of your team. Don’t rule your teams with a Scrum iron fist. It will lead to disengagement. Teams need to be empowered toward forward-thinking, results-based problem solving. Sometimes this means bending the Agile rules. Here are five ways to help agency teams be successful with Agile: Closely monitor teams for signs of people being overwhelmed, lost or confused. Meet these needs as soon as they arise. 1. Be sensitive to team needs. This is a critical step when positioning a project for success. 2. Make sure you plan ample time for on-boarding with new projects. Take the time to truly learn the client’s needs, the user environment and the business requirements. Then, clearly communicate the user experience and business requirements to teams all the way down the line. When merging your team with a client’s internal team, there are usually multiple touch points that require thought and oversight. 3. Prepare well for team merges with potentially ambiguous roles. Plan on allowing time for those touch points to ensure smooth communication and collaboration. Deliberate preparation will protect both teams from being entangled in confusing dialogue and becoming unproductive. Rely on Zoom meetings for face-to-face conversations across time zones. Utilize Slack for quick question-and-answer to keep workers from being blocked for a long time. 4. Communicate often in multiple ways. Keep communication friendly and personable, encouraging vulnerability. This is critical, especially when working with multiple teams and multiple clients. If everyone feels comfortable, you’ll avoid icebergs down the road. This personal connection strengthens client trust in teams while allowing developers to get credit for their work, which boosts morale. 5. Use backlog grooming and sprint demos to provide space for development teams to meet clients and present their work. Know Your Numbers for Effective Agile Don’t neglect to do your project management math. Agile is only effective when what you’re getting out of it is greater than what you’re putting into it. Free your teams from blind adherence to protocols that sometimes just don’t make sense. Adapting Agile to business context will help you earn client trust, retain customers, balance the books and cultivate innovative company culture.

Say Goodbye to Ivory Tower Scrum: 3 Keys to Adapting Agile at an Agency

Services are ambiguous, and creating an online services marketplace requires finding a fit b/w the service and the marketplace model The landscape of marketplaces for services is littered with failures. There are many a stories of promising startups that failed to create an enduring business. Services, by nature, are ambiguous and their lack of standardization makes it hard to create liquid online marketplaces. Plumbing, for example, isn’t a fixed priced SKU you can buy on Amazon and be 100% sure that it would solve the pipe leak in your house. Services span a whole range complexity, from low complexity services such as food delivery to high complexity services such as home remodeling. There is no “one size fits all” marketplace model that works for all services. However, an understanding of the patterns of what marketplace models are best suited for what kind of services would make it easier to spot opportunities and to avoid failures. My attempt here is to articulate these patterns by defining the 4 categories with a strong service & marketplace-model fit, and a couple that are misfits. Below is a chart that lays out services on complexity vs. frequency of service, and marks the 4 categories where successful marketplaces have been (and and can be) built. Fig: Categories of marketplaces with a Service & Marketplace-model fit Categories of Fits Fit Category 1 — Lead generators for medium/high complexity (medium/low frequency) services Given the ambiguity inherent in service marketplaces, lead generators have been the most obvious and the earliest way to bring services online. As the name suggests, lead generators are not involved in the transaction and make money simply on surfacing (or establishing connection) between the consumer and the lead. The prime example of a marketplace in this category is , which is a lead generator for services across all complexities and across all frequencies. However, I suspect a big part of Thumbtack’s revenue comes from medium and high complexity services such as event photography compared to low complexity services such as home cleaning. Thumbtack Lead generators could take a share of the market in any complexity level but typically, the value of the lead (and the trust the marketplace creates behind that lead) increases in proportion to the complexity of the service. There is no reason for one to use lead generators for procuring low complexity services when there might be specialized marketplaces, offering a much better consumer experience (Fit Category 2) for procuring those services. A good example of a successful lead generation model in a specific domain (everything home related), but cutting across medium and high complexity services, is . It builds trust for the leads by showing detailed photos of their past projects, Houzz badges and awards, affiliations, reviews, etc. Arguably, Houzz has taken away some of Thumbtack’s market in home services but Thumbtack’s staying power comes from the trust and brand awareness it has engendered because of its breadth of services. is another good example in the wedding domain. Houzz Zola Fit Category 2 —On-demand transaction marketplace for low complexity (high frequency) services This category encompasses specialized marketplaces focused on low complexity (high frequency) services such as food delivery, ride hailing and grocery delivery. Prominent examples are DoorDash, Lyft, Uber Eats, Instacart, etc. These marketplaces go beyond lead generation, and into transactions, and they owe their liquidity to the demand that is generated (and maintained) on the promise of a much better consumer experience for buying services compared to lead generation marketplaces. In that sense, they deepen the market and create more liquidity than there would have been otherwise. However, given the low complexity (and the commoditized nature) of the services being provided by supply side, trust mechanisms in these marketplaces are less important, and marketplaces in this category have a hard time preventing supply-side multi-tenanting with direct and indirect competitors. Supply-side keeps on switching across marketplaces and jobs (same person could do grocery delivery today with Instacart and ride hailing tomorrow with Uber), and this leads to very tough unit economics. Andrew Chen has a about it. Such marketplaces will continue to exist, though there will likely be consolidation that combines multiple low complexity and high frequency services into one marketplace. good post Fit Category 3 — Managed transaction marketplace for medium complexity (medium frequency) services This category is relatively underdeveloped, with and being good examples in home services, and and being good examples in wellness. The services offered by these marketplaces sit in the sweet spot of being that supply-side is not constantly churning (and multi-tenanting) and that the buying experience can’t be standardized into a few clicks. This enables these marketplaces to offer a consumer experience 10x of what the lead generators could provide, thereby capturing sustainable demand. Puls Setter Soothe Glamsquad complex enough not complex enough These transaction marketplaces have a high degree of “managed” component. Puls, for example, vets its technicians and provides a 90-day guarantee on its services. Its buying experience is also very much tailored to each service with as much clarity on pricing as reasonably possible. Setter, on the other hand, introduces a trusted home manager into the mix to instantly help find the right provider. More specialized marketplaces, on the lines of Glamsquad and Soothe, might emerge in this category as more service buying continues to move online, and more segments of services (e.g. dog training — just a random guess) become large enough to justify specialized marketplaces. Fit Category 4 — Managed transaction marketplace for high complexity (low frequency) services This category is also underdeveloped, with being the best example of being successful in the desk-work space. Note that some of Upwork’s services might better fit Category 3 above. The marketplaces in this category are what James Currier called . The focus for the marketplaces here is to bring as much of the offline negotiation involved in a complex transaction online, into an interface managed by the marketplace. The power of these marketplaces comes from a few aspects (not all might be present in one marketplace): a) vetting of suppliers b) SaaS tools to work with these suppliers (before and after one has hired them) and c) guarantee when things go wrong. Upwork Market Networks is an evolving example of such a marketplace for home projects in the consumer space. is an evolving example for office projects in the B2B space for some of its services. It should be noted that the consumer experience marketplaces in this category need to create is very different from the experience that marketplaces in the Category 3 above create. Therefore, it’s very hard for a single transaction marketplace to effectively span across the Categories 3 and 4. BuildZoom Managed by Q : As consumer expectations are evolving towards expecting lower and lower friction, marketplaces in Category 3 and 4 would pose a threat to lead generators (Category 1). That, in my view, is the reason Thumbtack went through all to change its matching approach to be more instant and effective. Note the pain The Misfits (or Loose fits) While it’s interesting to understand the categories of fits, to appreciate the nuances of service marketplaces, it’s also important to recognize the misfits. Below are 2: Misfit Category A— Lead generators for low complexity (medium/low frequency) services Prominent example of a marketplace in this category is . With its positioning as “get affordable help”, TaskRabbit cornered itself into mostly being an option only for low complexity (medium frequency) services that one wouldn’t be able to find elsewhere at a better price e.g. home cleaning, or low complexity (low frequency) services that one wouldn’t be able to find elsewhere at all e.g. standing in a queue for a ticket. To be clear, TaskRabbit is not a failure in absolute sense, but it turned out to be much more of a niche player than it seemed at one point of time because it did not do what was needed to build trust in buying medium complexity services. TaskRabbit Misfit Category B— On-Demand transaction marketplace for low complexity (medium frequency) services Prominent example of a marketplace in this category is . Its mainstay is home cleaning, which not only is medium frequency, but also suffers from the same supply-side churn we had talked about in Fit Category 2. The medium frequency and low complexity aspects of home cleaning makes it really hard to retain supply, and unfortunately for Handy, there also isn’t any silver bullet to providing consumers a 10x experience when buying cleaning from Handy as opposed to buying it from a cheaper lead generator such as TaskRabbit. This is unlike other low complexity services such as food delivery or ride hailing, where the high frequency and on-demand nature of services at least creates an opportunity for the transaction marketplaces to offer a 10x consumer experience compared to what a lead generator could provide. Handy Obviously, service marketplaces are hard, and I have been wrecking my brain to understand what leads to the varied outcomes. Hope the categorization of fits and misfits above resonates with you, and it provides a framework for evaluating opportunities and avoiding pitfalls. Please share any feedback. Follow me on Twitter @setparth

Service & Marketplace-model fit

50+ High Growth Companies to Launch Your Career With One of the most challenging aspects of growing up is figuring out how and where to spend your time. The world of “career advice” is incredibly noisy. Professors, friends, parents, irrelevant medium authors — everyone is telling you what you should and should not be doing with your life. The good news → You get to decide how and where to spend your time. The other goods news is that the world is increasingly massive…and there are so many exciting things you could do…infinite places you could go and learn… it is your life! But why do we graduate from college and settle for conventional jobs that do not unlock our real potential? — Kevin Hartz I put together this list of high-potential opportunities for people (of all ages!) who are interested in leveraging technology as a vehicle for high-velocity change and impact. what I think to be The list spans companies of all sizes tackling all sorts of problems (Finance, Healthcare, Social, Construction, etc.). Hopefully this list can be helpful as you make your next move! A few notes/disclaimers: Be sure to make your own judgements with any of the opportunities presented here and recognize that this list is not “an official ranking” of any sorts. It is not “backed by data” or any hard metrics whatsoever. This list is by no means de facto or comprehensive. Feel free to disagree with and question everything :) This is just one of many resources — be sure to also check out & . StartupSift Breakout List You will notice that many of these companies may or may not be hiring for your “specific role.” Others have thousands and thousands of hungry applicants. That is okay! You may have to cold email, create a position, or find other unique ways to stand out. You can do it! have thoughts? need help? i'd love to chat :) message me on twitter or here - jordan gonen 🌊 And without further ado…here is… The Signal: 50+ High Growth Companies to Launch Your Career With 🚀 (late 2018) Finance Blend (disclaimer: I interned at Blend) Blend’s technology empowers top mortgage lenders to be more efficient, compliant, and borrower-friendly. Brex Corporate cards for startups. Online application, no personal guarantee, no security deposit required, and built for modern businesses. Powered by the Visa network. Carta Carta helps private companies, public companies, investors, and employees manage their cap tables, valuations, portfolio investments, and equity plans. Cash Square is a merchant services aggregator and mobile payment company that aims to simplify commerce through technology. Square Cash is their mobile app (a Venmo competitor)…“the easiest way to send and receive money on the fly.” Coinbase Coinbase is an online platform that allows merchants, consumers, and traders to transact with digital currency. It allows its users to create their own bitcoin wallets and start buying or selling bitcoins by connecting with their bank accounts. Even “How busy people master their money.” We partner with employers to offer Even as a benefit so that employees can get paid on demand. Paystack Modern online and offline payments for Africa. Shogun Shogun Enterprises is a financial technology platform for home improvement. Stripe Stripe is the best software platform for running an internet business. They handle billions of dollars every year for forward-thinking businesses around the world. Titan The modern investment firm committed to exceptional returns and advisory through actively managed portfolios. Life is not a dress rehearsal — this is probably it. Make it count. Time is extremely limited and goes by fast. Do what makes you happy and fulfilled — few people get remembered hundreds of years after they die anyway. — Sam Altman Insurance / Legal Atrium Atrium builds products and services to help automate legal workflows, innovate new processes, and help firms identify new clients. ClearCover Clearcover is the smarter car insurance choice, offering better coverage for less money. DoNotPay DoNotPay is an online robot lawyer that allows anyone to automatically claim asylum in the U.S, U.K, and Canada for free. Lemonade Lemonade offers homeowners and renters insurance powered by artificial intelligence and behavioral economics. Newfront Newfront is the modern commercial insurance brokerage. No 20-page applications, confusing policy terms, or painful renewal cycles. Newfront’s experienced brokers and technology remove the headache from business insurance. Root Root is a mobile-first insurance carrier that uses an app to rate drivers based primarily on how they actually drive — not who they are. “It is the ultimate luxury to combine passion and contribution. It’s also a very clear path to happiness.” — Sheryl Sandberg HR Gusto Gusto provides a cloud-based payroll, benefits, and human resource management solution for businesses. Humu Humu is a human resource company that makes work better through science and machine learning. Rippling Rippling provides cloud-based employee management solutions, from HR (payroll, benefits, compliance) to IT (computers, software, security). Truework Truework is an HR tool that automatically responds to lenders, landlords, and others who need to verify employment. Seize any opportunity, or anything that looks like opportunity. They are rare, much rarer than you think. — Taleb Healthcare / Biology Basis Basis is an app that allows people to deal and cope with mental health issues and offers same-day access to trained specialists. CoFactor Genomics The Leaders in RNA. Harness the power of multidimensional gene expression models to treat cancer more effectively. Forward Forward provides you with personalized primary care, combining world-class doctors with advanced medical technology including genetics, cancer screening & wellness tracking. Gyroscope Gyroscope is a new OS for the human body, with an app and website for people to view their health analytics. Hims Hims is an e-commerce wellness brand made for men with products for skin care, erectile dysfunction, and hair loss. They work with doctors to prescribe Finasteride and Sildenafil (active ingredient in Viagra) through the app or website. MDAcne MDacne is a mobile platform that uses AI and computer vision to help people with acne. Ro Ro is a mission-driven healthcare technology company that handles everything from online diagnosis to the delivery of medication. Synthego Founded by former SpaceX engineers, Synthego is a leading provider of genome engineering solutions. Their flagship product, CRISPRevolution, is a portfolio of synthetic RNA designed for CRISPR genome editing and research. Zipline Zipline builds products that improve access to healthcare and saves lives. I always did something I was a little not ready to do. I think that’s how you grow. When there’s that moment of ‘Wow, I’m not really sure I can do this,’ and you push through those moments, that’s when you have a breakthrough. — Marissa Meyer Food Cloud Kitchens Powering the on-demand food economy. They provide infrastructure and software that enables food operators to open delivery-only locations with minimal capital expenditure and time. Full Harvest Full Harvest helps growers get the most out of a harvest and food companies save money by bringing farm excess to market. They are a B2B platform connecting large farms to food businesses to sell significantly discounted, yet perfectly good surplus and imperfectly shaped produce that would have otherwise gone to waste. Impossible Impossible Foods develops a new generation of meats and cheeses made entirely from plants. They select specific proteins and nutrients from greens, seeds, and grains to recreate the experience of meats and dairy products. Uber Eats (disclaimer: I interned at Uber) Uber Eats is a food delivery platform that makes getting great food from a favorite local restaurants as easy as requesting a ride. Sensei SENSEI is here to guide you towards greater wellbeing. Their ecosystem of products and experiences is designed with one intention: to empower you to grow well. “Two ways to be successful in life: do something worth writing about or write something worth reading.” — Ben Franklin Government Anduril Anduril commits top technical talent to solving the most complex national security challenges. They’re building the next generation of technology that will aid and protect those who serve on the front lines defending the nation and its interests. Citizen The need has never been greater for technology that informs and protects the public. The Citizen app empowers people with information to help keep their families, communities, and cities safe. Users receive instant notifications every time a crime or other major incident is reported near them. Coord Coord is a mobility company that creates seamless mobility and self-driving experiences today through deep integrations. They offer bike-share API, Curbs API, Tolls API, Routing API and etc. Sidewalk Labs Sidewalk Labs is a new type of company that works with cities to build products addressing big urban problems. They’re building a platform and a set of urban applications to accelerate innovation in cities around the world. Whenever you find a barrel , you should hire them instantly, regardless of whether you have money for them or whether you have a role for them. Just close them. — Keith Rabois Logistics Convoy Convoy is a network of tech-enabled trucking companies transforming the $800B trucking industry and logistics ecosystem for truck drivers and shippers. Using technology, Convoy matches reliable trucks (“carriers”) with companies that need to ship freight. Flexport At Flexport, they believe that a world that does business together is a better one. It’s called global trade. And freight forwarding is the $1 trillion industry that functions as the circulatory system of global trade — without freight forwarding, global trade simply wouldn’t exist. Nabis Nabis delivers the most reliable, consistent, and secure logistics solution for cannabis businesses. Whether you are a brand, cultivator, intermediary processor, or final good manufacturer, Nabis provides you with access to an enterprise-scale distribution network. Nuro NURO is a technology company which aims to accelerate the benefits of robotics for everyday life. They are a team of entrepreneurs and engineers, designers, and scientists who believe the advancements they are making in robotics and machine learning today will dramatically improve the way they live tomorrow. Rubicon Rubicon Global is a technology company that provides waste, recycling, and smart city solutions to businesses and governments worldwide. They develop and deploys a full suite of cloud-based solutions to help its customers and network of independent waste haulers work towards more sustainable waste and recycling practices, uncover cost savings, and improve operations through data analytics. Uber for Business (disclaimer: I interned at Uber) Get an all-in-one solution that simplifies how businesses gets around. It’s a digital “headquarters” for all your company’s ground transportation. Get a clear view into all your trip activity and automate billing, expensing, and reporting. Easily provide rides — even multiple rides at the same time — to anyone important to your business. Uber Freight (disclaimer: I interned at Uber) Uber Freight is an app that matches carriers with shippers. Carriers can just tap a button and instantly book a load, and the price you see is the price you get — no more back-and-forth negotiations. Make friends over the internet with people who are great at things you’re interested in. The internet is one of the biggest advantages you have over prior generations. Leverage it. — Patrick Collison Real Estate / Construction Buildzoom BuildZoom has a simple purpose: to help you find the perfect contractor for any job — commercial or residential. Using BuildZoom is just like asking a neighbor for a recommendation — except instead of just asking one, you are polling every neighbor in your community, analyzing their feedback, exhaustively researching work histories and credentials and only then, making a final decision. Bungalow Bungalow is a residential real estate platform that provides renters with a more convenient, flexible, and communal living solution. It utilizes existing housing supply by signing long-term leases with homeowners, and offers multi-bedroom homes in some of the most desirable neighborhoods in cities throughout the United States. Opendoor Opendoor makes it possible to receive an offer on a home in just a few clicks, and sell in a matter of days, removing all of the headaches, uncertainties, and risks from the transaction. They are headquartered in San Francisco, California and has received a total of $645 million in venture funding from Khosla Ventures, GGV Capital, and Access… Qualia Qualia is a cloud-based closing platform that provides seamless and secure coordination between everyone involved in the real estate closing process. Wanderjaunt WanderJaunt offers technology-enabled property management solutions for travelers, homeowners, and accommodations from around the world. And then the last piece is actually the hardest, which is specific knowledge. Specific knowledge is knowledge that you have that lets you do something that other people do not know how to do and cannot be trained to do. — Naval Ravikant Education / Life / Talent Holloway With hundreds of hours of research, writing, and editing, their comprehensive Guides help you make better decisions. Hatch Baby Their mission is to bring parents a series of smart products that use technology and user-centric design to help make caring for a baby a little easier. Lambda School Lambda School trains people to be software engineers for free in exchange for a share of future income. Pioneer A home for the ambitious outsiders of the world. They’re building a community of creative young people working on interesting projects around the globe. TripleByte Triplebyte believes the current technical hiring process doesn’t do enough to help engineers show their strengths. They’re dedicated to building a better process. You can read more about their views on hiring in their manifesto. 70MillionJobs 70MillionJobs is the first for-profit employment job board for people with criminal records. “Everyone starts out with very, very humble beginnings” — Daniel Gross Social / Consumer Brandless Brandless is an e-commerce company providing unbranded and essential products. Jumprope Create and share recipe how-to’s. Export to Instagram Stories, IGTV, YouTube, your personal website and more. Masterclass MasterClass is a premier online education platform redefining the digital learning experience by bringing world-class experts and renowned instructors to students globally through a cutting-edge technology platform meant to distill knowledge and create meaningful experiences through online video. Sandbox VR Sandbox VR combines the latest VR hardware, movie quality real-time motion capture and AAA-quality content experiences to create the best VR experiences on the planet. Period. It’s the perfect event for team building, corporate events, and parties. People always say you should live your life as if it were your last day. I think you should live your life as though it will go on for ever; that every day is so good that you don’t want it to end. — Peter Thiel Dev Augur Augur is built on Ethereum, a decentralized blockchain network similar to the Bitcoin network. Utilizing this technology, their markets can effectively eliminate counterparty risk and centralized servers while creating a global market by employing cryptocurrencies such as bitcoin. Clearbit Clearbit develops business Intelligence APIs. Clearbit is on a mission to set the new standard in business data. Simply put — Clearbit is changing how modern businesses source and operationalize data as part of their sales, marketing, and product workflows. Deepgram Deepgram saves businesses time and money by building tailored speech recognition models that increase revenue and maximize productivity. Handshake Decentralized certificate authority and naming. VectorDash Vectordash lets you use insanely fast cloud GPUs at incredibly low costs. You can start a powerful GPU instance within seconds. The world is an incredibly complex place and everything is changing all the time. You can’t plan your career because you have no idea what’s going to happen in the future. You have no idea what industries you’ll enter, what companies you’ll work for, what roles you’ll have, where you’ll live, or what you will ultimately contribute to the world. You’ll change, industries will change, the world will change, and you can’t possibly predict any of it. — Marc Andreessen SaaS Tools Density Density is a modern infrastructure for anonymously counting people. Front Front redefines work communication with the first shared inbox for teams. By unifying your email, customer communication channels, and apps in one platform, Front helps teams collaborate efficiently and have more context and visibility into every conversation, to work faster and better together. Fullstory FullStory takes a fundamentally different approach to understanding your customer experience. One tiny script unlocks pixel-perfect playback, automatic insights, funnel analytics, and robust search and segmentation — all without the need to manually tag your site’s code. Openphone OpenPhone adds a second phone number on top of one’s existing mobile device with powerful features to help business stand out. Mixmax Mixmax offers software that enables its users to boost their productivity. It enables its users to track emails accurately, set up meetings in an instant, save time with email templates, and schedule emails to be sent later. Notion All-in-one workspace. Write, plan, collaborate, and get organized. Notion is all you need — in one tool. Superhuman Superhuman is not just another email client. They are rebuilding the inbox from the ground up to make you brilliant at what you do. They specifically designed it for those of you who want the best. Miscellaneous 100 Thieves 368 Aero Angel List Apple Health Atoms b8ta Culdesac Deos Houseparty Neon Panda Saildrone Social Construct Substack Transmission Ttyl Urbit have thoughts? need help? i'd love to chat :)

message me on twitter or here - jordan gonen 🌊 Hope this was valuable! If you enjoyed, please share and hit recommend 💙 Company descriptions are from . Crunchbase.com Thanks Jonathan Z. White & David Lee for feedback/edits.

The Signal

Goal: put software on hardware It's the oldest business model in Silicon Valley: Build custom hardware. Write software to run on that hardware. Get paid to use this combo to solve people's problems. This three-step formula has generated trillions in market capitalization— , , and are all good examples of this strategy at work. Hardware builds their moat and software pads their margin. It's simple! Apple Nvidia AWS Problem: it's hard though Unfortunately, for robots and other embedded devices, no one has really perfected this strategy's technical underpinnings. While many device-specific, well-architected systems exist, the core challenge of how to install your software on your custom hardware remains canonically unsolved. Between two worlds This problem endures because these products exist at the intersection of two worlds. They're embedded devices, sure—robots usually run on batteries, move around their physical environment, and regularly experience shoddy network connectivity. But modern robots often have much more computing capacity than your average smartwatch or refrigerator. In addition to their drivetrain and sensor arrays, these devices often have CPUs, GPUs, and disk capacity to rival a top-end server rack. And of course, they have all the added management complexity that comes with these capabilities. Since all new robots are custom hardware, every new robot has slightly different hardware specifications, and thus, software deployment mechanisms. For engineers building an embedded software deployment system, there is no singular, correct, generalized system design. Instead, we're left to pick and choose from the long list of available tools from both the embedded and data center domains. And the list of potential options to choose from is quite long. A preponderance of tools Common technologies for packaging, deploying, and configuring software on hardware, in either or both the embedded and data center domains, include: Containers ( , ) Docker Podman Other packaging mechanisms (Snapcraft, Flatpak, AppImage) Container orchestrators ( , ) Kubernetes Docker Swarm Deployment agents ( , , ) Argo CD Gitlab CI/CD Mender Embedded Linux ( , , , ) Ubuntu Core OpenWrt BuildRoot Yocto Configuration management systems (Ansible, Salt, Puppet) IoT cloud frameworks ( , , ) AWS Azure GCP Virtualization mechanisms (VMWare, KVM) ... and more. This article is not a guide to which of these technologies is best—all of them are appropriate for certain applications some of the time. Instead, stay focused on a high-quality design for your particular embedded software deployment system with one simple acronym: . The five requirements are . CRAVE Comprehensive, Reversible, Atomic, Versioned, and Everywhere Regardless of product domain, hardware complexity, or company growth stage, designs that fulfill these five requirements will serve your business well. What bots CRAVE Comprehensive Comprehensive software deployment systems ensure that . Depending on what you're deploying, comprehensive could refer to a single binary, an application with all of its dependencies, or an entire root file system. the entire set of changes is deployed when a deployment completes This means that when a deployment finishes, the entire system has been updated to a comprehensively known state. Only allow incremental patching if you can reliably and deterministically sum up those patches to a single, well-understood, deployed version of your software. It's important to note that "comprehensive" does not necessarily mean that the entire deployment payload gets pushed onto your device every time. For example, many deployment systems use caching mechanisms to minimize network transfer. Caching is great—just make sure you're always cache-busting correctly when necessary. Comprehensive deployments ensure that you've deployed everything you think you've deployed. If your deployment mechanisms don't include a way for you to do this, you'll eventually lose track of what's deployed on your devices! Designing your system to perform comprehensive updates also helps deliver reproducible deployments. Without comprehensiveness, you'll have no way of knowing that you've deployed the same thing across your device fleet, or that a piece of software that works on one machine will work when deployed onto another. Reversible Reversible deployment mechanisms . Ideally, if a deployment fails for some reason, the software system will roll itself back without any human intervention. can always be rolled back to the version they were on before the update It's ok if this is actually "roll forward", or "deploy again from onboard cache". The important design goal here is not to get stuck on a botched deployment, forcing yourself to commit to emergency engineering work if a bug is found after a release. Reversibility is essential for minimizing the risk associated with software deployments. Without it, every update is a dangerous endeavor—if the update goes awry, you'll be stuck fixing forward, or worse, troubleshooting a bricked device. Without reversibility, your engineering team will underperform. Because of the risks involved, a lack of reversibility will force your team to ship changes less frequently, iterate less freely, and build the product more slowly. Atomic Atomic deployment mechanisms ensure that . Effectively, for every software deployment from version A to version B, there should be a single, well-understood moment in time before which the system was running version A, and after which it was running version B. your changes take effect in their target system in a single, well-coordinated moment Depending on the specific deployment mechanism in question, atomicity can take many forms. For base operating system deployments, this is often a system reboot. For Kubernetes-orchestrated workloads, it could be a new Pod replacing an old Pod behind a Service. Regardless, atomic deployment mechanisms ensure that your individually-versioned units of software do not update incrementally. If you have one hundred virtual machines in an autoscaling group and you want to gradually transition from A to B across the cluster, that's fine—but at any given moment, you should know for certain whether any individual machine is running version A or B. Atomicity lets you pinpoint which version of a piece of software to associate with behavioral changes. If you don't know exactly when your changes took effect, you can't reliably troubleshoot which changes in your software caused them. Atomic deployments also help you avoid disruptive incremental changes in production that might introduce compatibility issues in the middle of a software release. If your software deployment process lacks atomicity, and you allow different components of your software to float between two versions while deployments occur, then must ensure that all combinations of those two versions across those components are compatible and function properly. This can be very expensive—and it's easy to avoid that expense if you keep your deployment systems atomic. Versioned If you haven't realized it by now, your software deployments need to be versioned. This means that . all changes to the contents of your deployment payloads need to be tracked and auditable over time At first glance, versioning is simple—just check your source code into git, right? In practice, however, this design requirement often gets overlooked. Are the binaries that your compiled executables link against also versioned? Have you pinned all of your package dependencies? Do you know where those dependencies come from? Versioning is essential if you want to actually know what software you are running on your device after a deployment. It is a critical component of reproducibility, too—without versioning, you can't ever really know if a deployment on one device will work on another, because you have no reliable mechanism for telling whether the two devices are actually running the same software. If a system component's version is floating or unspecified, a change to that version might break your system's functionality in a way that would be very difficult to root cause. Incorporating versioning into your deployment system design prevents this expensive mistake. Everywhere For software deployment systems, "everywhere" means "everywhere at your company". This means that you should strive to use the same deployment mechanisms in your: Feature development processes. Quality assurance and testing procedures. Manufacturing line software installation. Production software over-the-air update systems. In other words, don't invent different deployment systems for different parts of your company or workflow. Abandoning this design requirement can be tempting, but you will regret it eventually. Over time, changes and fixes will make it into some deployment systems, but not others. And as the implementation details diverge, software that works properly in one part of your company will stop working in another. This will cause chaos and mistrust, and slow down your feature delivery. Once this deployment system divergence takes hold, it will naturally worsen over time. As separate individuals and teams run into deployment issues, they'll develop local, ad hoc solutions to solve the problems they run into. This leads to your engineering organization duplicating lots of automation work while delivering product updates more slowly and less reliably. Build what bots CRAVE The five requirements of the CRAVE framework are an ideal—it's probably impossible to build a system that fulfills them all completely. Software engineering is a game of tradeoffs—for every product, at every company, engineers should prioritize these criteria as time allows, weighing them against the needs of their employers. Even if you can't build exactly the deployment systems your robots CRAVE, it's still worth it to get as close as possible to this ideal. The five design criteria outlined in this article can help steer your company away from the classic "works on my machine" quagmire, where intermittent, environment-specific bugs are never root-caused or fixed and software quality rots away over time. Tell your friends! 👇 Also published here.

What Robots CRAVE: How to Deploy Software Onto Hardware Platforms

Today we're going to learn how to build a system that asks questions and gets accurate answers about documentation. The whole project being built is available . ChatGPT here You can also try an . interactive version https://www.youtube.com/watch?v=-9jL9r9QQm0&embedable=true Overview We're going to cover a few things here, but the big picture is that: We'll need to store our content in a database We'll get the user to type a query We'll search the database for the results that are most similar to the user query (more on that later) We'll create a "context" based on the top 5 most similar results matching the query and ask ChatGPT Answer the question based on the context below, and if the question can't be answered based on the context, say "I don't know"

Context:
[CONTEXT]
---
Question:
[QUESTION]
Answer: Diving into the implementation Alright, let's get started Here's what you'll be needing for this tutorial: A database that allows you to find "most similar results". Not all databases are suited for this kind of job. Today we'll be using Embedbase which allows you to do just that. Embedbase allows you to find "semantic similarity" between a search query and stored content. : that's for the ChatGPT part. OpenAI api key Nextra: . NodeJS installed Write the Embedbase and OpenAI API keys in : .env OPENAI_API_KEY="<YOUR KEY>"
EMBEDBASE_API_KEY="<YOUR KEY>" As a reminder, we will create with the amazing documentation framework Nextra which allows you to write documentation using NextJS, tailwindcss, and MDX (Markdown + React). We will also use as a database together with OpenAI to make use of ChatGPT. QA documentation powered by ChatGPT Embedbase Creating a Nextra doc You can find and use the official Nextra documentation template . Once you have created your documentation with this template, open it with your favorite editor. here # we won't use "pnpm" here, rather the traditional "npm"
rm pnpm-lock.yaml
npm i
npm run dev Now just head here. Try to edit some of the documents and see the content changing. .mdx Preparing and storing the documents The first step requires us to store our documentation in Embedbase. There's a small caveat, though, this works better if we store relatively small chunks in the DB. We'll chunk our text by sentences. Let's start by writing a script called in the folder .You'll need the library to list files (we'll use the 8.1.0 version). sync.js scripts glob npm i glob@8.1.0 const glob = require("glob");
const fs = require("fs");

const sync = async () => {
	// 1. read all files under pages/* with .mdx extension
	// for each file, read the content
	const documents = glob.sync("pages/**/*.mdx").map((path) => ({
		// we use as id /{pagename} which could be useful to
		// provide links in the UI
		id: path.replace("pages/", "/").replace("index.mdx", "").replace(".mdx", ""),
		// content of the file
		data: fs.readFileSync(path, "utf-8")
	}));
	
	// 2. here we split the documents in chunks, you can do it in many different ways, pick the one you prefer
	// split documents into chunks of 100 lines
	const chunks = [];
	documents.forEach((document) => {
		const lines = document.data.split("\n");
		const chunkSize = 100;
		for (let i = 0; i < lines.length; i += chunkSize) {
			const chunk = lines.slice(i, i + chunkSize).join("\n");
				chunks.push({
				// and use id like path/chunkIndex
				id: document.id + "/" + i,
				data: chunk
			});
		}
	});
}

sync(); Now that we have our chunks we need to store them in a DB, we'll extend our script so that it adds the chunks to Embedbase. To query Embedbase, we'll install the version of by running . 2.6.9 node-fetch npm i node-fetch@2.6.9 const fetch = require("node-fetch");

// your Embedbase api key
const apiKey = process.env.EMBEDBASE_API_KEY;

const sync = async () => {
	// ...
	// 3. we then insert the data in Embedbase
	const response = await fetch("https://embedbase-hosted-usx5gpslaq-uc.a.run.app/v1/documentation", { // "documentation" is your dataset ID
		method: "POST",
		headers: {
			"Authorization": "Bearer " + apiKey,
			"Content-Type": "application/json"
		},
		body: JSON.stringify({
			documents: chunks
		})
	});
	const data = await response.json();
	console.log(data);
}

sync(); Great, you can run it now: EMBEDBASE_API_KEY="<YOUR API KEY>" node scripts/sync.js If it worked well, you should be seeing: Getting the user’s query Now, we  will modify the Nextra documentation theme to replace the built-in search bar with one that will be ChatGPT-powered. We'll add a component to with the following content: Modal theme.config.tsx // update the imports
import { DocsThemeConfig, useTheme } from 'nextra-theme-docs'
const Modal = ({ children, open, onClose }) => {
	const theme = useTheme();
	if (!open) return null;
	return (
		<div
			style={{
				position: 'fixed',
				top: 0,
				left: 0,
				right: 0,
				bottom: 0,
				backgroundColor: 'rgba(0,0,0,0.5)',
				zIndex: 100,
			}}
			onClick={onClose}>			
			<div
				style={{
					position: 'absolute',
					top: '50%',
					left: '50%',
					transform: 'translate(-50%, -50%)',
					backgroundColor: theme.resolvedTheme === 'dark' ? '#1a1a1a' : 'white',
					padding: 20,
					borderRadius: 5,
					width: '80%',
					maxWidth: 700,
					maxHeight: '80%',
					overflow: 'auto',
				}}
				onClick={(e) => e.stopPropagation()}>			
			{children}
			</div>
		</div>
	);
}; Now we want to create the search bar: // update the imports
import React, { useState } from 'react'
// we create a Search component
const Search = () => {
	const [open, setOpen] = useState(false);
	const [question, setQuestion] = useState("");
	// ...
	// All the logic that we will see later
	const answerQuestion = () => {  }
	// ...
	return (
		<>
			<input
				placeholder="Ask a question"
				// We open the modal here
				// to let the user ask a question
				onClick={() => setOpen(true)}
				type="text"
			/>
			<Modal open={open} onClose={() => setOpen(false)}>
				<form onSubmit={answerQuestion} className="nx-flex nx-gap-3">
					<input
						placeholder="Ask a question"
						type="text"
						value={question}
						onChange={(e) => setQuestion(e.target.value)}
					/>
					<button type="submit">					
						Ask
					</button>
				</form>
			</Modal>
		</>
	);
} Last, update the config to set the search bar we created: const config: DocsThemeConfig = {
	logo: <span>My Project</span>,
	project: {
		link: 'https://github.com/shuding/nextra-docs-template',
	},
	chat: {
		link: 'https://discord.com',
	},
	docsRepositoryBase: 'https://github.com/shuding/nextra-docs-template',
	footer: {
		text: 'Nextra Docs Template',
	},
	// add this to use our Search component
	search: {
		component: <Search />
	}
} Building the context Here you will need the OpenAI token-counting library so run . tiktoken npm i @dqbd/tiktoken Now we are going to build the prompt to contextualize ChatGPT in a NextJS API endpoint. Create a file with the code: pages/api/buildPrompt.ts // pages/api/buildPrompt.ts
import { get_encoding } from "@dqbd/tiktoken";

// Load the tokenizer which is designed to work with the embedding model
const enc = get_encoding('cl100k_base');
const apiKey = process.env.EMBEDBASE_API_KEY;

// this is how you search Embedbase with a string query
const search = async (query: string) => {
	return fetch("https://embedbase-hosted-usx5gpslaq-uc.a.run.app/v1/documentation/search", {
		method: "POST",
		headers: {
			Authorization: "Bearer " + apiKey,
			"Content-Type": "application/json"
		},
		body: JSON.stringify({
			query: query
		})
	}).then(response => response.json());
};

const createContext = async (question: string, maxLen = 1800) => {
	// get the similar data to our query from the database
	const searchResponse = await search(question);
	let curLen = 0;
	const returns = [];
	// We want to add context to some limit of length (tokens)
	// because usually LLM have limited input size
	for (const similarity of searchResponse["similarities"]) {
		const sentence = similarity["data"];
		// count the tokens
		const nTokens = enc.encode(sentence).length;
		// a token is roughly 4 characters, to learn more
		// https://help.openai.com/en/articles/4936856-what-are-tokens-and-how-to-count-them
		curLen += nTokens + 4;
		if (curLen > maxLen) {
			break;
		}
		returns.push(sentence);
	}
	// we join the entries we found with a separator to show it's different
	return returns.join("\n\n###\n\n");
}

// this is the endpoint that returns an answer to the client
export default async function buildPrompt(req, res) {
	const prompt = req.body.prompt;
	const context = await createContext(prompt);
	const newPrompt = `Answer the question based on the context below, and if the question can't be answered based on the context, say "I don't know"\n\nContext: ${context}\n\n---\n\nQuestion: ${prompt}\nAnswer:`;
	res.status(200).json({ prompt: newPrompt });
} Making calls to ChatGPT First, add some utility function that is used to make stream calls to OpenAI in the file , you'll need to install by running . utils/OpenAIStream.ts eventsource-parser npm i eventsource-parser import {
	createParser,
	ParsedEvent,
	ReconnectInterval,
} from "eventsource-parser";

  
export interface OpenAIStreamPayload {
	model: string;
	// this is a list of messages to give ChatGPT
	messages: { role: "user"; content: string }[];
	stream: boolean;
}

  
export async function OpenAIStream(payload: OpenAIStreamPayload) {
	const encoder = new TextEncoder();
	const decoder = new TextDecoder();
	
	let counter = 0;
	const res = await fetch("https://api.openai.com/v1/chat/completions", {
		headers: {
			"Content-Type": "application/json",
			"Authorization": `Bearer ${process.env.OPENAI_API_KEY ?? ""}`,
		},
		method: "POST",
		body: JSON.stringify(payload),
	});
	
	const stream = new ReadableStream({
		async start(controller) {
			// callback
			function onParse(event: ParsedEvent | ReconnectInterval) {
				if (event.type === "event") {
					const data = event.data;
					// https://beta.openai.com/docs/api-reference/completions/create#completions/create-stream
					if (data === "[DONE]") {
						controller.close();
						return;
					}
					try {
						const json = JSON.parse(data);
						// get the text response from ChatGPT
						const text = json.choices[0]?.delta?.content;
						if (!text) return;
						if (counter < 2 && (text.match(/\n/) || []).length) {
							// this is a prefix character (i.e., "\n\n"), do nothing
							return;
						}
						const queue = encoder.encode(text);
						controller.enqueue(queue);
						counter++;
					} catch (e) {
						// maybe parse error
						controller.error(e);
					}
				}
			}
		
			// stream response (SSE) from OpenAI may be fragmented into multiple chunks
			// this ensures we properly read chunks and invoke an event for each SSE event stream
			const parser = createParser(onParse);
			// https://web.dev/streams/#asynchronous-iteration
			for await (const chunk of res.body as any) {
				parser.feed(decoder.decode(chunk));
			}
		},
	});
	
	  
	return stream;
} Then, create a file which will be an endpoint to simply make a streaming call to ChatGPT. pages/api/qa.ts // pages/api/qa.ts
import { OpenAIStream, OpenAIStreamPayload } from "../../utils/OpenAIStream";
export const config = {
	// We are using Vercel edge function for this endpoint
	runtime: "edge",
};

interface RequestPayload {
	prompt: string;
}

const handler = async (req: Request, res: Response): Promise<Response> => {
	const { prompt } = (await req.json()) as RequestPayload;
	if (!prompt) {
		return new Response("No prompt in the request", { status: 400 });
	}
	const payload: OpenAIStreamPayload = {
		model: "gpt-3.5-turbo",
		messages: [{ role: "user", content: prompt }],
		stream: true,
	};
	const stream = await OpenAIStream(payload);
	return new Response(stream);
};
export default handler; Connect everything & Asking questions Now it is time to ask questions through API calls. Edit to add the function to the component: theme.config.tsx Search // theme.config.tsx
const Search = () => {
	const [open, setOpen] = useState(false);
	const [question, setQuestion] = useState("");
	const [answer, setAnswer] = useState("");
	const answerQuestion = async (e: any) => {
		e.preventDefault();
		setAnswer("");
		// build the contextualized prompt
		const promptResponse = await fetch("/api/buildPrompt", {
			method: "POST",
			headers: {
				"Content-Type": "application/json",
			},
			body: JSON.stringify({
				prompt: question,
			}),
		});
		const promptData = await promptResponse.json();
		// send it to ChatGPT
		const response = await fetch("/api/qa", {
			method: "POST",
			headers: {
				"Content-Type": "application/json",
			},
			body: JSON.stringify({
				prompt: promptData.prompt,
			}),
		});
		if (!response.ok) {
			throw new Error(response.statusText);
		}
		const data = response.body;
		if (!data) {
			return;
		}
		
		const reader = data.getReader();
		const decoder = new TextDecoder();
		let done = false;
		// read the streaming ChatGPT answer
		while (!done) {
			const { value, done: doneReading } = await reader.read();
			done = doneReading;
			const chunkValue = decoder.decode(value);
			// update our interface with the answer
			setAnswer((prev) => prev + chunkValue);
		}
	};
	return (
		<>
			<input
				placeholder="Ask a question"
				onClick={() => setOpen(true)}
				type="text"
			/>
			<Modal open={open} onClose={() => setOpen(false)}>
				<form onSubmit={answerQuestion} className="nx-flex nx-gap-3">
					<input
						placeholder="Ask a question"
						type="text"
						value={question}
						onChange={(e) => setQuestion(e.target.value)}
					/>
					<button type="submit">
						Ask
					</button>
				</form>
				<p>
					{answer}
				</p>
			</Modal>
		</>
	);
} You should have this by now: Of course, feel free to improve the style 😁. Closing thoughts In summary, we have: Created a Nextra documentation Prepared and store our documents in Embedbase Built an interface to get the user's query Searched for the context of the question in our database to provide ChatGPT Built the prompt with this context and call ChatGPT Let the user ask a question by connecting everything together Thank you for reading this document, there is an open-source template to create this type of documentation . here Further reading Embeddings are a machine learning concept that allows you to represent the semantics of your data as a number, which allows you to create features such as: semantic search (e.g., what is the similarity between "the cow eats grass" and "the monkey eats bananas", which also works for comparing images, etc.) recommendation systems (if you like the movie Avatar, you might like Star Wars) classification ("this movie is amazing" is a positive sentence, "this movie sucks" is a negative sentence) generative search (chatbot that answers questions about a PDF, a website, a YouTube video, etc.) Embeddings are not a new technology, but they have been made more popular, more general, and more accessible recently thanks to the OpenAI embeddings endpoint which is fast and cheap. We won't dive into the technical subject of embeddings, there is a lot of information about them on the internet. AI embeddings can be thought of as a sorting hat of Harry Potter. Just like the sorting hat assigns houses based on the traits of the students, AI embeddings are assigned to similar content based on their features. When we want to find similar items, we can ask AI to provide us with embeddings of the items, and then calculate the distance between them. The closer the distance between the embeddings, the more similar the items. This process is similar to how the sorting hat uses the traits of each student to determine their best fit for a house. By using AI embeddings, we can quickly and easily compare items based on their features, resulting in smarter decisions and more efficient search results. The method described above is simply to embed words, but today, sentences, images, sentences + images, and many other things are possible. When you want to use embeddings in production software, there are some pitfalls to be careful with: All the infra of storing embeddings at scale Cost optimization (e.g. avoid calculating data twice) Segmentation of user embeddings (you don't want your search function to display another user's data) Dealing with the model input size limit Integration with popular app infras (supabase, firebase, google cloud, etc.) Preparing the data continuously in GitHub Actions The point of embeddings is to be able to index any kind of unstructured data, we want our documentation to be indexed every time we modify it, right? This is a GitHub action that will index every markdown file when a is done on the branch: git push main # .github/workflows/index.yaml
name: Index documentation
on:
	push:
		branches:
			- main
jobs:
	index:
		runs-on: ubuntu-latest
		steps:
			- uses: actions/checkout@v2
			- uses: actions/setup-node@v2
			with:
				node-version: 14
			- run: npm install
			- run: node scripts/sync.js
				env:
					EMBEDBASE_API_KEY: ${{ secrets.EMBEDBASE_API_KEY }} Don't forget to add to your . EMBEDBASE_API_KEY GitHub secrets

Building a ChatGPT-Powered Markdown Documentation 

This is the first post in this series where I build . In this post I focus on setting up the architecture to build an HTTP endpoint to do the following: a web chat powered by GCP free limits Anonymous users choose a username Users are ranked by recency of last access time After 10 minutes of inactivity, users are purged from the system A maximum of 100 users at a time Architecture and choice of components I want to have an effectively free infrastructure using GCP’s perpetually . The components for this post: free tier I will use to run the backend code. Cloud functions have a free limit of 2 million requests per month. I chose cloud functions because primarily because it requires little code to get started and I get observability and scalability out of the box. Cloud function: HTTP-based serverless cloud functions To store users’ data, I will use Redis because it is lightweight to run, fast and versatile for storing all kinds of data I will need for the chat app. But GCP’s implementation of Redis is not free. I work around this by installing Redis on a free compute instance (this somewhat limits scalability, but I have some room due to Redis’s memory efficiency). Redis: MemoryStore Connecting to rest of my VPC from cloud functions requires a . I work around this by connecting to Redis over the internet, but I need to ensure it is done over a secure connection. Connecting with Redis over the internet: (Serverless VPC access), which is not free VPC connector Installing Redis Google Cloud provides a free e2-micro instance as part of their monthly free tier. I will install Redis as a service on a compute instance. Providing an e2 micro instance in region -- let’s call the instance us-central1 pelican Reserve a static IP address to use and attach it to here pelican SSH into the instance and install the ( to get best TLS support) latest version Redis atleast version 7.0, If the compute instance is based on Debian, it is best to update the Redis config to be supervised by which is the default init system: change the file to update the supervision setting: systemd /etc/redis/redis.conf supervised systemd Remove the bind address to be nothing (all network interfaces on the instance should be able to access Redis) and the port to , add using the setting 12345 a password requirepass One last thing to do is to have access to the home directory -- this is only necessary because I store some files (generated later) in the home directory. allow the Redis service to be managed by systemd To do this, add or update the service file with this setting to read only: /etc/systemd/system/redis.service ProtectHome=read-only Reload systemd sudo systemctl daemon-reload Restart Redis sudo systemctl restart redis I can test Redis via the CLI locally on the instance mourjo@pelican:~$ redis-cli -p 12345
127.0.0.1:11219> AUTH somepassword
OK
127.0.0.1:11219> set x y
OK
127.0.0.1:11219> get x
"y" I want to connect to Redis over the internet, so first allow the port on to be accessible. On the in GCP console, create a new allow list with the following settings: pelican firewall tab Priority: 70 (less than the default value of 100) Direction: ingress Target tags: A tag that I will apply to the compute instance Source IPv4 ranges: allows every host to connect to this port 0.0.0.0/0 Protocol: TCP on port 12345 Edit the instance to apply this firewall using the “network tags” setting and using the tag I created the firewall with above (note that this opens up my instance to be accessible to anyone, so it is highly recommended to set a password as above) It should now be possible to connect to Redis from outside of the machine, for example from a computer that has not SSH’ed into the instance 🎉 Enabling TLS support for Redis So far I have set a password to access Redis but that data is still being transmitted over an unencrypted TCP connection which has two problems: It is very easy to and read the password intercept traffic Anyone can connect and start even without authenticating, causing my tiny instance to be overwhelmed sending a flood of traffic Both problems can be solved by using a where both the server and the client need to establish their identity even before interacting with Redis. . Therefore only known clients with the right private keys can access my server over an encrypted connection. secure connection over TLS (or mTLS) ensures that both the client and the server verify each other Mutual TLS Digital Certificates and Trust Establishment Digital certificates are commonly used in TLS and HTTPS to verify the identity of participants. In short, . a certificate is cryptographically verifiable proof that someone is who they say they are as attested by another authority If I am connecting to google.com, I need to know that I am in fact connecting to google.com and not someone impersonating google.com. This happens via a trust chain established between me (the browser) and the server (google.com): Google sends a certificate that has been cryptographically signed by a certifying authority (CA) and that signature is verifiable by us. It is important to note that I need to implicitly . This usually happens on the web via known issuers of certificates baked into browsers and operating systems (eg stores the CAs a Linux system implicitly trusts). Once I see a certificate that is signed by someone I trust, I can verify that the party claiming to be who they are (here google.com) is actually Google and not a spoof pretending to steal information from us. In reality, there may be intermediate authorities that do the actual certificate signing, but the intermediate CAs themselves must also have certificates signed by the root CA. trust the CA without question /etc/ssl/certs Image source. of the party whose identity is being verified. Using the server’s public key from the certificate, the client can encrypt a payload that only the server can decrypt, thus making the communication secure: Certificates contain the public key no other observer of the network can decrypt the information being communicated. This is called an mTLS handshake. It is slightly more complicated in reality, but it is the same in principle: Generating the Certificates The first step to a TLS connection is to have a certificate for the server and the client, both of which are signed by a CA. I don’t want to purchase a certificate so I will generate my own CA certificate, which is not trusted in the wild, so I will need to tell the server and client to accept all certificates issued by this CA. Create the root CA key and certificate -- this will be implicitly trusted by both client and server Create a new private key for the root CA (optionally encrypt it with AES 256) openssl genrsa -aes256 -out ca.key 4096 Create the certificate valid for 10 years signed by this private key openssl req -new -x509 -days 3650 -key ca.key -out ca.crt Create the client certificate signed by the root CA Generate a new private key for the client (same command as 1a) openssl genrsa -aes256 -out client.key 2048 Create a certificate signing request, which contains the parameters the certificate will be created with openssl req -new -key client.key -out client.csr Create the certificate signed by the CA openssl x509 -req -days 3650 -in client.csr -CA ca.crt -CAkey ca.key -out client.crt -CAcreateserial Create the server certificate signed by the root CA Generate a new private key for the server (same command as 1a) openssl genrsa -aes256 -out server.key 2048 Create a certificate signing request (it is customary to use the server IP address when prompted for ) Common Name openssl req -new -key server.key -out server.csr Create a certificate signed by the CA openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -out server.crt Setting up Redis with the certificates Using the certificates, let’s make these changes to Redis config: Enable TLS, disable the TCP port Add server certificate, server key Add CA certificate Enforce clients to be authenticated Update the file with these settings (here is the ): /etc/redis/redis.conf full config port 0
tls-port 12345

# server certificate and key:
tls-cert-file /home/mourjo/certs/server.crt
tls-key-file  /home/mourjo/certs/server.key

# the key file is encrypted, so add the password
tls-key-file-pass thisisredacted

# the CA certificate
tls-ca-cert-file /home/mourjo/certs/ca.crt

# make client authentication mandatory
tls-auth-clients yes Starting the server should show the following logs sudo systemctl start redis
tail /var/log/redis/redis-server.log 148924:M 27 Jan 2023 04:16:10.675 # Server initialized
...
148924:M 27 Jan 2023 04:16:10.676 * Ready to accept connections I can verify using OpenSSL’s that signed by my CA: s_client Redis does not accept a client that does not have a valid certificate # without any certificate
openssl s_client -state  -connect 35.209.163.139:11219 -servername 35.209.163.139 8610505984:error:1404C45C:SSL routines:ST_OK:reason(1116):/AppleInternal/Library/BuildRoots/810eba08-405a-11ed-86e9-6af958a02716/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/ssl/tls13_lib.c:129:SSL alert number 116 # with a certificate not signed by the CA
openssl s_client -state -cert random.crt -key random.key -connect <ip-address>:<port> -servername <ip-address> 8610505984:error:1404C418:SSL routines:ST_OK:tlsv1 alert unknown ca:/AppleInternal/Library/BuildRoots/810eba08-405a-11ed-86e9-6af958a02716/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/ssl/tls13_lib.c:129:SSL alert number 48 I can verify the SSL connection works when passing the right certificate: openssl s_client -state -cert client.crt -key client.key -connect <ip-address>:<port> -servername <ip-address> This should print out the necessary information about the server and security and also allow us to run Redis commands (because is human-readable): the Redis protocol Enter pass phrase for certprac/client.key:
CONNECTED(00000003)
depth=1 C = IN, ST = WB, L = Kolkata, O = mourjo.me, emailAddress = hello@mourjo.me
verify error:num=19:self signed certificate in certificate chain
verify return:0
write W BLOCK
---
Certificate chain
 0 s:/C=IN/ST=WB/L=Kolkata/CN=35.209.163.139/emailAddress=hello@mourjo.me
   i:/C=IN/ST=WB/L=Kolkata/O=mourjo.me/emailAddress=hello@mourjo.me
 1 s:/C=IN/ST=WB/L=Kolkata/O=mourjo.me/emailAddress=hello@mourjo.me
   i:/C=IN/ST=WB/L=Kolkata/O=mourjo.me/emailAddress=hello@mourjo.me
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=/C=IN/ST=WB/L=Kolkata/CN=35.209.163.139/emailAddress=hello@mourjo.me
issuer=/C=IN/ST=WB/L=Kolkata/O=mourjo.me/emailAddress=hello@mourjo.me
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 3049 bytes and written 1768 bytes
---
New, TLSv1/SSLv3, Cipher is AEAD-CHACHA20-POLY1305-SHA256
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : AEAD-CHACHA20-POLY1305-SHA256
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Start Time: 1674968406
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
read R BLOCK
read R BLOCK
AUTH SMASH-workaday-sully
+OK
PING
+PONG
SET a b
+OK
GET a
$1
b
^C I can also verify the SSL settings using an online tool like which reports that the SSL connection is set correctly, but issued by a CA that is not widely trusted in the world because I am using a CA who only I know. sslshopper Let us now connect using the Redis command-line client from outside the instance, passing the client certificate: redis-cli redis-cli -p 11219 --tls --cert client.crt --key client.key --cacert ca.crt

Enter PEM pass phrase:
127.0.0.1:11219> auth thishasbeenredacted
OK
127.0.0.1:11219> set xyz abc
OK
127.0.0.1:11219> get abc Redis is now working on TLS over the internet! 🎉 Client Implementation I have set up the Redis server and it works with the default client but I want to build a simple backend using Redis: redis-cli Allow a user to use their username -- authentication is out of scope for this post Keep track of active users for 10 minutes and purge inactive users Allow a maximum of 100 users at a time I will deploy an HTTP cloud function that stores and communicates with the Redis server. The backend code is written in Java using the popular for communicating with Redis. Jedis library The business logic is fairly simple, every time I get a new user, I check the limit of 100 users, purge inactive users and store the current user in a with the current timestamp. sorted set double timeoutMillis = 10 * 60 * 1000D;
int MAX_USERS = 100;

// connect with TLS, pass connect timeout and socket timeout of 10 sec
try (Jedis jedis = new Jedis(host, port, 10_000, 10_000, true)) {
    jedis.auth(redisPassword);

    // purge old users
    jedis.zremrangeByScore("recent_users", Double.NEGATIVE_INFINITY, System.currentTimeMillis() - timeoutMillis);

    // ensure that there only 100 users at max
    var total_users = jedis.zcount("recent_users", Double.NEGATIVE_INFINITY, Double.POSITIVE_INFINITY);
    if (total_users >= MAX_USERS) {
        throw new TooManyUsersException(total_users);
    }

    // add the current user to the sorted set with the timestamp
    jedis.zadd("recent_users", (double) System.currentTimeMillis(), user);

    // return a list of active users
    var activeUsers = jedis.zrangeWithScores("recent_users", 0, System.currentTimeMillis());
    Collections.reverse(activeUsers);
    return activeUsers;
} The rest of the client code uses the for cloud functions which wrap around the above business logic to respond to incoming requests. Java SDK The full repository is available . here Adding client certificates to Java Keystore The above code snippet although my Redis server only accepts TLS connections from clients that are trusted via my CA. This is as per the : , which ships directly with the JDK installation. So the client code while setting up the TLS connection transparently uses the certificates present in these protected files. makes no mention of certificates Java Cryptography Architecture (JCA) credentials/certificates are stored in password-protected files managed by the CLI utility keytool But before I start importing my certificates with , keytool I need to convert my certificates from the PEM format (which is the Linux default) to the PKCS12 format. Convert the CA root certificate to the format: PKCS12 openssl pkcs12 -export -in ca.crt -inkey ca.key -out ca.p12 Convert the client certificate (note that the key needs to be included in the p12 file): openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 As per common practice, will create two files with : one called the and the other . keytool keystore truststore The will store , that is the client’s private key and the client’s certificate that will allow us to prove to the Redis server that the client should be allowed to connect. keystore the keys/certificates the client needs to identify itself keytool -importkeystore -noprompt  -srckeystore client.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype PKCS12 The will , that is the root CA’s certificate. truststore store the certificates the client will implicitly trust With this, when the server sends its certificate, the client will know that it can trust the server. The will have my CA certificate: truststore keytool -importkeystore -noprompt -srckeystore ca.p12 -srcstoretype PKCS12 -destkeystore truststore.jks -deststoretype PKCS12 Announce to the JVM where it should look for credentials/certificates and set the following options either as CLI options or load them in the code: System.setProperty("javax.net.ssl.keyStorePassword", "redacted"); // decryption password used while generating the keystore:
System.setProperty("javax.net.ssl.keyStore", "keystore.jks");
System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");

System.setProperty("javax.net.ssl.trustStorePassword", "redacted"); // decryption password used while generating the truststore
System.setProperty("javax.net.ssl.trustStore", "truststore.p12");
System.setProperty("javax.net.ssl.trustStoreType", "PKCS12"); If all goes well, the following should return a from Redis server: PONG try (Jedis jedis = new Jedis(host, port, true)) {
  jedis.auth("theredispassword");
  System.out.println(jedis.ping());
} Secret Storage The client code should now be able to access Redis. But before deploying this to a cloud function, I need to instead of having them hovering all over the codebase or via unencrypted environment variables. safely store secrets To do this, I will use GCP’s to store the following secrets: secret manager : The text password for authenticating with Redis JIBBER_REDIS_PASSWORD : The keystore  file generated by above JIBBER_KEYSTORE keytool : The text password used to decrypt the keystore file JIBBER_KEYSTORE_PASSWORD : The truststore file generated by above JIBBER_TRUSTSTORE keytool : The text password used to decrypt the truststore file JIBBER_TRUSTSTORE_PASSWORD I need to also make sure that my cloud function has access to these secrets. I can do this by giving my default service account permission to read these secrets. I have to allow my service account to have the permission. Secret Manager Secret Accessor Deploying the Cloud Function In addition to the secrets, I also need to set a few environment variables (which are not secretive): Redis host and port Keystore and trust store locations The final command to deploy to cloud functions with secrets and environment variables looks like this: gcloud functions deploy jibber-function  \
  --entry-point me.mourjo.functions.Hello \
  --runtime java17 \
  --trigger-http \
  --allow-unauthenticated \
  --set-secrets '/etc/keystore:/keystore=JIBBER_KEYSTORE:1,/etc/truststore:/truststore=JIBBER_TRUSTSTORE:1,TRUSTSTORE_PASS=JIBBER_TRUSTSTORE_PASSWORD:1,KEYSTORE_PASS=JIBBER_KEYSTORE_PASSWORD:1,REDIS_PASSWORD=JIBBER_REDIS_PASSWORD:1' \
  --set-env-vars 'REDIS_HOST=1.1.1.1,REDIS_PORT=12345,KEYSTORE_LOCATION=/etc/keystore/keystore,TRUSTSTORE_LOCATION=/etc/truststore/truststore' Deploying the code to my cloud function should now work! 🎉 Conclusion In this post, I covered the foundations of the chat web app by setting up a GCP Cloud Function that triggers via HTTP and communicates over the internet via a secure connection with Redis -- . all of which is part of GCP’s free tier This cost-efficient infrastructure comes with caveats: This is partly due to the Cloud function and partly due to the encrypted connection to Redis over the internet instead of the local network The endpoint is slow: Any data written to Redis is not backed up and there is no secondary Redis instance that might fill in if the compute instance goes down. Redis is not failsafe: pelican In the next post, I will write a browser-based client that can communicate with this cloud function to establish a user session and then hand it over to a WebSocket server based on Cloud Run. Stay tuned!

Building a Secure Web Chat With Redis, mTLS and GCP

I have read some articles related to set up a QEMU environment for enabling RISC-V Linux kernel development. Unfortunately, none of them describes all the required steps to get a fully prepared RISC-V 64bit system. In this article, I am describing how to build the latest (as of the moment of writing) Linux Kernel for RISC-V 64 architecture and deploy it along with minimal environment: busybox command-line. PREREQUISITES I use Ubuntu as my main desktop OS, so all the described steps related to it. Probably it could be reproduced on other Debian-based distributions. My precise Ubuntu version is: hedin@home:~ linux/riscv64-linux$ lsb_release -a
LSB Version:    core ubuntu2-noarch:security ubuntu2-noarch
Distributor ID: Ubuntu
Description:    Ubuntu LTS
Release: Codename:       focal /projects/ -11.1 .0 -11.1 .0 20.04 .2 20.04 The following is the project's catalog structure: .....
hedin@home:~ linux/riscv64-linux$ tree -L .
├── busybox
├── initramfs
└── qemu /projects/ 1 Their intention is following: - contains minimal command-line environment to work with the Kernel. busybox - initial RAM disk for the Kernel. initramfs - emulator I run the RISC-V enabled Kernel on. qemu From now on I am using "$" instead of the full path to save space. Note 1: I intentionally didn't include Linux Kernel in this project as it is a huge amount of source code and it makes no sense to copy it to every project. It is better to have only one shared Kernel repository for all the related projects and use Git branches for each of them. Note 2: SETUP Firstly, we need to install common development tools: $ sudo apt install autoconf automake autotools-dev curl libmpc-dev libmpfr-dev libgmp-dev gawk build-essential bison flex texinfo gperf libtool patchutils bc zlib1g-dev libexpat-dev git And RISC-V compiler: $ sudo apt-get install -y gcc-riscv64-linux-gnu Secondly, we need to install Qemu from the source. The reason is that most Linux distributions don't contain the latest versions and also don't contain (or uses limited) RISC-V support. $ git clone https: $ cd qemu
$ git checkout v5 $ ./configure --target-list=riscv64-softmmu
ERROR: Cannot find Ninja //github.com/qemu/qemu .2 .0 Something went wrong. Qemu requires a Ninja-build package. Let's install it: $ sudo apt install ninja-build And try again: $ ./configure --target-list=riscv64-softmmu
$ make -j $(nproc)
$ sudo make install OK, now it is built. Let's return to the project catalog and obtain the Linux Kernel: $ cd .. Get the Linux tree: $ git clone https: //github.com/torvalds/linux Check out the latest (as of this moment of writing) kernel version: $ git checkout -b risc-v v5 .11 Make default config: $ make ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- defconfig And get a new error message: compiler not found 'riscv64-unknown-linux-gnu-gcc' The issue is that there is no standard toolchain that required my meets: $ sudo apt search riscv64-unknown-
Sorting... Done
Full Text Search... Done
binutils-riscv64-unknown-elf/focal,now ubuntu1 amd64 [installed,automatic]
  GNU assembler, linker and binary utilities RISC-V processors
gcc-riscv64-unknown-elf/focal,now ubuntu1 amd64 [installed]
  GCC compiler embedded RISC-V chips 2.34 -0 for 9.3 .0 -0 for There are 2 approaches for solving this issue: Compile it manually as described in the following article: https://programmersought.com/article/4626958334/ Get the latest build from bootlin. I will use the latter approach: Goto https://toolchains.bootlin.com/ Select arch - riscv64 Select libc - glibc Copy the link and download it somewhere (not in my project catalog): $ wget https: //toolchains.bootlin.com/downloads/releases/toolchains/riscv64/tarballs/riscv64--glibc--bleeding-edge-2020.08-1.tar.bz2 5) sudo mkdir -p /opt/bootlin 6) sudo tar jxf riscv64--glibc--bleeding-edge tar.bz2 -C /opt/bootlin/ -2020.08 -1. Now we are ready to compile the kernel again: $ make ARCH=riscv CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- defconfig
$ make ARCH=riscv CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- -j $(nproc)
...............................................................
  LD      vmlinux.o
  MODPOST vmlinux.symvers
  MODINFO modules.builtin.modinfo
  GEN     modules.builtin
  LD      .tmp_vmlinux.kallsyms1
  KSYMS   .tmp_vmlinux.kallsyms1.S
  AS      .tmp_vmlinux.kallsyms1.S
  LD      .tmp_vmlinux.kallsyms2
  KSYMS   .tmp_vmlinux.kallsyms2.S
  AS      .tmp_vmlinux.kallsyms2.S
  LD      vmlinux
  SYSMAP  System.map
  MODPOST Module.symvers
  OBJCOPY arch/riscv/boot/Image
  CC [M]  fs/efivarfs/efivarfs.mod.o
  CC [M]  fs/nfs/flexfilelayout/nfs_layout_flexfiles.mod.o
  GZIP    arch/riscv/boot/Image.gz
  LD [M]  fs/efivarfs/efivarfs.ko
  LD [M]  fs/nfs/flexfilelayout/nfs_layout_flexfiles.ko
  Kernel: arch/riscv/boot/Image.gz is ready /opt/ -2020.08 -1 /opt/ -2020.08 -1 The kernel is ready. It's time to compile BusyBox: Apply default config: $ CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- make defconfig /opt/ -2020.08 -1 Adjust one setting. I want a single monolith executable file without dependencies to dynamic libraries: $ CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- make menuconfig /opt/ -2020.08 -1 In the configuration change the following setting: Build binary (CONFIG_STATIC=y) static Build: $ CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- make -j $(nproc) /opt/ -2020.08 -1 Install: $ CROSS_COMPILE= bootlin/riscv64--glibc--bleeding-edge /bin/riscv64-buildroot-linux-gnu- make install /opt/ -2020.08 -1 The last thing we need to do is to create an initial RAM disk. And again I create it out of the project's tree as it will need for my purposes only once. After completion, we can remove it. So let's create it somewhere: $ mkdir _install
$ cd _install Create device tree catalog: $ mkdir -p dev And two required devices - console and ram: $ sudo mknod dev/ c $ sudo mknod dev/ram b console 5 1 1 0 And Init script, the first userspace process that the Kernel will run. This script creates required catalogs and mounts special-purpose kernel filesystems to them. Also, it measures how long this particular boot process took. And in the end, it runs a command interpreter, that is, bash-like busybox. $ vim init File content: echo mkdir /proc /sys /tmp
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp
echo -e exec /bin/sh #!/bin/sh "### INIT SCRIPT ###" "\nThis boot took $(cut -d' ' -f1 /proc/uptime) seconds\n" Let's pack file structure to the format the Kernel recognizes: find -print0 | cpio oH newc | gzip > -0 -9 /initramfs/initramfs.cpio.gz < > PATH_TO_OUR_PROJECT RUN Run qemu passing it the kernel, init RAM disk, and appropriate parameters: $ sudo qemu-system-riscv64 -nographic -machine virt -kernel ../linux-torvalds-tree/arch/riscv/boot/Image -initrd initramfs/initramfs.cpio.gz -append "root=/dev/vda ro console=ttyS0" ................................................................................................................................... I am in: / # ls
bin      init     proc     sbin     tmp
dev      linuxrc  root     sys      usr
/ # uname -a
Linux (none) # SMP Fri Mar : : MSK riscv64 GNU/Linux 5.11 .0 2 12 09 36 08 2021 References: https://risc-v-getting-started-guide.readthedocs.io/en/latest/linux-qemu.html https://programmersought.com/article/4626958334/ https://stackoverflow.com/questions/63393780/riscv64-linux-kernel-compilation-issue https://ibug.io/blog/2019/04/os-lab-1/

BUILDZOOM

buildzoom.com

51-200 employees

Since 2013

COMPANY RANKING

BUILDZOOM

EVERGREEN INDEX #2234

Representing this company? Click here to claim and customize this page!

BuildZoom WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

BUILDZOOM

buildzoom.com

51-200 employees

Since 2013

COMPANY RANKING

BUILDZOOM

EVERGREEN INDEX #2234

RELATED COMPANIESRANK

STORIES ABOUT BUILDZOOM

Representing this company? Click here to claim and customize this page!

BuildZoom WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!