
*A look at how a JWT authentication vulnerability led to $400k+ in drained wallets—and what it reveals about the tradeoffs between frictionless UX and wallet security.*

Some thoughts on the [Kontigo app wallet vulnerability](https://www.kontigo.com/en/article/security-incident-postmortem-unauthorized-account-access).

## What happened

The attacker exploited a [vulnerability in Supabase's GoTrue auth server](https://github.com/supabase/auth/security/advisories/GHSA-9wqv-qhrh-87f4). By using an OpenID Connect compliant ID token issuer under their control, they could authenticate as any legitimate user.

This allowed the attacker to mint JWT tokens and impersonate 1,005 users, draining 340,905.28 USDT from their wallets.

Three days later, the attacker used pre-issued TEE wallet JWTs to drain an additional 56,913 USDC. The TEE trusted these tokens, which had a default validity of 30 days.

### Why JWTs matter for wallet security

How can a JWT lead to draining a wallet?

Most TEE-based embedded wallets require a valid user token to reconstruct the user's private key. A TEE wallet JWT is issued after verifying an incoming OIDC-compatible JWT against the configured JWKS.

The root of trust is in that token. If it's exposed or forged, you're cooked.

## How this could have been avoided

Require user interaction whenever they interact with the TEE to reconstruct the private key. This way, JWTs would not be the root of the trust.

Options include:
- OTP verification
- Passkeys
- Authenticator apps

This attack is a reminder that **frictionless always comes with trade-offs**.

### A note on custody claims

Is the Kontigo app a self-custody wallet? No, but now at least it's being called non-custodial in the post-mortem.

That claim is also questionable. Kontigo could mint access tokens via Supabase Admin endpoints on behalf of their users—tokens that would be valid to create new TEE JWTs.

## What this means for OpenSigner

Let me take these learnings home and apply them to OpenSigner: wallet security is a spectrum. Developers should be able to tune the friction of the wallets they provide based on the assets they secure.

[OpenSigner](https://opensigner.dev) is an open-source on-device signing solution based on SSS with 2/3 quorum. It supports 3 encryption methods for securing its cold share:
- [Password](https://www.opensigner.dev/actions/signup#password-recovery)
- [Passkey](https://www.opensigner.dev/actions/signup#password-recovery)
- [Automatic](https://www.opensigner.dev/actions/signup#password-recovery)

![shamir-secret-sharing](/blog/auth-jwt-wallet-vulnerability/sss-3.png)

For its relation to the Kontigo attack, I'll focus on automatic recovery. The other two methods would not be affected by a similar attack because user input is required by default.

### How automatic recovery works

Whenever a user creates or recovers their wallet on a new device, they must decrypt the cold share.

In automatic recovery, the developer is given an encryption share they must safeguard at all times. This encryption share is part of a 2/2 quorum encryption key required to encrypt the cold share.

![encryption-key](/blog/auth-jwt-wallet-vulnerability/sss-2.png)

By default, the system's root of trust is with the access token—it must be secured at all times.

The developer must expose a backend endpoint to create a one-time encryption session based on the encryption share they own.

This introduces a first barrier to a similar attack, because the developer can check that the request to create an encryption session comes from their own front-end.

To avoid the same pitfall where an access token could be forged, we developed an OTP-based solution that requires users to provide input to create the encryption session.

## Key takeaways

- **JWTs as root of trust are risky** — If your TEE wallet relies solely on JWT verification, a compromised auth layer means compromised wallets
- **Frictionless UX has security costs** — Every step you remove is a layer of protection gone
- **User interaction matters** — Requiring OTP, passkeys, or authenticator input during key reconstruction adds meaningful security

Building secure wallets means finding the right balance between convenience and protection. [OpenSigner](https://opensigner.dev) gives developers the tools to make that choice.

Some thoughts on the Kontigo app wallet vulnerability

When TEEs become insecure for private key operations


We hire for people that we believe will be in the NYC stock exchange ringing the bell with us.

We have a growth mindset, everyone that joins in the beginning has the opportunity to get into a very high leadership position from within the company. 

There's a component to building a company that's different from just the transaction of paid by project. Rather, it's a camaraderie and really stark belief in the mission and projection of the company.

Communication is faster in-person. Everyone in the room will pick by osmosis what's going on, which will translate into people innovating better.

Us being one of the few tech companies that are fully in person all in Barcelona opens a lot of access to the game studio community.

We manage plans to maximise productivity. 

We optimise for being on top of our game for health and learning. This makes it an awesome place to work.

In 10-15 years we hope to have achieved a significant amount of impact on the way people interact and manage digital assets.

The company has an intense work ethic. That's how we operate. Eventually, at scale, we'll have such a MOAT that we'll have a little more work/life balance.

If you want to join a seed stage company, and you actually want to be successful and win, there's going to be a lot going on in your profession, so you'll need to make some sacrifices in your personal life.

If you're at a point in your life where you want to lean into professional growth and trying to be the best that you can be, this is the place for you. We have an immense amount of mentorship from some of the best investors of the world. We are growing significantly fast, which unlocks a lot of opportunity to work on really cool, innovative projects. If you want to work hard, just like going to engineering school where you create relationships that last a lifetime, this is the place for you.

We're on the trenches, we're building together, and you'll have relationships that last forever (think PayPal mafia). That's the goal. While doing that, you're going to have a very positive impact that you can see in our customers' eyes while you do it.

Our core values:
- Dream big: a trillion-dollar company.
- Olympians work ethic.
- Growth mindset.
- Customer obsession.

[We're hiring](https://jobs.openfort.io/)

We hire ambitious, hard-working smart people.

Openfort's Work Ethic


A blockchain-native communication platform could foster collaboration between decentralized community members while allowing them to build their digital identity with their contributions. Decentralized communities could host hubs for their members, where each tokenized community features a Discourse-like discussion board.

## The problem: Decentralized communities are missing a native coordination layer

The current coordination infrastructure used by decentralized communities relies too heavily on traditional solutions. Solutions that look like enterprise SaaS instead of multiplayer. Why is that?

For once, the lack of alternatives makes the switch impossible. Communication tools like Discourse and Discord have been filling the gap for crypto communities with increasing numbers of apps and bots to power their communities or API calls to offer their centralized content.

We all know what happens when the tools we use depend too heavily on centralized players (See Aave Founder being blocked by Twitter or Bankless being blocked by Youtube).

Crypto-native communities deserve crypto-native software. User databases are siloed, there is no cross-chain reputation and solutions are missing on new frontiers enabled by crypto.

Decentralized communities remove the barrier for billions of internet users to trust and coordinate capital with anyone on the internet. More crypto-first coordination tools are required.

[A user on the MakerDAO Discourse](https://forum.makerdao.com/u/longforwisdom/summary).

The same user on multiple Discourse forums will lose all this information and start from scratch.

## A potential solution: Incentives on the social graph

A decentralized communication layer on top of the onchain social graph could add social, collaborative, and productivity components that, otherwise, would exist in different off-chain silos. Tools for feedback, voting and decision-making would emerge for every user.

An implementation could leverage Lens protocol to create a place where community members share and discuss relevant resources for the community. Some information would live on the blockchain while other data could be stored in IPFS.

## Vision

Social protocols will define how people organize and how culture flows by allowing digital-age coordination at scale. Open social graphs are the crypto-native approach to re-architecting the traditional tech stack.

## Moving from Enabler to Grower

Community tooling has evolved immensely in the past years. But there is a clear distinction to make when it comes to incentives. Tools designed as "Growers" help contributors take the next step, with modules to increase the value of the end-user.

The ability to own your contributions and bring your badges with you means that people can build their reputation on their own terms. The days of waiting for someone else to decide whether or not you are worthy of recognition are over.

With an open state database, everyone can see who has contributed what, how often they contribute, and how much value those contributions have created for others. This approach was not possible before because it would take too long for someone else to verify the validity of one's contributions using conventional methods like peer review or other forms of verification by third parties.

### Technical considerations

Building on Polygon makes sense due to its low-cost transactions. Even with Ethereum rollups where transaction costs are over $1, low-value transactions such as following and upvoting would not be economical.

Content management protocols like Ceramic (content storage on top of IPFS) and Lit Protocol (privacy via content access control) could manage and store content file data.

Using a social graph protocol like Lens allows the use of implemented core primitives in a composable fashion.

Lens is extendable and EVM compatible, which means that developers can add features on top of the core primitives. This approach is clearly distinct from social graph protocols like [DeSO](https://www.deso.org/) and the full stack application [gm.xyz](https://gm.xyz/)

## Growth strategy

A strategic starting point would be in the discussion for protocol-based communities. Protocol communities are the most resilient and active in the ecosystem.

Developing liquidity over scale early on matters. Building enough value for crucial communities to migrate operations to another platform at once.

## Key features

On-chain interactions bring novel ways to interact with community members. This is a novel approach to community aligned metrics where contributors can [prove](https://twitter.com/StaniKulechov/status/1529544441303863296) and benefit from being actively involved. Developing an on-chain reputation through these interactions plays a key role for participants of any digital economy.

Unlike applications like Discourse that monetize through subscriptions, a blockchain-native platform isn't limited to the direct selling of licenses or subscriptions. Modules could be pre-configured to serve different functions, such as targeted airdrops based on the social graph, sentiment analysis on the community or access to gated sections.

Communities have to rely on tools like [SourceCred](https://sourcecred.io/) to encourage and activate their community by rewarding their most active users. Opening up collaborators to earn cash implies that economic value is not derived from speculation, but rather from *commerce.* This evolves into tipping capabilities or even curate-to-earn dynamics.

Once the social graph is formed, the relationships are unforkable, which cements the social graph in the network and attracts other protocols to service the revenues.

## Challenges

There is no doubt about how powerful open social graphs are. Owning your engagement and identity is a no-brainer for anyone starting the journey in decentralized networks. There are 2 challenges that need to be overcome:

 - Technological challenges. Any meaningful social network would produce significant transaction amounts that far exceed the current chain throughput. Because with Lens the state of every retweet, post comment, etc, is a transaction, there needs to be a sustainable model of gasless transactions through relayers. There are some open questions whether subnets or token incentives can balance out these costs.
 - User Experience. Blockchain apps have long relied heavily on the desktop experience. But mobile is by far the preferred way to access communication. Finding the optimal balance between connecting identities and engagement in decentralized communities will revolve around clean and intuitive products.


Exploring blockchain-native communication platforms for decentralized communities.

Decentralized community incentives



- Places where people have a big passion already but the economic models don't make sense.
- It's hard to keep living in the future. The mind wants to rest in the present. Inspiration comes in bursts.
- To get intuition on a certain topic, you need first to learn the rules upon which that field is based to then forget them.
- When you know that you can build it better, take the leap of faith if it won't happen without you.
- The most rewarding thing about my job is that I never have to work very hard to explain why I love it.
- Work on a super hard problem that no-one else is working on.
- If you have to use someone else's name or authority to get your point across, there is little merit to the point (you might not believe in it yourself). If you believe in something to be correct, focus on showing your work to prove it. Authority derives naturally from merit, not the other way around.
- A platform is *composable* if its existing resources can be used as building blocks and programmed into higher order applications.
- If you mix two hard problems you get an impossible problem.


## Best founders
- MVP as a wedge into the market and then leverage that into a much larger opportunity.
- Timestamp the vision.
- Predict something non-obvious about the future of the world before others see it & make it market ready for their ultimate vision.
- Too many companies are money driven, end up making less money. Be positive impact driven.

## Analyse an idea
- If with a new technology:
	- Can only be done this way.
	- Take full advantage of the new technology/benefits.
- Motivation around the topic.
- Potential of the idea.
- Knowledge around the core technology.
- Capacity to attract top talent with the idea.
- Profit potential.
- Probability of success.
- Ever felt the problem.
- Do you like who the customer is.
- Can we have product led growth.

**On life's intrinsic motivations by [Daniel Pink](https://en.wikipedia.org/wiki/Drive:_The_Surprising_Truth_About_What_Motivates_Us)**
1. Autonomy → the urge to direct one's life.
2. Mastery → the desire to get better at something that matters.
3. Purpose → the yearning to do work in the service of something larger than one's self.

**On how to begin**
1. Where am I now.
2. The very next step forward.
3. The goal/dream.

## How to find a problem
- Reformulate as a question → bite off a partial solutions off of it.
- Bring something inaccessible to the masses.
- Find the problem intolerable & feel like there must be a way to solve it.

**How to find something people want**
1. Something people use that's broken.
2. Turn luxury into a commodity.
3. Look at what big companies should be doing and then do it.

## Zero to one - Thiel
- Doing what we know how to do takes the world from 1 → n.
- College can teach you many things many don't know what to do with those skills.
- What important truth do very few people agree with you? Many people believe in X, but the truth is Y.  What companies is no-one building.
- How do we go about developing the developed world.

-   Two types of progress: horizontal (1 to n) or **vertical (0 to 1)**
    -   Horizontal is focused on copying things that work and improving them
    -   Vertical is focused on breaking new ground
- Most common case of failure is when people don't get along. Far more than external competition.
-   “Competition can make people hallucinate opportunities where none exist”
-   Build + maintain a monopoly
    -   Monopolists lie to protect their monopolies — they inflate the size of markets in which they compete seem larger, to deflect attention; “everyone is competing with us” (Google has a monopoly on search and search advertising, but talks about being a broader technology player)
    -   Non-monopolists tell the opposite lie — ”we’re in a league of our own”; understating the true scale of real competition
-   Capitalism and competition are opposites
    -   Capitalism generates profits
    -   Competition eliminates profits
-   Definite vs. Indefinite / Optimism vs. Pessimism — a great 2x2 matrix for thinking about mindsets for innovators
- How to develop a good idea? Know a secret about your market. How to develop a secret:
	- Know the tools better than anyone else
	- Know the problems better than anyone else
	- Draw from your own experience background
- Get an understanding about something where other people do not yet have. The secret at PayPal they were very interested in cryptocurrencies and encryption technologies and currencies and could they be intersected. Can you build a new digital currency.
- Go after big markets that are growing a lot and capture as much of it as possible - one example of this is clean tech companies, where in the first slide they show a huge market- which will of course come with a lot of initial competition.
- What are the things that can be done in London better than anywhere else in the world.
- The advantages of Silicon Valley, like network effects, also have disadvantages like more Lemming liked and crowd like behaviour which can also be problematic.
- work on a problem that otherwise would not get solved. an important problem where people have a blind spot around it or aren't thinking about it. Foundation about it - passion about, and physiological level - something that a lot of people is missing one way or another.
- A bad plan is always better than no plan.
- The future has to be thought in concrete terms and  has to be different from the present. Only with these two the future can have a charismatic force. Based on western Europe there're 3 possible futures on offer:
	- Islamic Shari'ha: women have to wear a burka
	- totalitarian AI a-la China: computer track you 
	- hyper environmentalism where you drive an e-scooter and you recycle.
- Where is the frontier? Where are the pockets of innovation where you can do some new things and not be in a craze competition? What's a good career that other people aren't pursuing ? -e.g. petroleum engineer-
- The most important things you need to have a **secret**.
- In an industry with a lot of incumbents, a lot money, one has to have a projection of the future that nobody else agrees with that turns out to be insightful.
- You need to be able to track future accurately. Otherwise you give generic advice and that's something that most people ignore.
- Most people hedge
- You must be looking where everyone else isn't. Otherwise there will be tons of competition and it'll be very hard to differentiate.
- What do you know that's true that nobody else understands.
- Tech startups are inherently a global business, so they must do one thing uniquely well, better than anyone else in the world.
- What great business exists that nobody else is building.
- Sometimes companies are iterations on things with one fundamental improvement in one key dimension.

## Previous successes
### Musk
Looked at the present, where the internet was, and thought about the obvious opportunity this was going to be. No rocket science, no genius. Seeing the truth when everyone is laughing and having math to prove it.

Next company, x.com (Paypal) -> putting your financial information on the internet. 
Trust your reasoning from first principles.

Reason from axioms vs reason by analogy. In the important moments in life you should reason from first principles.

See where it's going because he could see where it was that day. Conventional wisdom is still a few years later.

If this could b done, this would have been done a long time ago -> a math that you believe in. See reality, assess probabilities, ignore the rest/noise.

### Bezos
1. Saw web usage growing 2300% YoY.
2. Made a list of the top 20 products to sell online & picked the one that could only happen online.

For any infant technology -> Anything that can be done using traditional methods should probably be done that way.

You best theories are going to be creating guesses, not simple speculations.

### Airbnb, Coinbase, Stripe
1. Timing was important:
	- Preexisting product.
	- Preexisting competitor.
	- 10x Better Product Possible.
2. Most founders and investors thought these ideas were terrible (either too hard to execute or plain bad ideas).
3. Each opportunity turned out to be bigger than what the founders expected.

## Axioms
GDP percentage of the west is in decline:
- Influence and capability to defend itself will also decline (although people will probably not notice this).
- Capability of states to crack down on civilians will increase -> people will try to look for alternatives.

The west focusing more on equality rather than in excellence. Focus in defending universal values of:
1. Freedom of speech.
2. Free markets.
3. Protection from search & seizure.

## YC recommendations
-   What problem are you solving?
-   Can you state the problem clearly
-   Have you experienced it yourself?
-   Can you define your problem narrowly?
-   Is your problem solvable?
-   Who’s your customer?
-   How intense is the problem?
-   Are they willing to pay?
-   how easy are they to find? (The customers)
-   Does your MVP actually solve the problem?
-   Which customers should you go after first?
-   Which customers should you run away from?
-   Should you discount or start with a super low price?
-   How to setup metrics
-   GA + something else (Amplitude, Mixpanel)
-   Pick 5-10 important stats
-   Make measurements a part of a product spec
-   Product Development Cycle
-   KPI Goal

Bullet points and ideas that are relevant when evaluating startup ideas

Bullet points on evaluating startup ideas


Censorship resistance feels more like an edge case today.
Another way of thinking about it is in terms of digital property rights.

e.g. in the 2000s, the deal from social networks was amazing because you’d get free distribution to everybody, hosting, content creation tools…
Relative to the 1980s and 1990s when distribution was very scarce when being on TV was the biggest thing, now everyone is able to stream on YouTube, post on blogger, post on Facebook or what have you.

But as time went on, this has become the standard package and what has happened, is that rather than being neutral platforms, they have a huge thumb on the scale. Downgrading in search results, YouTube Adpocalypse… people don’t have a share in what they are creating and don’t have control over their digital presence, which become more and more important as it becomes a larger percentage of your life.

An interesting question to ask: What percentage of your waking hours a day do you spend in front of a computer. That is more than 50% for many people, especially information workers.

Most of your remaining life will be spent in the Matrix, and if you don’t have root over the Matrix (if you can just be locked in a box and all the doors are closed and money is taken away, and you’re silenced), that’s actually possible if somebody has root.

Against being totally powerless, the alternative is to have control and have economic rights. Control means private keys, and economics also means private keys. It's both the freedom and the prosperity. People focus on the freedom in the sense of censorship resistance, but is also the prosperity in the terms of digital property rights.

Crypto creators will be so much bigger than Internet influencers because they will get a much bigger cut on what they create. Millions of people are not getting a cut of what they create. When they do, they will share so much more of it, and it's going to be more useful because they're going to do it in exchange for cryptocurrency and not simply likes, and so on.

One should appreciate how hard it is to build centralized companies and also appreciate that it is very difficult to have something where you got a loop that has been optimized for being addictiveness for many people, and it’s taking so much time and to having that compensated in some way. 

One bad part would be that things can become too transactional. On balance though there’s some good to that too. But even that can be positive, given that so much in social media currently is empty posturing and so much is hostility. This is because it would incentivize people to behave more positively when there are more mechanisms for economic alignment instead of a zero-sum status. But that is clearly a negative. Also, when everything has a price, you’ll see a lot of things that you didn't think about as being priceable, like sentiment (memes, hashtags) so you’ll be able to trade against that.

On balance, it’s good to add some degree of scarcity to the mix here because otherwise it is hidden, and it only exists as root in someone's servers, so instead put that back into people’s hands.

The single most important field is crypto identity (ENS, Solana names, Orbit …). We’ll need another term other than “Connect Wallet”, as it sounds like it will drain your money, but that portable identity is way more important that people think because when identity becomes portable, backends become liquid. When you can log in to a new service as easily as you load a new webpage, that means that the ice blocks (Twitter DB, Facebook DB), those become liquid and can flow between platforms, potentially as easily as just clicking. 

It's like the transaction with analog and digital cameras. Even though they were worse than its counterparts, they were more convenient, so they got used a lot and improved a lot.

One's crypto identity hits that flipping, when it has millions of users, when services are built for that first (maybe around late 2030), then you can have for instance a crypto phone, and you have identity fundamentally with the private keys (all money, digital property), then digital exit becomes much more powerful because digital services need to fight for their bread because they don't have lock in.

The most scarce resources per decade:
- 2000 - Bandwidth
- 2010 - Attention
- 2020 - Blockspace
- 2030 - Loyalty

There needs to be Vampire attacks on web2 services like (Instagram, Twitter, Facebook). When tokens are integrated into social networks, they become more of a digital tribe.

In the west, people react with apathy and then panic.

The first web was the open web and Google could index that, it’s actually very difficult to do it, but it's possible with crawlers and so on (many technical difficulties in allocating the right bandwidth to each crawler and telling when should a side be recrawled - Cisco algorithms). Crawling is complicated because there are many formats, you have to do wrapper induction, it's a database populated page, how do you know you got all of it, how do you know you’re not breaking the web app when crawling it, etc.

The social web is even harder to index because it sits in Facebook's, Twitters… servers and they don’t want to let you index it. LinkedIn actually lost the “high five” case where scrappers can now in theory index LinkedIn, but they are still not making it easy. In theory, you can do a data export but really is not just data but also your identity and your connections - your social graph - as an individual (is your community, your subculture).

What people don’t get about blockchains is that up until this point they have been basically hosting financial data. It didn't look like web1 or web2 data, meaning HTML pages or social pages. But now it's starting to as blockspace increases (DeSo, Mirror, Capsule Social, orbit, …). Essentially you have decentralized storage of posts and identity and other kinds of things. This radically simplifies indexing. One simple proof is that everybody    can set up something like btc.com or blockchain.com or blockchair.com (block explorer), and already billion dollar companies have been built as block explorers (ehterscan.com). Indexing is easier and therefore searching is also easier because instead of pinging the sites, and all the crawling complications, you get it all pushed directly to you with new blocks.

Now with people signing the content they create with the ens or other identities, you have digital signatures as a first class feature. That is huge, and they are open. 

A big chunk of Google nowadays are actually queries for many recent events. They don't show all the historical stuff - hard to find it. That means that their index is highly biased towards open state platforms (because they’re less than 1 yo). A large fraction of Google will move to new clients. They are much more vulnerable than what people think because the whole scope of what they index and the difficulty of indexing it may just get transformed. This is a redefinition of the problem because search has just become easier, it has got more signals, Google doesn't have the core competency around it.

New kinds of social networks will be built, and many of them will invoke finance as a first class feature (because you can assume that every user has a balance). The backend change to a decentralized social network is so challenging, that people might just do is to have almost exactly the same front end that we’re already accustomed to (client), and then put all the energy into innovating in the backend and making that actually work first.

Crypto creators will be so much bigger than Internet influencers

Balajis on distributed social networks.


The bits that matter:

1. **Vision and mission**
2. **Speed**
3. **Product Customer Fit**
4. **Product Market Fit**


## Mission and vision

**Mission**: Why do you exist, other than making money? Higher-order purpose. Clear on what would be better afterward.

**Vision**: What does the future look like because of you?

Why do you need those things:

1. **Decision-making** if everyone knows the end goal there's less existential debate.
2. **Your brand customers** will know what ideas they're signing up to, what do you stand for?
3. **Your employees** you want a team inspired by the shared purpose, not just the revenue growth or monthly metrics.

## Speed

A startup is a business designed to grow fast. You should be moving at breakneck speed. You should be very uncomfortable with things moving at a normal and fast pace.

Companies that ship fast always outperform.

What are the ingredients of speed:

- Culture
- Tooling: Bring value to customers and increase our ability to do that fast.
- Focus
- Process

>Fast gets good before good gets fast


## Product customer fit

Your product must be **loved** before you can tolerate being **liked**

Forget all the hacks, optimizers, and multipliers. **Product Customer Fit** means that "for a given customer, do they use our product every time the problem occurs and does it solve the problem **<u>every</u>** time.

**Jobs to be done:** The more you understand the problem, the more the solution becomes self-evident. How to understand your job:

- **Interview your users**: Break the interviewees into different specific groups of people.

- **Scope your product:** Make a storyboard on why someone would start using your product. i.e., What happened so that you needed to start using our product, What did it feel like to start using our product, how did you know that our product was the right one for you, what was your definition of success, do you ever think you'll stop using our product. Use this to set up metrics that matter.

- Pick metrics that matter. The real question you want to know is, **do they use my product every time it matters**, meaning **what is the expected problem frequency or the trigger that causes me to use it.**

When X happens, I use Y, every X I use Y. How many unique users have fully adopted your product. Are you fully solving the problem? You have product customer fit when some amount of unforgiving customers use our product every time they need it can help them, and it solves their problem completely.

## Product Market Fit

You have a repeatable, reliable, and efficient way to reach the people who have the problem your product solves.

On the marketing funnel, you should start at the bottom with the happy paying customer and work your way up the funnel

How people buy your product:

1. Problem-based They search by the description of their problem.
2. Category-based: They search by the solution category.
3. Competition-based: They want a better version of what they currently have.
4. Brand-based: They want you!

**Disclaimer**: _These are a set of notes I took from listening to Des Traynor. They don't fully represent his thoughts as some of these might be rephrased to something I understand more clearly._


## Notes

1.  [Why startups succeed](https://www.youtube.com/watch?v=Oh4sA47XpR0)


Notes on what Des Traynor (co-founder of Intercom) has to say about startups

Des Traynor on why startups succeed


Just some random thoughts I got today after hearing the latest episode of King of Kings from Hardcore history. From its definition of ambition: "The earnest desire for some kind of desire or distinction, such as power, honor, fame or wealth, and the willingness to strive for its attainment."

I have the intuition that remarkable individuals are born, sure. But they are also blessed by a set of circumstances that allowed them to develop their ambition to their full potential.

Before the information age, coined from the “Sovereign Individual”, it feels like the places where this person could appear were always constrained to what civilization happened to be in the eye of the hurricane. There are countless examples of this: Alexander the Great, Xerxes, Julius Caesar to name a few.

This is because even extremely ambitious individuals are constrained by the local maxima they believe plausible, therefore crippling their expectations.

Now in the information age, these hyper-ambitious individuals aren’t only constrained to where they live but rather have the possibility of learning what everyone else at the top of civilization knows, which in theory should make the likelihood of an extraordinary individual appearing from wherever. I’m not sure this is the case though.

I have the intuition that remarkable individuals are born, sure

About hyper-ambitious individuals


Zoom fatigue is a real thing. A lot of meetings are now lasting much less, like a turbo meeting of around 7 minutes. A lot of meetings are getting replaced by written culture (asynchronous communication). People just post and say what they are going to do that day, no need to meet every morning for a daily stand-up. People are finally realizing that reading is 2x as fast as listening, and if your culture really wants to speed up you move to a written culture, an asynchronous culture where business moves at the speed of thought

We're realizing that we can just send a Google Doc that aligns our thinking and if we take the time to write it well, there's no point in talking. And that's time saved, even though it takes longer to write the doc, if it deletes the meeting, that's a win. There's still a bit of fallback to Looms where we narrate the piece, which is also working. People are trying to avoid meetings, it pisses people off.

Having meetings mainly for socialization. Avoiding and clarifying meeting slides through other async tools as Slack allows for higher-level discussions in the actual meetings. It's fascinating because people miss co-workers, and want to see them hang out. But, the fact that people are happier around their families on their own schedule makes a lot of companies double down on the work from home paradigm.

This clearly doesn't work for everybody. The effect that this has on mentorship for people that are young in their career will be something to be determined. At this point, changing companies is like changing between tabs in the same browser, because none of these policies are unique. The idea of company identity is lost and people are starting to regret this kind of stuff. All these evangelists that claim they know how to make hybrid work, still haven't figured it out themselves.

Moving to deliberate social gatherings is very valuable. Especially because they're an opportunity to replicate the camaraderie moments. The cost of leaving a job where you haven't met anybody and you have no fabric or real estate in the company other than the transactional nature of compensation is as low as ever. In a way, there's something lost there, as you didn't get a chance to bond with a group of people.

The written culture also forces a lot more for people to be self-managed (and have more ownership over what they produce), which means that the middle management roles aren't as necessary.

For people that will want to go back to the office, they'll let them go back. For remote and hybrid workers, I believe we need to make a distinction on performers. There are mainly three levels of performers in organizations:

High performer

Middle performer

Low performer

Every company gets a percentage of each. For low performers between 10% and 20%. For anybody that is a real contributor, no one will care whether they're at home or office. For anyone in the middle that has the potential to become serial contributors, low average or below average, there's the possibility where a two-class system will come into play where for an average performance that has high potential and the company wants to invest in them, it might be hard to do that remote and wouldn't have the option. A-list players would get to pick, anywhere in the middle have to go to the office or the company chooses.

In the upcoming months, everyone is going to go back to the realization that workspaces have good air conditioning, nice food, and are purposely designed for work with nice meeting rooms. People are going to love it initially. The appetite is there, as the employees realize that designers optimize offices for work and there's something useful about that. So there'll be an initial storm back and that's fine. Still, fully remote workers will continue to be fully remote.

Companies will have to make a decision on what's the threshold for doing that, as you don't want a junior person that is super inexperienced and needs a lot of mentorships and wants to learn from the more senior engineers, it's going to be harder to do that from a bedroom somewhere.

The next stage is when everything normalizes, these 3 days a week thing is going to be complicated. That's because we're going to realize that we want a team behaving the same schedule. if there are 6 people in a room and a person on the dial-in, that's messy as they have different bandwidth conversations.

They'll need to agree on a schedule like, Mondays and Tuesdays they go to the office, and after that work is dished and everyone knows what they're doing and there's no need to contact regularly (you move to async). Teams will need to set an operational cadence themselves.

I suspect it is going to be three months after everyone is back to normal that people are going to realize what we need to do. That moment is going to be a bundling between fully in-office, fully remote, or the hybrids (where they'll need to agree on the days).

You can't just dabble with remote, once the more senior people aren't in the office all the time, the shift to written culture becomes mandatory. It's either that or losing time in meetings.



We're realizing that we can just send a Google Doc that aligns our thinking

My thoughts on the future of work


Every software company that ever was, has always said, _“our product is intuitive and easy to use”._ The reality is that every one of them lies. Here’s what happens for a human to use software: from the thing that you want to do, you need to translate that intent into a set of actions (drag and drops and swipes) to make the software do what we intend to do. E.g. You’re in photoshop and say that you want to remove the background, you should just be able to say “remove the background” from this image. If you’re in HubSpot you should be able to ask “how many people have signed up for our product in the last 90 days?"

You should be able to just type that question in because that is your intent. You should be able to express the thing that you want, and the technology should be able to figure it out. We have the technology now on the language side to be able to understand languages, and all we really need is a translation layer.

This is a megatrend to be, which is bigger than mobile. Mobile added the translation from what you used to do on your desktop, now you can do it from anywhere. And this enabled a bunch of new use cases.

This thing is; that thing that you have been trying to learn, that software layer in which you never got good at because you never had the time. Now a billion people can use that piece of software that wasn’t even possible before because they don't have to learn the clicks and drags to make it work. They can express the thing they want, and the software can do it.

If you were an enterprising VC, you'd be choosing the categories where this will have the biggest impact (business intelligence, reporting, B2B software is a natural fit). The beginnings of the consumer side would be with things like Alexa, but the B2B world is open to making the thing actually intuitive and make it do what I want.

That magic trick → You just do this and that and get the result that easily. Like waving a wand and getting a surprisingly good result. Once you see it, you can’t unsee it. So that when you see it, you can’t watch at the products that don’t have it in the same way.

Google is kind of this magic genie where if you give it a set of questions, it tries to come up with the answers. If this can actually be done, this is the next level to Google in that you can ask it any question, and it doesn’t just give a set of pages where the answers might be, but it actually tells you the answer.

It turns out that many tools out there (Google Calendar, Microsoft Word) all have internal APIs to build plug-ins around them. So there is a sophisticated way to control these tools with these internal APIs. Today, if you want to make new more complicated behaviors from these products, you need to add a new button from every new behavior. It is possible to use Codex and tell, for instance, your calendar to schedule a meeting next week after 2 pm. It would then write the corresponding piece of code, which is the thing that you ultimately want. No need to hard code each interaction, but rather Codex can take each API on the fly.

Every software company that ever was, has always said

Blog