What I learned doing a startup: part 1

This post comes from a series; read the series overview here.

Validate your validations

When I began Ground Control I had no idea I was starting a business. I had been hired to build something, and wanted to do a good job of building it. However once other people expressed interest in the same system, and realising my initial customer would allow the software to be licensed in this way, I got the idea that this could become a system that could be sold over and over again.

The first customers paid lump sum values to use the system, but I quickly realised that large one-off payments for software had disadvantages - they made the sales process harder (the customer is committing a lot up front) and they risk the business needing to keep selling to survive. This would be a problem for any business but skydiving is a small industry - one could feasibly run out of customers, or at least exhaust all potential leads.

Read More

What I learned doing a startup

I’ve considered writing up some thoughts about my first business for some time now. There’s become a tradition in the startup world of publishing post-mortems when a company fails. In many cases these are published after the startup may only have been around for months, or a low number of years; they’re usually published once the business is wound up or does a dramatic pivot which essentially amounts to it becoming a new business. My case is somewhat different; Ground Control is a business I started in 2010 and exists to this day, but it shared a similar aspect as other “failed” startups in that it never got to the place I imagined it could be when I started.

Read More

Handling environment variables in Lambda@Edge

I recently came across the issue of managing environment variables in Lambda functions when they are deployed @Edge, i.e. are made part of a cache behaviour for a CloudFront distribution. It turns out it is not possible to use environment variables when a function is used in this manner. Fortunately there is a workaround which may handle some common requirements, if you happen to be using Terraform.

Read More

Zoom's security woes

The COVID-19 pandemic has turned the Zoom video conferencing app into a household name, no longer just the preserve of business people who ask if they can “send you a calendar”. The sudden transformation of social life across much of the world (at least the western part anyway) into an online only activity places a much-loved tool into a tumultuous new market, where customers have different desires, expectations and understanding.

Needless to say it has not been a smooth ride for them.

There have been plenty of opinion pieces on the matter; I imagine I’ll not bring anything new to the table. But Zoom right now provides an interesting study into the mechanics of success for a technology startup, and shows how important assumptions are when building a product - especially when considering how the security posture of such a product interacts both with its development and with its adoption.

Read More

Deploy a secure static site with AWS & Terraform

Originally published at AWS Advent. Look out soon for a new post describing how you can auto-publish your site direct from Github using Github Actions

There are many uses for static websites. A static site is, of course, the simplest form of website. Every website consists of delivering HTML, CSS and other resources to a browser, but with a static website, that HTML and CSS are delivered the same to every user, regardless as to how they’ve interacted with your site previously. There’s no database, authentication or anything else associated with sending the site to the user – just a straight HTTPS connection and some text content. This content can benefit from things like edge caching for faster delivery and poses little risk of bugs, as there’s not much in the way of code being sent down the wire.

Read More