Hacker News: plehoux

New comment by plehoux in "Ask HN: Who is hiring? (May 2026)"

plehoux — Fri, 01 May 2026 20:35:19 +0000

Missive | Senior Backend Developer | REMOTE (Eastern americas to Central central Europe) | Full-time

Missive brings inbox collaboration to teams that run on email.

This isn’t your typical SaaS; it’s a full-fledged app users live in all day. We integrate with dozens of APIs and servers, process 10M+ emails, 100M+ requests per day serving thousands of users who collaborate in real-time. If you’re excited by data at large scale, complex edge cases and third parties that always find new ways to fail, this is for you.

Missive started over a decade ago. It is mature, still 100% founder-owned and highly profitable. We’re in it for the long run; a small, dedicated team building a product customers genuinely love.

We keep our stack simple and that doesn’t mean boring. The backend is a Rails monolith, Postgres, plus a few tiny services in Ruby, Node or Bun.

Warning, we are hiring remotely, but Eastern americas to central Europe timezones only.

New comment by plehoux in "Spherical Snake"

plehoux — Tue, 06 Jan 2026 19:49:36 +0000

I love this, congratulations on the clever design and concept.

New comment by plehoux in "Replacing a $3000/mo Heroku bill with a $55/mo server"

plehoux — Tue, 21 Oct 2025 22:32:56 +0000

Congrats Greg & Antoine! disco.cloud is really needed, I hope you guys get the visibility you deserve and some momentum from the community!

Tell HN: Crazy sloppiness in X.com Content Security Policy

plehoux — Fri, 29 Aug 2025 14:48:31 +0000

TL;TR Just uncovered a backdoor into http://X.com’s stack... or more likely some giant sloppiness.

First let's define CSP, Content Security Policy. In simple terms, CSP is a browser-side firewall: it lets websites tell the browser exactly which domains it may load scripts, images, or exchange data with; blocking rogue code and data leaks. In my book, it’s one of the greatest inventions of the modern web.

When configured well, CSP can make your web app practically immune to XSS and data exfiltration.

A few weeks ago I was pondering if allowing “.yourdomain.com” or “.thirdparty.com” wildcards in CSP was risky, especially if you run side projects on sub-domains. A marketing microsite left to rot for years, with user upload capability could become an attacker’s exfil gateway.

Curious, I wondered how the big players handled their CSP. Were they whitelisting entire subdomain trees? I opened the dev console. First check: X… and to my surprise, I found hundreds of domains in their CSP.

I pasted the list into Grok and asked it to flag anything suspicious, and indeed, it found a few "connect-src" directives whitelisting three SnappyTV sub-domains, an old video product Twitter shut down in 2019.

The gotcha is that the domain expired in 2023 and is now controlled by unrelated third party pushing Korean casino ads. (see screenshots here https://x.com/plehoux/status/1961170683439853875)

That means if the new owner of this domain is a bad actor, with the right XSS, they can exfiltrate data from X, all with CSP's blessing.

I reported the finding through X's bug-bounty program. Their verdict: “best practice, not a vulnerability.” Maybe true in isolation, but still crazy they are not cleaning the mess (reported 45 days ago).

“Not exploitable today” can become “critical tomorrow” when conditions align.

I mean X threat model must include state actors...

I would suggest a business to:

1. Never let any business domain name expire. 2. Have their most conspiracist developer review their CSP on a recurring basis.

I'm crazy or, shouldn't this be fixed ASAP?

Comments URL: https://news.ycombinator.com/item?id=45064867

Points: 5

# Comments: 1

New comment by plehoux in "AI Horseless Carriages"

plehoux — Wed, 23 Apr 2025 19:35:34 +0000

This is our exact approach at Missive. You 100% control system prompts. Although, it's more powerful... it does take more time to setup and get right.

https://missiveapp.com/blog/autopilot-for-your-inbox-ai-rule...

Ask HN: AI Tools Now Drive 50% of Our Traffic, You?

plehoux — Sat, 19 Apr 2025 13:58:56 +0000

At Missive, for every 100 referrals we get from Google, AI now sends 50.

Google has long been our main source of traffic, with a significant portion coming from our comparison ("versus") pages.

But now, AI tools like ChatGPT and Grok are sending us close to 50% of the referrals we get from Google.

Crazy shift!

e.g. 12 minutes o3 research on "What is the best shared inbox for a law practice?"

https://chatgpt.com/share/680293fb-4190-8000-be2b-d4c4debad1d3

Would love to know more insights if you are dealing with this for your product/company?

Comments URL: https://news.ycombinator.com/item?id=43736464

Points: 3

# Comments: 2

New comment by plehoux in "A Decade of Lazy Marketing to $500k MRR"

plehoux — Wed, 02 Oct 2024 20:23:44 +0000

Look we were lazy on the marketing side, not on the product side. :)

A Decade of Lazy Marketing to $500k MRR

plehoux — Wed, 02 Oct 2024 20:16:06 +0000

Article URL: https://missiveapp.com/blog/a-decade-of-lazy-marketing

Comments URL: https://news.ycombinator.com/item?id=41724598

Points: 2

# Comments: 1

We coded our affiliate program from scratch, you should too

plehoux — Mon, 06 May 2024 17:44:36 +0000

Article URL: https://missiveapp.com/blog/affiliate-program

Comments URL: https://news.ycombinator.com/item?id=40277275

Points: 3

# Comments: 0

Dropbox sends takedown notices to developers building with their File Picker API

plehoux — Wed, 21 Feb 2024 16:25:56 +0000

Article URL: https://twitter.com/plehoux/status/1760338005322035220

Comments URL: https://news.ycombinator.com/item?id=39455827

Points: 2

# Comments: 0

New comment by plehoux in "Proton Mail gets a desktop app for encrypted email and calendar"

plehoux — Thu, 14 Dec 2023 13:59:40 +0000

CEO at Missive and proud developer of an electron based email client, I would love for you to try it and judge it's speed. It might change your opinion.

New comment by plehoux in "Entrepreneurs who regret starting businesses"

plehoux — Tue, 04 Apr 2023 13:16:33 +0000

What a depressing take.

Starting young (at 20 years old or earlier) gives you over a decade to explore and discover your entrepreneurial path with low risk. Stop making excuse.

AI Could Transform Email

plehoux — Wed, 01 Mar 2023 13:07:46 +0000

Article URL: https://www.wired.com/story/how-to-use-ai-for-email-artificial-intelligence-tips-advice/

Comments URL: https://news.ycombinator.com/item?id=34981938

Points: 4

# Comments: 0

New comment by plehoux in "Sam Altman calls Google a lethargic search monopoly"

plehoux — Thu, 09 Feb 2023 11:23:13 +0000

I think Google is fine. Will win this in the end.

But I was curious about DuckDuckGo and Gabriel's take on this, https://twitter.com/yegg... not a word.

AI is a scale game, how can they offer this without blowing all their revenues to MS?

Embracing Hard Limits

plehoux — Thu, 17 Nov 2022 20:27:56 +0000

Article URL: https://missiveapp.com/blog/embracing-hard-limits

Comments URL: https://news.ycombinator.com/item?id=33645165

Points: 3

# Comments: 0

New comment by plehoux in "Remote startups will win the war for top talent"

plehoux — Tue, 23 Aug 2022 15:31:19 +0000

I'm in the rare camp of those believing the employees will crave back the office at some point.

Maybe not in the crazy expensive cities with long commutes like LA and SF, but everywhere, yes.

Insanely productive workflow to keep track of user requests

plehoux — Wed, 01 Jun 2022 14:04:41 +0000

Article URL: https://twitter.com/plehoux/status/1531998984155418624

Comments URL: https://news.ycombinator.com/item?id=31581957

Points: 2

# Comments: 0

New comment by plehoux in "Shopify Store more predatory than the App Store with its developer cut"

plehoux — Fri, 20 May 2022 14:57:05 +0000

I post this thread on HN. I honestly can't understand why they would deprecate the Unpublished App option. Was a win win for everyone. Using their Billing API makes sense when you building a business on top of theirs... but it's not our case.

Any other people affected by this here?

Shopify Store more predatory than the App Store with its developer cut

plehoux — Fri, 20 May 2022 14:38:22 +0000

Article URL: https://twitter.com/plehoux/status/1527659599028969473

Comments URL: https://news.ycombinator.com/item?id=31448060

Points: 41

# Comments: 8

New comment by plehoux in "We need a middle class for startups"

plehoux — Tue, 10 May 2022 15:23:01 +0000

> We Need a Middle Class for Startups

You mean a bourgeoisie?