@founderschoolhq for solo founders trying to bootstrap profitable web apps.
Portland, OR
Joined June 2022
- Tweets2.1K
- Following584
- Followers2.1K
- Likes6.3K
Will Hawkins 🚀 retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Will Hawkins 🚀 retweeted
stop selling to indiehackers
build software for companies already making money
a successful startup/company is not interested in vibe coding everything; they want stuff to work
they don't mind paying saas prices for things that add value
indiehackers will spend days replacing software to save $50/m (and that is totally fine)
yes a lot of internal tooling will be vibe coded, but there is so much opportunity right now to build software that just works and within an agent stack
i am a really big fan of building things in house (especially with ai now) but we are growing fast and we have no time to waste; we are not trying to save a few hundred $ a month
everything is moving faster, growing startups don't want to waste any time
Will Hawkins 🚀 retweeted
Technical moats are mostly over at this point. If you’re building something that is meant to be durable, the only moats now are:
• Proprietary data
• Network effects
• A physical component
Will Hawkins 🚀 retweeted
We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks:
Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better:
Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better:
Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better:
Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work!
In summary:
- As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding.
- Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.
Will Hawkins 🚀 retweeted
Lots of founders are crashing out
A year ago AI felt like an incredible opportunity.
Most of us were able to ship faster, remove admin, and get time back.
Lots of engineering founders were even able to explore marketing for the first time: SEO, organic social, outbound.
Building complex systems that felt extremely productive.
But since then, a lot has happened.
Here’s some of the themes I’m seeing:
AI marketing isn’t working. At first it feels impressive and it looks good but for most it’s not driving results. This is made worse by the fact everyone has access to the same tools. Inboxes are flooded, buyers are fatigued, the economy is flat.
Engineers are fried. Yes you can ship more but for many the flow state has gone. It’s a new way of working and it’s not for everyone. The speed leaves many of us exhausted before 11am.
There’s a feeling of what’s the point? Is my product’s next feature going to be redundant in a year, or a month? Can’t AI do what my business does, better?
SaaS valuations have collapsed. From 3-4x revenue to 1x. There’s a sinking realisation that a large number of SaaS companies will go to 0 in the next few years. Building to exit seems almost crazy right now.
There’s far fewer buyers and far more sellers. These include vibe coders cloning products without the care or craft, contributing to the distribution challenges from people doing it the right way.
Lots of people are trying to make money by selling shovels. This just adds to the frenzied energy.
Build in public stopped being fun. A few makers realised that the new game is attention, and now everything feels insincere and stunt-driven. They are influencers not founders. Changes to the X timeline compounded the issues.
There are exceptions and there are still moats remaining, but the challenges feel existential
Will Hawkins 🚀 retweeted
Yet again cosplaying an actual journalist and doing my best to objectively analyze the words of the Oregon gubernatorial candidates — from a startup perspective siliconflorist.com/2026/09/2…
Will Hawkins 🚀 retweeted
The latest Threat Intelligence report is an absolutely terrifying and important read.
As models become more intelligent, without the right safeguards and monitoring they also become more dangerous. Many capabilities are dual use: a model that codes well can be used to hack critical infrastructure; a model that assists with biology research can also be used to engineer the next pandemic.
These issues are complex, thorny, and increasingly important for everyone to understand so that the world can weigh in and respond to rapidly escalating risks.
anthropic.com/threat-intelli…
Will Hawkins 🚀 retweeted
Anyone can build an app in three days now, so what happens after launch is more interesting to understand. To see what makes an app successful, the team studied 250K+ @Bubble apps. #BusinessOfBuilding 🧵
Will Hawkins 🚀 retweeted
I wanna share all my startup experience, one topic at a time,
Today it's ---SEO---
In the past years, I generated over 1B impressions and 1M clicks from SEO.
Everything I've done:
📁 Domain names
↳ Use: .com, .org, .dev, .ai, .io
↳ Use keyword-like naming, e.g. osssoftware dot org
↳ Max 14 letters in a domain name
↳ No “-” or “_”
↳ One topic per domain when possible
↳ Pick www or non-www and stick to that one version (one redirects to another one)
📁 Tech SEO
↳ Make sure the page renders HTML when bots make requests
↳ One way to check it:
↳ Drop your URL into Claude
↳ Ask if it’s doing everything right for tech SEO
↳ There are many more details, but really, Claude or Codex will lay it all down for you if you show it your website
↳ HTTPS on
↳ Mobile-friendly
↳ Fast enough that it doesn’t feel broken
↳ PageSpeed Insights is enough
↳ Open GSC web-vitals and if it's green then all good
↳ Short, stable URLs
↳ Url slug should match the meta title and h1
↳ No random strings
↳ One H1 per page
↳ Unique title + unique meta per page
↳ Image alt text on anything that matters
↳ Canonical URL on every indexable page that has no query string in it
↳ Fix 404s and redirect chains
↳ No orphan pages
↳ Every important URL should have at least one internal link pointing to it (seogets shows all such pages)
📁 Indexing
↳ Add sitemap.xml to Google Search Console
↳ See if all the pages are indexed
↳ If not, run @indexrusher
↳ Do the same for Bing and Yandex via indexrusher
↳ robots.txt should be there and allow your public pages, again, ask chatgpt to check your robots.txt
↳ Request indexing in GSC for new pages or run indexrusher to automate this
↳ Check Coverage / Pages reports
↳ Fix “crawled – currently not indexed” on pages that should rank
↳ Don’t waste crawl budget (don't create too many pages, too many folders, tags, groupss...at least right away, you better do it later once the first bulk is indexed)
📁 Analytics
↳ Google Search Console
↳ Ahrefs small plan
↳ @seogets + @DataFast_
↳ Once a week, look at:
↳ Queries with impressions but few clicks (take the queries pointing to these pages and embed them into h1 and meta title)
↳ Pages that used to get clicks and then decayed (update the content here)
📁 Low hanging fruit
↳ Pages already in positions 8–20
↳ Those are closer to page 1 than any new article
↳ Add the exact query(if makes sense) to H1 / title / H2
↳ Add one missing section the current top results have
↳ Queries with lots of impressions and almost no clicks
↳ Rewrite title + meta, keep the keyword
↳ Old pages that already get a little traffic
↳ Update them before writing a new one (google kinda loves to see pages being regularly updated)
↳ Pages Google knows but didn’t index
↳ Request indexing manually page by page, or run @indexrusher (if it doesn't help, remove them, cuz google wont index them ever)
↳ Thin pages fighting each other for the same query
↳ Keep the stronger URL
↳ Merge or 301 the weaker one
📁 Quick 5min SEO hacks
↳ Paste a URL into GSC → URL Inspection → Request indexing
↳ Put the target keyword in the first 60 characters of the title
↳ Add the main query into the H1 if it’s missing
↳ Add 2 internal links from old posts to the page I want to push
↳ Add alt text to the first image on the page
↳ Add a 3-question FAQ at the bottom using GSC queries
↳ Submit / resubmit sitemap.xml in GSC
↳ Search site:mydomain and see if the pages are indexed and how they look like
↳ Google my brand + product keyword
↳ If a page mentions me with no link, ask them to add one
↳ Ask ChatGPT “best tool for [keyword]”
↳ Open the cited URLs
↳ Email those authors the same day (offer them either money or a link exchange)
↳ Post the article URL on X / LinkedIn / Reddit with the keyword in the first line
↳ Drop the URL into Claude: “what 5 on-page fixes can I do in 5 minutes?”
📁 Blog
↳ Write 1 good blog post a week
↳ Do it manually with some AI assistance
↳ Focus on the most promising keywords where you already rank high
↳ Use @seobotai to generate more blog articles
↳ See if some of them get traction
↳ Manually turn the promising ones from AI-generated into high-quality human-made articles
↳ Before writing, search Google for the keyword
↳ Match the format that already ranks
↳ Answer the question better than the current top 5
↳ Put original stuff in the article
↳ Screenshots
↳ My own numbers
↳ What I actually tried (basically ensure google that this article comes from a human's own experience)
↳ Refresh old posts that already get impressions
↳ Update the date only if the content actually changed (avoid hacks here, do real updates)
↳ Useful page types on top of the weekly post:
↳ “best X”
↳ “X vs Y”
↳ “X alternatives”
↳ “how to” for the exact job my product does
📁 Backlinks
↳ Ask ChatGPT: “What’s the best tool for...”
↳ See the URLs it used to form the response
↳ Reach out to all those authors
↳ Ask them to include my URL in exchange for money or a backlink from you
↳ Do the same in Claude, Perplexity, and Gemini and Grok
↳ Search Google for your keywords
↳ Find the pages that already rank
↳ Do the same as above
↳ List on as many directories as possible using @listingbott
↳ Link all my pages across all my websites when possible
↳ Do internal linking on each site too
↳ Between blog articles
↳ Between pages
↳ Extra places that still work:
↳ Guest posts on sites that already rank for my keywords
↳ “best tools” roundups
↳ Unlinked brand mentions
↳ Search Google for my brand name
↳ Ask them to turn the mention into a link
↳ When I link out or guest post, I want the page to have:
↳ Real traffic
↳ A topic close to mine
↳ A link that looks natural on the page (avoid spam at all cost)
📁 Social media SEO
↳ Social media gets indexed instantly
↳ Reddit
↳ X
↳ Substack
↳ LinkedIn
↳ Monitor hot, growing keywords and trends
↳ Google Trends
↳ Radar on X
↳ Produce posts around those trends
↳ Place some of the product links inside
↳ Find relevant social media posts via Google Search
↳ Plug my product into the comments when it brings some value
↳ No spam
↳ Put the keyword in the first line of the post
↳ Turn each good blog post into (and link back to the original url with a backlinks, cuz social media backlinks in my experience have really high weight for google):
↳ 1 X thread
↳ 1 LinkedIn post
↳ 1 Reddit answer where it actually helps
↳ Reply under bigger posts in my niche
↳ Useful reply first
↳ Link only if it adds something
📁 AI search
↳ Same game as SEO
↳ Ask ChatGPT / Claude / Perplexity / Gemini:
↳ “What’s the best tool for [my keyword]?”
↳ “Best alternatives to [competitor]”
↳ See if they mention me
↳ If not, look at who they mentioned and get onto those same pages by paying them or doing a link exchange
---
That's it for now.
I'll share the next topic in my next tweet. What should it be?
Also, i put it all in great details into my Founder Guide: guide.johnrush.me/
Will Hawkins 🚀 retweeted
Who's gonna tell vibe coders about...
> Rate Limiting
> Caching
> Load Balancing
> Reverse Proxies
> API Gateways
> CI/CD
> Docker
> Kubernetes
> Service Discovery
> Circuit Breakers
> Timeouts
> Retries
> Exponential Backoff
> Idempotency
> Message Queues
> Pub/Sub
> Event-Driven Architecture
> Distributed Transactions
> Saga Pattern
> Dead Letter Queues
> Cron Jobs
> WebSockets
> Long Polling
> Server-Sent Events
> Database Indexing
> Query Optimization
> N+1 Queries
> Connection Pooling
> Read Replicas
> Sharding
> Partitioning
> Replication
> Leader Election
> CAP Theorem
> Eventual Consistency
> Optimistic Locking
> Pessimistic Locking
> Distributed Locks
> Race Conditions
> Deadlocks
> Memory Leaks
> Garbage Collection
> Thread Safety
> Backpressure
> Autoscaling
> Horizontal Scaling
> Vertical Scaling
> CDN
> Edge Caching
> Cache Invalidation
> Feature Flags
> Blue-Green Deployments
> Canary Releases
> Rolling Deployments
> Rollbacks
> Health Checks
> Liveness & Readiness Probes
> Monitoring
> Logging
> Distributed Tracing
> Metrics
> Alerting
> SLOs
> SLIs
> Error Budgets
> Observability
> Secrets Management
> IAM
> OAuth
> JWT Rotation
> TLS
> Encryption at Rest
> Encryption in Transit
> WAF
> DDoS Protection
> CORS
> CSRF
> SQL Injection
> XSS
> SSRF
> Database Migrations
> Schema Versioning
> Disaster Recovery
> Backups
> Failover
> Multi-Region Deployments
> Chaos Engineering
> Cost Optimization
> Cold Starts
> Serverless Limits
> Latency
> Throughput
> P99 Latency
> Tail Latency
> Network Partitions
> Clock Skew
> DNS
> TCP vs UDP
> HTTP/2 & HTTP/3
> gRPC
> Webhooks
> API Versioning
> Semantic Versioning
> Infrastructure as Code
> Terraform
> Helm Charts
> Build Caching
> Dependency Hell
> Production Incidents
> On-call
> Postmortems
...until the app gets its first million users.
Will Hawkins 🚀 retweeted
the models have no moat (OpenAI, Anthropic, XAI)
the IDEs have no moat (Cursor, Windsurf)
the harnesses have no moat (Cognition, Factory, LangChain)
the app builders have no moat (Replit, Lovable, Bolt)
the wrappers have no moat (Harvey, Abridge, OpenEvidence)
the inference providers have no moat (Together, Fireworks, Groq)
the voice layer has no moat (Sierra, Decagon, ElevenLabs)
the data labeling companies have no moat (Scale, Surge, Mercor)
the AI infrastructure has no moat (Baseten, Modal, Railway)
the neoclouds have no moat (CoreWeave, Lambda, Crusoe)
the generative media companies have no moat (Runway, Higgsfield, Suno)
apparently nobody in AI has a moat
except the venture firm ☠️
Will Hawkins 🚀 retweeted
everyone in the indiehacking (and startup) space thought that, thanks to ai they could be building many projects at once
but it seems the opposite is true: every market started to move faster, and competition is harder
i don't necessarily think we are getting better products but just more
it's almost sad that ai allows you to explore so many things, but you still need to really lock in to create something outstanding
Will Hawkins 🚀 retweeted
Golden age of selling hours as freelancer/outsourcing agency is over
See it in my org too:
- I dont buy design anymore; AI produces good design out of the box
- 99% of legal, accounting & fin questions now go to AI; used to pay experts $250/hr
- I outsourced most of the coding, now most of it is done by Codex and CC on Max
- I paid marketing agencies, now a combo of @seobotai / @listingbott / @indexrusher / @tinyadz_ is my marketing department
Ofc some work still requires a human expert, e.g. once I get all my accounting and reporting done by AI i hire a pro human to review it, this year I paid just $1k for such review, while in the past I’ve paid $15k for entire job to be done.
Will Hawkins 🚀 retweeted
I've now added Wispr, Notion, Granola, Fireflies, Zoom, Gemini, Cluely, Otter, Fathom, Read AI, and Wingrep to every meeting.
Each produces slightly different meeting notes.
I send all of them to Claude and ChatGPT, which push the summaries into Slackbot and Salesforce AI. Linear agents automatically create tickets while Notion agents create follow-ups in Notion. A Zapier workflow then uses 500k tokens to draft a follow up email in Superhuman.
None of it works and all of it is wrong but man, is it beautiful.
AGI is here.
Will Hawkins 🚀 retweeted
We’ve agreed to a partnership with @SpaceX that will substantially increase our compute capacity.
This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API.
Will Hawkins 🚀 retweeted
AI has stopped being a feature and started being the foundation.
We're excited about a new wave of startups rebuilding software, services, and silicon— and pushing AI into the physical world.
ycombinator.com/rfs
