various things @clerk, girl dad, bagel guy, calisthenics beginner, event planner, drummer, woodworker

Serenbe, GA
Joined March 2009
Here's a pattern that can absolutely murder your startup launch that many are not aware of at all. - You built your product, you're ready to go live with it. You have prepared a producthunt launch, social posts, paid ads, etc. - Conversion, for you, looks like users signing up for your product. - In order for users to sign up, they need to verify their email address. This is a standard, and highly recommended practice to prevent attackers from squatting peoples' emails and/or impersonating them. - 🚀 Your launch is live, it's going great. People are making accounts like crazy. You start sending out a bunch of emails to people who sign up, from your brand new domain that hasn't sent substantial email traffic in the past. - Email providers see this pattern, it exactly matches the way that spammers operate, and they start marking most/all your messages as spam. - Most users don't check their spam folder, and so they never get their OTP to verify their email address, never create their account, and you start bleeding out all the users you worked so hard to get. This situation SUCKS. Don't let it happen to you, or anyone you know. Plan ahead to make sure that you have established a "sender reputation" for your domain. This takes time and conscious effort. Using domain warmup services often backfires. Do it the hard way and it will pay off. Wrote a piece about how you can do this here: clerk.com/docs/guides/develo… I'm also thinking about adding a feature to Clerk where we send ~95% your emails from our own, established domain initially, and gradually reduce that over time to "auto warm up" your custom domain. It would be a paid feature but not too pricey. If anyone's interested let me know, I'd love to get some more feedback on this.
9
3
1
28
1,397
I hate saying no to things so much, and I think that will be my downfall. Especially when they are like, things that are genuinely helpful to others and/or fun and interesting! So many things like this in the world 😞
2
13
811
Jeff Escalante retweeted
Got the van back from the shop recently with some upgrades. 👀 @Tesla
4
8
1
50
3,563
Jeff Escalante retweeted
We've seen a massive increase in both the number and sophistication of fraud attacks. CAPTCHAs and WAFs are not nearly enough. Clerk Protect (a @clerk product) is starting to roll out generally.. This is just the first release of many. If your application is under attack, DM me. We can most likely help. Clerk Protect will work with any auth provider, but it will be at toggle away for existing clerk customers. Super excited to make bad actors, sad actors. clerk.com/docs/guides/protec…
5
1
11
536
Jeff Escalante retweeted
Authentication has no business being this fun. Meet the Clerk van. 🚐
4
4
3
33
8,875
Fun fact - @clerk now has a backup email provider under the hood, so that if our primary email provider has an outage, your auth is still not impacted. Both providers use entirely different infrastructures, so an AWS or GCP outage can't take them both down. It takes a ton of work to get features like this in place, the many subtle differences between two different providers add up across your customer-facing logs and codebase surfaces. I'm not aware of any other providers that do this. Most people don't know about it at all. It's not a big flashy exciting feature, but often times invisible reliability work is the most important work 🤝
2
4
1
30
2,070
I will be there running very not fast at all if any fellow slow people want to join 😂
Come get some miles in with us and @Resend next Tuesday ☀️ We’re sponsoring the Resend Running Club at Crissy Field. Run, jog, or walk, then stick around for snacks and drinks. Oct 20 · 7:30am · SF See you by the bridge.
8
340
Jeff Escalante retweeted
My top advice to junior software engineers: Eat more eggs. When I was a junior engineer, my boss asked me, "Hillel, how many eggs have you eaten today?" I told him, "three." He said, "that's not enough eggs." And then he gave me four more eggs. I ate the eggs and eggshells and immediately got promoted to regular engineer. To become a senior engineer, I had to eat twelve eggs. To become a staff engineer, I had to eat twenty seven. Nowadays I won't even *consider* jobs where the engineering director can't eat sixty eggs at once. Got any more #tips for Junior engineers? Please share in the comments!
48
23
7
381
26,079
Jeff Escalante retweeted
Historically, our enterprise readiness solution was passable, but not best-in-market. This launch changes that. @clerk is now the easiest way to be enterprise ready. It's zero extra lines of code, just toggle a switch and your customers can self-serve.
Your customers can now set up their own Directory Sync. Let their IT admins configure and test provisioning inside your app, without your team handing over SCIM endpoints and tokens.
1
8
24
1,327
Jeff Escalante retweeted
Your #SFTechWeek side quest: find the Clerk Van 🚐 👀 We're making the rounds next week during @techweek_. Spot it, snap a photo, tag us, and we'll send you a mini van. Tiny van. Big auth energy.
4
5
2
34
4,808
New AI thread, auto populated title "explain what's going on" 😂 Feels like every thread should be this title tbh
1
348
Jeff Escalante retweeted
Replying to @clerk
@clerk UI has always been a choice: quick drop-in components, or full control with hooks and a lot more work. Their new (experimental) composable components split the all-in-ones into sections and subcomponents — so you can reorder and reorganize the profile however you want. Demo 👇
1
1
8
394
I got a fairly scary account takeover scam in my inbox this week, delivered through a genuine email from OpenAI. Let's break down its mechanism and reflect a little on how we can both protect ourselves from scams like these, and stop them from being propagated through our own apps: 🧵
1
3
15
1,321
It would be a disservice not to also mention OAuth in here. In order to actually execute the scam here, the attacker used a legitimate OAuth flow from x.com. This is also a very common abuse vector, and unless a provider enforces CIMD only, which nobody does right now, there is no real way to stop someone from registering an OAuth app on your platform, calling it "Google" or "OpenAI" or whatever, adding their logo, and delivering that consent screen to people to see who they can bait into hitting accept. When you see an OAuth screen, be suspicious. It's tempting to just autopilot your way through, but they are very often used as scams. If you are designing an OAuth screen, make sure that you make the callback URL extremely clear - its easy to claim you're google or openai with the app metadata, but you cannot fake the callback url. If you truncate long callback urls, that's a mistake as well - it's easy to set up a super long subdomain like "auth.h794r9weh9rf9edf.google…", and if the end is cut off, it's gonna look like a legit url. I also have to give X credit here - the "check the box to confirm you trust this domain" is a really good addition to the consent screen.
1
179
I have to shamelessly plug here as well because I have spent a lot of time working on this and fighting fraud day in and day out at Clerk, and I genuinely believe and have seen first hand the outrageous volume of fraud attempts that pour in constantly against our customers both big and small. Using a vendor like @clerk for your auth will protect you out of the gate against many of these types of issues. We have complex fraud detection and prevention systems running under the hood for all comms that go out on behalf of our customers, both automated and manual. And we have spent years fighting off these types of scams and fraud and hardening our systems against them. I have plenty of stories and examples if anyone is curious. Some of them are really wild. It's much easier to use a battle-tested vendor and keep your focus on building out your actual product than to have to deal with and fight off fraud like this constantly.
1
2
114