I've been double-checking app permissions lately and it's surprising how many basic utilities demand access to personal contacts or background tracking.
When a product explains why it needs certain info and lets you opt out without breaking core features, it builds way more trust. Sharing sensitive data by default just to try a new tool creates unnecessary friction during onboarding.
How do you decide if a software product actually needs your personal details, and what data do you strictly refuse to share?
I have been reflecting on how early stage startups educate new users, specifically when users come across an obstacle before they even learn about the product. The temptation to instruct users by constantly telling them what to do is great ( Click here, Do this, Try that ). It is even harder when you have put in the time and effort to create something and you want the users to discover all that you have developed. However, too much instruction can lead to confusion and deter users from ever having their aha moment . If, on the other hand, users are left on their own, they might get confused or fail to notice the features that could actually help them. I guess finding the balance in what to do is what s difficult. One group of users might need more guidance than others. I also wonder how others are dealing with this issue, especially those creating learning products.
In my experience, launch page comments tend to be either congratulatory and good luck or ask a question that has been asked before in the description. Both are very nice comments, but neither provide the creator any value.
The comment that singles out a specific component is much more valuable. Noting that the export screen saved you a step that you would typically take in Excel tells the creator how to preserve their creation. Likewise, noting where in the process you were lost is valuable feedback; both can take about twenty seconds to write.
In commenting today, I adhere to one principle - talk about something I tried and pose one question I can't answer using the content on the page. It results in fewer comments, but the answers are more meaningful, and a couple even started a dialogue.
We route across a handful of models and on a spreadsheet the savings look obvious. The small model gets it right most of the time. The problem isn't the hit rate, it's the shape of the misses.
When a frontier model is unsure you can usually see it. The output hedges, goes vague, asks a question. When a small model is unsure it produces something clean, confident and wrong, and that sails straight past any eval checking format instead of truth. Nobody catches it until a user does.
A successful product is often seen as one that is well-commercialized, with users willing to pay for it. But is that always the case?
Today, I came across many products that are incredibly fun and creative. It made me wonder: are there products that don t fit the conventional definition of success? Maybe some exist just to bring joy, even if users simply visit, smile, and leave.
Some might argue that if something brings value, people will naturally be willing to pay. But is that always true?
most audit trails answer 'did this action happen.' the ones that hold up under legal scrutiny answer something harder: 'would the reviewer who signed it still say yes if you asked them today.'
ive been calling this consent-of-record. not just reviewer id, but reviewer knew X at time of sign-off and stands behind it now. it sits above the usual forensic level (timestamp, user, action, immutable hash chain). that layer proves it happened. it doesnt prove the human is still endorsing it.
Everyone is very worried and I get it, but genuinely. But...what do you mean I design a website and then I just build it myself?!! Without knowing code.
This to me has opened a whole new world of possibilities..
Coding agents now run commands, read files and call tools with our own permissions, and most of us review the final diff rather than every step. For a while that felt fine to me.
Then I started recording every tool call my own agents made. Some of what it flagged in my own sessions was things I hadn't noticed at all, like a credential read followed by a call to a cloud API in the same session. Each turned out to have a reason, but I only knew because I looked. The transcript alone wouldn't have told me.
I'm curious how others approach this:
- Do you review what your agent ran, or only the result? Why?
