Tom Milewski

We've decided to sunset Arc on December 22, 2026. That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community. Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward. We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how: · Your passwords, bookmarks, extensions and history come over to Dia seamlessly. · Spaces, Folders, and Tab Groups are in Dia and import over with your data intact. · Dia now surpasses Arc benchmarks in stability, speed, and security. · The browser features you use in Arc are free in Dia, and the AI is optional. Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.

Here's a pattern that can absolutely murder your startup launch that many are not aware of at all. - You built your product, you're ready to go live with it. You have prepared a producthunt launch, social posts, paid ads, etc. - Conversion, for you, looks like users signing up for your product. - In order for users to sign up, they need to verify their email address. This is a standard, and highly recommended practice to prevent attackers from squatting peoples' emails and/or impersonating them. - 🚀 Your launch is live, it's going great. People are making accounts like crazy. You start sending out a bunch of emails to people who sign up, from your brand new domain that hasn't sent substantial email traffic in the past. - Email providers see this pattern, it exactly matches the way that spammers operate, and they start marking most/all your messages as spam. - Most users don't check their spam folder, and so they never get their OTP to verify their email address, never create their account, and you start bleeding out all the users you worked so hard to get. This situation SUCKS. Don't let it happen to you, or anyone you know. Plan ahead to make sure that you have established a "sender reputation" for your domain. This takes time and conscious effort. Using domain warmup services often backfires. Do it the hard way and it will pay off. Wrote a piece about how you can do this here: clerk.com/docs/guides/develo… I'm also thinking about adding a feature to Clerk where we send ~95% your emails from our own, established domain initially, and gradually reduce that over time to "auto warm up" your custom domain. It would be a paid feature but not too pricey. If anyone's interested let me know, I'd love to get some more feedback on this.

Hey #renderATL if you need a quiet space to work the last few hours, swing by. We have a beautiful coworking space. luma.com/clerk-3v4t

Day 2!! @RenderATL Jersey Day ✌️ Come find the @clerk team and get a surprise 👀 🏎️

What a great evening at The Commits Award Show by @RenderATL @acolombiadev @tmilewski @FrancescoCiull4

Ghostty 1.3 is now out! Scrollback search, native scrollbars, click-to-move cursor, rich clipboard copy, AppleScript, split drag/drop, Unicode 17 and international text improvements, massive performance improvements, and hundreds more changes. ghostty.org/docs/install/rel…

Introducing Clerk Billing The easiest subscription billing for B2B and B2C SaaS. No webhooks, no UI to build, no payment integration code, no DIY authorization engine. Just enable Billing and drop a <PricingTable/> on your /pricing page!

Announcing Chrome Extension SDK 2.0! This release ships with the new createClerkClient() helper for background service workers, improved support for syncing auth state, a new quickstart guide, and refreshed docs. clerk.com/changelog/2024-11-…

This is so cool!! Dev Starter Pack live in Times Square!! 🤩🎉 Thank you @Nasdaq!! One day I hope a company started with the Dev Starter Pack will be back here at Nasdaq, from starter tools to IPO 💜

Clerk has reached a clear fork in the road: 1. Focus on enterprise sales Hire an outbound sales team, bump our prices, and focus our engineering efforts on adding extra knobs that enterprises want. Basically just copy the Auth0 playbook on a more modern toolchain. 2. Focus on product expansion Create additional tools for billing, CRM, analytics, etc. These product verticals are heavily dependent on customer data, so we can lean on our user management roots to bootstrap our offering. This is Rippling's "compound startup" playbook, but using customer data as the foundation instead of employee data: rippling.com/blog/rippling-c… --- We're doing 2. We know it's a bit unexpected... "What do you mean you're building a payments integration? You're an auth company!" On the other hand: it's not 🙂 A Stripe integration is almost our most requested feature on feedback.clerk.com, so clearly there's demand. We see it as a broader shift in developer tools: developers want to "buy best practice" instead of piecing it together themselves – and it's happening up and down the stack: * Serverless instead of DIY infra * One step further: @nextjs "framework-defined infra" instead of DIY serverless (h/t @cramforce) * Stripe Checkout instead of DIY checkout * @inngest instead of re-reading Brandur's "Transactionally Staged Job Drains" for the Nth time and building a DIY job drain (h/t @itstonyhb) * @convex keeping the client updated instead of DIY webhook hell (h/t @jamwt) * etc etc etc There's still innovation on the other side (e.g. kubernetes), but we see that more as tools for tool-builders than for mass-market adoption. Since Clerk is playing into this trend by selling best practice for auth, it's not surprising that our customers are saying "do it for more things" instead of "give me a bunch of auth knobs" – they wouldn't have picked Clerk if they wanted more knobs! --- To be clear, this doesn't mean we're giving up on enterprise sales. We expect the sales will come as more enterprises adopt the "buy best practice" mindset - and we already see it starting. What is really means is that we won't force ourselves up market early, and that we've needed to grow comfortable telling enterprises "no" when they ask for a knob that we think shouldn't exist. Let me give you a concrete example. At some point, we had an enterprise demand LUNS-based password validation (Lowercase, Uppercase, Number, Symbol) You've seen this before, probably in an auth flow that you hate. You probably even have a default memorized password that you use when websites demand the requirement. We built the feature to win the sale (screenshot below), but the whole thing just felt icky. LUNS hasn't been best practice for over a decade, and it's advised against in NIST 800-63B, which is the foremost guidance for how to implement authentication factors. At this point, we regret it. We don't want this footgun in our product, and soon we'll be clearly marking it as "Bad practice: please do not use" We're avoiding more options like this because they dilute our offering, and create an opportunity for a competitor to be better at selling best practice. We don't want that to happen. Ultimately, we're confident that the "buy best practice" mindset will reach all enterprises eventually. It's no different than when enterprises were afraid of the cloud. While we wait, we can build more great products in other verticals.