Hank:  And I don't know, the whole thing looked like a mess, so I didn't go like as deep into it as I think you did. Yeah…

Gonto: I like drama. That's why I go like that…

Hank: Yeah. 

Gonto: I need some gossip. 

Hank: Um, but I do enjoy talking about it with you. 

Gonto: Exactly.

Gonto: Welcome to another episode of Code To Market. We have actually four topics for today, and we'll talk a bit about spies, we'll talk about vulnerabilities, we'll talk about a new documentary and a shitty flight sim that became popular. But let's start actually with that one. 

I'm personally a big fan of Levels.io and Levels.io started vibe coding, like this idea of you write code without actually writing it.

You just chat with cursor, use the agent and just write something. And then he kept on tweeting every day about how he started the game, how he continued it, how he did it, et cetera. Then he started to get sponsors for the game. Then he did a hackathon, then he started to get swag, um, build swag from it. 

I personally think it's genius. I actually had a Twitter discussion with somebody who was putting a lot of hate into and what he was doing. 

Hank: The whole concept of vibe coding is so decise.. divisive. He had this good little victory lap tweet of, “I hit 57,000 MRR” and he has a checklist of like made redditors… 

Gonto: He has more now. I think he got like 97 or or so.

Hank: Oh, I'm sure he does because just on that, he put a stripe on that tweet. He put a Stripe link and he is like, today done, made Redditors angry and then a bunch of feature stuff. 

Yeah, he's, he's a divisive person to traditional coders. Or traditional developers. Or developers at companies and people who want to do things the right way.

So it's always interesting to see him, 'cause he's like, why aren't more people like me just out here vibe, coding, making money, traveling, doing whatever he wants? It's very interesting.

Gonto: He has like his own server. He codes everything in one file, like he's notoriously known for just however, like you build it however you can, and that's it. Like you don't need it crazy scale or like this much files or microservices or stuff like that. 

Hank: Yeah. What I love about him is he is, every once in a while you need this type of person who's a call to the “Hey, perfect is the enemy of the done.” There are always people criticizing people like Levels on their code quality and, and whatever, and their buggy apps.

At the end of the day, code is to make products and products are to be part of businesses. And yeah, I don't know. I find him an interesting and refreshing angle on that. But how do you, how do you feel about his, like go to market? I mean, you've spoken against, uh, well, you haven't spoken against it, but you've kind of criticized the ethos of build in public before, but this very much felt to me like this is the build in public for vibe coding. I'll show you guys what can be done with…

Gonto: And to me, this build in public is not really build in public, like we talked about it last time where I, I think that a lot of build in publics are just fake GTM and distribution. I think that's the truth for Levels.io, like I think Levels.io has been publishing as he does things.

Mostly because that's how he gets people to notice him. And of course like his game became popular very fast because now he has such a following that it's easy to do that. But if you look at Levels.io in the past, he always like built products and started to share what he was doing and why on Twitter, a lot of them were not popular, but then one of them caught up. And then after the one of them caught up, the second one did, the third did, and now it's easier for him.

At the same time, like people were saying, like, who can be so stupid to sponsor for 5K something in the game? And I think it's the, I think it's very smart and even more smart for the first person who did it.

Mostly because it's the current thing on Twitter for tech. Everybody's talking about it. And then it's not only the people that will play the game, that's actually, I would say the least important. It's more about Levels.io will tweet about it, he'll mention your brand, he'll do a video showcasing it, and then people are gonna talk about you, whether you're dumb or smart for sponsoring it.

But when I was saying like, no, you can't measure it, like why would you do it? And of course you can't measure it. But the brand that I think you can get from some of that, I think it's. Impressive. Do you agree? Will you sponsor Levels.io’s game or not? 

Hank: Yeah, I think if there's, if there's an angle, definitely you can, like, I think like depending on the product, it can make a lot of sense.

I mean, the one, the one he announced in that tweet I referenced already, you know, MessageBird. That's right. They sponsored the birds in the game. So that's just kind of. A funny tie in, and then every time you see a bird you're like, oh, MessageBird. 

I would ask you like, okay, the crowds and crowds of people who listen to our podcasts, we've picked the smallest niche possible, but…For the technical founders of dev tools and their heads of marketing who are listening to this, what's the takeaway here? Like how do we, how do we draw from like this, like rogue guy vibe coding? He, he sells a hat to, I always, he sold the founder mode hats. Now he’s got vibe coding hats. Fantastic. What's to be taken from this guy and how he does this, and how do you insert it into a B2B brand?

Gonto: I think to add to that, once he saw the game is working, he started to do so many things on top of it. Like he started to sell the hat on his marketplace and he sold the shit out of them, so getting even more revenue out of it. He then created a place that's called portal.pieter.com where. He publishes games from other people's, other by coders, and when you land there, there's portals, and once you go to a portal, you go to that game.

So he's also promoting other people's game who then promote him back because it's like, oh. I mean now in the portals from Levels.io. So he’s getting free distribution from some of the other folks that have less people, but they all link back to Pieter and now he's doing the vibe coding hackathon. That he got sponsors, He got like really good judges. Like Carpa is there. Mr. Dub the creator of Three JS, which is used for all of the animations, and he got like really good juries. He's giving a prize and everybody's now is doing games for vibe coding and then again, to participate most of them are done in the portal, which then links back to him. And then all of the juries that he has are people that are very well known that are also tweeting about this, which makes even more people learn about the game. So to me, what I think Levels.io is really good at is he's a genius of distribution. 

Hank: Yeah, it's interesting. I think a lot of times in B2B we're guilty of when we catch a little bit of lightning in a bottle, we just kind of let it sit there. When there are people who are amplifying our message or catching onto our vision, like I, I love that he created this marketplace.

He is like, “oh, people are catching onto the vibe coding vision. How do I make them part of my thing?” 

Gonto: Exactly.

Hank: So that they don't like, rather than letting them all go out, because a lot of times founders will do this. They'll inspire their customers and and so on to go and do stuff without capturing that interest and those voices and using the amplification.

Hmm. 

Gonto: And I think it's, he's a genius of distribution in the sense that maybe he has a lot more followers in all of the people that are doing vibe coding games, but if you sum the followers of all of the other vibe coders that are now part of portal or of his hackathon, they have more than him, which means that he has improved visibility and distribution.

As you're saying, like I don't think companies think about this and how they can include others and work with partners, increase their brand a lot of times. 

Hank: Yeah, a lot of times. Like there'll be someone in your, in your company Slack, who goes “So and so just tweeted about us.” They have 10,000 followers, a 100,000 followers, and then everyone just goes and likes it.

The best founders, the best heads of marketing, will immediately DM that person. They'll immediately comment on the thread like, “Hey, let's find a way to work together more. Let's do more and more, and more, more. Let's amplify. Like how can we raise the stakes with each other?” 

Gonto: Exactly. And then what other things can you sell like the Vibe coder hat is genius as well. Like he did the same with FounderMode. He did the same with Make Europe Great Again. Like he catches stuff and it's controversial and ships things very fast. Like, 

Hank: yeah…

Gonto: I think he's so fucking good.

He's good at…you love surfing the wave. And he's good at that. 

Gonto: I do. 

Hank: He's very good at that. So I think that those are some good notes on building in public.

Let's go to the opposite end of the spectrum: scheming in secret. So we talked a long time ago about this competitor page by Rippling, where they had like the snakes, like eating up the false, the false statements by Deal. This rivalry has gotten out of hand. Rippling is now suing Deal.

We know this isn't super like dev tool relevant, but it's just, it's in the space, it's interesting. It's also like an interesting, there's some lessons to be learned here. So my understanding is Rippling noticed that Deal… we… we're not sure how they noticed, but I think it was, 

Gonto: They…We do. They noticed because they had one employee that was searching Deal in Salesforce and England on average 23 times a day.

Hank: Yeah. But I, I think that was part of their investigation. I. I think what happened first was Deal was probably just like somehow always one step ahead on any of their competitive deals. So anytime there was an opportunity where someone was evaluating Rippling and Deal, I think all of a sudden Deal would make just the right move. And they were one step ahead of Rippling. 

And Rippling, I think probably looked into this because they're like, “how are they doing this?” And then they find this guy whose searching 20 times a day Deal, you know? And they're like, “okay, how can we catch this guy?” They set up a honeypot because it was basically just like the lawyer and a couple of the executives, like the CTO, and the founders who knew about this person.

So I think what they did was they like mocked, they like said something that they emailed the Deal executives that they had some channel about their their Deal competitive deals or Deal ex employees or something. 

Gonto: No, they had something on the channel that would be very hurtful for them. And then they faked a slack message.

Hank: Yes. 

Gonto: Which was actually redacted just to make it people more, and they waited and see if the spy would go on into that slack channel. 

Hank: Yes. But they did involve, they somehow made it so that they could implicate the, the Deal executives. But… 

Gonto: Yeah, so, so they sent an email to the Deal executives. The lawyer did saying like, “Hey, if the, like people are talking in Rippling channel about something that could be very hurtful for you.”

And that's it. That's the only thing they said. And then they noticed that the spy entered 10 times to that channel that day, and the channel was empty. 

Hank: Yes. 

Gonto: Nobody was there. The only, it was just being created 30 minutes before. 

Hank: Yeah. The only people who could have known about that channel were yes, the founders of Rippling, the lawyer and the executives over there.

So therefore, they clearly told the spy. The spy found the channel, and now there's a huge lawsuit. Corporate espionage is illegal, like blah, blah, blah. So like my first lesson is: Don't commit corporate espionage. As tempting as it is, there's always competitors. It's always tempting to like get into this.

We're gonna get into some more like heated competitiveness on our next topic, but it's just such a dumb thing to do, to be like paying someone as a spy at your competitor. Just win the right way I say. Like, then you don't have to deal with all this, no pun intended. And yeah, for Rippling, how clever to set up a honeypot, they did the right thing.

They didn't like, they didn't go public until they like had done all the right and necessary steps. Just the…

Gonto: And I think for them it was great marketing as well. Like now everybody's talking about Rippling because like I remember, like I read the lawsuit. And it was more than that. Then like the police went to the guy, the guy tried to hide his phone.

Hank: Yes. 

Gonto: And put it in the bathroom and it was like a movie. And like it was just, everybody's talking about Rippling now. So in the end it was, I think, worse for Deal. Maybe they won some competitive deals, but now people are thinking Deal is evil and Rippling is just all over the place. Which is funny, taking into account that the founder of Rippling was sued and removed from the company that he was at before. Allegedly because of David Sach. I don't know like the the truth there, but just interesting that they ended up leveraging this spy for them to be more popular now. 

Hank: Yeah. I forgot about the whole like, 'cause this is in Ireland, right? Like where that employee is. They show up at his house to confiscate his phone. He like hides the phone. Nobody knows where that is. He's allegedly deleting messages. It's a whole crazy saga. Don't get into that mess guys like. It's just not worth it. Uh, 

Gonto: I. I don't think we have a lot more to say. It was to me just funny that they show up a lot and just interesting that we now like we're likely gonna get a Netflix show on, on Ripping Spy, 

But talking a bit about competition, but competition that is legal. Let's talk a bit about what happened with Vercel and CloudFlare this weekend. I dunno if you saw, but Vercel published a CVE. A CVE is a vulnerability basically that existed on the middle wire for Next. It didn't affect all of the apps. It actually, I would say mostly affected apps that had static pages that needed authentication to be seen, like somebody could enter or could see those, and it's basically would hurt companies that are only using middleware to handle authentication, not the rest. The problem was that they knew that. They kept it for five days or so, then they shipped the fix for it on their blog post.

The first version, like they mentioned, like, “yeah, it's not even that important because our firewall solved it.” However, they didn't work as much with the partners, so CloudFlare, Netlify and a lot of the others are using Next get got pissed off about it. At the same time, people who hate Next, which there are a lot of them, use this opportunity to just say more bad shit about Next, and talk about how Next is mostly focused on Vercel and not the rest. There's a version called OpenNext that people are using 

The same time, the CEO of CloudFlare, I think was pissed off. They actually went down for some time while they were trying to fix it, and they post a GitHub project called Diverce, like divorce but Vercel, that basically you could put your Vercel Next project and it will automatically migrate to CloudFare. To which RauchG got pissed off about the message.

And, and I, I think it makes sense. And he answered a bit about things that CloudFlare did wrong in the past and. It was just interesting, like it was CEOs fighting on Twitter. There were people like saying bad things about Next, using the CVE for it. There were others that were trying to explain and talk about the CVE.

I dunno, what's your take on everything that's, that's been happening here? 

Hank: You know, it just looked like a mess to me. The whole thing looked like a mess. It's always hard with this stuff. When you're a company to know, well, there's a security vulnerability. How quickly do we tell people? Do we tell people before there's a fix? Which potentially opens up like then more people know about it. Do we tell our partners? And when and what kind of stance do we take? Do we, uh, try and sweep it under the rug? Uh, as a small thing, do you always exaggerate it? Like, who knows. And then there's the whole thing with all the, there's a lot of people like waiting in the wings these days to hate on Next.

Gonto: Yes. 

Hank: And so it's interesting whenever something like this happens, and this happens at lots of bigger companies, Vercel’s a bigger company now that you know, RauchG and Vercel and Xjs have, they all have haters. There are people ready to collect their Twitter engagement or to try and promote their company or product by hating on it.

And I don't know, the whole thing looked like a mess, so I didn't go like as deep into it as I think you did. Yeah…

Gonto: I like drama. That's why I go like that…

Hank: Yeah. 

Gonto: I need some gossip. 

Hank: Um, but I do enjoy talking about it with you. 

Gonto: Exactly. But a couple of things that I have to say is like, one, we had a huge vulnerability at Auth.O when we were big.

And it was even, we had to get everybody to update different versions of SDKs, not just basically update the backend that it would be solved. So it was in that sense, similar to this, because it wasn't the framework, but it was an SDK, and we actually took four months to announce the vulnerability because we want to make sure that all of our enterprise customers had migrated, which was very hard.

We wanted to get new versions. We wanted to create some messaging on like when or you would be at risk or not, and how we would work. But in the end, we worked with partners who also were doing SDKs to get them to fix the SDKs, and in the end it worked really well. Like people were happy. And I actually think we did right in waiting four months, which sounds insane. But the… 

Hank: It doesn't sound that insane to me. What sounds insane is when you first said people were upset that the turnaround was five days or something. I was like, 

Gonto: No. The problem was they were saying that they hid it for five days before publishing and they were pissed off. And to me it was because they didn't include partners, they didn't include others, and that's why everybody was pissed off about it.

But I dunno, as I was saying, like we took four months and it was okay because we included the partners. We got every enterprise, the clients like handhold them to move it. We did the same with self service, like we took four months so that we could send multiple emails with self service, help with support and stuff like that without saying that there was a vulnerability.

Like so couple of things that I have in mind is number one, I really like that Vercel said sorry. Like Guillermo has a pinned tweet on his Twitter saying, we fucked up. I'm sorry we didn't include the partners. We're gonna get better. So send me please, all of the complaints that you have. That to me is incredible.

Like he said, sorry, most founders do not, and he was open to complaints like, give me all of your complaints just to make it better. Even Paul Rathnam retweeted that saying like, this is founder mode. And I agree. I think in that they did a really good job and like you learn like these are probably the first huge vulnerability that they had and they didn't think of like, I dunno, I think being honest and open about like in which cases it's very bad and in which cases it's not that bad. Like I would put that into a blog post to explain it. I don't think they did that extra effort. And the worst part is they didn't include their frenemies, I will call them frenemies, that use Next, like Netlify, Cloudfare. Like they need to include them, even if they are enemies, so they know that they need to change it.

Those to me, were the first, the main two mistakes. The other thing I think a lot about Next is I think Next needs to do a better job of explaining which features that Next is shipping are for any cloud service, and which ones are more for like a frontend cloud as Vercel calls them. So the idea is if a feature is for a frontend cloud, I think they need to specify what a frontend cloud is. So then the competitors could have something like that. Like you could have a spec for CloudFlare and Netlify. You say if you follow the spec, you can also host Next.js like us. And then be honest with people on this feature will only work on a frontend cloud, which could be Vercel, eventually there will be others, but for now it's us.

The rest of the features maybe works for others. And I think if they are a bit more honest and clear on that, they will get a bit less hate from people again. But I think it all starts with Guillermo saying sorry, which I think is true. And then learning from that. So I think they didn't handle the vulnerability right, they did handle the post of it, I think pretty good. 

Hank: Yeah. Well, what do you think of the back and forth with CloudFlare? 

Gonto: Um… 

Hank: I mean it starts with Matthew Prince, CEO of CloudFlare. 

Gonto: Yeah. 

Hank: Kind of being a bit of a, a bully and then RauchG replying. Is that right for RauchG to reply? You think it's important or do you think it's just a lightning line?

Gonto: I would reply if I were RauchG, like in general, I would say like, do not reply. But if the CEO of your competitor is giving you shit publicly, I would reply like, and I think Guillermo replied with style. Like he mentioned one thing that was a big vulnerability from them, which again, it was a big problem, but it was in 2017.

He mentioned there as well on how it, they tried to do it and they couldn't, how they tried to work together. So I think it was good that he replied. The only thing I would've added to that tweet is saying something like, CloudFlare, one of the first vulnerabilities or something like that they went down for a long time, but then it was in 2017.

From there they got better. And Vercel could have said something like, this was our first big vulnerability, or something like that. Like, we didn't do it right this time, but we get better. Like he could have mentioned that there as well. But I don't know, like to me, if a CEO attacks directly on you, and you have either something to say or something to defend yourself.

I would reply like, just don't be an asshole and reply with data and facts. 

Hank: Yeah. Yeah. I think that's fair. Uh, it's just hard. There's not, there's not a clear way to, we've talked about this before, but there's just not a clear way to win on these, like internet things. It mostly just amplifies what people already feel about you.

Gonto: Yeah, exactly. 

Hank: Yeah. 

Gonto: Next small topics. Yeah. Um, talk a bit about our newest documentary. 

Hank: All right. Last, last little one. We mentioned that we saw a trailer for this before, so we don't have to talk too long about it, Sut supabase put out like a 10 minute documentary on StackBlitz/Bolt/Eric Simons its founder.

And that was interesting to me because it was way more about Eric and Bolt than I anticipated. It is kind of inspiring, like it talked about the struggles of this startup. And Eric has an interesting story. He's famous/infamous for being an employee who used to sleep and eat and shower at the AOL offices. So he's like your absolute founder, mode founder. 

And you know, he uses the term, this was our last bullet in the chamber. It was Bolt working or we're dead as a company. And it's a great little dramatic 10 minute thing. There's barely a mention of Supabase in there, which I, I find interesting 'cause it actually reflects how Supabase is in the product.

Um, Supabase is a thing that if you use Bolt and some of these other agents, like if you use Replit’s agent, it'll be neon that they'll, the agent will sometimes say, Hey, you need a backend for this, so now you need to create a Supabase account or a neon account. Go do that and then I can do the rest of this work for you.

And it's, it's interesting in these new AI as channels, marketing stuff that Supabase, put in a great expensive effort to just promote the product and the founder and try and keep their momentum going because it, it must be such a great source for new users for them. 

Gonto: To me, there's two parts, like I actually don't think they published it, just so that Bolt becomes more popular because of course like if Bolt, if it has more users, they will use more Supabase and Supabase will make more money.

Again, as you said, Replit with Neon, it's the same. But to me they did this because Supabase always talks to developers. Now, instead of talking to developers, they wanna talk to founders who create these AI agent apps because there's gonna be more and more of these AI agent apps. And I think what Supabase is realizing is that convincing one developer, you get 100 a month. Convincing, bolt.new, maybe you get 100K a month.

So to me, this video is not actually to get more people to Bolt. It's to show how they helped Bolt and how they appreciate them as a customer so that Bolt shares becomes more popular and other companies that are similar to Bolt the founders sees it and talks to them. But I agree with you. It's interesting that there's not that much mention of Supabase.

I would've expected more, but I think it's a bold different way to try to get these new customer types from them that… for them, that's interesting. 

Hank: It's a, it's a platform marketing…

Gonto: Yes. 

Hank: play. It's saying, “Hey, we can be part of your platform. Blah, blah, blah.” But yeah, they really understated that. I feel like they could have done more, they could have gotten Eric, I mean, he said nice things about Supabase and why he went with them.

But, yeah. I'm curious. It, it goes back to one of my themes this year is the, like influencer content marketing of 2025 and beyond, and this just felt like a way to do it, right. 

So I was very interested in that. 

Gonto: To me, what what was missing here was more data. Like if I’m in Bolt, I wanna understand like, how fast are your databases created?

How will people be able to use them? Like why did Bolt choose Supabase and Replit picked Neon? Like what are the differences? What is best for each use case? Like that's what I think I expected more in the video and was nothing about, that's the main thing I would've expected I have, because again, it's not about Supabase per se. It's like how Supabase connects to these AI agents apps.

Hank: Yeah. I've worked with videographer, like you could tell they used a professional videographer. 

Gonto: Yeah. 

Hank: So that's why I'm like, “Oh, this was expensive.” 'cause to do video like this, in that Docus style, you're paying someone tens of thousands of dollars at a minimum.

Gonto: Yeah. 

Hank: Sometimes into the six figures. Even just for a 10 minute video like that. And the problem I have with those is that those videographers and the producers they have, they don't understand what they're interviewing for. They're making art first and foremost. And I noticed that too. I mean, I. Like, yeah, they didn't talk about Supabase enough. They didn't talk about the technology. It was very story lofty, whatever. One thing you can do to prevent that if you're gonna make that type of investment, is have an engineer or a very technical PMM on the site. Not your PR or comms person, but like someone very technical or very close to technical, and they can do that.

Gonto: I think it's a smart new idea, but they could have done better. 

Hank: Yeah. 

Gonto: And again, I think it's more about the technology, how it works and the stats. Because I think Supabase, Neon, and Planet K are now gonna fight for all of these agent apps just because they're much bigger customers than just their regular user.

Hank: Yeah, but it's interesting to see them do this and start the iteration process. Hopefully. I mean, hopefully they all get really good at this 'cause I wanna see, I wanna see what good looks like on this… 

Gonto: Agree.

Hank: And try it out myself. So yeah. Cool. Well that's probably plenty from us today. Cami's got her work cut out to edit this. Thanks Cami. Thanks everybody. 

Gonto: Thank you.