Building things, breaking things. Mostly @tern_mail 🐦 Sometimes 🎨 @LogoLattice
Joined December 2010
- Tweets10.7K
- Following479
- Followers2.4K
- Likes19.1K
"Congratulations, you've won $5000!"
I spent all week making Tern harder to hack. Servers, accounts, password resets, all locked down.
But none of that stops an email like that landing in your inbox.
So Tern now checks for scams. One click and it looks at the sender, links, attachments and wording. Then tells you if it's a scam, suspicious, or fine and why.
Every email client should have this. Now Tern does 🔒
Live now for Pro.
A few people have asked why I removed email-code sign-in from Tern.
It was a trade-off between convenience and security, and I'll pick security every time.
Tern isn't one inbox. It's every inbox you connect. If someone gets into your Tern account, they don't get one mailbox, they get all of them.
Email codes skip your password and 2FA completely. So if the email you sign in with is every compromised, everything behind it is too. One weak link means every account is exposed.
Yes, typing a password and setting up 2FA is more work friction. But a few extra seconds at sign-in is worth it when the alternative is someone reading every email you own.
Conveinence is great until it's the reason you got breached 😮💨
xitter.cf/ldo_dev/status/2114476…
This update has no shiny new features 🔒
After a week deep in security work, here's what just went live:
📎 13MB attachments on every provider
✉️ SMTP checks emails are received
🔐 Stronger passwords that are automatically checked against known breaches
🚫 Magic links are deprecated
📱 iOS and Android have offline outbox support
Not the flashiest update, but it's the one that makes Tern something you can trust with every inbox. xitter.cf/tern_mail/status/21142…
This update has no shiny new features 🔒
After a week deep in security work, here's what just went live:
📎 13MB attachments on every provider
✉️ SMTP checks emails are received
🔐 Stronger passwords that are automatically checked against known breaches
🚫 Magic links are deprecated
📱 iOS and Android have offline outbox support
Not the flashiest update, but it's the one that makes Tern something you can trust with every inbox. xitter.cf/tern_mail/status/21142…
Updates rolling out today 🛡️
Most of this week went into server security and hardening how Tern protects your accounts.
iOS and Android get a lighter update: bug fixes and performance improvements.
Not flashy, but this is the work that matters when you're trusting us with your inbox.
Thanks for flying with us 🐦
My Mac has never had the compute to run multiple dev instances and agents in parallel for audits.
It's been my biggest bottle neck for months.
Turns out I can link @t3dotcodes across my Mac and Linux PC.
Now the dev servers and dbs stay running on Linux, the agents work through everything on the Linux box and with Tailscale I can reach all of it from my Mac like it's on the same machine.
Should have done this ages ago 😮💨
Luke retweeted
Updates rolling out today 🛡️
Most of this week went into server security and hardening how Tern protects your accounts.
iOS and Android get a lighter update: bug fixes and performance improvements.
Not flashy, but this is the work that matters when you're trusting us with your inbox.
Thanks for flying with us 🐦
The best part of building Tern? Nobody gets to overrule a good decision.
No layers to sign off. No "we'll look into it". No opinion from someone that has never touched the problem.
I own it end to end, so I can do it properly.
Own it. Fix it. Follow up fast.
It's not complicated. It just takes caring.
This week has been a lot. And now it's time for one more massive hurdle.
🔒 Tern is officially going through CASA.
The deadline is closing in, so I've floated the remaining cost myself. No more waiting, it's time to get things moving with this.
There are still lifetime spots available if anyone wants to support Tern, but this is happening either way! 😎
Let's get Tern certified!
Another thing that's always worth checking if you're self hosting: your backups.
Not just whether they're running but whether you can actually restore them.
A successful backup means very little if you've never tested recovering from it.
Pick one database, restore it somewhere safe, and make sure everything works.
It's boring right up until the day it's the most important thing you've ever done 😅
I've spent the last 4 hours doing this across all my servers.
Moving websites behind Cloudflare Tunnels, putting SSH, databases and Coolify behind Tailscale and closing off access wherever possible.
It's easy to focus on securing what's exposed but one of the best things you can do is reduce what's exposed in the first place.
If you're self-hosting, PLEASE take an afternoon to look at your setup.
It's much nicer to do this before you need to 😅
I've spent the last 4 hours doing this across all my servers.
Moving websites behind Cloudflare Tunnels, putting SSH, databases and Coolify behind Tailscale and closing off access wherever possible.
It's easy to focus on securing what's exposed but one of the best things you can do is reduce what's exposed in the first place.
If you're self-hosting, PLEASE take an afternoon to look at your setup.
It's much nicer to do this before you need to 😅
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
Luke retweeted
Here's how that new file transfer feature works 🔥
Just right-click it and Scootch it to your other computer. That's it.
Mac. Windows. Linux.
Scootch is magic 🪄
getscootch.com
Scootch v1.2 is out! 🚀
Halloween animations, synchronised animations, and an even faster way of transferring files between computers!
Right-click a file and there's a "Scootch to..." option that lists your connected computers 🔥
If you're using Scootch on a Mac, please note that this update will be the first notarized Mac release, so it's been signed differently from the previous releases.
As such, you'll need to reset the permissions in Privacy & Security.
Remove any old entries for Scootch and re-add once you've got this new version!
Any issues, give me a shout.
Read all the updates here: getscootch.com/changelog
Luke retweeted
So I came across a few posts about how we're all getting tired of subscriptions, and that got me thinking last night.
While I think One Design is worth the price, I tried putting myself in my users' shoes and realised it's probably not something you'd use daily, unless your workflow requires it.
So I made a pretty big change to the pricing.
I've removed the £4.99/mo subscription and, for a limited time, dropped the lifetime price from £79.99 to £29.99.
There are 95 founding supporter spots left, which come with a nifty little card and your name and link on the Info page alongside the other cool people.
Oh, and there are already 24 tools available, with more coming!
Tern is officially back at $0 MRR.
And somehow, that's good news.
My very first monthly subscriber was due to renew tomorrow.
Instead, they upgraded to a lifetime founding membership.
I've lost my recurring revenue, but gained someone who believes in Tern enough to back it for life.
In think that's a pretty good trade!
Just 4 spots left 🧡
Luke retweeted
Not even out the beta phase yet,
and Scootch has already had its first sale 🥹
Thank you so much @ldo_dev!
You've genuinely made my day, I'm absolutely buzzing🧡
Check out his amazing product to unify your email inboxes - tern.so | @tern_mail
8 inboxes. 8 different reasons for my phone to buzz. Not anymore 🔕
Tern now lets you choose which emails deserve a notification, separately for every mailbox.
All mail, important only, priority senders, or complete silence.
Your inboxes, your rules.
Oh, and iOS and Android are getting a huge update later. Lots of fixes and improvements.
Let me know if you want access 👀
Luke retweeted
If you haven't tried Scootch yet, today's the last day of the free beta!
From tomorrow (Monday 19th), we move to a 3-day free trial and then you'll need a licence key. Those of you on the beta get those 3 days too 😄
Thanks to everyone who's tested and provided feedback so far, I've been loving the positive reactions, particularly those of you who DM'd me footage of you scootching between your computers, that was awesome 😄
Luke retweeted
If you have more than one computer at your desk, try the Scootch beta now!
Free access ENDS MONDAY
• Easily cross between your Mac, Windows and Linux computers 🪄
• Transfer files by dragging across
• Copy and paste between machines
• and more!
Link below 👇
The next big hurdle for Tern is here 😨
This weekend is all about tying up loose ends, fixing bugs and getting Tern stable.
Come Monday, everything shifts to Google's CASA certification.
OWASP testing, security audits, documentation, pen testing. I'll be throwing everything I can at Tern to find weaknesses before anyone else does.
Once I'm confident, it's time to pay for the assessment and hope I've done enough to pass.
The deadline is November 20th.
One dev, one expensive hurdle, one final step 🧡
