justinludwig

It sounds pretty fair to me. I would look at it more like I'm getting a stipend to spend a few months learning if I really want to devote the next 5 years of my life building stuff with this guy. But if you're looking at it more like it's just a paycheck, then it's not going to be a good fit.

"Get shit done" is by far the most important attribute of your first few employees. You need people who can work independently without a lot of direction, and focus on the right things while the rest of the world burns around them.

They don't need fancy credentials or to be super smart or have a great internet presence; what you should look for is a track-record of shipping, and evidence of independent work; and when you interview them, find out if they have good judgement, if they have a sense of when to trade off perfect for good enough, if they're able to diagnose and fix things when they're broken.

As you grow, you can add more traditional engineers to build a more conventional, well-rounded team. But most companies don't get to 20 employees if their first 5-10 aren't able to work quickly & make good decisions without getting side-tracked on all the myriad little distractions of designing the perfect framework for the framework, office politics, dev environment isn't quite right, etc, etc.

> - System design at ~whiteboard still feels reasonable / CS basics.

Bingo. Timeless classic for good reason.

Code review also can be good, not in a "can you spot the 17 bugs" way, but rather as a tool for discussing what makes code good, what make a code-review good, what are the tradeoffs in this particular section of code, what tests or other safety checks might you want to add to this particular code, etc.

More about what you actually do -- I'd suggest something like "Secure, Sustainable Open Source: We partner with open source projects to monitor their upstream dependencies for security fixes, and automatically rebuild and distribute our partners' projects with those fixes. Our partners don't have to change what they do, and we share 70% of our subscription revenue with them."

Also:

> New SecureBuilds are created whenever upstream CVEs are available, with a 6-day SLA for critical vulnerabilities.

Surely this should be "New SecureBuilds are created whenever upstream fixes for CVEs are available" -- you cut new builds for the fixes, not the bugs, no?

Simply being first isn't the moat -- _switching cost_ is the moat. You've got to get people using your app in order for being first to matter. And the easier it is for those users to switch, the smaller the moat is.

IE6's moat wasn't that it was first at anything, it was that it was installed as the default browser on all new Windows machines -- switching was work. And once lots of custom web applications were built that used IE6-only features (or required IE6-only bugs), switching became impossible.

You realistically only have time for one of the following:

1. be a serious student

2. be a serious athlete

3. be a serious maker

4. be a serious business-person

My advice would be not to take any of them too seriously -- enjoy college, enjoy your sport, enjoy tinkering, make connections. Don't worry about starting a company until after college. Take advantage of your college years to learn, work on other people's projects, try out new things, and invite others to collaborate with you.

If you're brimming with ideas now, you'll have just as many in four (or six or eight) years, and you'll have gained invaluable connections and the know-how to execute on them. (But if before then a great opportunity falls into your lap to start a business with some of your fellow students or professors, don't be afraid to take a sabbatical from being a student and athlete and having a life, and dive into it for six months or a year.)

This tactic is usually used as a diversion, either to bury an important email message (like a notification that your credentials to an important account have changed) in a flood of garbage messages, or to keep you focused on your email instead of keeping tabs on your usual responsibilities (like say to monitor the entrance to your office suite).

If this is her personal phone number, then it's likely available from any number of "legitimate" data brokers; plus likely would be part of various database dumps you can buy on the dark web. It's pretty easy for someone who knows what they're doing to spend a few minutes of research on social media to find several employees of a small company, lookup their personal contact info, and message them claiming to be the company's CEO.

To protect your employees, let them know that either a) you'll never call or text their personal phone number; or b) if you call or text, it will always be from a known good phone number (which they can put in their phone's contacts).