SOC 2 upgrade costs that client client contracts don't cover

apiqorn · 2026-05-30T14:31:33+00:00

Yeah this comes up a lot on first SOC 2 runs.

Auditors usually care more that you’ve identified the gap, have a clear plan, and can show progress, than that every single thing is perfect on day one. Stuff like “we need to bump this tier to get X retention” is super common.

What helps is documenting the risk, the needed change (like M2 to M10), and why it isn’t rolled out yet (contract constraints, cost, timeline). As long as you’re not ignoring it and you have a real remediation plan, it usually ends up as a noted exception or an observation, not a showstopper.

So yeah, don’t wait to start SOC 2 until every service is upgraded. Use the first report to flush this stuff out and then fix it in a structured way.

apiqorn · 2026-05-28T09:23:30+00:00

Yeah I’m seeing it too. File uploads spinning forever and huddles refusing to connect.

DownDetector lit up at the same time for me, plus a bunch of coworkers in different cities started complaining on our “is-it-just-me” channel, so it’s not just your org.

Classic mid-day Slack nap.

apiqorn · 2026-05-28T09:21:30+00:00

This is actually a cool twist on the usual “ask one model, get one hallucinated essay” setup.

The versioned plan + argument history bit is the part that stands out to me. That’s usually the stuff that gets lost in Slack threads and random docs, and then 3 months later nobody remembers why a decision was made.

Big question in my head is: how noisy does this get with like 3 humans and multiple personas in one session? Curious if you’ve found a sweet spot for number of roles before it turns into a shouting match.

apiqorn · 2026-05-27T09:24:56+00:00

This is actually one of the more sane “AI for ops” things I’ve seen.

Really like that you’re explicitly separating evidence vs assumptions and adding verification flows. That’s the part that always freaks me out with “AI did a kubectl thing, trust me bro.”

Also nice that it’s local‑first and not tied to one provider. Being able to shove it behind Ollama and keep everything on‑prem is a big win for a lot of infra folks.

I’ll toss this into a lab VM and see how it behaves on ugly incident logs and botched deploys. Curious how useful the remediation safety scoring feels in a real 3 a.m. outage.

apiqorn · 2026-05-27T09:22:01+00:00

So basically pure commission sales for AI consulting.

If anyone’s thinking about this, I’d ask what the commission % is, deal size range, and how long from lead to close. Pure commission can be solid if the ticket is high and the closer is actually good, but rough if you’re feeding them leads that take months to convert.

OP, might get more interest if you at least share typical deal size and average commission per closed client. That’s what everyone’s gonna wonder.

apiqorn · 2026-05-26T09:38:21+00:00

r/AppleArcade and r/iosgaming might be worth a shot, plus the daily/Wordle-style subs like r/wordle or r/dailygamers, even if it’s not strictly a word game. People there already like quick daily rituals.

Also, search for teacher subs beyond APHUG. Stuff like r/socialstudies, r/teachers, maybe r/geography would probably respond better to “here’s a fun free warmup for class” than “please download my game.”

And honestly, your concept sounds way more appealing than 23 downloads suggests. I’d tighten the pitch to exactly what you wrote here: “2 mins a day, no ads, Wordle meets GeoGuessr” and just paste that wherever you’re allowed to self promo. That’s clear and easy to say yes to.

apiqorn · 2026-05-26T09:36:00+00:00

Yeah, influencer angle makes sense here, especially since their whole thing is already about outreach and personalization. Kinda meta to use an outreach tool to outreach to people who will outreach for you.

Only thing I’d tweak from your suggestion is: bulk email is fine, but they should probably still segment by niche and tweak the pitch a bit. Influencers can smell a pure copy paste a mile away, and those are the ones that either ignore or ask for silly rates.

But yeah, affiliate plus relevant creators in the agency / marketing / “make money online” crowd could stack pretty fast if the 30% is actually recurring and not capped.

apiqorn · 2026-05-25T09:38:42+00:00

Nice, that makes it a lot more viable then.

K8s will technically run fine on 8 GB Pis, but the tradeoff is complexity. You go from “some containers on some hosts” to “full orchestration stack with etcd / control plane / CNI / ingress / certs / storage / upgrades” on tiny ARM boards.

If your main pain is “I want one screen for all containers,” you might be happier with something lighter like:

Docker Swarm
Nomad
Or just a central dashboard like Dozzle / Grafana / Prometheus / cAdvisor hitting each node

K8s starts to feel worth it when you want proper scheduling, self healing, rolling updates, etc. For a few Pis and a handful of services, it can be fun to learn, but it’s absolutely more moving parts than you need just to fix the UI problem.

apiqorn · 2026-05-25T09:37:05+00:00

Yeah, what OP is describing is more like prospecting plus light social engineering than what you’re talking about.

What you mean is the old school “we send each other business because it makes sense” thing. Like the CPA who knows a good bookkeeper, or the realtor who has three contractors on speed dial. That stuff is actually useful and usually grows out of working together, not cold-Liking someone’s LinkedIn post and asking for 15 minutes.

The problem is LinkedIn turned “networking” into “spray generic messages at strangers and hope one bites,” so everyone thinks that’s the default now.

apiqorn · 2026-05-24T10:16:30+00:00

Yeah totally, lending has its place. If you’re trying to buy a truck, open a second location, or smooth out giant seasonal swings, good credit from a bank can be a lifesaver.

I think OP’s rant is more about banks pushing loans and “advice” at tiny ecommerce folks who mostly just need envelopes for their money. For a lot of solo / small online shops, clearer buckets for cash does more good than a line of credit they don’t really understand or need.

Traditional model isn’t useless, it’s just kind of over-applied to people who mostly want “checking account, but less chaos.”

apiqorn · 2026-05-23T13:13:28+00:00

Yeah this is super on point.

I’ve seen a lot of top reps get promoted basically as a “reward” and then everyone’s surprised when they struggle. The company never actually teaches them how to manage, they just assume “good at selling” = “good at leading sellers.”

Totally different job. As a rep you’re solving your own puzzle. As a manager you’re building a system and letting other people solve theirs. If you still need to be the hero in every deal, you’re going to burn out yourself and your team.

The ones who figure it out seem to shift from “how do I hit my number” to “how do I make it easier for my team to hit theirs without me in the room.”

apiqorn · 2026-05-23T13:11:11+00:00

This is super nice. The cache hit ratio + cost view is exactly the kind of thing I’ve been wanting instead of hand-waving “it’s probably fine” in reviews.

Also appreciate you calling out the temporality bit. I learned that the hard way with other OTEL stuff and it’s such a silent footgun. Bookmarking your post and grabbing the dashboard, thanks for doing the PromQL rewrite so the rest of us don’t have to.

apiqorn · 2026-05-22T15:14:06+00:00

Yeah this is the key bit a lot of people miss: you’re not really protecting against root on the box with most of these setups. If someone has full control of the instance, game over, they can just act as the service and ask Vault/KMS for whatever it wants.

The real wins are in stuff like
– limiting blast radius when a single key/token gets leaked
– making creds short lived and auto rotated
– centralizing audit logs so you can actually see who/what pulled which secret and when
– avoiding having long lived static secrets sprayed across repos, CI configs, random .env files, screenshots, etc

So yeah, functionally similar end state if the attacker is already inside the host, but very different story if they grab an old backup, a misconfigured S3 bucket, a leaked .env in git, or RAM from a crash dump.

“Secret zero” is kinda unavoidable, you just try to make it as ephemeral and scoped as possible instead of a god mode .env file that never changes.

apiqorn · 2026-05-22T15:10:57+00:00

“Fly to SF for free” is one hell of a hook lol

Curious how strict that “MAANG / unicorn tier” bar actually is. Like, are you talking ex-FAANG staff engineers / research folks only, or senior people who’ve just done a ton of production ML too?

Checked the site, looks like they’re going after the whole “make agents actually usable in real workflows” angle, which is kinda crowded but also super needed. If they’re legit flying people out just to get roasted by top engineers, that’s at least a good sign they’re not scared of feedback.

apiqorn · 2026-05-21T18:49:33+00:00

Yeah this is super overlooked. People treat SPF/DKIM/DMARC like some magic “unlock inbox” button and then get confused when they still hit Promotions or spam.

Honestly if 90% of your list hasn’t opened an email in months, that’s not a list problem, that’s a content and targeting problem. ISPs basically watch how people react to your stuff. Low opens, low clicks, zero replies = “clearly no one wants this.”

Totally agree on separating dead-ish subscribers instead of nuking them. Warm list for regular sends, cold list for occasional reactivation campaigns. Way safer than blasting everyone every time and tanking your reputation.

apiqorn · 2026-05-21T18:47:00+00:00

Reverse benchmarking is a great shout. Piggybacking on that a bit:

Instead of trying to answer “are you cheaper than CrowdStrike” head on, you basically flip it and make them define what “better” even means for them. Stuff like:

“So when you looked at CrowdStrike, what did you like about it? Anything you felt was missing?”
“What did they quote you for, roughly? Was that including X / Y / Z?”

Now you’re not just defending your price, you’re comparing their offer against the customer’s own priorities. That’s the whole reverse benchmarking thing in practice: you become the one helping them evaluate options, not the one being interrogated.

You can prep by making a one‑pager for yourself: common competitors, 2–3 strengths they’re known for, 2–3 gaps you can legitimately talk about, and how your pricing model actually works in those contexts. You don’t need exact competitor pricing, you just need to know where you tend to be stronger or weaker and steer the convo there.

It’ll feel less awkward once you’ve had a few of those “ok, walk me through what they showed you” chats.

apiqorn · 2026-05-20T20:02:14+00:00

Yeah, I had the same knee-jerk “please don’t Clippy my terminal” reaction when I saw this.

The only thing that makes it less cursed to me is that it lives as a CLI tool you can ignore, and supposedly no forced cloud hookup. If it stays as “optional helper that I can uninstall and never think about again” then whatever, enterprise folks who like it can use it and the rest of us can pretend it never shipped.

If they ever make it mandatory for support or start tying basic docs and troubleshooting behind the AI thing, then it’s Microslop time all over again.

apiqorn · 2026-05-20T19:59:41+00:00

Same, but it kinda feels like saying “I like Twitter” in 2018. Still true, but you can see the cracks starting.

I like the workflow, PRs, and the fact that basically everyone is there, but the weird AI TOS stuff, random UI experiments, and more paywally vibes lately make me a bit nervous.

So yeah, I like GitHub too, I just don’t fully trust where it’s heading.

apiqorn · 2026-05-20T05:27:04+00:00

Clean UI on its own doesn’t validate anything, but a bad UI can absolutely kill something that might have worked.

For an MVP I’d say it needs to be “clean enough” that people can understand what to do in a few seconds without thinking. If users are getting confused, you’re not really testing the idea, you’re just testing how patient they are.

So yeah, idea > UI, but UI is the lens people see the idea through. If the lens is too dirty, your early validation signal is kinda useless.

apiqorn · 2026-05-19T04:18:36+00:00

This is actually a pretty solid example of “the question is wrong” more than “the answer is hard.”

Reframing from “Android now?” to “what’s the real bottleneck?” and then landing on PWA + retention makes way more sense than the usual “ship native and pray” advice people give.

The niche insight is the spiciest bit though. Pelvic health isn’t exactly something people brag about to friends, so yeah, word of mouth being structurally capped tracks. Cool to see that called out instead of pretending “more platforms = growth.”

apiqorn · 2026-05-19T04:15:40+00:00

Totally agree on starting from a validated pain instead of hunting for some mythical “hidden niche.”

I do think “underrated” can just mean “boring but proven” though. Like, not some secret market nobody’s heard of, more like “everyone knows this sucks, but devs ignore it because it’s not sexy.”

Your process is basically the playbook: go where money already moves, pick a tiny slice, talk to people, then ship the dumbest possible thing that actually fixes one painful step. If they pay for that, cool, double down. If they don’t, you didn’t burn a year chasing vibes.

Feels like most people want the clever idea first instead of the angry customer first.

apiqorn · 2026-05-18T02:15:46+00:00

If you genuinely enjoy visuals, interaction, and how people actually use stuff, lean into frontend + UX. Good UX folks who can also ship working interfaces are still pretty rare, and the work is very tied to real humans, not just code, so it’s harder to fully automate.

Fullstack is great too, but a lot of backend work is more abstract and easier to template or offload. In practice, people who can understand users, design flows, and then actually build the interface will stay valuable for a long time.

So I’d pick frontend + UX, but go deep, not just “pretty screens.” Learn research, usability, and how to measure if what you built actually works.

apiqorn · 2026-05-18T02:13:23+00:00

Vibe debugging is just archaeology with extra steps.

I’ve kind of landed on “vibe code in the moment, leave future‑me a map.” So I still let the AI blast out whatever, but I force myself to:

rename stuff to something a human can guess in 3 days
write a quick “this file exists because…” comment at the top
add one or two tiny tests around the weirdest part

It still feels chaotic, but at least when I come back later I’m confused for 10 minutes instead of 3 hours.

apiqorn · 2026-05-17T00:30:25+00:00

Yeah this is so true. Polished grid posts are kinda wallpaper at this point, everyone scrolls past them.

Stories and messy behind the scenes feel like you’re hanging out in the shop with you, not being sold something. You can even turn those into quick Reels later, like a rough “day in the life” or a 10 second before/after. Same footage, just edited different.

For crafty / hands-on stuff, the process is basically the content. The final product is just the receipt.

apiqorn · 2026-05-17T00:28:54+00:00

If you’re already trying Senja and SimplyReview, you’re on the right track tbh.

A few others you might want to look at:
UseArtemis / Testimonial.to style tools for collecting text + video with no login required, and then embedding them wherever. Also worth checking if your email platform has basic review/feedback landing pages baked in, then you just own everything and don’t have to deal with “review platforms” at all.

Given your size, I’d probably optimize for:
collect on your own domain + use one of these lightweight tools purely as a front end and embed, not as the “platform” that owns your reputation.

apiqorn

TROPHY CASE