My very good friend (+ previous co-founder) Jonny Nassimi and I have a perpetual, ongoing debate on how to start a startup. There are two schools of thought.

1. Study-up, do your research and make a plan. You’re about to invest a lot of time (your most valuable resource) into something, and you better make sure you’re building something truly worth your time.
2. Build something small and useful — either because you want something that doesn’t exist or literally just want to have fun. It may be a waste of time, yes, but worst case you build yourself something you wanted and had fun doing it.

Every founder faces this debate. Whether we’re on summer break or putting in those few extra hours outside of work, we all must decide how we spend our time. Do we plan or do we build?

I tend to lean on the “just build” side. Not because it’s easier, or more nonchalant (I’m a pretty nonchalant kinda guy 👋), but because I think its the best way to start up—even though it may not be your intentions at the time.

I’ll explain.

Around two years ago, Jonny and I were working hard on ShopTurn, a company that made in-person returns on behalf of consumers in exchange for a small fee. We had just graduated from Techstars, had ample funding and were making very good progress. We had a plan and we were executing. This was around the time HQ was going viral, so naturally, at 3pm every day, nearly everyone at our WeWork would huddle up and try to win HQ.

At one point or another, Jonny and I realized we could build a tool that would google HQ’s questions, and make an educated guess on what the answer might be. It didn’t always work, but it worked well enough. We put it online so friends can use it, and gave it a funny name — HQuack. Word got out, and before we knew it, HQuack had gone completely viral, hitting over 250k sessions within 30 days.

After much debate, we came to the conclusion that removing the site would be the right thing to do. It was ruining HQ for others, and we had no intentions to ruin a game we love so much. But you know this already.

What you may not know is what we did next. We felt like it would be a shame to take down such a popular site without establishing relationships with our users first. To fix that, we replaced the site with a sign up form to be notified of future products we may release. It worked, and within a week we collected 150k emails.

At this point in the story, we were faced with a unique opportunity:

What to do with a mailing list of 150,000 people who play a live mobile game show….

Create our own of course! After all, every Uber has its Lyft, and every Instagram has its Vine. 😉

We always thought HQ was a bit alienating to people who didn’t like trivia, so we put our own little spin on the game format and published MajorityRules. Our game was different in that users had to guess the most popular answer to a free response question, instead of the correct answer to a multiple choice question. Sort of like Family Feud. 🙌

At its height, MajorityRules hit the 15th spot in the App Store under Trivia > Top Charts.

We had fun, squashed many bugs and worked very hard. We didn’t stay on the top charts, but we most definitely built a product that was entertaining, engaging and functional.

Eventually, we piqued the interest of a company called PeerStream(PEER). They made an offer, we accepted, and only a few months after starting MajorityRules, we sold it.

And BOY did it feel good.

Jumping into the start up world comes with big risks. Deciding to pursue ShopTurn meant Jonny and I turning down some enticing post-grad job offers. To have our work even slightly validated in such a risky industry felt really good. It instilled a newfound confidence in us to continue building and follow our dreams.

And to think—it all happened by accident. There is no way we could have foreseen that starting an HQ answer bot would lead to this. Steve Jobs’ quote from his 2005 Stanford commencement speech finally started to make sense:

You can’t connect the dots looking forward; you can only connect them looking backwards. So you have to trust that the dots will somehow connect in your future. —Steve Jobs

After the acquisition, I was yet again faced with a very important question. What do I do with my time? Do I research industries ripe for disruption? Or do I work on my smart door buzzer?

I began looking through my old passion projects, looking to see what had potential. Maybe, I thought, there was a dot waiting to be connected.

There was one project which seemed perfect—LiftLog.

LiftLog is an app I made in college that allowed me to easily and efficiently keep track of my weightlifting. I made LiftLog because similar apps felt like overkill, requiring way too much of my attention mid workout. Plus, building it was much more fun than studying for finals. So during my Sophomore year, I pushed it to the App Store and forgot about it.

I monitored it every now and then, and pushed a few updates. I knew users loved it, because it received stellar reviews and retention was off the charts.

Although it never went viral, LiftLog was consistently downloaded around 30 times a day, and out of around 40k users, many of them used it religiously over the course of 3 years.

At first I decided to monetize LiftLog itself, so I changed the price from free to $2.99. No luck. Downloads went down to only ~4 a day. Free ramen, yes, but definitely no Tesla anytime soon.

Then, I remembered something: all the workout data my users were generating was being stored in the cloud. I was surprised by how much data I had collected (almost 6 million workouts) and that I couldn’t find a publicly available weightlifting dataset bigger than my own. I began analyzing everything, and found a clear disconnect between those who made progress over the years, and those who didn’t. The reason seemed obvious—people weren’t increasing the difficulty of their workouts. In fact, most people lifted the same amount, every time they performed an exercise

What surprised me is that less than 8% of my active users actually saw any real progress. I wondered if people were simply more interested in maintaining their strength as opposed to building strength, but that wasn’t the case. After a quick survey I found that 71% of my active users were actually looking to get stronger.

Now that’s a disconnect worth solving for.

I did a bit of googling and eventually learned about progressive overload.

I knew it was legitimate because [it was on wikipedia 💁‍♂️] it completely coincided with all the data I collected. What I needed to figure out was whether or not there is an optimal schedule to follow in order to build the most strength over a period of time.

I tasked myself to answer the following questions using LiftLog data:

1. How often should an exercise be performed?
2. What is the optimal amount of difficulty to increase an exercise by between workouts? Do we ever decrease the difficulty?
3. Do we alter the difficulty by increasing the number of reps, or the amount of weight (or both)?

Much brainstorming, coding and designing later, I landed on FitnessAI. A highly effective strength training algorithm, wrapped in a beautifully simple and elegant iPhone app – the perfect weightlifting trainer, right in your pocket.

FitnessAI users see a 20% increase in total volume lifted in their first 30 days on average. If you or a friend is interested in weightlifting, I invite you to check it out on the App Store :)

FitnessAI stands on the shoulders of 40k weightlifters who used LiftLog more than 5.9 million times over a 3 year period.

And remember, I never planned on “disrupting” the personal fitness industry, all of this happened by accident.

Since you can only connect the dots looking backwards, there’s really only one thing you can do to increase your chances of success – make a shitload of dots.

Here’s how:

1—Build Something for YOU

Take a few weeks and build something you can start using immediately. If you want something, it’s likely other people want it too. Don’t waste time adding complicated features, just get the job done quickly. After all, this is mainly for your own use.

If you aren’t a coder, that’s no excuse. My friend Joshua Brueckner created and scaled his company AirTailor, an on-demand clothing alterations service, exclusively using AirTable and Zapier!

2—Make it Available

You don’t know if the dot you’re working on now, may connect to a dot in the future, so store everything from email addresses to usage patterns in the cloud for future reference. It’s sometimes easy to omit things like analytics and SEO for “small side projects” because it’s tedious work—just take time time and do it, because you never know how this dot may connect.

3—Tell your Friends

After you’ve published your side project, tell your friends about it. Post it on Product Hunt! Definitely don’t spend money marketing it. You’re really just sharing something cool you made, and giving it a chance to take off organically.

4—Repeat

Here’s where most people mess up: Drop your current project, and start a new one. It’s easy to become attached to what you’re building. You’ve worked hard on it, and you want to make improvements. Don’t. The time you spend improving something that may not have potential, could be spent creating something that has more potential. In other words, your return on time invested diminishes, so it’s smarter to start something new.

5—Look Back

Every now and then, glance back at your projects. Analyze the feedback you’ve gotten and the data you’ve collected. If there’s a small following, push an update and make your users happy. If you find out something interesting, write about it on Medium! When you hit gold, you’ll know it, so don’t trick yourself into thinking it.

Just remember that patience is 🔑

Thanks!

If you want to stay up to date on future projects, consider following me on twitter.

… and don’t forget to download FitnessAI!

HQuack is a website I made that displays predictions to HQ Trivia questions in real time, every single day. It started off as a small project out of curiosity, but then it went viral.

The funny part of this story is that none of this was intentional. When I first built HQuack, it didn’t have a name, and it wasn’t a website — it was just a program that ran on my laptop. Friends eventually found out, and kept asking me if there was a way they could use the bot too.

I gave it some thought and decided to add a page to my website, jakemor.com/hq, which mirrored the results I was getting on my laptop.

The way it worked for users was simple. A question would show up on HQ, and after a second or two, the question would show up on jakemor.com/hq, with the proposed answer highlighted in green.

Fast forward about 10 days — visitors on my personal site grew 10,000% to 1,000 visitors/week. I thought that was crazy, because the only way to reach jakemor.com/hq was directly; it wasn’t linked to anywhere on the internet.

As word of mouth continued to spread, I began to wonder how big this could get. I decided to spin off jakemor.com/hq as a new product, and the more user friendly HQuack.com was born.

The site began to grow 20% day over day, and after three weeks, the site hit 4.5k users.

Then, the media picked it up. The first article mentioning HQuack was written by Paris Martineau for The Outline on Wednesday Jan. 31st.

The day after it was published, HQuack went from 4.5k users to 11k. After that first article, Complex, BuzzFeed and CNET picked it up, and by Superbowl Sunday the site hit 19k users — a 400% increase in users over the span of 4 days.

At that point, three things happened: first, my mind was blown because I never thought I’d actually make something that would go viral, second, I began to realize the affect media can have on a small side project, and third, I began to wonder if there were any ethical problems here.

I decided it would be okay to keep the site up, because in reality, HQuack never got 12/12 questions right. It had gotten 11/12 only once before, and most of the time it only got around 9/12 right (and not in order). Sure, people were getting further than they would have without HQuack, but I never felt like HQuack was ruining the game for the masses.

Then, on Feb. 6th, just as SpaceX’s Falcon Heavy was launching, this happened…

HQuack went 11/12 during the midday game on Feb. 6th, and the only question it got wrong was the first one (which was a fairly easy question). That game, HQuack had 13k users, and HQ had almost 9k winners 🤔

To make matters even crazier, HQuack went 11/12 again that night, and HQs payout was only $0.89. It was becoming more apparent that when HQuack was accurate, it had a serious effect on HQ.

The next day, I woke up to an email from Rus Yusupov, HQ’s CEO. We scheduled a time to chat, and came to the conclusion that taking down the site was the right thing to do. It was fun to build something that went viral, but at what point was HQuack just ruining someone’s startup?

At the same time, my business partner and I decided to focus on an idea that we think will be huge. It’s going to be by invite only at first, so we replaced the site with a sign up form for what’s coming next. To our surprise, 25k people have already signed up!

As an aspiring tech entrepreneur, it was fun to have my product in the hands of many people. This has been an extremely exciting journey, and I can’t wait to begin the next. Stay tuned!

UPDATE: 1/23/19 — I’ve launched my latest app :) https://getfitnessai.com.

Thanks for reading. If you like this story and want to stay up to date on future projects, follow me on Twitter.

This is the default “Sign in to iCloud” dialogue that iOS presents its users (sometimes a bit too often and for no apparent reason). What scares me is that this is a fairly simple sign in prompt for someone to doctor, include in a decoy app, and use to steal iCloud passwords.

Email Address

Although users iCloud emails aren’t readily available to developers, there is an API Apple provides that verifies if an email address belongs to an iCloud account.

The decoy app could ask the user for their email during a sign up process, or get it from their Facebook account. Later on, the attacker could verify that the email belongs to an account, then display the popup shown in the video. If the email doesn’t belong to an iCloud account, the prompt could be modified to say that the email address provided is wrong and just ask for the email and password from within the prompt — most people wouldn’t think twice.

Issues

The real “Sign in to iCloud” popup seems to present itself at random times, so a fake form would be hard to detect. Additionally, iOS uses a generic UIAlertController to ask users to input secure information, which means it would be hard for the average person to detect a fake one. Instead of iOS asking users to log in from within the alert view, it should launch settings to the iCloud section where the user can securely sign in. Unfortunately, users are already conditioned to the current dialogue. I get the feeling that even if Apple secured their sign in to iCloud flow, a majority of people would still fall for this sort of attack. You may think an app like this would never be accepted by Apple, but in order to fly under the radar during the reviewal process, the attacker can delay the pop up from showing until the app is approved. For example there could be some server side logic that dictates when and who to show the fake form to.

Keep up with what I’m up to on twitter or my website, and please share this article to raise awareness.

// .htaccess (same directory as index.php)

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^?]*)$ /PATH_TO_PROJ_DIR/index.php?path=$1 [NC,L,QSA]
Options -Indexes

If you don’t know what a .htaccess file is, you can read about it here. Among other things, its a way to make your URLs beautiful, but if you use it the right way it lets you add a nice layer of abstraction between how your client uses your API and how the app operates.

Some background: I’m not a huge fan of backend frameworks (Rails, Codeignitor, Django, Zendphp, Laravel, CakePHP, Symphony). If you know a language well, and if you are using the right language, you can do anything any framework lets you do in a couple of lines of code– you just need to think about it the right way. I like to think of using PHP as a framework (I didn’t invent this idea). Here’s a starter template I built in PHP that mirrors the django project setup (I love the simplicity):

jakemor/jakephp

The .htaccess file above routes everything to index.php and makes everything before the url parameters available at $_GET[“path”].

Here’s an ex:

this/is/the/path?param=jake&param2=php+is+awesome

In index.php:

// index.php 

var_dump($_GET);

spits out:

// http://localhost:8888/this/is/the/path?param=jake&param2=php+is+awesome

Array
(
    [path] => this/is/the/path
    [param] => jake
    [param2] => php is awesome
)

Now in index.php we can reference a function by name based on the given path, which is just a String.

Since php has support for variable functions (read more here), you can do this:

// index.php

$method = $_GET["path"];
...
(figure out what file to include and include it)
...
unset($_GET["path"]); // get rid of the path once we used it
$method($_GET); // include the $_GET as params

There you go! Here’s a “php micro framework” that does the same thing but makes you learn how to speak Vulcan first.

Slim Framework

And finally, from the maker of PHP Rasmus Lurdorf himself:

https://www.youtube.com/watch?v=anr7DQnMMs0#t=1913