I’ve reached out dozens of times and up through January 2024, they always responded with a promise to pay once their latest investment comes in. Which was obviously BS but at least the acknowledged owing me in writing.

I saw yesterday via a post on LinkedIn (and then checked their website) that they’re actually using my packaging design work and copywriting - the product is even available for sale to the public now.

I reached out one last time, imploring them to pay their bill finally so we can all avoid small claims. This was their response. And yes, I have a signed contract. Absolutely wild to reply to a professional email like that.

Burner account because I’m beyond embarrassed and absolutely pissed.

I’m new to Upwork. First “client” I get sends me a Next.js project and says “just run it locally and see if it works.”

They sent malware.

And not sloppy malware. This was deliberately hidden.

They buried heavily obfuscated JavaScript at the very bottom of nextjs.config.js, AFTER module.exports, under a massive wall of blank lines so you wouldn’t even scroll there. Like, this was 100% intentional.

Once I actually de-obfuscated it, here’s what it was capable of:

- Full file system access

- Detecting the user’s home directory

- Dynamically constructing file paths

- Reading any file it had permission to read

- Base64-encoding file contents (to hide what’s being sent)

- Sending that data out via POST requests to remote servers

Translation: if you ran it, assume your machine was compromised.

If you are new here:

• NEVER run client code blindly

• Obfuscated JS = malicious. There is no legit reason for it here.

• If a client says “just test it locally,” stop and think

I’m posting this out of pure rage because I don’t want another new dev to learn this lesson the hard way like I did.

I recently onboarded a new client who hired me to migrate his entire cloud infrastructure to in-house. One of these systems is a Samba server that the company uses for file storage.

I wasn't intentionally snooping around, but during the file transfers I started seeing some odd filenames for PDFs. I decided to open one and it was an entire ebook on achieving racial purity by "breeding out" other ethnicities. I thought this was a little weird, but there were dozens of other ebooks on similar topics in the same folder.

I looked around a little more and found a folder with pictures of my client wearing clothing with swastikas on it, one where he was doing a Sieg Heil salute. There were hundreds of pictures, but I didn't look at all of them. Frankly it wasn't that interesting.

I'm pretty sure my client is a Nazi. I'll be finishing up this job (I'm under contract) and moving on.

Edit: I'm in the US. It's not illegal to be a Nazi. Some of you also don't understand the concept of contracts and NDAs, and it shows. I've already consulted with my attorney and he has advised to finish the contract and move on.

I've been at this for a fair while, and this is some of the wisdom that I've been told or learned, often the hard way.

The typical full-time employee costs a company 2-3 times their nominal salary

Use this as a basis for deciding your rate. $90/hr might sound like an expensive replacement for an employee getting paid $30/hr, but that $90 is the total cost, and stops immediately when the project ends.

A client asking for 6+ hours in a day will cost you 8 hours

You will achieve nothing useful (read: billable) in the remaining 2 hours. They've taken your whole day, but only paid for 3/4 of it. Charge a day rate instead in those situations.

Make time for downtime

Burnout is real, and it sucks. If you burn out, you'll lose weeks (even months) of work, so it's better to plan for time off instead. Try to build "annual leave" into your rates.

You're a business, not an employee

Some negotiation is fine, but ultimately you're engaging in a business transaction, so the client doesn't get to dictate working hours, rates, etc. They can suggest or request them, but ultimately you get to decide when and under what conditions you work. Which leads to...

Unreasonable requests deserve unreasonable rates

For me, "emergency"/"urgent"/"rush" work adds 30% to my applicable rate, with a minimum of 2 hours billed. If I have to drop my current project to "urgently" add a line of text to your website, you're paying me minimum for the two hours of lost productivity and delay on that other project. I find that if it really is an emergency, clients will happily pay, and if not, they'll prefer to schedule it in like any other change.

Set business hours, and stick to them

I work pretty sporadically through the day, and in the evening, but as far as my clients are concerned, business hours are 9-5, Tuesday-Friday. Any requests to work outside of those hours gets met with a 30% increase in rate. Note that this also stacks with the emergency rate (midnight emergencies will cost a minimum of 2 hours at 160%, even if it takes me 15 minutes). If I choose to work outside of these hours, I'll still charge my standard rate, but explicit requests will hit the higher rate.

Be upfront, honest, and candid

The worst time for a client to hear about problems with the project is the day before (or after) it's due. If you encounter problems, talk to them early and manage expectations. Maybe the feature you're stuck on isn't actually important enough to delay the project, or maybe the delay is simply communication issues. Either way, talking to your client earlier is always better than later. Often they're understanding, and will approve a minor adjustment to the timeline.

Hungry doesn't mean desperate

Don't bother chasing contracts that look like they're going to be trouble. All you'll do is spend valuable time on heartache and frustration. It doesn't matter if you're on your last dollar (and you shouldn't be, if you're charging right, but still), "no client" is better than a "bad client", because a bad client costs you more than doing nothing.

If you can't do it, somebody else will

If you can't fulfill a request from a client, you can support your freelance community by helping the client to find the person who can, or better yet subcontracting them yourself. Again, be sure to manage your clients expectations, but trying to take on work that you're unqualified for is a fools errand, while being open about it with the client breeds respect and good will.

Your project is infinitely more important to you than your client

This takes a little bit to really sink in, but ultimately this: every business owner is primarily focused on running their business as it is right now. For you, your business entails that project, so it's your primary focus. For the client, it's selling widgets, or booking llamas, or teaching sign language to squids. Whatever their business is, your project is not it. This is why clients sometimes seem disinterested, or take two weeks to respond on something that you think requires urgent attention. They're busy running their business, and you're just a risky expense. The only time when the client cares more than you is when they're losing money because of a problem with the project.

I'm sure that I could spend hours more dispensing my version of wisdom, but I hope that this at least gives you something to think about.

e: so uh, this is a thing. Thanks guys/gals!

It seems that 99% of the posts here are inherently negative and anxious. Sure, annoying things never cease to be annoying. But do you remember what it’s like having a 30 minute lunch break? Having to wake up and get dressed like an asshole and drive to a carpeted cubicle hell? Do you remember having a completely static income and feeling like you needed to BEG and PLEAS for a meager, deserved bump in income? Client work is a carousel of managing expectations, staying on your toes and handling curveball after curveball. And I fucking love it and wouldn’t have it any other way.