Normally, I'd first go with "So what did they do wrong?".
But since it's the security team, I'm gonna go with Patreon is in dire financial straits and this is the tip of the iceberg.
But since it's the security team, I'm gonna go with Patreon is in dire financial straits and this is the tip of the iceberg.
Like, we HAD TO change our passwords every 30 days.... but our default modus operandi was not having password auth in first place + hardware tokens for authentication, which made whole password thing totally irrelevant, but no, security, change your password you don't use every 30 days.
That's good. Scrum manager as a crontab:
Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]"
Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.]
Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."
And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.
DevSec is next, right?
Not really. If you wanted to find a way to exfiltrate it would be in your favor to have the tool client side that you were trying to bypass.
Alternatively maybe the devops or other team took over their functions. They're not legally required in that industry, while in some industries / publicly traded companies they can be.
I think that's a wrong attitude to have. The entire point of security systems is to be bureaucratic, i.e. to follow proper procedures.
A good chunk of security incidents in the software industry could be avoided by people following procedures rather than winging it, the annoyance is often not justified or an indication that people are playing too fast and lose.
I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers.
Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.
Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!
I view them as a media hosting company of sorts, like YouTube or Vimeo. The fact that they collect money makes them nothing special, since everyone technically collects money somehow.
I have a Patreon page with hundreds of supporters. If I want to post a video for my supporters, it has to be hosted elsewhere. Patreon will not host and serve it.
a couple additional cases that can cause a security team to be laid off:
1. Outsourcing or Offshoring
2. evidence of significant corruption or incompetence within the team requiring a full reset
It doesn't happen often, but when I get requests to investigate a C-level for misconduct, the first thing I do is update my resume.
"We've never had a security breach, what am I paying you for?"
"We're having a security breach, what am I paying you for?"
A couple years ago, they tried to change their whole payment system so each subscription was billed individually, racking up more fees for patrons. They kept defending it and finally backed down at the last minute after a ton of their biggest creators yelled at them.
no, I don't understand either.
Meanwhile in January they said they had taken in a total of $3.5 billion in creator lifetime funding. At lets say 8% average cut that means they've made a total of $280M in their whole history, although earlier accounts got grandfathered at the original 5% rate I think. We'll go with 8% to be generous. Even at 12% that means total lifetime income for patreon is $420M, around the same as their VC funding.
Then they have to pay all the processing fees, their own development and operational staff (~300 employees in 4 offices), etc. Then they have to actually make money as profit to satisfy investors.
VC funding killed patreon.
A company is worth it’s future cash flows. You are making an incorrect argument about the sunken costs (sunken costs do admittedly have relevance to individual funds, but not to your argument).
You don’t get 10 rounds of investment without a convincing argument (or believable story) for future profitability at each round (even if some rounds turn out to be duds later).
Patreon has had multiple rounds of layoffs since 2020. Their finances aren't public but no matter what they're selling investors, what they're doing shows they're bleeding money all over, and VCs make many mistakes betting on the wrong horses.
A poor analogy. VC is more like putting 20 horses in a race, hoping that 1 horse will win billions of dollars. The other 19 horses usually make approximately $0 in comparison to the winner.
VC is not zero-sum. Most sports are zero-sum and most sports betting is worse than zero-sum due to house take and taxes. Using sports for analogies with business often gives invalid intuitions because of this.
I think you are also making a fat tail error, the opposite of survivorship/selection bias[1]: you see heaps of failures so you are not properly offsetting correctly for the small percentage of big wins which is the theoretical modus operandi of VC[2]. A majority of VC funds fail to return enough for their risk, but that alone doesn’t tell you whether investing in VC funds gives a poor return: perhaps one VC fund returns 100x, perhaps an investor is willing to pay for investment diversity, perhaps other reasons to invest in what superficially appears to be a poor performing sector.
[1] https://en.m.wikipedia.org/wiki/Survivorship_bias
[2] https://techcrunch.com/2017/06/01/the-meeting-that-showed-me...
Profitability might not matter to the VC investors if they can IPO like Uber.
Patreon has been amazing for small and large content creators, providing a big win for society IMHO, and Patreon seems likely to continue in some form even if they don’t meet the VC growth targets. In a perfect world, things would be different, but there there is little surprising here (which is part of the crux of your point?).
Profitability is almost meaningless for a growing company (see Amazon). Perhaps Patreon turns out to be a loser for the investors, or perhaps a loser for society. But we have to wait and see, and meanwhile take the wins we get.
They have sacked some employees, but employees take that risk on when they join a startup, and those risks are obvious to anyone that is paying any attention.
Sure, VCs make mistakes, often big hurtful ones. That’s part of the game. You are calling the game over, and it isn’t half-time (to stretch some sporting analogies badly), and most importantly: you are a spectator and you are not the ref. As far as I can tell, you don’t understand the rules of the game.
Having members on YouTube doesn't impact that at all. The members will pay and discover, same as if they were on Patreon. Non-members might have a harder time discovering, but it's not like it's easy to discover content through Patreon either.
Only if the Visa/Mastercard duopoly approves. It's not a real market.
Cardless Subscriptions are also here (disclaimer, that's my role at a large open banking company) although some more legislation needs to be done before they can be used for ecommerce
For the Creator, even if you exclude the things that interact with Patreon to do the benefit-management bits, you have to also do any KYC/Identity verification bits, re-setup account transfers.
Then you need to reach out to all your supporters and convince them to move over. They're going to lose some percentage of those people -- how much is going to depend on the creator and the fanbase. Some people are just going to ignore it, every single one of them though are going to re-evaluate that math in their head as to whether they really want to continue supporting that person.
Patreon also has major brand-awareness. Someone telling you to move over to SubscribeStar, Liberapay, Buy Me a Coffee or whatever might get a "This seems like a scam" type reaction.
E: see this video https://youtu.be/bGvfYv5nzs0?t=138
"Good UI" doesn't make something a platform.
Doing payments in a fee-minimizing way definitely doesn't make something a platform.
This isn't like a newspaper, finding neither ads nor paywalls will make ends meet. They're not phone app developers, finding users will barely pay $1. It isn't an ad-supported business that can only make a fraction of a penny per user. Their moderation needs are at a pretty small scale, with most user accounts tied to known bank accounts. They don't have to negotiate with rights holders for copyrighted content and get taken to the cleaners. They don't have to store and distribute gigabytes of video per second. They don't face big customer acquisition costs.
Youtube and Twitch are doing a lot more work for their cuts.
Only if the creatives are making their money on their platform.
Since Patreon's entire business model is based on taking a cut of the revenue artists make on their platform, they don't make money if the artists make money elsewhere. Many creatives use Patreon only for fan outreach, and sell merchandise outside of Patreon.
If Patreon charged a fixed rate for their software, they could make more money, but they would lose the business of small creatives. That's the dilemma.
You could be correct, but I posit it'll take 2-3 years minimum before it's used widely.
They have zero reason to lose significant money over the video feature, especially since it's still in closed beta.
You want people focused on security, but separate security department all too often just becomes annoyance that doesn't understand business, or architecture, just drops decrees.
This is why the decrees are made, I guess it strongly depends on the tone of the message and the messenger. A little bit of social engineering of engineers goes a long way.
So they don't seem to have any problem with income. VCs have little reason to pressure them for anything either - this is a startup that is making 125-130 million revenue every year already, and its subscription revenue - the holy grail. Any pressure that comes in from that side would likely be in the direction of pushing for growth. Which may be one of the reasons for the layoff. Excepting some major incident related to the security, of course.
If they are in dire financial straits, they can definitely afford 1-2 security engineers to keep the light on.