Hacker News Reader

Thanks for sharing the only actual piece of commentary I can find from the company.

Reading between the lines, this suggests that they've decided to use an external firm to cover these security domains (for now). Without knowing which firm or firms we obviously can't say anything specific about their reputations, but I will say that I know some individuals who operate in this space and there are some very qualified and talented outside security firms out there.

However, the good firms aren't cheap. Obviously we can't know the details, but I wouldn't assume this move was motivated by cost-cutting reasons. Keeping a top-notch outside security firm fully involved could easily cost more than the salaries of the people who were let go.

I don't want to single anyone out, but a quick glance through LinkedIn leaves me somewhat confused about their former security team's structure. I could be missing something, but the only lead I found on LinkedIn was listed as "acting head of security" with a description that they were covering the Head of Security position for now. It's possible that the security team were good engineers, but maybe not the exact engineers/managers that Patreon needed at this stage of their development. Some times a mismatch like that really can't be overcome easily, so employing a known external firm can cover the gaps while the company tries to find a better match for their security leadership needs internally (if they return to internal at all).

This move could make even more sense if Patreon was aggressively heading toward IPO. In this case, the company would need to demonstrate that they've done their due diligence and made a best effort to cover security as best they can, even if that means paying exorbitantly for an external firm that has helped prepare companies for IPO in the past. If their internal security team didn't have this experience (and maybe didn't even have an official head of security) then they didn't stand a chance.

> This move could make even more sense if Patreon was aggressively heading toward IPO

This upsets me so much. Patreon is a perfect example of a company that could operate as a non-profit and everyone would benefit; but, instead, they need to make so much money that they're valuable on the Stock Market. It seems like a net harm for society, here :/

> Patreon is a perfect example of a company that could operate as a non-profit and everyone would benefit;

Everyone except all of the employees who built the company with some equity compensation.

Like it or not, a lot of the current and former employees are equity holders in the company. An exit event gets them paid for their ownership piece.

Of course, anyone could start a non-profit Patreon competitor if they really wanted to and operate it as such. However, cloning Patreon isn't as trivial as it might sound to the casual observer. A lot of work has gone into getting the company to this point, and IMO it's fair to reward the people who took on the risk to make it happen.

As an employee of a startup, I understand the value and desire to get that compensation.

My argument is that I wish Patreon had been non-profit from the start and such there would never be a time for them to "Go Public"; and, all their employees would already be focused on the common good that comes out of a patronage platform.

How would that impact their ability to recruit and retain talent though?

They are competing against some of the best paying firms in the world. “Making it easier for podcasters to make money” is not high on the list of causes I’d give up my high paying gigs for.

"High paying" and not-for-profit are not necessarily contradictory terms. Market rate for good engineers is still what it is.

A significant amount of tech compensation is in equity. It means Patreon would have to offer a lot more in cash to match the same total compensation as other firms.

Only for your (edit: FANG-style) companies, really. A lot of startups give options, which are pretend until the company goes public; and, in many cases cannot be considered real money, ever.

I may be "a fool", but when I wasn't working for a startup or a FANG, my stock earnings were pretty piddling, really, and my salary was (a bit less) than FANG's pre-stock earnings.

I just have no idea how this would work? I'm starting a golf wiki: https://golfcourse.wiki , and i really am thinking about taking in a not for profit direction.

I just... I don't have any money, and if I ever made any money instead of losing money on it (currently), I could never imagine making enough to actually pay employees.

Patreon works because they marketed the hell out of themselves. That costs a ton, and it almost certainly was funded by VC capital. I wouldn't be surprised if they didn't operate at large losses for years.

I guess, as someone trying to build a startup from nothing, bootstrapping is just hard. Lord knows I'm very proud of the growth I've had, but I'm still almost certain that nothing will come of the nearly 3 years I've worked on this site. Unless you're willing to potentially bankrupt yourself to build a nonprofit, or fight on alone incredibly slowly, I really think that nearly every startup with seed funding will absolutely have to sell out big time.

How did Patreon advertise that it cost a ton? Where there many ads or commercials, online and offline?

Marketing for SaaS is rarely in traditional media, and isn't limited to paid ads. Everything on a non-app website is marketing. Obtaining case studies, references, trade shows are all under the umbrella of marketing.

Even stuff like exclusivity contracts can be "marketing" in a sense - it may not land that way on a finance budget (genuinely don't know how that stuff is classified), but a lot of big creators are incentivized to join platforms outside of just choosing what works best for them.

Disclaimer: I work for a Patreon competitor (Supercast) and I'm not saying any or all of the above is definitely something Patreon does, it's just things that are typical in the industry.

I'm not a lawyer, but I imagine:

It really does probably start with the kindness of the initial benefactor - or as an in-house job until such time as the "profits" exceeded the founder's "wages" and then they could hire more people and have a reserve of X years of current employees' wages to handle the ups and downs.

It would likely need to start from someone that either has a primary job, or is independently wealthy, though, and then that person would need to remain at the company because AFAIK (I'm not a lawyer), you cannot pay a "board" at a non-profit.

On "getting that compensation", are there other ways to financially bootstrap a company and give "future payoff" to investors and early employees without requiring IPO/acquisition? What do the balance sheets and end of year accounts look like for a non-profit? What happens if they generate surplus profit? Can the CEO and director simply pocket it too avoid "making profit"? Or must they reinvest in the company? Or pay dividends to original investors? Or give it to charity? Burn it in a pile?

| On "getting that compensation", are there other ways to financially bootstrap a company and give "future payoff" to investors and early employees without requiring IPO/acquisition?

In virtually all existing use cases, I'm strongly against cryptocurrencies, buuuut token issuing and the related Ponzi scheme has been the single biggest new thing they brought to the table which _does_, actually solves this (minus the questionable legality, the Ponzi, and all the current issues the crypto market is having). IE: issue utility-coin for founders & first employees, issue utility coin for public, increase overall utility (and thereby price) of coin, cash out of coin via public. Some coins even carry voting power, which makes the end-consumer part of the governing process. Connecting value-holding with utility _is fairly novel_, haven't seen it being tried in normal corporations before, and might be interesting, if it works.

The other config would be dividend-paying corps; however they went out of fashion on account of growth-above-all-strat playing corps being able to fundraise based on the _biggest hopes and aspirations_ any of the potential investors can dream up; which means, a competitive market have selected for growth-above-all against dividend-paying.

| What do the balance sheets and end of year accounts look like for a non-profit? What happens if they generate surplus profit? Can the CEO and director simply pocket it too avoid "making profit"?

Nonprofits _totally can make a profit_; buuut they can't distribute it to directors, and can't issue dividends. They could have increased salaries; however the governing check&balance on the organization, is that they must have 3 independent people on the board, who checks decisions against the organization's "non-profit mission"; and having high salaries for execs can't really fit that.

It might actually be a good business for the Internet Archive to get into. It seems like a natural adjacency to their current mission. They could even include a "right to archive and distribute" clause at, say, 5Y old content.

> However, cloning Patreon isn't as trivial as it might sound

I imagine the non-trivial piece is adoption and normalization of the business model. Or do you mean that there is something technically difficult in what they are doing (which would surprise me greatly)?

Now that Patreon has normalized people donating on a subscription basis to content creators, that actually helps competitors.

Nobody can operate at scale as a non profit. Capitalism-designed legal system crafted non-profits regulations in such a way that non-profits will never ever be any kind of competition to profit-driven capitalist companies because they have to beg every 2 years for money from outside in order to be able to stay afloat. They can only gather 2 years' worth of operating money legally. So its 1 year of actual work, then starting begging for a year so that you can gather enough money over that year to be able to survive another year before having to beg for money again.

> Nobody can operate at scale as a non profit.

Wikipedia seems like the biggest tech counterexample.

Wikipedia's labor costs are anomalously low.

Wikipedia "works" as a non-profit but they are also 100% the Kings of deceptive marketing to get way more funding than they need to operate and blow most of it on stuff unrelated to Wikipedia or to an ever-growing endowment that supposedly already covers the site for several decades.

Source: https://www.dailydot.com/debug/wikipedia-endownemnt-fundrais... // associated HN discussion: https://news.ycombinator.com/item?id=27339887

For a more practical example; I moderate a wiki project with semi-decent traffic and a decent enough reputation and our operating costs are about ~3k each year (it's like a little more than that) if the donation rounds are any indication. The donations usually occur in November and we get funded within 3 weeks. In terms of expenses, it's really hosting and a small amount of money set aside for a WMF developer (independently) to maintain our custom extensions for the site.

You don't need tons of money if you just want to stay solvent.

I agree with you, but this just makes the counterexample stronger. Wikipedia could be raising far less money and still successfully operate one of the biggest sites on the web.

And the only one. Who needs to beg every other year for money and risk going under even if they falter in being able to gather 2 years' of runway at any given point. Precisely how the non-profits were designed to be.

Wikipedia is nowhere near faltering: they beg for money because this gets them money which they can use to run interesting things, but the basic work of operating the primary site is very easy to keep funded.

Many non-profits don't need to fundraise publicly because they've lined up some sort of stable funding, but then you're naturally much less aware of their funding situation.

Mozilla was also nowhere near faltering until a few years ago. Then suddenly they are on shaky ground.

Such a model can work for stuff that people's lives dont depend on. But its not viable for people trusting their livelihood on them.

The Signal Foundation, Mozilla, and the EFF are other prominent examples.

Plenty of successful business models rely at least partially on "begging for money". Universities and hospitals are two notable ones that rely pretty significantly on philanthropy.

I mean, you have entire governments, the United Nations, Wikipedia, Mozilla, Burning Man, some universities, many schools and museums and libraries... capitalism is just one way to motivate workers.

I don't know where you got this weird idea of begging for money every two years. Nonprofits can and do make money from products and services, and they can pay it out in salaries or executive compensation. What they can't do is pay shareholders or VCs. Their revenue can be reinvested in themselves or in some fund, just not paid as "profit" to investors.

Wikipedia is a good example of how bad the non profits have it. They have to beg every other year for 2 years' worth of money. If they cant succeed in gathering that amount even once, they go under. Mozilla is already on shaky ground.

And the others have permanent funding from other sources, so they are not really non-profit examples.

Mmm, do you have some examples or sources to cite? I don't know where you're getting these ideas, but I've worked for many nonprofits and considered starting my own, so had to understand their legal and financial structures a little bit.

If you have to beg every 2 years for money or you go bankrupt, that is some terrible planning. Nonprofits are usually run like businesses, and have revenues and expenses like any other business, usually continuous. It's not like they fundraise every 2 years and then spend money the rest of the time. That's just not how it works. They have boards, managers, staff, salaries, etc. that they plan for day to day, like any other business, and their revenue streams are not limited to donations (there can be grants, sales, memberships, endowments, whatever).

Wikipedia, as an example, uses that bullshit to stir up a sense of urgency as a call to action, but they are actually doing just fine:

https://www.makeuseof.com/tag/wikipedia-millions-bank-beg/

https://www.washingtonpost.com/news/the-intersect/wp/2015/12...

You can also look at their Form 990s for a clearer picture of their financials; https://projects.propublica.org/nonprofits/organizations/200... (it's not FAANG money, but it's enough for what they're doing, and they get richer every year).

The reason typical nonprofits don't get rich is that you can't really "invest" in them via capital injections, because investors can't get a return. That's what makes them nonprofit. But nothing stops them from doing routine business activities to make money on a predictable, cyclical cycle -- not a lump sum every year. That Wikipedia thing is just a marketing gimmick, the same way many charities will use holidays or Giving Tuesday to beg for money, but that's not their entire income stream (or even most of it).

The choice to become a nonprofit is exactly that, a choice. They don't "have it bad", they just choose their mission (well, ideally) over profit. Of course scams exist and some are just tax havens or whatever.

There are also non 501c3 nonprofits, like churches or issue-based advocacy groups, that have their own funding structures (tithes, corporate affiliations, whatever). And nonprofits can and do have their own investments, their own funds, etc. that earn a return, but it just goes back to the org and/or its staff (as salaries and perks, etc.), not shareholder return.

Overall, though, for the most part the primary differentiation is just that they don't have shareholders/owners to give money to. Aside from that they are mostly just businesses with a bunch of small technicalities of IRS rules to adhere to.

> If you have to beg every 2 years for money or you go bankrupt, that is some terrible planning

Its not. Its the legal setting that prevents non-profits from gathering more operating money than a given period.

> their revenue streams are not limited to donations

They aren't. Except it works the same way - they cant gather any kind of financial capital that could make them a viable competitor for for-profit companies. Otherwise non profits would have steamrolled the for-profit companies a long time ago.

> Wikipedia

Picking one example as poster boy does not make the argument. Wikipedia is the product of a well-connected, famous persona, who already had enough connections to start and float any kind of organization at the point he started Wikipedia. Its also the first and practically the only one of its kind with no practical competititon. Even so, it is dependent on fleeting funding from donations and similar revenue sources.

The sole example of Mozilla can prove how fickle this format is. Its also one-of-a-kind, it was also practically the first in its field, and for a time it had no competition for its major product. Now its on shaky grounds, with funding for Thunderbird being cut, Firefox not doing so fine and so on.

Thats the problem with non-profits in the current legal landscape. The landscape is crafted to prevent any threat to for-profit companies and it gimps many things ranging from non-profits to cooperatives for that end.

And that makes it totally risky for anyone to build their livelihood on such a non-profit. You can still be able to pay your rent next month as a creator if Wikipedia goes down. But if your Patreon goes down, you are in knee-deep sh*t. Because its infrastructure by now.

...

Im totally for non-profits. Actually, an entire economy that comprises of cooperatives, functioning on the infrastructure provided by the democratically elected government is the ideal economy for me. However the proposition of turning such services like Patreon to non-profit is not viable with the current legal landscape unless its changed drastically.

This just isn't true. There is nothing preventing nonprofits from accruing and banking money for many years at a time. Where do you keep getting this idea? There's no magical 2 year limit or anything like that.

There are thousands if not millions of perfectly functional nonprofits. Mozilla is more the exception, a monster that gets fed by Google and produces little of value. The EFF, ACLU, Sierra Club, whatever are also nonprofits. There are lots and lots and lots.

Nonprofits are a different beast from cooperatives. They don't have a profit motive. If you want a democratic nonprofit there are such things as worker self directed nonprofits. Or if you want shared investments without shared governance there are ESOPs and such.

Yes, I would love to see a more democratic economy too. But that's not held back by the limits of organizational structures.

Please, if you're going to make these extraordinary and (I believe) incorrect claims about nonprofits, provide some sources?

> This just isn't true. There is nothing preventing nonprofits from accruing and banking money for many years at a time.

That was what I was told. Even if its 'many years', its still a limit. Even if there wasn't any limit and what I was told was wrong, it still doesn't change the reality:

https://www.councilofnonprofits.org/tools-resources/operatin...

All the examples that people give on behalf of nonprofits are organizations that provide a free, non-critical service which would not harm anyone's livelihood if they went away. From free browsers to Wikipedia. There isnt one single service provider among them.

...

Ask yourself: Would you build your startup by relying on a nonprofit-provided infra like payments, hosting and so on. That is, if you can even find such a non-profit service in the first place.

> Ask yourself: Would you build your startup by relying on a nonprofit-provided infra like payments, hosting and so on. That is, if you can even find such a non-profit service in the first place.

Recall that the majority of people that use Patreon tend to be YouTubers that want real income but are regularly banned from getting it; artists; non-profit / open-source software development teams; single-person dream-projects; influencers / online personalities; etc.

So, "would I build my [community-facilitated, primary source of income] by relying on a [company that is not beholden to the whims of the stock market, so it can choose what's in everyone's best interest and not just the highest stock value]?"

Absolutely.

There is no limit. They can bank millions if they want. And yes, there are poorly run nonprofits just like there are poorly run businesses. How many businesses can survive 3 months with no income?

What are you doubting, exactly? That nonprofits can't charge for services?

Here's a few examples... some big museums (the NY Moma, the Field Museum in Chicago), the Green Bay packers (and the NFL as a whole until 2015), the Mayo Clinic, the Kaiser Permanente parent organization (which owns the for profit hospitals), etc. Donations are a part of many of their income streams, but not all.

In tech, some other examples include VLC/VideoLan, the Linux foundation, TechSoup, Change.org, the Internet Archive...

None of those have FAANG level money, but that was never their goal. They still manage to survive and produce very valuable output.

Of course I would want a nonprofit payment processor, along with a nonprofit Lyft/Uber equivalent, etc. If I had the money or talent, I'd build those myself.

Don't get me wrong, the nonprofit space has a lot less money overall because it can't attract investment. That doesn't mean they can only survive two years at a time. It entirely depends on their business model (yes, even nonprofits have one). If they don't diversify and depend solely on donations and don't get any, yes they will die. Businesses without income will die too.

I'm not really sure what we're arguing about anymore. That nonprofits are poorer? It's true, they are. That they can't make or bank money? That part is not true. It's harder for them to attract money because you can't invest in them, but once they get it, they can manage it like any business, even buying up for profit businesses as investments.

A lot of nonprofits have huge endowments that allow them to have annual income in virtual perpetuity.

Like Open Collective?

I'm not sure about non-profit.

But certainly one that should be run as lean and mean. After all there is only so much money to be extracted. And the whole system is not that complicated. Entirely reasonable business to run, but not something that will be an unicorn...

Its possible of course, but the statement does sound a lot like PR speak for: we are going to get a really cheap pentest once a year to check the compliance box.

Sounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. MSSPs are a step above offshoring your whole security team, so not a great bit of news.

The average windows enterprise customer who uses MSFT for 60% of the security load and 40% to the MSSP and IT team can get by with this move.

But, knowing people who work at MSSP, a lot of security theater goes on because it’s just on the wrong side of industry trends. Watching is one thing, fixing it is the other. They prob has some cost cutting and a CISO or equivalent who didn’t know how to make the case (or no CISO).

Some of the MDRs seem good. Red Canary for example.

I see a lot of companies successful via a long-running relationship with MSSPs for improving help desk style support and occasional emergency forensics etc. That's been getting more interesting, and as we partner with MSSP ourselves (graph ai, GPU, etc tech), been awesome to see how that enables investments that are too hard at the individual company levels. For SMB, even more sensible.

But at SME/enterprise scales, a lot of the success is driven by in-housing tier 2 + security engineering. For tech/product companies, true at even smaller scales. Security is part of a common core product value proposition for the customer: trust baked in. Same but different for say fraud & safety and how that relates to account churn vs growth. Seeing that capability evaporate is scary.

As an analogy, most companies who handed over control of their data plane to palantir engineers & proprietary palantir infra ended up regretting it and wanting to change the relationship. Areas like parts of the US Gov who haven't are now stuck. Doing the same with the trust & risk aspects of an enterprise is scary, especially as each one is now increasingly part tech company.

Yup, I'm sure that's right.

That being said, I don't doubt a good arrangement can be had with someone like Red Canary to provide services of tier 2 and 3. I've only spoken with them and not other leading MDRs so I'm not sure as to the quality of others. I can easily see a company like Patreon making the decision to use an MDR and it being the right call.

Agreed, good vendors and the related teams. I’d def trust Crowdstrike L1 triage. The problems show up with 3rd parties running a suite of EDRs across a spread of customers.

Some of them are very good, and accordingly very expensive.

A non-exhaustive look through the LinkedIn profiles of the former security team doesn't show any previous startup-to-IPO security experience. If Patreon is preparing the company for eventual IPO, getting everything security-related aligned with the due diligence expected for an IPO is critical.

I would guess Patreon is simply engaging with an external firm that has past experience preparing security at a company for IPO. The laid off security team might have been otherwise good engineers, but not necessarily the right team needed to prep a company for IPO.

A fun exercise is scouting the sec eng numbers and tenure of a pre-IPO shop, or of more concern vendors that are all over product teams. Big yikes

The probability of your whole team not being the right people is very low to begin with, and you kinda have to assume none of them would be up for the task of growing into that role, with external support. Sure.

I dunno, either all they did is actually covered by developers and ops, or they're getting rid of a lot institutional knowledge.

> all of your patrons may be supporting multiple creators, not just you;

This is exactly why I use it - and the only reason why I use it. It's just a convenient portal for me to manage donations. I don't care about exclusive content and I'd rather the people I support just continue to put out content on their primary platforms. The less I have to engage with Patreon's content feed, the better.

You wouldn’t be using it if the creators weren’t on the platform. That is the main draw.

A platform like Patreon mainly provides the really hard service of collecting and distributing money while conforming with tax and other laws you run into while doing that. The rest, like the content feed, is trivial.

As a web developer [with horses in other races] it's hard to ignore statements like those in your last paragraph.

Centralisation that "literally can’t be duplicated" is no cause for celebration; it's a broken black-hole monopoly and the more it grows, the more you have to use that platform if you want a "fair" shake against other creators; the harder it is for competition.

You're technically right in what you said but I don't think it hurts to give people a little encouragement if they want to strike out and show people there's another way than just paying Patreon 5-12% or OnlyFans their 20%. We need creative solutions for getting away from relying on Amazon, Patreon, etc, etc to find the things we want.

Indeed, and it seems like true hubless p2p technology is the only real solution to this. It almost makes me wonder if the crackdown against p2p services that started back in the 90s was secretly motivated by a desire for bolstering blackhole monopolies.

P2p is not a solution to this simply because the problem is not in being able to get a recurring payment. The problems start with fraud, chargebacks, refunds and range all the way to having to collect and pay differing sales taxes that stream in from different economic regions of the OECD. California and other sales taxes in the US. EUVAT for European subscribers. Even Japan has its own VAT scheme. On top of that, you have to maintain a billing system. Its a b*tch.

Anyone who tries to do those ends up spending a lot of their time in maintaining and sorting these out than doing their actual activity like art, music and so on. That's why services like Patreon are a godsend to, well, practically anyone. Anyone, because there are a lot of software developers (freeware, shareware, modders) who use Patreon to fund their software development.

spoken like a true central banker :)

Yeah. You turn into someone like that when you start running your own business and get to know the reality of payments, compliance, taxes, fraud, chargebacks and all that sh*t. And it doesn't matter how small is your business.

I think they mean P2P for federation, discoverability, searching.

Handling payments, subscriptions, fraud, local tax kinks are mostly solved problems with the right intermediaries. Yeah, it's more than letting somebody else handle it, but —depending on your content— it's potentially 15% of your revenue.

> Handling payments, subscriptions, fraud, local tax kinks are mostly solved problems with the right intermediaries.

Yeah. And Patreon is that intermediary. That intermediary service is the difficult thing to do.

> depending on your content— it's potentially 15% of your revenue.

That's peanuts compared to the effort that goes to doing those stuff by yourself.

>“As a global platform, Patron will..."

Wait, they can't even spell the name of their own company correctly?

Must have drank too much Patreon.

Hm. That looks like a bad copy and paste on my part. I perhaps foolishly copy-and-pasted from a screenshot I'd taken rather than going right back to the Discord, so the text was generated by macOS's built-in OCR. I hadn't noticed that one, but I just checked and they did indeed spell "Patreon" correctly. :)

> copy-and-pasted [text] from a screenshot

It's kind of amazing that that's even a thing, let alone that it's higher quality than a typical read-and-type copy.

For how long OCR has existed, I'd expect better from a presumably high-resolution screenshot of text in a common font. Here we have deletion of an entire letter, a severe case of 'anti-contoot' [0] -- too aggressive NLP correction.

[0] <https://news.ycombinator.com/item?id=6156238#:~:text=Languag...>

> As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations

This is the key part here - whoever they've outsourced this to costs less than those 5 employees and presumably still lets them tick whatever regulatory boxes they need.

Either that or their 5 person security team made a boo-boo recently and this is the fallout.

Did they really misspell the name of their own company in a public statement?