Should you delete your Patreon account after they laid off their security team?

It's really hard to get people to take their monthly contributions to a Patreon competitor. The inertia is really hard to overcome. So in a sense its kind of like lock-in - if you move you'll give up some % of your income.

What's visible once you are past the hyped language in the article is that Patreon had a 5-person security team, and MULTIPLE security vendors up until this point?

Doesn't that look like too much for a small startup to start with? And if one argues that 'No amount of security is enough', then HOW many security vendors does anyone need?

Is there an objective measure? Like, does the amount of manpower that a security vendor should determine whether that vendor is enough? Or the number of industry-renowned personas that work in that vendor?

What happens if one player buys out all those security vendors and combines them into one single large vendor? Will that be enough?

...

So basically there is no objective criteria for this. The proposition is 'less security is bad', but nobody defines 'the right amount' of security objectively. So even if Patreon or anyone else is using a top-notch competent security vendor that handles all their stuff, it wouldn't be enough because... well, this is a chance to do some hype, obviously.

The proposition of the article in canceling Patreon and 'moving somewhere else' is also very dangerous and it feels like self serving.

Cancel Patreon and go where? Set up a subscription service yourself? And deal with all the chargebacks, fraud, refunds, financial compliance, and gasp sales tax collection and clearing? Or, one of the much smaller Patreon-competitors who have even less backing and organization behind them? So move from Patreon to... 'smaller Patreon'?

Which would easily put someone in hot water regarding actual legal responsibilities that can land one in large fines and even court sentences, by the way. People think that just because they have been making some side money here and there on the Internet and this was not something that the tax agencies and governments would bother to look into, things will stay the same if they start making such regular, noticeable income. It doesn't work like that. Things get serious.

Because now the money that you are making with your creative activity is not occasional 'gig money' that is paid you in cash somewhere, totally unaccountable. Its regular, trackable income that may land you in very hot water if you end up getting called up by your tax authority randomly in a few years. There is always the chance that your government may start a major sweep to weed out tax-dodgers so it may not be even random.

So such propositions like in the article 'Cancel and do something else' feels like random retorts from people who don't actually know what they are dealing with - laws and other people's money.

...

Even the prospect of having to set up and maintain a billing system should make people shudder at such a proposition. Its all fun and games at the start when you are setting up stuff. Not so much when keeping it updated and compliant takes a considerable chunk of time 2 years down the road. Forcing you to do deal with those instead of doing your creative activity.

When people post websites to Show HN the majority of the comments are usually not more insightful than "I don't like this button, make it a different color."

>The website you’re reading is a furry blog before it’s anything else.

I don't think anyone should hate him for that. But neutral commentary I feel is okay. Otherwise yeah some people are proud of their identity

I'm going to export all my files and drop the account i think. Need to tighten the belt anyway.

And to be painfully honest, it also encourages coverups and lying on reports. As a security engineer at another vendor who has worked with these MSPs and their clients I have seen a lot of things that went sideways and the MSP wants to cover it up and it makes responding to an incident really hard.

There's one CISO school of thought that believes the job is to run every automated scanner they can get their hands on, report results to engineering and job is done. That can certainly all be outsourced.

Another school of thought (where I inhabit) is that sure, you need to do that, but to really have a secure product or service it has to be built ground-up with security as a core requirement. You can't outsource that (ok you could but it means having expensive consultants sitting in with the engineering teams day to day, at which point it's far cheaper to have an in-house security team).

Top comment at the moment seems pretty reasonable.

This furry-to-IT pipeline has been running since the beginning of the World Wide Web as a thing people put money into.