3 ms·

Good lesson for other founders here. Early on nobody knows you, but as soon as they do, you'll need to have chosen if you're on the trust-and-brand-building mar

Good lesson for other founders here. Early on nobody knows you, but as soon as they do, you'll need to have chosen if you're on the trust-and-brand-building marathon or not. By default, if you do nothing, you're building up to an explosion like this that can take years to recover from. How did the CEO, the board, the sales team, the marketing team, customer support team, and the engineering team all fail to notice and act on a gross privacy breach? How will that change? It's good the CEO is starting to take responsibility, but an apology letter is roughly, apology, acknowledgement, explanation, and plan to fix / prevent repeat. I see a lot of "I...", but no post-mortem on how the internal culture they've built encouraged breach of trust & privacy in favor of growth numbers, and if/how that'll change top-to-bottom. For now, it remains, "I'm sorry you caught me and made me feel like the bad person I don't think of myself as." Once you think of systems and culture, and start tracing through the dark patterns around the launch and the scope of the initiative, things get uncomfortable. Hiring, on-boarding, feature planning, feature reviews, personal responsibility, feature ownership, management prioritization, trust & safety oversight... .

wolfgang42 6y ago
Ammon says a postmortem is in the works: https://news.ycombinator.com/item?id=23304127 https://news.ycombinator.com/item?id=23304127
- lmeyerov 6y ago
  Yes, I was responding to the apology. This should have been part of it, and is part of the lesson to founders. If you are in position of responsibility, mistakes are inevitable, and so is having to correctly apologize. (I learned the hard way.) This incident is about a self-inflicted customer data breach. As it surprised the CEO, it suggests a full-company culture & governance issue, and is hard to be reactive about. Even when things are going well, customer responsibility & data protection should be a constant and non-obvious responsibility for everyone as soon as anything like marketing, sales, engineering, hiring, delegation, etc. gets interesting. A lot of people are involved in a major move like this and the governance structures that inform them. Think their VCs / VPs / managers / etc either signing off... or not caring. And again, I'm writing this more as a warning for other founders. Building a culture is a constant marathon, and it's way harder to fix one. (For the CEO: I'd consult with a few folks knowledgeable about communicating apologies ASAP, esp. before any further unvetted public comms, and for longer-term, get regular external advisors + directly responsible internal leaders for fixing culture + security, and rethink why multiple internal leaders failed in both. But that's super generic.)
gjs278 6y ago
lol why do you think this company even has a board

wolfgang42 6y ago

Ammon says a postmortem is in the works: https://news.ycombinator.com/item?id=23304127 https://news.ycombinator.com/item?id=23304127

lmeyerov 6y ago
Yes, I was responding to the apology. This should have been part of it, and is part of the lesson to founders. If you are in position of responsibility, mistakes are inevitable, and so is having to correctly apologize. (I learned the hard way.) This incident is about a self-inflicted customer data breach. As it surprised the CEO, it suggests a full-company culture & governance issue, and is hard to be reactive about. Even when things are going well, customer responsibility & data protection should be a constant and non-obvious responsibility for everyone as soon as anything like marketing, sales, engineering, hiring, delegation, etc. gets interesting. A lot of people are involved in a major move like this and the governance structures that inform them. Think their VCs / VPs / managers / etc either signing off... or not caring. And again, I'm writing this more as a warning for other founders. Building a culture is a constant marathon, and it's way harder to fix one. (For the CEO: I'd consult with a few folks knowledgeable about communicating apologies ASAP, esp. before any further unvetted public comms, and for longer-term, get regular external advisors + directly responsible internal leaders for fixing culture + security, and rethink why multiple internal leaders failed in both. But that's super generic.)

gjs278 6y ago

lol why do you think this company even has a board