18 ms·
Patreon laid off their security team
- datalopers 4y agoSo Patreon will announce a massive user data leak tomorrow?
- ok_dad 4y agoUnless the whole team was complicit and malicious, there’s no need to fire them all for something like that. That would just performative and does nothing to fix any issues.
- tartoran 4y agoThat’s not unheard of, could be just prepping with the security team lay off. But it’s mere speculation at this point
- ReflectedImage 4y agoAll the VC funded companies are cutting staff to make the VCs happy.
- tptacek 4y agoThat's not at all what I'm seeing.
- altruios 4y agothat sounds like a royal fuck up... cleaning house is... unusual right... for an entire security department?
- jiggawatts 4y agoI’ve seen this happen once when there was an insider attack from within the IT department involving multiple staff. Instead of trying to figure out who the bad actors were and who could still be trusted, the directors simply fired everybody in the team. I was brought in as an outsider on the Friday evening to reverse engineer their passwords and basic network info so that they could continue to operate on Monday morning.
- nebula8804 4y agoGo on...did you manage to keep operations running on Monday? Everyone else has all the cool stories meanwhile here I am aspiring to live Homer Simpson's lifestyle. Oh well.
- sleepybrett 4y agoI've never worked at a company where the security department was actually key to uptime. Mostly they are responding to design proposals/consulting with engineering teams, responding to scanner alerts, etc.
- chris_wot 4y agoHe said the IT team.
- tomjakubowski 4y agoHomer Simpson was friends with Gerald Ford, toured with the Smashing Pumpkins, and he's even been to space. I bet he has some pretty cool stories.
- jiggawatts 4y agoYes! This was an legal firm with something like 100-200 staff. The vague memory I have of the incident that triggered the whole thing was that a drug gang bribed someone in IT to get inside information about a rival gang's case. We got dragged in on Friday mere hours after the entire IT staff (not just SecOps) was walked out the door, with several people apparently escorted by police. The non-IT staff had no passwords other than to their own normal staff accounts, and there was no accessible hardcopy of any documentation. I found a plain-text password in SYSVOL with some "server admin" rights, used that to find a plain-text domain admin password in a scheduled task, which we then used to dump out the Active Directory hashes. I have a vivid memory of a nice fancy lunch in a central business district on a quiet Saturday with my colleague while my laptop GPU was making turbine noises back at the customer site running hashcat. By the time lunch had finished we had about 80% of all passwords, including more than half of all admin and service accounts. The only credential we couldn't obtain by Monday morning was the Cisco firewall appliance root password. We found some documentation and reverse-engineered the rest. It was an eye-opening experience to see just how fast the security of a network can fall against an "attacker" with LAN access and just some basic tools you can download from GitHub, nothing fancy. There was another similar incident where an sole IT admin had a rapidly deteriorating mental illness. Similarly he was walked on a Friday to prevent him "salting the Earth behind him", which apparently he had threatened. That network was reverse engineered in a similar timeframe with little effort...
- noodleman 4y agoNormally, I'd first go with "So what did they do wrong?". But since it's the security team, I'm gonna go with Patreon is in dire financial straits and this is the tip of the iceberg.
- sleepybrett 4y agohow could they not be rolling in cash. their product is not that sophisticated and i assume they take a decent haircut from every subscription. Seems like a money printing machine to me.
- nebula8804 4y agoFurthermore, if Patreon goes then a lot of indie people are royally screwed. So many demonetized Youtubers or people at risk of being booted depend on Patreon.
- ainar-g 4y agoThere are still Ko-Fi, SubscribeStar, as well as YouTube memberships. To say nothing about OnlyFans and Fansly, which have been trying to become less… porn-dependent.
- miguelazo 4y agoYouTube memberships? Demonetization on YouTube is one of the main things that drives people to use Patreon.
- sofixa 4y agoDemonetization on YouTube means YouTube won't show ads on your videos so you don't get money from them, and YouTube recommends them less. Having members on YouTube doesn't impact that at all. The members will pay and discover, same as if they were on Patreon. Non-members might have a harder time discovering, but it's not like it's easy to discover content through Patreon either.
- midislack 4y agoDidn't they also just steal the Flipper money?
- klyrs 4y agoThat's paypal https://news.ycombinator.com/item?id=32739950 https://news.ycombinator.com/item?id=32739950
- bagels 4y agoDo you have any references for this? I've no idea who you're accusing (the employees or Patreon) or what Flipper money is.
- rnk 4y agoSearch for flipper device. It's a fun looking hacker tool with multiple radios for different kinds of devices (think door openers, security scanners) and in their videos looks like easy to use and program. It's apparently a russian company and so in the west you can't legally buy it or send them money. There was some argument about this in earlier hacker news discussions about that exact detail. But apparently it has turned out to officially be a russian company.
- detaro 4y agoand had nothing to with Patreon at all
- vouaobrasil 4y agoSounds rather scary but I would like to hear both sides of the story. I don't like guessing and passing judgment with basically a single sentence describing something that could have more to it than meets the eye.
- NoPicklez 4y agoWhat a refreshing response!
- BLanen 4y agoThis "refreshing" response is all hackernews has to say about everything always.
- capableweb 4y agoAlmost like reasonable people in life don't react to everything with a black or white view, but rather trying to figure out the middle-ground and where the truth lies before spewing their opinion all over the place.
- synicalx 4y agoAnother reply in the comments here posted what they claim is a snippet from some sort of Patreon Discord server. It looks like for reasons unknown (probably financial) they have outsourced their security to "a number of external organizations" that they already have relationships with. The key part of the Discord post is this; > As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations...
- NowhereMan 4y agoMaybe I won't have to log in to Patreon every week now.
- nebula8804 4y agoThe fact that I might have actually seen this person at DEFCON just a few weeks ago seems so cool to me. Its like my world on HackerNews is colliding with real life(for the first time). I wonder if this is how people feel when they meet celebrities? Also, that is one cool badge as their pinned post, I didn't see that one this year. I always miss out on the cool badges at DEFCON.
- jiveturkey 4y agowell, how big is the ENTIRE security team? LinkedIn only shows up 4 people. Don't know what a typical percentage would be expected to show up there.
- golemotron 4y agoI'm scratching my head that someone who does security and privacy as their job puts this out on Twitter. Aside from the messed up ethics, it's not a good look while job hunting.
- nebula8804 4y ago
- awinder 4y agoWhat’s unethical about stating that your entire team was disbanded (aka not terminated for individual performance) and you’d like help with connections finding new work? The message seemed extremely germane, seen those messages constantly over the years.
- equitytomorrow 4y agoAgree. Everyone laid off should be encouraged not judged for sharing the news of their availability with their network, just as much as one might boast when they achieve a milestone or get a new security certification. And unfortunately ‘I’m searching for a new role’ without context leaves the reasons why open to wild, impersonal internet haters imagination to fill in the blank.
- golemotron 4y agoThe tweet says "I and the rest of the Patreon Security Team." That implies that the organization is without any security team or that there could be a lull in capability. Not very security or privacy conscious.
- IX-103 4y agoThe part where it announces to the world that Patreon is currently running without a security team so they would not be able to respond effectively to hacks. If your business had a broken lock on the door would it be ethical for a disgruntled former employee to tweet that fact out to the world after you laid him off? They may not be breaking in themselves, but they are substantially increasing the chance that someone else will.
- matrix_overload 4y agoI think, a healthy dose of skepticism is in order. This news traces down to one LinkedIn post [0] from one person claiming that them "and the rest of the team" is no longer with the company and are looking for work. They have 3 clear motivations to exaggerate the situation: 1. Disgruntled employee wanting the employer to look dumb. 2. Oversensationalize the news to attract more attention to their job search. 3. Oversell their role in the company in hopes of getting more interviews. For what it's worth, "me and the rest of the security team" could be one person with a handful on interns doing an experimental project in the security area. Like, trying to achieve 100% formal validation of a massive codebase, on top of existing engineering practices. Such ambitious projects do get axed at the first sign of a downturn, and it would not be a reason for panic. I would exercise caution and stick to quantifiable facts before concluding that Patreon is run by idiots. Patreon would, in turn, have a motivation to deny the layoff, so the truth is somewhere in between. A good independent metric would be other verifiable LinkedIn users confirming that they got sacked as well. [0] https://www.linkedin.com/posts/emetcalfe_opentowork-activity-6973709234702032896-Ef6h/ https://www.linkedin.com/posts/emetcalfe_opentowork-activity...
- deleted 4y ago[deleted]
- picardo 4y agoExactly. There are far too many people who are ready to wave their pitchforks around on claims made with the slightest evidence. I would have thought HN would have a higher burden of proof for such claims than the rest of social media landscape.
- matrix_overload 4y agoThis culture is fostered deliberately because the blood-thirsty crowd is a good weapon in the hands of those who control the information flows. Ironically, the comment you replied to stayed on top of the thread for about 30 minutes, gaining upvote after upvote, and then instantly got kicked down to the bottom, while still showing the original score. This is very different from the usual time+score-based ordering and looks 100% like a manual override. Strange response to trying to be objective.
- dredmorbius 4y agoNitter: <https://nitter.net/wbm312/status/1567974063578185728 https://nitter.net/wbm312/status/1567974063578185728>
- deleted 4y ago[deleted]
- bm5k 4y agoPatreon requires you to "submit your account for deletion" to close your account. > Starting July 2020, Patreon no longer offers the previous “disable” feature. To close a Patreon account, users must submit their account for deletion through our Privacy center.
- deleted 4y ago[deleted]
- sliken 4y agoWow, definitely not trusting them with my credit card. Just cancelled my subscriptions and removed my payment method. I'll be looking at other options the content providers have available.
- i_have_an_idea 4y agoI mean, it sounds bad, but in a lot of those small companies, the security team is actually dead weight / just for show. A bunch of guys running automated scans with Rapid7 / Crowdstrike, looking at pretty dashboard graphs and sending managers scary "intrusion alert" emails because someone tried to SSH on 22 but failed. Obviously, we don't know if that's the case here, but I wish more companies figured out their security team is security theatre.
- lazyasciiart 4y agoMy security team is deadweight. They once tried to create a sev-1 incident when a customer complained that if they typed a password on the command line while trying to call our program, it got saved in session logs.
- orf 4y agoOurs started a sev-1 and pulled my whole team into incident response mode after AWS guard duty told them some account credentials where used outside our VPC. It was a member of their team doing a pentest they organized.
- deleted 4y ago[deleted]
- josephcsible 4y agoAren't most security teams scapegoated if their company gets harmed by being hacked, but let off the hook if their company gets harmed by overly zealous security rules? And doesn't this incentivize them all to be way too risk-averse and even paranoid?
- porkbrain 4y ago"Dom, get on to recruitment. Get them to look for a security team that can work as a team. They may have to escort the current security team from the building for not acting like a team. "
- deleted 4y ago[deleted]
- cableshaft 4y ago“Team! Team, team, team, team, team. I even love saying the word ‘team’. You probably think this is a picture of my family? No! It’s a picture of The A-Team. Bodie, Doyle, Tiger, the Jewelry Man.”
- gwbas1c 4y agoIronically, one of Patreon's CEO's bands is named Scary Pockets. They're good, too.
- prirun 4y agoMaybe they're getting bought?
- marmot777 4y agoCouldn’t they have cut other things besides security? If nothing else, it will undermine confidence. And worst case, they get compromised and ruined as they’ll immediately be blamed for dropping infosec and enabling this to happen.
- dogman144 4y agoHah this thread is good reading for security engineers. Agreed with a lot of the criticism but will first leaven that with devs get up to some wild shit that has to get controlled behind the scenes by the sec team. Can’t say more without doxing, but I’ve have done sec eng at a variety of pre/post IPO tech companies. Staggering irresponsibility with PII management, prod secrets, access prod on a personal laptop and indignantly arguing About it, malicious IDE/browsers extensions given prod creds by a freewheeling dev, and on and on and on. I have lost a non-zero amount of evenings due to this and top it off with an argumentative dev or PM, even if I really do a good job about crafty “this is a blame free situation we’re just trying to solve.” But, that aside, 10-20% of security hires are engineers who dig security, 20-30% can glue tools together and know the concepts but really stretch the definition of engineer, and the remainder are ivory tower no-machines who somehow refuse to learn how to code. SREs playing a large role in security are a natural result of this. The less technical the company, the more these %s skew badly. Also, the emotional intelligence distribution is all over the place across these categories. However, keep in mind that behind the stronger “no don’t do this anymore” dictates is not a zero chance it’s a sales RFP or large client audit. If you want to generate revenue and get paid, audits have to get passed, and many hardline rules source from this (as in, not just regulated industries do this).
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- lumost 4y agoGreat read, the problem is that in many common situations you really just need someone to yell “USE SSL” or similar. These types of tasks can be performed by anyone who can read a best practices guide. In complex applications, the person who just yells about security and doesn’t understand code becomes a liability.
- dogman144 4y ago
- chipotle_coyote 4y agoPatreon’s comment on this so far is on their creator Discord, so I can’t link to it, I’m afraid, but this is what one of their team members posted about an hour ago (7:29 PM EST): - - - “As a global platform, Patron will always prioritize the security of our creators' and customers' data. As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations to continuously develop our security capabilities and conduct regular security assessments to ensure we meet or exceed the highest industry standards. The changes made this week will have no impact on our ability to continue providing a secure and safe platform for our creators and patrons, including the upcoming adult ID verification requirement.” - - - I have no idea how big their security team is (five may in fact be the entire group they called “the security team”), but I am not convinced that this is necessarily the end of the world for those who use Patreon. I don’t know how much financial data they even store directly (I would assume best practices entail letting their payment processors store actual credit card and bank account numbers, for instance, although I’m aware that may be easier said than done depending on their infrastructure). While I do think Patreon is going to have Issues (tm) due to having accepted so much VC money, it’s not clear to me that these layoffs were forced by their funders—they haven’t accepted any money recently, and I haven’t heard anything that suggests their revenues have been dropping to a point where there’d need to do serious belt-tightening. (Also, to people who seem to think any creator could just slap up “a basic microblog” and get all of Patreon’s functionality, that kind of falls into the “not even wrong” category. Replicating what they do would be a lot of work even for the technically-minded, many creators who use them are not technical, and even if you pull it off, there are things that just literally can’t be duplicated as a solo endeavor: all of your patrons may be supporting multiple creators, not just you; patrons may discover other creators based on who their friends support and who those they support are supporting; creators who support other creators just have those charges automatically deducted from their earnings; etc.)
- dogman144 4y agoSounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. MSSPs are a step above offshoring your whole security team, so not a great bit of news. The average windows enterprise customer who uses MSFT for 60% of the security load and 40% to the MSSP and IT team can get by with this move. But, knowing people who work at MSSP, a lot of security theater goes on because it’s just on the wrong side of industry trends. Watching is one thing, fixing it is the other. They prob has some cost cutting and a CISO or equivalent who didn’t know how to make the case (or no CISO).
- nekoeth0 4y agoMaybe it was because of this review left on Glassdoor, and they decided to just clear house? https://i.imgur.com/LJhngan.png https://i.imgur.com/LJhngan.png
- deleted 4y ago[deleted]
- mardifoufs 4y agoAdvocating for MAPs? Like I believe that they could be ignoring the problem because they have a financial incentive to do so, but I'd be very very surprised if they were really doing pedophile advocacy and communicating to staff about it?
- b0afc375b5 4y agoAnecdote. A few months ago, I have been using my credit card for about a year with no issues, no fraud purchases. Then I decided to support someone at Patreon and to do that I had to enter my credit card details. A few days later there were fraudulent purchases on Alibaba charged to my card. I immediately called the bank, had my credit card frozen, reversed the transactions, and requested a new card. Although I can't be sure, I have a strong suspicion that it was Patreon that leaked my credit card info, as it was the only unusual payment I made, the usual being electric/internet bills, food delivery, etc. Have had no problems with my credit card since.
- devoutsalsa 4y agoAny possibility you fell for a phishing scam that wasn’t actually Patreon?
- b0afc375b5 4y agoI still have the success email in gmail. From <bingo@patreon.com> To <my@email> According to gmail both SPF and DKIM pass, so I know my payment went to Patreon. Mitm attacks possibly, but I highly doubt it.
- tylerhou 4y agoMaybe once they got your card details, they also signed you up to support that person on Patreon to throw you off the scent?
- pipeline_peak 4y ago“ Wouldn’t trust my data there” Such a narrow comment, as if they didn’t outsource the work. Not every company on the planet needs a team of specialists in one sector.
- bosswipe 4y agoPatreon is kind of known for sudden unexpected mass layoffs unrelated to their financials. Previous to this I know of it happening twice.
- bArray 4y agoThere seems to be some speculation that this is credit card details being hacked. Firing your _entire_ security team sounds like the sort of action taken if basic security practices are not being done. Until we know more, hold out on hiring these people. Xe has commented on this and is suggesting to simply enable 2FA to deal with security concerns [1], as apparently a more measured response to security issues at Patreon. This seems to be more self-serving advice rather than good advice [2], the better suggestion would be to simply move to one of the many alternatives. The assumption is that the login system is somehow insecure, instead of the bank details themselves being stored insecurely. (Hypothetically) If you suffered a large leak of payment details, when payment processing is your _main_ income revenue, and you find out your security team of X people at probably $100k+ a year for N years have done nothing to secure payment details, you too may fire them on the spot. Until Patreon explain why they fired their _entire_ security team, the best advice is to remove your card details immediately. You can always add it back at a later date, or use an alternative payment processor. [1] https://xeiaso.net/blog/patreon-happening https://xeiaso.net/blog/patreon-happening [2] https://www.patreon.com/cadey https://www.patreon.com/cadey (Edit: As pointed out, Xe didn't mention credit card details.)
- PragmaticPulp 4y ago> Xe has commented on this and is suggesting to simply enable 2FA instead of removing your account details entirely [1], as apparently a more measured response to credit card details being hacked. The Xe link you cited doesn't speculate about credit card details being hacked at all. In fact, the entire gist of the blog is that we shouldn't be speculating about hacks or other theories. The 2FA recommendation isn't a response to a potential hack, it was just general good security advice.
- bArray 4y ago> The Xe link you cited doesn't speculate about credit card details being hacked at all. In fact, the entire gist of the blog is that we shouldn't be speculating about hacks or other theories. True, I accidentally bridged that gap when reading it. I have updated my comment to reflect security more generally. > The 2FA recommendation isn't a response to a potential hack, it was just general good security advice. Given the context in which the article is written (the security team being expelled), this is the way I have interpreted it. It's not a standalone PSA on best security practices. It's written as if enabling 2FA is an alternative to homeless creators.
- molticrystal 4y agoPatreon had their databases dumped at least twice, and along with one of those their complete software stack including keys. I believe it was this was the biggest, most complete and the first time: https://www.zdnet.com/article/patreon-hacked-anonymous-patrons-exposed/ https://www.zdnet.com/article/patreon-hacked-anonymous-patro... I didn't dig enough to find the second time but it occurred a few months later if I recall and wasn't as extensive.
- sjsadowski 4y agoI'm pretty sure a security event in 2015 isn't relevant to the layoff of a security team in 2022.
- cratermoon 4y agoCynical cratermoon take time. Company has its own security team: professionals tell their employers "do A, B, and C, or else you'll be on the hook legally for the consequences" Company hires outside firm X: "pay us $LARGE_SUM annually and we'll take on responsibility and legal liability for failures, which we can do because we have a lot of customers and we pool the risk". When $LARGE_SUM < the cost of maintaining your own security team + the potential liability payouts, the choice is easy.
- rvz 4y agoSomething tells me that Patreon is in serious trouble on this one and it is highly likely got to do with a breach of credit card information. Is this now enough for you to not trust platforms like Patreon? Regardless, with the light of this failure and the platforms like PayPal stealing funds from the likes of small businesses and locking it up for months; killing them. Web 2 payments is going just great! /s
- phendrenad2 4y agoI wonder if this has something to do with political activism. It's possible that the security team was either (A) trying to sabotage Patreon's efforts to ban content they've determined is untenable or (B) trying to usurp top-down control and take banning into their own hands. God knows "both sides" of the political spectrum see themselves as saving humanity, and would jump at the opportunity to work in a position of technical power within a company like Patreon, where far-right and far-left content is often hosted.
- BikeGremlin 4y agoAs far as I could tell, Patreon is firing about one-fifth of their employees (17%). The article by the co-founder is not shown on any Patreon blog front pages, but it can be searched on their blog. I found it on Patreon official Discord announcements channel. Along with a statement from their "Head of Engineering." I published the statement quote, and the article link in my Patreon-related article: https://io.bikegremlin.com/29277/patreon-review/#7 https://io.bikegremlin.com/29277/patreon-review/#7