7 ms·

Patreon’s comment on this so far is on their creator Discord, so I can’t link to it, I’m afraid, but this is what one of their team members posted about an hour

Patreon’s comment on this so far is on their creator Discord, so I can’t link to it, I’m afraid, but this is what one of their team members posted about an hour ago (7:29 PM EST): - - - “As a global platform, Patron will always prioritize the security of our creators' and customers' data. As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations to continuously develop our security capabilities and conduct regular security assessments to ensure we meet or exceed the highest industry standards. The changes made this week will have no impact on our ability to continue providing a secure and safe platform for our creators and patrons, including the upcoming adult ID verification requirement.” - - - I have no idea how big their security team is (five may in fact be the entire group they called “the security team”), but I am not convinced that this is necessarily the end of the world for those who use Patreon. I don’t know how much financial data they even store directly (I would assume best practices entail letting their payment processors store actual credit card and bank account numbers, for instance, although I’m aware that may be easier said than done depending on their infrastructure). While I do think Patreon is going to have Issues (tm) due to having accepted so much VC money, it’s not clear to me that these layoffs were forced by their funders—they haven’t accepted any money recently, and I haven’t heard anything that suggests their revenues have been dropping to a point where there’d need to do serious belt-tightening. (Also, to people who seem to think any creator could just slap up “a basic microblog” and get all of Patreon’s functionality, that kind of falls into the “not even wrong” category. Replicating what they do would be a lot of work even for the technically-minded, many creators who use them are not technical, and even if you pull it off, there are things that just literally can’t be duplicated as a solo endeavor: all of your patrons may be supporting multiple creators, not just you; patrons may discover other creators based on who their friends support and who those they support are supporting; creators who support other creators just have those charges automatically deducted from their earnings; etc.)

dogman144 4y ago
Sounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. MSSPs are a step above offshoring your whole security team, so not a great bit of news. The average windows enterprise customer who uses MSFT for 60% of the security load and 40% to the MSSP and IT team can get by with this move. But, knowing people who work at MSSP, a lot of security theater goes on because it’s just on the wrong side of industry trends. Watching is one thing, fixing it is the other. They prob has some cost cutting and a CISO or equivalent who didn’t know how to make the case (or no CISO).
- danielmarkbruce 4y ago
  Some of the MDRs seem good. Red Canary for example.
  - lmeyerov 4y ago
    I see a lot of companies successful via a long-running relationship with MSSPs for improving help desk style support and occasional emergency forensics etc. That's been getting more interesting, and as we partner with MSSP ourselves (graph ai, GPU, etc tech), been awesome to see how that enables investments that are too hard at the individual company levels. For SMB, even more sensible. But at SME/enterprise scales, a lot of the success is driven by in-housing tier 2 + security engineering. For tech/product companies, true at even smaller scales. Security is part of a common core product value proposition for the customer: trust baked in. Same but different for say fraud & safety and how that relates to account churn vs growth. Seeing that capability evaporate is scary. As an analogy, most companies who handed over control of their data plane to palantir engineers & proprietary palantir infra ended up regretting it and wanting to change the relationship. Areas like parts of the US Gov who haven't are now stuck. Doing the same with the trust & risk aspects of an enterprise is scary, especially as each one is now increasingly part tech company.
    - danielmarkbruce 4y ago
      Yup, I'm sure that's right. That being said, I don't doubt a good arrangement can be had with someone like Red Canary to provide services of tier 2 and 3. I've only spoken with them and not other leading MDRs so I'm not sure as to the quality of others. I can easily see a company like Patreon making the decision to use an MDR and it being the right call.
  - dogman144 4y ago
    Agreed, good vendors and the related teams. I’d def trust Crowdstrike L1 triage. The problems show up with 3rd parties running a suite of EDRs across a spread of customers.
  - PragmaticPulp 4y ago
CivBase 4y ago
> all of your patrons may be supporting multiple creators, not just you; This is exactly why I use it - and the only reason why I use it. It's just a convenient portal for me to manage donations. I don't care about exclusive content and I'd rather the people I support just continue to put out content on their primary platforms. The less I have to engage with Patreon's content feed, the better.
- tinus_hn 4y ago
  You wouldn’t be using it if the creators weren’t on the platform. That is the main draw. A platform like Patreon mainly provides the really hard service of collecting and distributing money while conforming with tax and other laws you run into while doing that. The rest, like the content feed, is trivial.
PragmaticPulp 4y ago
Thanks for sharing the only actual piece of commentary I can find from the company. Reading between the lines, this suggests that they've decided to use an external firm to cover these security domains (for now). Without knowing which firm or firms we obviously can't say anything specific about their reputations, but I will say that I know some individuals who operate in this space and there are some very qualified and talented outside security firms out there. However, the good firms aren't cheap. Obviously we can't know the details, but I wouldn't assume this move was motivated by cost-cutting reasons. Keeping a top-notch outside security firm fully involved could easily cost more than the salaries of the people who were let go. I don't want to single anyone out, but a quick glance through LinkedIn leaves me somewhat confused about their former security team's structure. I could be missing something, but the only lead I found on LinkedIn was listed as "acting head of security" with a description that they were covering the Head of Security position for now. It's possible that the security team were good engineers, but maybe not the exact engineers/managers that Patreon needed at this stage of their development. Some times a mismatch like that really can't be overcome easily, so employing a known external firm can cover the gaps while the company tries to find a better match for their security leadership needs internally (if they return to internal at all). This move could make even more sense if Patreon was aggressively heading toward IPO. In this case, the company would need to demonstrate that they've done their due diligence and made a best effort to cover security as best they can, even if that means paying exorbitantly for an external firm that has helped prepare companies for IPO in the past. If their internal security team didn't have this experience (and maybe didn't even have an official head of security) then they didn't stand a chance.
- t-writescode 4y ago
  > This move could make even more sense if Patreon was aggressively heading toward IPO This upsets me so much. Patreon is a perfect example of a company that could operate as a non-profit and everyone would benefit; but, instead, they need to make so much money that they're valuable on the Stock Market. It seems like a net harm for society, here :/
  - PragmaticPulp 4y ago
mc32 4y ago
>“As a global platform, Patron will..." Wait, they can't even spell the name of their own company correctly?
- butterisgood 4y ago
  Must have drank too much Patreon.
- chipotle_coyote 4y ago
  Hm. That looks like a bad copy and paste on my part. I perhaps foolishly copy-and-pasted from a screenshot I'd taken rather than going right back to the Discord, so the text was generated by macOS's built-in OCR. I hadn't noticed that one, but I just checked and they did indeed spell "Patreon" correctly. :)
  - unwise-exe 4y ago
    > copy-and-pasted [text] from a screenshot It's kind of amazing that that's even a thing, let alone that it's higher quality than a typical read-and-type copy.
    - mgdlbp 4y ago
      For how long OCR has existed, I'd expect better from a presumably high-resolution screenshot of text in a common font. Here we have deletion of an entire letter, a severe case of 'anti-contoot' [0] -- too aggressive NLP correction. [0] <https://news.ycombinator.com/item?id=6156238#:~:text=Language%20model%20would,... https://news.ycombinator.com/item?id=6156238#:~:text=Languag...>
iou 4y ago
Did they really misspell the name of their own company in a public statement?
synicalx 4y ago
> As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations This is the key part here - whoever they've outsourced this to costs less than those 5 employees and presumably still lets them tick whatever regulatory boxes they need. Either that or their 5 person security team made a boo-boo recently and this is the fallout.
oliwarner 4y ago
As a web developer [with horses in other races] it's hard to ignore statements like those in your last paragraph. Centralisation that "literally can’t be duplicated" is no cause for celebration; it's a broken black-hole monopoly and the more it grows, the more you have to use that platform if you want a "fair" shake against other creators; the harder it is for competition. You're technically right in what you said but I don't think it hurts to give people a little encouragement if they want to strike out and show people there's another way than just paying Patreon 5-12% or OnlyFans their 20%. We need creative solutions for getting away from relying on Amazon, Patreon, etc, etc to find the things we want.
- boltzmann-brain 4y ago
  Indeed, and it seems like true hubless p2p technology is the only real solution to this. It almost makes me wonder if the crackdown against p2p services that started back in the 90s was secretly motivated by a desire for bolstering blackhole monopolies.
  - unity1001 4y ago
    P2p is not a solution to this simply because the problem is not in being able to get a recurring payment. The problems start with fraud, chargebacks, refunds and range all the way to having to collect and pay differing sales taxes that stream in from different economic regions of the OECD. California and other sales taxes in the US. EUVAT for European subscribers. Even Japan has its own VAT scheme. On top of that, you have to maintain a billing system. Its a b*tch. Anyone who tries to do those ends up spending a lot of their time in maintaining and sorting these out than doing their actual activity like art, music and so on. That's why services like Patreon are a godsend to, well, practically anyone. Anyone, because there are a lot of software developers (freeware, shareware, modders) who use Patreon to fund their software development.
    - boltzmann-brain 4y ago
      spoken like a true central banker :)

dogman144 4y ago

Sounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. MSSPs are a step above offshoring your whole security team, so not a great bit of news. The average windows enterprise customer who uses MSFT for 60% of the security load and 40% to the MSSP and IT team can get by with this move. But, knowing people who work at MSSP, a lot of security theater goes on because it’s just on the wrong side of industry trends. Watching is one thing, fixing it is the other. They prob has some cost cutting and a CISO or equivalent who didn’t know how to make the case (or no CISO).

danielmarkbruce 4y ago
Some of the MDRs seem good. Red Canary for example.
- lmeyerov 4y ago
  I see a lot of companies successful via a long-running relationship with MSSPs for improving help desk style support and occasional emergency forensics etc. That's been getting more interesting, and as we partner with MSSP ourselves (graph ai, GPU, etc tech), been awesome to see how that enables investments that are too hard at the individual company levels. For SMB, even more sensible. But at SME/enterprise scales, a lot of the success is driven by in-housing tier 2 + security engineering. For tech/product companies, true at even smaller scales. Security is part of a common core product value proposition for the customer: trust baked in. Same but different for say fraud & safety and how that relates to account churn vs growth. Seeing that capability evaporate is scary. As an analogy, most companies who handed over control of their data plane to palantir engineers & proprietary palantir infra ended up regretting it and wanting to change the relationship. Areas like parts of the US Gov who haven't are now stuck. Doing the same with the trust & risk aspects of an enterprise is scary, especially as each one is now increasingly part tech company.
  - danielmarkbruce 4y ago
    Yup, I'm sure that's right. That being said, I don't doubt a good arrangement can be had with someone like Red Canary to provide services of tier 2 and 3. I've only spoken with them and not other leading MDRs so I'm not sure as to the quality of others. I can easily see a company like Patreon making the decision to use an MDR and it being the right call.
- dogman144 4y ago
  Agreed, good vendors and the related teams. I’d def trust Crowdstrike L1 triage. The problems show up with 3rd parties running a suite of EDRs across a spread of customers.
- PragmaticPulp 4y ago

CivBase 4y ago

> all of your patrons may be supporting multiple creators, not just you; This is exactly why I use it - and the only reason why I use it. It's just a convenient portal for me to manage donations. I don't care about exclusive content and I'd rather the people I support just continue to put out content on their primary platforms. The less I have to engage with Patreon's content feed, the better.

tinus_hn 4y ago
You wouldn’t be using it if the creators weren’t on the platform. That is the main draw. A platform like Patreon mainly provides the really hard service of collecting and distributing money while conforming with tax and other laws you run into while doing that. The rest, like the content feed, is trivial.

PragmaticPulp 4y ago

Thanks for sharing the only actual piece of commentary I can find from the company. Reading between the lines, this suggests that they've decided to use an external firm to cover these security domains (for now). Without knowing which firm or firms we obviously can't say anything specific about their reputations, but I will say that I know some individuals who operate in this space and there are some very qualified and talented outside security firms out there. However, the good firms aren't cheap. Obviously we can't know the details, but I wouldn't assume this move was motivated by cost-cutting reasons. Keeping a top-notch outside security firm fully involved could easily cost more than the salaries of the people who were let go. I don't want to single anyone out, but a quick glance through LinkedIn leaves me somewhat confused about their former security team's structure. I could be missing something, but the only lead I found on LinkedIn was listed as "acting head of security" with a description that they were covering the Head of Security position for now. It's possible that the security team were good engineers, but maybe not the exact engineers/managers that Patreon needed at this stage of their development. Some times a mismatch like that really can't be overcome easily, so employing a known external firm can cover the gaps while the company tries to find a better match for their security leadership needs internally (if they return to internal at all). This move could make even more sense if Patreon was aggressively heading toward IPO. In this case, the company would need to demonstrate that they've done their due diligence and made a best effort to cover security as best they can, even if that means paying exorbitantly for an external firm that has helped prepare companies for IPO in the past. If their internal security team didn't have this experience (and maybe didn't even have an official head of security) then they didn't stand a chance.

t-writescode 4y ago
> This move could make even more sense if Patreon was aggressively heading toward IPO This upsets me so much. Patreon is a perfect example of a company that could operate as a non-profit and everyone would benefit; but, instead, they need to make so much money that they're valuable on the Stock Market. It seems like a net harm for society, here :/
- PragmaticPulp 4y ago

mc32 4y ago

>“As a global platform, Patron will..." Wait, they can't even spell the name of their own company correctly?

butterisgood 4y ago
Must have drank too much Patreon.
chipotle_coyote 4y ago
Hm. That looks like a bad copy and paste on my part. I perhaps foolishly copy-and-pasted from a screenshot I'd taken rather than going right back to the Discord, so the text was generated by macOS's built-in OCR. I hadn't noticed that one, but I just checked and they did indeed spell "Patreon" correctly. :)
- unwise-exe 4y ago
  > copy-and-pasted [text] from a screenshot It's kind of amazing that that's even a thing, let alone that it's higher quality than a typical read-and-type copy.
  - mgdlbp 4y ago
    For how long OCR has existed, I'd expect better from a presumably high-resolution screenshot of text in a common font. Here we have deletion of an entire letter, a severe case of 'anti-contoot' [0] -- too aggressive NLP correction. [0] <https://news.ycombinator.com/item?id=6156238#:~:text=Language%20model%20would,... https://news.ycombinator.com/item?id=6156238#:~:text=Languag...>

iou 4y ago

Did they really misspell the name of their own company in a public statement?

synicalx 4y ago

> As part of a strategic shift of a portion of our security program, we have parted ways with five employees. We also partner with a number of external organizations This is the key part here - whoever they've outsourced this to costs less than those 5 employees and presumably still lets them tick whatever regulatory boxes they need. Either that or their 5 person security team made a boo-boo recently and this is the fallout.

oliwarner 4y ago

As a web developer [with horses in other races] it's hard to ignore statements like those in your last paragraph. Centralisation that "literally can’t be duplicated" is no cause for celebration; it's a broken black-hole monopoly and the more it grows, the more you have to use that platform if you want a "fair" shake against other creators; the harder it is for competition. You're technically right in what you said but I don't think it hurts to give people a little encouragement if they want to strike out and show people there's another way than just paying Patreon 5-12% or OnlyFans their 20%. We need creative solutions for getting away from relying on Amazon, Patreon, etc, etc to find the things we want.

boltzmann-brain 4y ago
Indeed, and it seems like true hubless p2p technology is the only real solution to this. It almost makes me wonder if the crackdown against p2p services that started back in the 90s was secretly motivated by a desire for bolstering blackhole monopolies.
- unity1001 4y ago
  P2p is not a solution to this simply because the problem is not in being able to get a recurring payment. The problems start with fraud, chargebacks, refunds and range all the way to having to collect and pay differing sales taxes that stream in from different economic regions of the OECD. California and other sales taxes in the US. EUVAT for European subscribers. Even Japan has its own VAT scheme. On top of that, you have to maintain a billing system. Its a b*tch. Anyone who tries to do those ends up spending a lot of their time in maintaining and sorting these out than doing their actual activity like art, music and so on. That's why services like Patreon are a godsend to, well, practically anyone. Anyone, because there are a lot of software developers (freeware, shareware, modders) who use Patreon to fund their software development.
  - boltzmann-brain 4y ago
    spoken like a true central banker :)