3 ms·

> I realize that my announcement looks self-serving and at some level it kind of is (support on Patreon is part of how I keep my US account solvent because inte

by bArray 4y ago

> I realize that my announcement looks self-serving and at some level it kind of is (support on Patreon is part of how I keep my US account solvent because international wire transfers have yearly limits to their frequency, apparently). Are other alternatives not viable? For example SubscribeStar [1]? It's probably better to have multiple sources of income, rather than a single payment processor? > However, the facts of the situation are that we do not know what is going on and other creators I know are not in the same kind of financial situation that I am in. At least one of my good friends will probably miss a rent payment if there's a mass dropoff in support (and they just escaped an abusive living situation). I'm sympathetic to your friend, but I also weigh up the possibility of however many supporters having their credentials exposed. Not for being taken for a few dollars, but potentially having their entire account wiped out. (On a side note I would also suggest that given the incoming economic downturn we are about to experience, this disposable income from strangers may not be reliable in the near future.) > My goal is to emphasize a "woah, slow the fuck down and let's wait to see what's going on before making rash decisions" rather than a "oh no my free money fountain is at risk let's stop them from going away". That post exists because I've gotten over 60 inquiries about this today from as many people. I was tired of explaining it over and over so I put it on the blog to avoid constant duplication. I still think the best action for your supporters would be to temporarily remove their card details until Patreon explain themselves. These can be added back in a few days once Patreon come up with some PR. In the meantime, I would definitely suggest to look for alternative platforms. Firing your entire security team without warning is not standard practice, it really does indicate something bad. If the security team were caught be surprise, it means there has been no hand-over process, meaning that potentially Patreon currently has no way to handle or detect new security issues. Clearly Patreon themselves were taken off-guard by this, hence the radio silence amid growing speculation. > Telling people to enable two-factor auth is the moral equivalent of a free space in bingo. It's something people should already be doing and it's good to repeat that message in case people haven't heard it. As I wrote in another child comment, it somewhat sounds like enabling 2FA is an alternative to starving creators. If there was a breach in the system itself behind the login system, 2FA won't make an ounce of difference. Anyway, fingers crossed this is all blown out of proportion. My gut is still telling me there is something amiss here though. [1] https://www.subscribestar.com/ https://www.subscribestar.com/

xena 4y ago
> Are other alternatives not viable? For example SubscribeStar [1]? It's probably better to have multiple sources of income, rather than a single payment processor? Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. Also for total transparency's sake, posting that thing about Patreon has actually made me lose patron support. > As I wrote in another child comment, it somewhat sounds like enabling 2FA is an alternative to starving creators. If there was a breach in the system itself behind the login system, 2FA won't make an ounce of difference. As a corollary, if credit card information was actually pwned, it's not like people can do much about that either at 10:30 PM EDT on a thursday after the Queen died. The financial system is gonna be kind of tied up. Two factor auth is a more actionable step that can have measurable security benefits. If it really is a credit card pwnage, that's a big enough problem at Patreon's scale that individual actions can't really do anything. It would need a systemic response. I'm hoping this is blown out of proportion too.
- surewe 4y ago
  > Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. What about LiberaPay?
  - xena 4y ago
    Please reread this sentence: > Patreon is where the users are. Moving my stuff would make for an incomplete migration. I don't want to deal with that.
- bArray 4y ago
  > Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. Theoretically it shouldn't be too difficult to periodically charge people and then send this money as a single sum periodically. This is done by companies all of the time. As it's one person you can cut out a lot of the complications. > As a corollary, if credit card information was actually pwned, it's not like people can do much about that either at 10:30 PM EDT on a thursday after the Queen died. The financial system is gonna be kind of tied up. Two factor auth is a more actionable step that can have measurable security benefits. If it really is a credit card pwnage, that's a big enough problem at Patreon's scale that individual actions can't really do anything. It would need a systemic response. Patreon just fired their entire security team, they may not be well positioned for such a scenario. 2FA is of course good to have but I somehow doubt accounts have been compromised in this way (if they have been compromised at all). I suspect that although the Queen has died, financial systems continue to operate near normal (minus the stock market).

by bArray 4y ago

xena 4y ago

> Are other alternatives not viable? For example SubscribeStar [1]? It's probably better to have multiple sources of income, rather than a single payment processor? Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. Also for total transparency's sake, posting that thing about Patreon has actually made me lose patron support. > As I wrote in another child comment, it somewhat sounds like enabling 2FA is an alternative to starving creators. If there was a breach in the system itself behind the login system, 2FA won't make an ounce of difference. As a corollary, if credit card information was actually pwned, it's not like people can do much about that either at 10:30 PM EDT on a thursday after the Queen died. The financial system is gonna be kind of tied up. Two factor auth is a more actionable step that can have measurable security benefits. If it really is a credit card pwnage, that's a big enough problem at Patreon's scale that individual actions can't really do anything. It would need a systemic response. I'm hoping this is blown out of proportion too.

surewe 4y ago
> Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. What about LiberaPay?
- xena 4y ago
  Please reread this sentence: > Patreon is where the users are. Moving my stuff would make for an incomplete migration. I don't want to deal with that.
bArray 4y ago
> Patreon is where the users are. I've evaluated other platforms, but at that point I'm probably going to come up with my own thing on top of Stripe if Patreon falls over. I'm kinda low on ideas on how to make such a migration palatable otherwise. Theoretically it shouldn't be too difficult to periodically charge people and then send this money as a single sum periodically. This is done by companies all of the time. As it's one person you can cut out a lot of the complications. > As a corollary, if credit card information was actually pwned, it's not like people can do much about that either at 10:30 PM EDT on a thursday after the Queen died. The financial system is gonna be kind of tied up. Two factor auth is a more actionable step that can have measurable security benefits. If it really is a credit card pwnage, that's a big enough problem at Patreon's scale that individual actions can't really do anything. It would need a systemic response. Patreon just fired their entire security team, they may not be well positioned for such a scenario. 2FA is of course good to have but I somehow doubt accounts have been compromised in this way (if they have been compromised at all). I suspect that although the Queen has died, financial systems continue to operate near normal (minus the stock market).