4 ms·

> As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Honestly, I'm more afraid of reputational loss than government fines. Ou

> As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.

adrr 2y ago
Crowdstrike took down all windows boxes that had their software installed and didn’t really affect them.
- jrochkind1 2y ago
  I think customers feel, rightly or wrongly, there's no alternative to CrowdStrike. There are so many alternatives to what GoDaddy provides, it is quite commoditized. But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...
  - rez9x 2y ago
    I've actually not worked anywhere that has used CrowdStrike. It's usually ruled out as too expensive (I've mostly worked in public sector). I've had very good experiences with Sentinel One and Microsoft Defender. I've had terrible experiences with Trellix and Sophos."Oopsy" aside, is CrowdStrike really that much better than the competition?
    - alephnerd 2y ago
      The big four (CRWD, S1, Prisma, and MDE) all mostly comparable tbh. EDR (especially Windows EDR) is heavily commodified.
      - esafak 2y ago
        A commodified market with no good product? Something is wrong here.
        AnthonyMouse 2y ago
        It's enterprise software. The people using the software and the people choosing the software are not the same people. In many cases they only buy it to satisfy a contractual or regulatory requirement and then the primary criterion is which one costs less or which one's sales reps give the best kickbacks, with considerations like "is it any good" not really playing a major role.
        adrr 2y ago
        Race to the bottom.
    - to11mtm 2y ago
      I only worked at one shop that used CrowdStrike but TBH compared to the others I've had to deal with, definitely is the 'least' shitty compared to other competitors...
  - rainsford 2y ago
    I always feel dumb and like I'm missing some fundamental principle thinking about companies like GoDaddy. They provide a pretty undifferentiated commodity with a relatively low bar to switching, don't seem particularly well run or trustworthy based among other things on events like this, and their brand and marketing give off a vaguely skeezy low-rent vibe. Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share?
    - BobbyTables2 2y ago
      Are banks not fairly commodified too? Did you move to a new bank after yours had a security breach? There are so many breaches these days, companies don’t even have liability — any damages can be blamed on another breach.
      - roenxi 2y ago
        Not commodified as much as regulated. The personal data that banks collect is probably mandated by the government, so switching banks doesn't really change the risk someone faces. And probably a bunch of other things that would otherwise be competitive advantages for customers too. The lack of full reserve banks (or close enough too) despite what would be a reasonable level of customer demand, for example.
    - AnthonyMouse 2y ago
      > Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share? Worse. It's a market where most of the customers are unsophisticated but price sensitive, so they tend to prefer the provider with the lowest apparent price, and then the big providers compete on the basis of who can present the lowest apparent price through the use of dark patters, misleading claims, bait and switch tactics and hidden fees. Example: GoDaddy provides a "free" site builder but if you use it the resulting site can't easily be extricated from their service and now you're locked in if you don't want to recreate your site. Meanwhile the price you were quoted for various services was an onboarding price and now that you've sunk a lot of time creating and improving the site you can't move, the price is going up. This is, incidentally, a major reason WordPress is so popular despite being fairly miserable. It makes it easy for unsophisticated users to get started and your site isn't tied to a particular host.
- iforgot22 2y ago
  Crowdstrike's security reputation matters a lot more. I'll bet the customers assume the competitors have the same reliability problems, they can tolerate a little downtime, and going with nobody is even worse.
  - hulitu 2y ago
    > they can tolerate a little downtime A couple of days of production stopped can cost a lot of money.
- manquer 2y ago
  Yet. it takes time there are plenty of lawsuits flying around that incident . Even if they win all the suits without settling or loosing, customers will negotiate far stiffer penalties and controls on next renewal or get steep discounts or just straight up switch vendors . Sooner or later their ability to be competitive will get affected and they will likely become a target for acquisition and rebranding. Organizations of that magnitude do not collapse overnight like startups
  - goalieca 2y ago
    I’ve been around long enough to see this not happen. Crowdstrike ticks a lot of boxes and no one buys them for anything else.
stevenicr 2y ago
I feel this is more important for a younger or smaller company, and less so when stopping a product from one company to switch to another is a pain in the ass or has other problems / risks.. switching from godaddy to another registrar is not super hard, but there are hurdles and sometimes problems occur that even people with experience run into. I think (some?) people also hope a place that suffers a breach learns from it and makes it near impossible for similar to happen again.
zelon88 2y ago
Most customers use your product because it was on the first page of their Google search results. The only people who's reputation gets ruined are the D-Level Directors and Managers who run this stuff and regularly run into budget or resource shortfalls that prevent them from doing all that they are capable of doing.
tsimionescu 2y ago
The whole thread is related to GoDaddy's numerous breaches not affecting their bottom line or market position. So it seems lots and lots and lots of people really don't care.
- deleted 2y ago
  [deleted]
- oxide 2y ago
  I can take my business elsewhere and do. but do I blame the average person for not caring? The kind of person who would use GoDaddy for hosting? I find it really hard to blame them.
  - tbossanova 2y ago
    Also your data will probably just be leaked somewhere else sometime anyway. Punishing a single company once unfortunately does next to nothing at this point.
philipov 2y ago
Creating lock-in which prevents customers from having an alternative is a more effective use of money, because it "solves" not just the threat of reputation loss due to security failures, but many others at the same time.
ted_dunning 2y ago
Many people consider building a business on customer trust to be a strategic mistake.
philsnow 2y ago
That reputational loss is almost exclusively among those who understand how the crowdstrike products work, but the Venn diagram with those folks and “people at companies who can approve large expenses” is nearly empty. Yes, the CRWD ticker took a hard hit, dropping about 50% over the course of 2 weeks last July. But... it recently topped its previous high, only 7 months later (which is like 1/2 or 1/3 of an enterprise sales cycle!).

adrr 2y ago

Crowdstrike took down all windows boxes that had their software installed and didn’t really affect them.

jrochkind1 2y ago
I think customers feel, rightly or wrongly, there's no alternative to CrowdStrike. There are so many alternatives to what GoDaddy provides, it is quite commoditized. But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...
- rez9x 2y ago
  I've actually not worked anywhere that has used CrowdStrike. It's usually ruled out as too expensive (I've mostly worked in public sector). I've had very good experiences with Sentinel One and Microsoft Defender. I've had terrible experiences with Trellix and Sophos."Oopsy" aside, is CrowdStrike really that much better than the competition?
  - alephnerd 2y ago
    The big four (CRWD, S1, Prisma, and MDE) all mostly comparable tbh. EDR (especially Windows EDR) is heavily commodified.
    - esafak 2y ago
      A commodified market with no good product? Something is wrong here.
      - AnthonyMouse 2y ago
        It's enterprise software. The people using the software and the people choosing the software are not the same people. In many cases they only buy it to satisfy a contractual or regulatory requirement and then the primary criterion is which one costs less or which one's sales reps give the best kickbacks, with considerations like "is it any good" not really playing a major role.
      - adrr 2y ago
        Race to the bottom.
  - to11mtm 2y ago
    I only worked at one shop that used CrowdStrike but TBH compared to the others I've had to deal with, definitely is the 'least' shitty compared to other competitors...
- rainsford 2y ago
  I always feel dumb and like I'm missing some fundamental principle thinking about companies like GoDaddy. They provide a pretty undifferentiated commodity with a relatively low bar to switching, don't seem particularly well run or trustworthy based among other things on events like this, and their brand and marketing give off a vaguely skeezy low-rent vibe. Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share?
  - BobbyTables2 2y ago
    Are banks not fairly commodified too? Did you move to a new bank after yours had a security breach? There are so many breaches these days, companies don’t even have liability — any damages can be blamed on another breach.
    - roenxi 2y ago
      Not commodified as much as regulated. The personal data that banks collect is probably mandated by the government, so switching banks doesn't really change the risk someone faces. And probably a bunch of other things that would otherwise be competitive advantages for customers too. The lack of full reserve banks (or close enough too) despite what would be a reasonable level of customer demand, for example.
  - AnthonyMouse 2y ago
    > Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share? Worse. It's a market where most of the customers are unsophisticated but price sensitive, so they tend to prefer the provider with the lowest apparent price, and then the big providers compete on the basis of who can present the lowest apparent price through the use of dark patters, misleading claims, bait and switch tactics and hidden fees. Example: GoDaddy provides a "free" site builder but if you use it the resulting site can't easily be extricated from their service and now you're locked in if you don't want to recreate your site. Meanwhile the price you were quoted for various services was an onboarding price and now that you've sunk a lot of time creating and improving the site you can't move, the price is going up. This is, incidentally, a major reason WordPress is so popular despite being fairly miserable. It makes it easy for unsophisticated users to get started and your site isn't tied to a particular host.
iforgot22 2y ago
Crowdstrike's security reputation matters a lot more. I'll bet the customers assume the competitors have the same reliability problems, they can tolerate a little downtime, and going with nobody is even worse.
- hulitu 2y ago
  > they can tolerate a little downtime A couple of days of production stopped can cost a lot of money.
manquer 2y ago
Yet. it takes time there are plenty of lawsuits flying around that incident . Even if they win all the suits without settling or loosing, customers will negotiate far stiffer penalties and controls on next renewal or get steep discounts or just straight up switch vendors . Sooner or later their ability to be competitive will get affected and they will likely become a target for acquisition and rebranding. Organizations of that magnitude do not collapse overnight like startups
- goalieca 2y ago
  I’ve been around long enough to see this not happen. Crowdstrike ticks a lot of boxes and no one buys them for anything else.

stevenicr 2y ago

I feel this is more important for a younger or smaller company, and less so when stopping a product from one company to switch to another is a pain in the ass or has other problems / risks.. switching from godaddy to another registrar is not super hard, but there are hurdles and sometimes problems occur that even people with experience run into. I think (some?) people also hope a place that suffers a breach learns from it and makes it near impossible for similar to happen again.

zelon88 2y ago

Most customers use your product because it was on the first page of their Google search results. The only people who's reputation gets ruined are the D-Level Directors and Managers who run this stuff and regularly run into budget or resource shortfalls that prevent them from doing all that they are capable of doing.

tsimionescu 2y ago

The whole thread is related to GoDaddy's numerous breaches not affecting their bottom line or market position. So it seems lots and lots and lots of people really don't care.

deleted 2y ago
[deleted]
oxide 2y ago
I can take my business elsewhere and do. but do I blame the average person for not caring? The kind of person who would use GoDaddy for hosting? I find it really hard to blame them.
- tbossanova 2y ago
  Also your data will probably just be leaked somewhere else sometime anyway. Punishing a single company once unfortunately does next to nothing at this point.

philipov 2y ago

Creating lock-in which prevents customers from having an alternative is a more effective use of money, because it "solves" not just the threat of reputation loss due to security failures, but many others at the same time.

ted_dunning 2y ago

Many people consider building a business on customer trust to be a strategic mistake.

philsnow 2y ago

That reputational loss is almost exclusively among those who understand how the crowdstrike products work, but the Venn diagram with those folks and “people at companies who can approve large expenses” is nearly empty. Yes, the CRWD ticker took a hard hit, dropping about 50% over the course of 2 weeks last July. But... it recently topped its previous high, only 7 months later (which is like 1/2 or 1/3 of an enterprise sales cycle!).