5 ms·

"Non-technical teams are now shipping production code" Boy that's scary for a company that's effectively fintech...

nothercastle 5mo ago
Worse, crypto is irreversible at least there are legal channels elsewhere to undo. Even if these people don’t touch the crypto side they still create backdoors for phishing
mothballed 5mo ago
Must be the KYC/AML people. I've notice fintech is on a hair trigger to freeze your money for hallucinated reasons. Once they have your money frozen, they can use it as float to pad their numbers for investor decks and draw more interest. Spin up some AI CS agent that just deflects and wastes your time and they can stall out paying for weeks to months.
- phist_mcgee 5mo ago
  I realise you're joking, but crypto is now a heavily regulated industry, the KYC/AML requirements are no-joke and non-compliance will get the company's licences in a given country/state terminated. For the end user it looks like an evil cash-grab, but really it's the company protecting itself from regulatory vengeance.
  - mothballed 5mo ago
    No I'm not joking. That is the bullshit answer they (note: crypto/fintech space in general, not necessarily Coinbase) give. But when pushed on the occasions I've had my funds frozen they are never able to provide any evidence or what specific reason they have for triggering KYC/AML, just vague bullshit handwaving and AI customer service agents that lie about them "being on it" or some such and then your money gets returned when they're done squeezing it for interest (yes no one cares about your $50 but they do when it's some fractional percent of millions of accounts getting triggered at any particular point in time.) You can check something like the customer support reddits of a variety of crytpo and fintech companies, it is always filled with people have their money frozen for some long period while conveniently no one is looking at it while it is sitting there drawing interest, then maybe after a month someone tells them they need to hop on one leg while reciting Deuteronomy chapter 1 with a passport booklet in their hand and blink their eye 3 times while turning their head and that is all they were waiting for all along (I'm embellishing a bit here but that seems to be what KYC checks are like nowadays when they pop up). Just a vague nonsense about compliance, that magickly aligns with padding their float. In reality they are using compliance and regulatory language as a shield to prop up their numbers. They are using KYC/AML to hold your funds hostage, as it's the most plausible explanation that also allows them to legally seize it under a legal sounding explanation. The fact that they do have to perform KYC/AML and there are penalties for not doing so just happen to make it a valid enough sounding excuse for when it's used overly aggressively because it lines up with other goals. If they move the hair trigger to freeze funds 2x as often as they need to against the innocent false-positives to pass compliance checks, due to a hair trigger, then it falls under plausible deniability and even better when the regulator comes they can say some insane bullshit about how good their KYC/AML is. If they freeze it less often but instead just steal some for a little while and then return it, then it's more obvious a crime has been committed. It's obvious what they're up to. Of course the KYC/AML/ regulatory officers are probably just pawns in this. The executives in the crypto and fintech space tell these people they need to set the sensitivity up to the 9s which does increase KYC/AML 'true positives' but the unspoken part is that money is now locked up into the company's accounts which creates a moral hazard in their fiduciary duty. They know damn well what that actually does is inflate their float, at the cost of a bunch of false positives. In theory that's satisfying AML because a function of doing so is you trigger more true positives, but in reality it's merely stealing money to increase floats not actually optimizing to meet the cutoffs to keep your license. But no one is actually going to come out and say this. It will probably take a class action suite, which I have little doubt will eventually happen when someone comes out and admits one day that these regulatory compliance triggers were intentionally set on the sensitive side for non-regulatory reasons.
    - EdwardDiego 5mo ago
      > what specific reason they have for triggering KYC/AML As far as I understand, they're often not allowed to disclose that. E.g., https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ > In the specific case of “Why did the bank close my account, seemingly for no reason? Why will no one tell me anything about this? Why will no one take responsibility?”, the answer is frequently that the bank is following the law. As we’ve discussed previously, banks will frequently make the “independent” “commercial decision” to “exit the relationship” with a particular customer after that customer has had multiple Suspicious Activity Reports filed. SARs can (and sometimes must!) be filed for innocuous reasons and do not necessarily imply any sort of wrongdoing. > SARs are secret, by regulation. See 12 CFR § 21.11(k)(1) from the Office of Comptroller of the Currency...
      - mothballed 5mo ago
        The fact they may not be able to in one circumstance doesn't prove that they're merely following the BSA. It's obvious when someone gets their money frozen for a month only to just have to perform a KYC check that even if the KYC check was legitimate, and these kinds of results are common over years, the delay was a result of a business decision that increased their float. I think you're conflating the requirements with the BSA with how executives are using it in a hostile way against customers. They can make the deliberate decision to slow down KYC/AML officers and checks after a trigger, while putting them on a hair trigger, while citing secrecy under the BSA. That is the regulatory nonsense under which they are dressing up a business, non-regulatory decision. It's there to provide plausible deniability. The compliance officer in this case is plausibly just following the law but in reality they're just running cover for increasing the float -- maybe even unwittingly.
    - kentm 5mo ago
      > But when pushed on the occasions I've had my funds frozen they are never able to provide any evidence or what specific reason they have for triggering KYC/AML They are legally prevented from telling you by the regulators, at least in the US.
  - drdaeman 5mo ago
    The missing bit is that compliance is for governments and business partners, not for any end-users. For the purposes of KYC/AML process, end-users are objects, not subjects. Your coins frozen with no reason given even internally except for "machine said no" - no one gets any slap on the wrist unless you sue real hard, happen to win, and most likely that'll be just a scratch that won't be noticed enough to change any attitudes. The Man sees that someone they don't like transferring their coins through the fintech company - that's what those companies are really concerned about, because it would be a punch in the gut the company will feel. Thus, the incentives. Current social design doesn't punish for false positives (until they hit really high levels), only false negatives.
  - nullc 5mo ago
    Coinbase gave my confidential "AML" information to criminal extortionists-- I hadn't even had an account with them for a decade because I realized they were bad eggs long ago. What licenses of theirs were terminated? Seems to me that the regulatory oversight is a joke.
butterlesstoast 5mo ago
I respected the "No Pure Managers" part. That's similar to what happened at our org. The question remains, if there are no pure managers, then is this CSM / Sales shipping production code? If yes, then it's indeed scary... > No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams.
- zdragnar 5mo ago
  I've strongly disliked every team where this was the case. The people in those positions ended up being neither good managers nor good engineers. YMMV, I suppose, but this combined with the AI nonsense just makes the dislike even harder.
  - operatingthetan 5mo ago
    [dead]
  - claytonjy 5mo ago
    My experience as well. It sounds nice at first, but since it’s tied to org flattening these “player-coaches” end up with 15-20 reports, which is way too many for even a pure manager. I noticed it was especially bad for on-call and incident response; these managers get pulled in to all the incidents because of their status and supposed involvement, but are not particularly useful in those rooms, adding even more cooks to the already crowded kitchen.
    - colechristensen 5mo ago
      I worked somewhere once where every once in a while we'd have to create a new deploy meeting because 1) our code was deployed manually over the course of hours and 2) every manager imaginable wanted to be in the meeting asking questions and directing people... you couldn't actually speak to anyone you had to talk through their manager.
      - 5mo ago
shell0x 5mo ago
My employer does that too and people don’t even read or review code anymore.
- drdaeman 5mo ago
  Maybe I won't have to be concerned about job security some years from now, when everything becomes FUBAR and companies will need a legacy systems expert/software necromancer to a) discover, spec and re-formalize what their machine-generated black boxes are doing; b) build comprehensible and maintainable systems; and c) be responsible for what happens in the process aka swear by my work. While (a) probably can be done by a machine alone, and (b) can be done by a machine-and-human tandem, (c) absolutely requires a human. But the few years to come are going to be wild for a lot of folks out there. I don't expect Coinbase to publish a "we're hiring everyone back" in 5 years from now, but I hope at some point media will spot those trends as they'll - I have no doubts - will happen, and propagate that tune.
annjose 5mo ago
Are they also held accountable for the code they ship? Are they added to the on-call rotation?
- lokar 5mo ago
  IMO managers (and directors) should staff the large incident management rotation. Helping to coordinate response, freeing up ICs to debug and fix.
  - duzer65657 5mo ago
    or at Coinbase now apparently, prepare to complete 15+ annual reviews in your new role as player-coach!
willio58 5mo ago
Yep I take this as a signal to remove the remaining amount of crypto I had on coinbase out. Fun thing for tonight!
- pishpash 5mo ago
  What are the top alternatives? (And are they doing the same thing?)
  - atl_tom 5mo ago
    Hardware wallet. Or just stamp the wallet and private key on a sheet of aluminum.
  - Anamon 5mo ago
    I went with Exodus. Have fun trying to get your funds out of Coinbase. I managed after about 3 days and 10 support tickets. The process seems intentinally broken. What a nasty company.
ghnbv 5mo ago
It is very likely a lie.
stephenlf 5mo ago
This is exactly what stood out to me, too. Before this Tweet, my feelings towards Coinbase were completely neutral. After this Tweet, I want nothing to do with it. > Over the past year, l've watched engineers use Al to ship in days what used to take a team weeks. Nontechnical teams are now shipping production code and many of our workflows are being automated.
simonbw 5mo ago
There's plenty of non-critical code that I would trust non-technical people with good AI tooling to touch. As long as their access is segregated from the actual critical stuff. But let them write marketing pages or help and documentation pages. Let them write internal reporting code or build tools to use themselves.
- brandall10 5mo ago
  Internal tools and help/marketing pages aren't generally considered production code.
  - estimator7292 5mo ago
    You and I wouldn't because we're engineers. An executive with ulterior motives would want to call it production for "Marketing"
  - Atotalnoob 5mo ago
    What world do you live in internal tooling isn’t production code? Internal tools keep the lights on and allow customer facing code to function! Operational tooling also isn’t a sexy thing, but it’s vital for any company to function.
    - kenferry 5mo ago
      I mean, this is semantics. Production is not the same thing as "important", but to me production code means customer facing. Internal tooling isn't production.
    - deleted 5mo ago
      [deleted]
- themafia 5mo ago
  > As long as their access is segregated from the actual critical stuff. Do fintech customers share your ideals as to what is "critical stuff" and what isn't? How much of this business could _plausibly_ be "non critical?"

Worse, crypto is irreversible at least there are legal channels elsewhere to undo. Even if these people don’t touch the crypto side they still create backdoors for phishing

mothballed 5mo ago

Must be the KYC/AML people. I've notice fintech is on a hair trigger to freeze your money for hallucinated reasons. Once they have your money frozen, they can use it as float to pad their numbers for investor decks and draw more interest. Spin up some AI CS agent that just deflects and wastes your time and they can stall out paying for weeks to months.

phist_mcgee 5mo ago
I realise you're joking, but crypto is now a heavily regulated industry, the KYC/AML requirements are no-joke and non-compliance will get the company's licences in a given country/state terminated. For the end user it looks like an evil cash-grab, but really it's the company protecting itself from regulatory vengeance.
- mothballed 5mo ago
  No I'm not joking. That is the bullshit answer they (note: crypto/fintech space in general, not necessarily Coinbase) give. But when pushed on the occasions I've had my funds frozen they are never able to provide any evidence or what specific reason they have for triggering KYC/AML, just vague bullshit handwaving and AI customer service agents that lie about them "being on it" or some such and then your money gets returned when they're done squeezing it for interest (yes no one cares about your $50 but they do when it's some fractional percent of millions of accounts getting triggered at any particular point in time.) You can check something like the customer support reddits of a variety of crytpo and fintech companies, it is always filled with people have their money frozen for some long period while conveniently no one is looking at it while it is sitting there drawing interest, then maybe after a month someone tells them they need to hop on one leg while reciting Deuteronomy chapter 1 with a passport booklet in their hand and blink their eye 3 times while turning their head and that is all they were waiting for all along (I'm embellishing a bit here but that seems to be what KYC checks are like nowadays when they pop up). Just a vague nonsense about compliance, that magickly aligns with padding their float. In reality they are using compliance and regulatory language as a shield to prop up their numbers. They are using KYC/AML to hold your funds hostage, as it's the most plausible explanation that also allows them to legally seize it under a legal sounding explanation. The fact that they do have to perform KYC/AML and there are penalties for not doing so just happen to make it a valid enough sounding excuse for when it's used overly aggressively because it lines up with other goals. If they move the hair trigger to freeze funds 2x as often as they need to against the innocent false-positives to pass compliance checks, due to a hair trigger, then it falls under plausible deniability and even better when the regulator comes they can say some insane bullshit about how good their KYC/AML is. If they freeze it less often but instead just steal some for a little while and then return it, then it's more obvious a crime has been committed. It's obvious what they're up to. Of course the KYC/AML/ regulatory officers are probably just pawns in this. The executives in the crypto and fintech space tell these people they need to set the sensitivity up to the 9s which does increase KYC/AML 'true positives' but the unspoken part is that money is now locked up into the company's accounts which creates a moral hazard in their fiduciary duty. They know damn well what that actually does is inflate their float, at the cost of a bunch of false positives. In theory that's satisfying AML because a function of doing so is you trigger more true positives, but in reality it's merely stealing money to increase floats not actually optimizing to meet the cutoffs to keep your license. But no one is actually going to come out and say this. It will probably take a class action suite, which I have little doubt will eventually happen when someone comes out and admits one day that these regulatory compliance triggers were intentionally set on the sensitive side for non-regulatory reasons.
  - EdwardDiego 5mo ago
    > what specific reason they have for triggering KYC/AML As far as I understand, they're often not allowed to disclose that. E.g., https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ > In the specific case of “Why did the bank close my account, seemingly for no reason? Why will no one tell me anything about this? Why will no one take responsibility?”, the answer is frequently that the bank is following the law. As we’ve discussed previously, banks will frequently make the “independent” “commercial decision” to “exit the relationship” with a particular customer after that customer has had multiple Suspicious Activity Reports filed. SARs can (and sometimes must!) be filed for innocuous reasons and do not necessarily imply any sort of wrongdoing. > SARs are secret, by regulation. See 12 CFR § 21.11(k)(1) from the Office of Comptroller of the Currency...
    - mothballed 5mo ago
      The fact they may not be able to in one circumstance doesn't prove that they're merely following the BSA. It's obvious when someone gets their money frozen for a month only to just have to perform a KYC check that even if the KYC check was legitimate, and these kinds of results are common over years, the delay was a result of a business decision that increased their float. I think you're conflating the requirements with the BSA with how executives are using it in a hostile way against customers. They can make the deliberate decision to slow down KYC/AML officers and checks after a trigger, while putting them on a hair trigger, while citing secrecy under the BSA. That is the regulatory nonsense under which they are dressing up a business, non-regulatory decision. It's there to provide plausible deniability. The compliance officer in this case is plausibly just following the law but in reality they're just running cover for increasing the float -- maybe even unwittingly.
  - kentm 5mo ago
    > But when pushed on the occasions I've had my funds frozen they are never able to provide any evidence or what specific reason they have for triggering KYC/AML They are legally prevented from telling you by the regulators, at least in the US.
- drdaeman 5mo ago
  The missing bit is that compliance is for governments and business partners, not for any end-users. For the purposes of KYC/AML process, end-users are objects, not subjects. Your coins frozen with no reason given even internally except for "machine said no" - no one gets any slap on the wrist unless you sue real hard, happen to win, and most likely that'll be just a scratch that won't be noticed enough to change any attitudes. The Man sees that someone they don't like transferring their coins through the fintech company - that's what those companies are really concerned about, because it would be a punch in the gut the company will feel. Thus, the incentives. Current social design doesn't punish for false positives (until they hit really high levels), only false negatives.
- nullc 5mo ago
  Coinbase gave my confidential "AML" information to criminal extortionists-- I hadn't even had an account with them for a decade because I realized they were bad eggs long ago. What licenses of theirs were terminated? Seems to me that the regulatory oversight is a joke.

butterlesstoast 5mo ago

I respected the "No Pure Managers" part. That's similar to what happened at our org. The question remains, if there are no pure managers, then is this CSM / Sales shipping production code? If yes, then it's indeed scary... > No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams.

zdragnar 5mo ago
I've strongly disliked every team where this was the case. The people in those positions ended up being neither good managers nor good engineers. YMMV, I suppose, but this combined with the AI nonsense just makes the dislike even harder.
- operatingthetan 5mo ago
  [dead]
- claytonjy 5mo ago
  My experience as well. It sounds nice at first, but since it’s tied to org flattening these “player-coaches” end up with 15-20 reports, which is way too many for even a pure manager. I noticed it was especially bad for on-call and incident response; these managers get pulled in to all the incidents because of their status and supposed involvement, but are not particularly useful in those rooms, adding even more cooks to the already crowded kitchen.
  - colechristensen 5mo ago
    I worked somewhere once where every once in a while we'd have to create a new deploy meeting because 1) our code was deployed manually over the course of hours and 2) every manager imaginable wanted to be in the meeting asking questions and directing people... you couldn't actually speak to anyone you had to talk through their manager.
    - 5mo ago

shell0x 5mo ago

My employer does that too and people don’t even read or review code anymore.

drdaeman 5mo ago
Maybe I won't have to be concerned about job security some years from now, when everything becomes FUBAR and companies will need a legacy systems expert/software necromancer to a) discover, spec and re-formalize what their machine-generated black boxes are doing; b) build comprehensible and maintainable systems; and c) be responsible for what happens in the process aka swear by my work. While (a) probably can be done by a machine alone, and (b) can be done by a machine-and-human tandem, (c) absolutely requires a human. But the few years to come are going to be wild for a lot of folks out there. I don't expect Coinbase to publish a "we're hiring everyone back" in 5 years from now, but I hope at some point media will spot those trends as they'll - I have no doubts - will happen, and propagate that tune.

annjose 5mo ago

Are they also held accountable for the code they ship? Are they added to the on-call rotation?

lokar 5mo ago
IMO managers (and directors) should staff the large incident management rotation. Helping to coordinate response, freeing up ICs to debug and fix.
- duzer65657 5mo ago
  or at Coinbase now apparently, prepare to complete 15+ annual reviews in your new role as player-coach!

willio58 5mo ago

Yep I take this as a signal to remove the remaining amount of crypto I had on coinbase out. Fun thing for tonight!

pishpash 5mo ago
What are the top alternatives? (And are they doing the same thing?)
- atl_tom 5mo ago
  Hardware wallet. Or just stamp the wallet and private key on a sheet of aluminum.
- Anamon 5mo ago
  I went with Exodus. Have fun trying to get your funds out of Coinbase. I managed after about 3 days and 10 support tickets. The process seems intentinally broken. What a nasty company.

ghnbv 5mo ago

It is very likely a lie.

stephenlf 5mo ago

This is exactly what stood out to me, too. Before this Tweet, my feelings towards Coinbase were completely neutral. After this Tweet, I want nothing to do with it. > Over the past year, l've watched engineers use Al to ship in days what used to take a team weeks. Nontechnical teams are now shipping production code and many of our workflows are being automated.

simonbw 5mo ago

There's plenty of non-critical code that I would trust non-technical people with good AI tooling to touch. As long as their access is segregated from the actual critical stuff. But let them write marketing pages or help and documentation pages. Let them write internal reporting code or build tools to use themselves.

brandall10 5mo ago
Internal tools and help/marketing pages aren't generally considered production code.
- estimator7292 5mo ago
  You and I wouldn't because we're engineers. An executive with ulterior motives would want to call it production for "Marketing"
- Atotalnoob 5mo ago
  What world do you live in internal tooling isn’t production code? Internal tools keep the lights on and allow customer facing code to function! Operational tooling also isn’t a sexy thing, but it’s vital for any company to function.
  - kenferry 5mo ago
    I mean, this is semantics. Production is not the same thing as "important", but to me production code means customer facing. Internal tooling isn't production.
  - deleted 5mo ago
    [deleted]
themafia 5mo ago
> As long as their access is segregated from the actual critical stuff. Do fintech customers share your ideals as to what is "critical stuff" and what isn't? How much of this business could _plausibly_ be "non critical?"