Lots of software talks about money, keeps records about money, does calculations about money, but can't *touch* money.
One of the big promises of software is composability. You can build rich, powerful experiences out of basic building blocks.
APIs add new things to the toolbox. For example: Treasury, which lets an app/platform store, move, and track a business’
Lots of software talks about money, keeps records about money, does calculations about money, but can't *touch* money.
So you generally push work to the operator.
You need to be able to read bank transactions to reconcile. You probably can't. The owner can. So you ask the owner to do mind-numbing work a computer does better.
There is some software to write but it is not rocket science.
But let me speculate a bit:
They can automate its operations.
https://t.co/fMOqHh2Tlv
We made it *better* for your users than many business bank accounts.
"When do I get my money?"
Can you imagine needing to email Google to ask when that email that you know was sent will arrive?
Why is money *so slow* and *so opaque*?
In the U.S., you’ll often be blocked on the ACH network. Fast compared to stagecoach; slow compared to email.
Stripe has an arrangement with the banks that ultimately hold the business users’ funds.
(We are working on making that even faster by default. It’s not called HTTP 200 Check Back In An Hour.)
Putting together fintech products is historically a pain in the keister.
Then your engineering team receives the spec, and the *real* fun begins.
No negotiation required. No bespoke legal work. More of the necessary levels of complexity in touching money businesses depend on; less of the overhead.
You can build all of that on Stripe APIs now.
AAAAAAAARGH.
It is managed at most banks as an offshoot of personal banking, because the userbase is basically the same people who show up at the branch.
But the needs are quite different.
(Narrator: This is not, in fact, an adequate spec for a checking account.)
So do graveyards. And hotels. And landlords. And spas. And tutors. And yoga teachers. And...
Not enough dentists pay not enough dollars for banks to put software teams against dental practice UX.
We can then take that package to leading banks. That reach is *very interesting* to them.
A pizzeria can't walk into Goldman Sachs and walk out with a bank account.
A software company serving pizzerias could if they had, uh, a lot of dough.
And so our partner banks have made great products available, at pricing and terms that small businesses just don't usually get in direct banking relationships.
I know exactly how many times I paid the $14 account maintenance fee for my software businesses, ten years later. That’s how much I hated them.
One way to think of it is that banks have huge expenses to attract SMB deposits, including marketing campaigns and branch networks, and those drive the pricing of SMB banking.
Nationwide advertising, branches, and sales reps aren’t as cheap as cron jobs.
I'm very excited to see what software people do with the Stripe Treasury.
No. This was my number two. You're welcome to your guess at the number one. (Though, who knows, I heard of a new project last week and might steal the zeroth spot for it.)
https://t.co/osjjx8gNM0
Part of the needle threading is making sure that one is still developing some things which are uniquely exciting to developers and smaller shops.
— Patrick McKenzie (@patio11) September 23, 2020
Which: I can\u2019t spoil it, but one thing in the pipeline is maybe my favorite Stripe product since Stripe Atlas if we do it right.
More from Patrick McKenzie
I like this heuristic, and have a few which are similar in intent to it:
Hiring efficiency:
How long does it take, measured from initial expression of interest through offer of employment signed, for a typical candidate cold inbounding to the company?
What is the *theoretical minimum* for *any* candidate?
How long does it take, as a developer newly hired at the company:
* To get a fully credentialed machine issued to you
* To get a fully functional development environment on that machine which could push code to production immediately
* To solo ship one material quanta of work
How long does it take, from first idea floated to "It's on the Internet", to create a piece of marketing collateral.
(For bonus points: break down by ambitiousness / form factor.)
How many people have to say yes to do something which is clearly worth doing which costs $5,000 / $15,000 / $250,000 and has never been done before.
Here's how I'd measure the health of any tech company:
— Jeff Atwood (@codinghorror) October 25, 2018
How long, as measured from the inception of idea to the modified software arriving in the user's hands, does it take to roll out a *1 word copy change* in your primary product?
Hiring efficiency:
How long does it take, measured from initial expression of interest through offer of employment signed, for a typical candidate cold inbounding to the company?
What is the *theoretical minimum* for *any* candidate?
How long does it take, as a developer newly hired at the company:
* To get a fully credentialed machine issued to you
* To get a fully functional development environment on that machine which could push code to production immediately
* To solo ship one material quanta of work
How long does it take, from first idea floated to "It's on the Internet", to create a piece of marketing collateral.
(For bonus points: break down by ambitiousness / form factor.)
How many people have to say yes to do something which is clearly worth doing which costs $5,000 / $15,000 / $250,000 and has never been done before.
So the cryptocurrency industry has basically two products, one which is relatively benign and doesn't have product market fit, and one which is malignant and does. The industry has a weird superposition of understanding this fact and (strategically?) not understanding it.
The benign product is sovereign programmable money, which is historically a niche interest of folks with a relatively clustered set of beliefs about the state, the literary merit of Snow Crash, and the utility of gold to the modern economy.
This product has narrow appeal and, accordingly, is worth about as much as everything else on a 486 sitting in someone's basement is worth.
The other product is investment scams, which have approximately the best product market fit of anything produced by humans. In no age, in no country, in no city, at no level of sophistication do people consistently say "Actually I would prefer not to get money for nothing."
This product needs the exchanges like they need oxygen, because the value of it is directly tied to having payment rails to move real currency into the ecosystem and some jurisdictional and regulatory legerdemain to stay one step ahead of the banhammer.
If everyone was holding bitcoin on the old x86 in their parents basement, we would be finding a price bottom. The problem is the risk is all pooled at a few brokerages and a network of rotten exchanges with counter party risk that makes AIG circa 2008 look like a good credit.
— Greg Wester (@gwestr) November 25, 2018
The benign product is sovereign programmable money, which is historically a niche interest of folks with a relatively clustered set of beliefs about the state, the literary merit of Snow Crash, and the utility of gold to the modern economy.
This product has narrow appeal and, accordingly, is worth about as much as everything else on a 486 sitting in someone's basement is worth.
The other product is investment scams, which have approximately the best product market fit of anything produced by humans. In no age, in no country, in no city, at no level of sophistication do people consistently say "Actually I would prefer not to get money for nothing."
This product needs the exchanges like they need oxygen, because the value of it is directly tied to having payment rails to move real currency into the ecosystem and some jurisdictional and regulatory legerdemain to stay one step ahead of the banhammer.
More from Software
As the year wrap's up, let's run through some of the worst public security mistakes and delays in fixes by AWS in 2020. A thread.
First, that time when an AWS employee posted confidential AWS customer information including including AWS access keys for those customer accounts to
Discovery by @SpenGietz that you can disable CloudTrail without triggering GuardDuty by using cloudtrail:PutEventSelectors to filter all events.
Amazon launched their bug bounty, but specifically excluded AWS, which has no bug bounty.
Repeated, over and over again examples of AWS having no change control over their Managed IAM policies, including the mistaken release of CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller.
First, that time when an AWS employee posted confidential AWS customer information including including AWS access keys for those customer accounts to
Fresh data breach news-
— Chris Vickery (@VickerySec) January 23, 2020
Amazon AWS engineer exposes work-related keys, passwords, and documents marked "Amazon Confidential" via public Github repository: https://t.co/7gkIegnslx
Discovered within 30 minutes of exposure by my team at @UpGuard.
Discovery by @SpenGietz that you can disable CloudTrail without triggering GuardDuty by using cloudtrail:PutEventSelectors to filter all events.
"Disable" most #AWS #CloudTrail logging without triggering #GuardDuty:https://t.co/zVe4uSHog9
— Rhino Security Labs (@RhinoSecurity) April 23, 2020
Reported to AWS Security and it is not a bug.
Amazon launched their bug bounty, but specifically excluded AWS, which has no bug bounty.
Amazon Vulnerability Research Program - Doesn't include AWS D:https://t.co/stJHDG68pj#BugBounty #AWS
— Spencer Gietzen (@SpenGietz) April 22, 2020
Repeated, over and over again examples of AWS having no change control over their Managed IAM policies, including the mistaken release of CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller.
@JuliaLMarcus @Iplaywithgerms This paper gives documentation on software (with causal reasoning, assumptions reviewed in appendix) for a parametric approach to estimating either "total effects" or "controlled direct effects" with competing events and time-varying
@Iplaywithgerms Total effects capture paths by which treatment affects competing event (e.g. protective total effect of lifesaving treatment on dementia may be wholly/partially due to effect on survival). Controlled direct effects do not capture these paths
@Iplaywithgerms More detailed reasoning on the difference and tradeoffs between total and controlled direct effects and causal reasoning in the point treatment context provided here along with description of some estimators and
@Iplaywithgerms If you are familiar with more robust approaches like IPW or even better TMLE for time-varying treatment, these are trivially adapted to go after the controlled direct effect by simply treating competing events like loss to follow-up (censoring). e.g.
@Iplaywithgerms Examples of IPW estimation of the total effect of a time-varying treatment described in Appendix D of this paper:
https://t.co/RNhcgTBMkb
And here
https://t.co/rMWmwFBWwV
Others in reference lists of above papers.
@Iplaywithgerms Total effects capture paths by which treatment affects competing event (e.g. protective total effect of lifesaving treatment on dementia may be wholly/partially due to effect on survival). Controlled direct effects do not capture these paths
@Iplaywithgerms More detailed reasoning on the difference and tradeoffs between total and controlled direct effects and causal reasoning in the point treatment context provided here along with description of some estimators and
@Iplaywithgerms If you are familiar with more robust approaches like IPW or even better TMLE for time-varying treatment, these are trivially adapted to go after the controlled direct effect by simply treating competing events like loss to follow-up (censoring). e.g.
@Iplaywithgerms Examples of IPW estimation of the total effect of a time-varying treatment described in Appendix D of this paper:
https://t.co/RNhcgTBMkb
And here
https://t.co/rMWmwFBWwV
Others in reference lists of above papers.
