Its $100 if it is both a first offense and not willful. For any willful or intentional delay, or a second or subsequent late paycheck regardless of willfulness, the penalty is $200 plus 25% of the payment that was due.
(And if any terminal paychecks are late, there are greater penalties – waiting time penalties equal to an average days pay for each day of delay up to 30 days – though I don’t recall if there is a wilfullness condition or modification to that.)
Maybe it’s not fair to compare Garry Tan to sama in this situation because Garry is the current president and sama is the former, but, it’s nice to see sama’s measured response compared to Garry’s.
Garry is shouting from the rooftops that more than a million jobs are going to be lost if the fed doesn’t immediately do something (that we all know it isn’t going to do). I wouldn’t want to be a YC startup right now, listening to Garry stoke panic.
The fdic and fed probably will do exactly what Gary Tan and many others recommended - no bailout of the company or shareholders but organise a facility so that the depositors get 100%.
They’re trying to sell it first but if that doesn’t work they don’t really have other options if they don’t want to be dealing with massive job losses and multiple bank runs next week.
That’s not necessary though unless we are to believe that a meaningful amount of money has disappeared. The FDIC offers insurance with a limit for a reason, it’s a fantasy to believe that the FDIC are going to invent a brand new standard of deposit protection because some companies might be forced to take a small haircut on their money.
The bank will re-open, companies will get most of their money, and life will carry on. The FDIC aren’t going to guarantee 100% of deposits, and shouting from the rooftops that a million jobs will be lost if the FDIC don’t do it (which they won’t) is panic-inducing for no discernible reason.
Edit: I intentionally took one for the team by embarrassing myself with a claim disproven less than an hour later. You’re welcome.
I'm not sure it's as simple as that if the fed don't guarantee deposits, but we'll see tomorrow I guess. The impression I had was these assets can't just be sold right now, today, without booking substantial losses.
Getting 90 cents on the dollar is not 'massive job losses' and most people outside of tech (SV VC tech precisely) think that the bank run risk is massively overblown.
Anyway we'll see what FDIC does. They're good at what they do.
Isn’t this quite unusual (a bank run at a large US bank)?
I agree the fdic has done this before and if they can find a buyer or communicate well it should turn out fine next week.
There is a risk of contagion though and a risk of job losses if money is delayed for say 6-12 months. I don’t think it’s unreasonable to be worried about it if you’re impacted.
HelloFresh have outlived many others but they aren’t long for this world either. They’re still spending huge amounts of money on marketing which isn’t converting to long term customers.
There’s definitely a market for these type of food boxes but it’s a much smaller market than HelloFresh etc. require to sustain the size of company they’ve built.
The all have the same issue: you tied up with what ever meal you are given (regardless if you've chosen them or not). Those are perishable goods. It means that you cannot just drop one meal without incurring waste. Their recipe are not very varied either, which can lead to some less than desirable meal (some are even borderline terrible).
I have tried pretty much all the major offering in the UK in the last 3 years. There need to be something more flexible than that. The big store could easily already make meal kits from their stock for specific recipes that would compete with Hello Fresh and the like.
I’m not sure I follow. Circle don’t hold tens of billions of USDC: USDC is minted when they receive USD at a one-to-one ratio. What coins are you proposing they burn? If there’s $10bn USD missing they’d need to burn $10bn USDC.
it’s not as simple as is being suggested. The corporate veil can be pierced in cases of wage theft where the corporation has been used for nefarious means. There’s no evidence that being unable to make payroll because of a bank collapse comes close to qualifying as bad behaviour on behalf of those behind the corporate veil.
You could argue that an overly cautious founder might cut all their employees off immediately out of an abundance of caution, but that would be self-immolation.
As a non-lawyer with zero credibility, I’d be shocked if any founders of companies that can’t make payroll because of this are at risk of the corporate veil being pierced. SVB was based in California, subject itself to California law, it would require some extreme mental gymnastics from a judge to believe that a company that can’t make payroll because they used SVB behaved inappropriately in this situation.
Again, I have zero credibility, but I’d expect when the dust settles, the only companies we see get in any trouble will be the companies that do some insane illegal things in a panic because they get caught up in the tidal wave of fear. Founders withdrawing millions into their personal accounts and then losing it by buying crypto or going to vegas to do a fedex with their remaining cash or something equally insane feels much more likely an outcome.
California labor laws are extremely powerful. "Not receiving agreed upon wages" is wage theft, full stop. They don't care if your bank collapsed or your great aunt ran off with contents of the cash register.
All you have to do is file a wage theft claim with the Labor Commissioner, who evaluates your claim and issue an ODA (Order Decision or Award). Once the ODA is filed it is considered a legal judgement against the employer. You can then use any legal means to collect.
Edit to add: the whole process so streamlined and employee friendly it happens entirely outside the court system. Once a claim is filed the employer has to pay you or appeal within 10 days.
> California labor laws are extremely powerful. "Not receiving agreed upon wages" is wage theft, full stop. They don't care if your bank collapsed or your great aunt ran off with contents of the cash register.
You forget that thinking, rational, humans are ultimately charged with enforcing the law.
Also, you seem way too certain of something that has no precedent. Show me where a major bank has gone under, caused companies to miss payroll, and the corporate officers were held liable.
The laws exist to protect employees, not to discourage employers from employing. Setting the precedent that a shareholder in a company is at risk of losing everything because a bank that their company uses fails would have a very negative impact on California as a place to employ people, which doesn’t help employees.
> "Not receiving agreed upon wages" is wage theft, full stop. They don't care if your bank collapsed or your great aunt ran off with contents of the cash register
The wage theft section of the California Penal Code (section 487m) says it is the intentional deprivation of wages. The California Labor Code talks about it in section 216, which applies when the employer has the ability to pay and willfully refuses.
It is hard to see how failure to pay because your bank collapsed and you can't get the money would be either intentional or a willful refusal.
Anyone who's been on the internet more than five minutes knows how much an uncited claim about the law is worth.
I find it very hard to believe they don't have some clause about employers acting in good faith but who can't make payroll because the payment processor had a truck number of 1, the bank was robbed that day and there was a police line or any of the other legitimate reasons processes have hiccups. And if they don't have that clause the labor commissioner almost certainly just ignores those claims until it's clear whether they're gonna shake themselves out or not.
The labor commissioner's office is almost certainly going to be slower at getting people the money than the company is (the latter is already set up to do so) in cases where the company is acting in good faith so in those cases the labor compssioner's office will best serve employees and also have the least work to do by just sitting back.
Collection can mean arrive with the sheriff and start taking things to sell at auction. Since it pierces the corporate veil, this can eventually include the executives' personal property and bank accounts.
Cut to a scene of fifty angry unpaid devs banding together to file their claim and then standing in the Atherton driveway of their VC and figuring out who gets his art collection, who gets the wine and how much, who gets his watches...
To me, as an employee, that seems like a slightly weird take.
If my employer knows they can't pay me, and they ask me to do work anyway that is causing me serious losses. The moment they know they can't pay me, they have to stop asking me to do work. I would expect someone to be accountable for those sort of serious lies.
A sane enoloyer would furlough pending stabilization. Layoffs would destroy the company. Who would work for a company that both can't manage its finances and also can't manage its staffing?
I am presuming the employers operate in good faith, that is, they are open with the employees about the situation — it would be hard to keep this a secret given it’s major news.
If your employer said to you, “we are caught up in this, we are working to resolve the situation“ it would be pretty fair and reasonable of them. You can choose to quit if you want, you’re under no obligation to work.
I am all in favour of getting rid of minimum wage laws. However, they are currently in play and I suspect that being open and direct about engaging in an illegal act to deal with a bankrupt bank is exactly the sort of situation that is likely to result in criminal prosecutions for executives if the company goes under.
Garry has an incentive to say the sky is falling because the sooner this is resolved the less pain it’ll cause, but to say this is an industry extinction event is a stretch.
Even if the extremely unlikely scenario plays out and companies are unable to make payroll, employees are very unlikely to walk out, it would make an inconvenient situation (no pay) much worse (terminated) in an already challenging economic climate. Anybody with the financial means to walk away because payroll has been missed is someone with the financial means to ride out a few weeks waiting to be paid.
We will see many startups fall in the next few weeks + months, and many will attribute it to the failure of SVB, but SVB’s failure is a symptom of the broader economic environment, not a cause, and the same factors that caused SVB to fail are already hurting startups — like the difficult fundraising environment at the moment. SVB will be an easy scapegoat, “we didn’t fail, it was SVB’s fault!”
Most any startup that attributes its failure to SVB’s collapse would have been dead in a few months anyway.
Do keep in mind that at least in California unpaid wages are one of the only things that pierces the corporate veil, so management and investors are on the hook for them personally.
editing to add citation: California Labor Code Section 558.1
As Garry wrote, companies would furlough before closing up shop. You get your paycheck, and then you're told you're furloughed until FDIC does their thing. This protects the company and the founders.
This may be better or worse for workers than being laid off.
That would certainly be better, but companies generally have more expenses than payroll. Lets say hypothetically I'm a healthy cloud computing provider startup and a bunch of revenue comes from startups. If those companies can't pay me, then I can't pay my own costs. That means I have to shut down and all the businesses on my platform get screwed over too.
Bigger companies will be able to float resources for a bit, but if it takes the FDIC more than a few months to sort it out there will be large second order effects.
I hope this hypothetical stays hypothetical, if the FDIC can announce that SVB has been acquired and all the deposits will be honored this will all be moot. But any company with a large deposit at SVB should probably be working off the assumption that they're going to have to make that $250k of insured deposits last for a while. At least until new information is released.
$250k will be in every account Monday morning, agreed on that.
It's everything above $250k, which is substantial, and which companies need, that will take a while to sort out. It's true that everything above $250k isn't covered by insurance, which means they may not get it, but SVB has assets, those assets will get sold, and first up to those assets is those who had bank accounts and to make them whole.
These are Chicken Little scare tactics, and it is disappointing he chose that.
I wonder how much of YC's reputation was destroyed yesterday by this self-serving attempt.
It is unlikely that these companies won't have access to enough of their deposits to make payroll, and even if that rare case occurs there are many many alternatives available to them-- bridging from their VCs, from private lenders, etc.
Tan yesterday sounded a lot like that Zero Hedge guy back in 2009.
> If this happens the companies will immediately close up shop.
If their bank accounts get frozen for a week, they'll just lay everyone off and then hire them all back a week later with a signing bonus to cover their missed days. No one is going to permanently shut down their company because their bank is closed for a couple days.
Maybe a few lucky executives will accidentally get their vesting accelerated, and a few startups that were on the brink of collapsing anyway might be pushed over the edge, but beyond that life will go on as usual.
If you are a director of a company facing such a situation, it's what you want to do. Because if you don't, you become personally liable for the missed payroll. Do you want to close up shop and say "this startup died because of SVB, on to start another one", but keep your car and your house, or do you want to risk losing literally everything you own and then end up with loads of new debt on top of that.
Depends if you think the eventual outcome is worth more. People used to second-mortgage their house to start small businesses where the best-case payoff is much less than these tech companies-- some of which are apparently the next Google or Facebook according to the head of YC on CNBC yesterday
Ahhhh. So maybe this explains why David Sacks is absolutely foaming at the mouth on twitter at the moment? Crunchbase says he sits on quite a few boards.
He even managed to use the occasion to throw Ukraine under the tank treads, again.
So ... San Francisco USD has had payroll system issues for more than a year which have continued to cause staff to sometimes not be paid, and sometimes be underpaid. robbiet480 said that the _corporate_ veil is pierced and so manager and investors are personally on the hook for SVB-related payroll issues. Should school principals, the superintendent or London Breed be personally on the hook for making up shortfalls? Are they literally committing a crime every pay cycle that the bugs in the payroll system continue?
I suppose if you were about to h it a pedestrian while driving your car you could always bail out and claim you weren’t in charge of the vehicle, although that might be a bad example given Tesla’s shenanigans.
The government isn’t that simplistic that they’d accept that as a legal defense if they were going to enforce the law. Possibly if the executive could prove that they were defrauded by another exec or vendor with liability and they resigned as soon as they had information to that effect which coincidentally was on pay day, they could pull it off. Even then though as a corporate officer they have liability over how the company operates when they choose the people to do the job. As the other poster pointed out the liability for payroll pierces the corporate veil and that means they can’t just bail out and use the corporation as a legal shield.
Labor law generally applies where the employee lives. Otherwise companies would just incorporate in <fucked country> and be able to do whatever they want.
Yes, Delaware has no jurisdiction over events that take place in California, or vice versa. A delaware corporation hiring an employee in California means that it is subject to the laws of California solely when it comes to its relationship with that employee.
Well an amendment in 2017 to the General Corporation Law of the State of Delaware added Section 115 which explicitly permits Delaware startups to adopt in its certificate of incorporation a requirement that all internal corporate claims are exclusively held in front of a Judge in Delaware. Several cases in California have upheld this. So it's not exactly a crazy question to ask if this would work for YC startups employees.
On the one hand, of course in this case it applies. On the other hand, let's not pretend CA government doesn't sometimes pass things that aren't very effective.
Realistically this encourages immediate furloughs, layoffs, firing or bankruptcy proceedings. There isn't a world where the companies actually get to the stage of "unpaid wages", there are many steps they can take to avoid getting into that legal boondogle.
Normally, yes. But in this case isn't it the upcoming payroll that's the problem? That work has already been done by employees, so the wage is already on the books. If they can't come up with the money, they'll have unpaid wages no matter how many people they fire. Right?
Sure, but then they'll just furlough or lay off everyone. So employees get one payroll paid out, but then they don't get anymore, and the company and all the economic activity it produces are gone too.
If your company is economically unviable, it's going to eventually fold anyway; that's not the workers' fault. But if it's profitable and just has fallen temporarily behind in payroll, then it's not like it has to pay back wages all at once, it can make arrangements to pay them back over a period of weeks or months. But what it can't do is just decide not to pay people for the work they have performed.
People are acting like there's some set of circumstances that makes wage theft reasonable. Situations where management forces the employees to work for free under threat of being fired are exactly why the corporate veil should be pierced in these matters.
It seems like there are circumstances that make it reasonable, though. And this isn't wage theft. This is where through no fault of the company, their bank closed down and their money is no longer theirs. It is in no way reasonable to make the company owners destitute over two weeks of pay. The corporate veil should remain here.
Just because a company is unviable today doesn't mean it will be unviable a year from now, that's the whole idea behind investing. If this had happened to Google in 1999 (a year before they would eventually make money through advertisements) Google would likely not be able to make payroll, pay their server bills, or keep their office lights on.
Second, even if the company is profitable, they might rely on income from other companies screwed over today. Those companies might not be able to pay their bills. If I'm Sentry, Render, Mongo, or any other number of companies that gets most of their revenue by providing services to startups, I'd be worried right now. Even big cloud providers like AWS and GCP will likely take revenue hits. Big companies can float resources while this debacle gets sorted out, but small companies cant. I'm sure there are a bunch of startups out there that had $2 million in the bank which would give them a good 18 months of runway, and are now trying to prioritize cost cutting measures to help make that initial $250k of insured deposits last as long as possible. And that's permanent lost revenue for those companies.
Third, I'm not saying wage theft is reasonable (it's not), and I don't think anyone else is either. I'm simply trying to point out that piercing the veil isn't some magic bullet here. If a company has to close up shop that's probably the worst of all worlds. Employees lose their jobs with little notice and no severance, office owners need to find new tenants (in an already tough office real estate market), healthy companies seeing ripple effects start belt tightening as well. And in the event that the full (or majority of) deposits from SVB are eventually released to the bankrupt company, where do you think that money goes? Right back to the shareholders. Employees are still screwed.
Piercing the veil makes sense in a typical situation where a company has gone bankrupt and they need to find a way to meet their final obligations, but it's a little more complicated in this situation. There are plenty of healthy companies that will be healthy again once the FDIC is able to release deposits.
> Even if the extremely unlikely scenario plays out and companies are unable to make payroll, employees are very unlikely to walk out, it would make an inconvenient situation (no pay) much worse (terminated) in an already challenging economic climate.
I don't understand how you can say this is an unlikely scenario. It is very likely, because a large number of startups are using one bank and that 250k won't cover much of their burn rate.
It also puts you in a terrible position to raise bridge rounds and other financing. Every investor and lender isn't incentivized to give good terms.
You’re conflating the amount insured and the amount that will be recovered. SVB has failed as a bank, it hasn’t failed as a place to have money. The money still exists, and while there’s a hole created by recovering immediate access to that money, it represents a very small haircut — maybe a few percentage points for each customer.
sure it may (in the long term) be a few percentage points of a loss. The problem is the timeline on which you get access to it. If you are a larger company, 250k won't cover much of your payroll. No banks are going to rush to buy these low interest securities unless they get a steep discount.
A company spending millions of dollars per year on payroll will have the relationships necessary to weather a storm like this. SVB made some very poor investment decisions but they didn’t light the money on fire: it’s not going to take years to liquidate. There is huge upside opportunity for buyers of assets from a distressed bank: the assets are worth less than what SVB paid (hence the crisis) but are not worthless. We will have to wait and see, and perhaps my optimism is naive, but I struggle to see a situation in which these remaining assets can’t be liquidated in the coming weeks. Even pre-crisis, SVB held less than $200bn — that’s a small amount of money in the context of the US banking system. Apple alone has, what, $100bn?
The FDIC has taken control of the bank. In their last bond offering SVB lost 1.8bn$ from a 21bn$ sale. 8.5% seems like more than a haircut... and 8+% to get the money you need now is a steep cut that will result in larger consequences.
8% might seem like a stubbed toe, but these are _bonds_. You aren't suppose to lose anything. 8% inflation, 8% from bank failure and add-on the additional losses from non-bond related issues... S&P500 at 1% for the year but from mid-2021 it is down nearly 10%.
> It also puts you in a terrible position to raise bridge rounds and other financing. Every investor and lender isn't incentivized to give good terms.
Why wouldn't a lender lend in this scenario? It's almost zero risk.
It wouldn't be a good negotiating position if there was no other lenders, but there would presumably be plenty of lenders interested in providing a "small" bridging loan in a situation like this. And those lenders will have to compete.
Smells like blame shifting to me.
He shouted the sky is falling.
Maybe it was, maybe it wasn't.
SVB was a pretty big bank and was clear in its representations.
Maybe he shouldn't have played Chicken Little, initiating the precise scenario the bank warned against.
I wonder if he even realizes what much of the rest of America _already_ thinks of Silicon Valley, and how much more he damaged the perception of SV / YC by basically asking for a government bailout while the ink was still wet and before any payrolls etc were missed (and which may not even happen)
Gonna be some new faces at some board meetings soon!
And by new I mean a buncha old guys from Wall Street or private equity who are going to buy a seat at some “disruptors” and then explain how things are going to work now.
On top of that: there is no meaningful risk that these startups will not be made whole in the coming weeks. Given the absence of risk, there will be plenty of lenders competing to provide these companies with liquidity for a relatively small slice of the pie, should it even come to that.
> there is no meaningful risk that these startups will not be made whole in the coming weeks.
Wow, two very bold claims here:
1. they will be made whole
2. in a few weeks
For 1. I think this is very unlikely to happen. Absolutely account holders will get some money back, but I would be pretty surprised if it was 100%. Regarding number 2. I would be even more shocked if anything more than the FDIC insured amount was returns within "a few weeks".
However you are claiming that there is "no meaningful" probability these will not both happen. Do you care to elaborate on this more because I have heard nobody with any experience in this space making claims like this?
If they sell SVB to another bank, it will probably guarantee 100% of it because the alternative makes all customers of small banks a lot more nervous about their accounts.
The FDIC will cover the portion that they couldn't recover from bank assets. The depositors will be made whole (up to $250k), but it may take some taxpayer money to do that.
The subject of OP's post is the non-insured deposits.
No one, yet, has expressed doubt on the credit of the FDIC.
Sub 10% of SVB's deposits were insured. Meanwhile SVB's HTM bonds have taken a 20%+ loss which will, barring an acquisition, cause non-insured deposits to take a 19%+ haircut.
Combined with an indeterminate period of waiting. So start ups with cash in SVB should expect to lose 20% and find alternative sources to make payroll, pay payroll taxes, and pay suppliers. I expect we will see many startups close us shop when founders are unwilling to bail out their own company's balance sheet with personal money.
In 2008, when startups started to fail, many colleagues left to work for large old established firms. Some others left banking on ne started new ventures. Turnover accelerated.
If we go through an event of the same magnitude, the economy and people will adapt, because history taught us so.
SVB’s failure is only a symptom of the wider environment in as much as it failed because of a focus on handshakes over proper management. The comments on the FT are illuminating: bankers can’t understand how they didn’t hedge for interest rate risk.
> Even if the extremely unlikely scenario plays out and companies are unable to make payroll, employees are very unlikely to walk out, it would make an inconvenient situation (no pay) much worse (terminated) in an already challenging economic climate. Anybody with the financial means to walk away because payroll has been missed is someone with the financial means to ride out a few weeks waiting to be paid.
Even if employees don’t walk out, they can file a wage claim and collect penalties. Any retaliation for filing a wage claim is illegal and would result in more penalties.
FDIC isn't stupid; they're issuing IOUs and these companies can borrow against the IOUs. It's not like this is a minor bank failure; everyone knows about it.
“Receivership certificates” aren’t really IOUs (they are more “defunct entity owes you”). The DFPI takeover and FDIC receivership is, effectively, a kind of “bankruptcy” for the bank.
> these companies can borrow against the IOUs.
What amounts to an IOU from a bankrupt entity is…not very good collateral for a loan.
> It’s not like this is a minor bank failure; everyone knows about it.
Right, and everyone who isn’t already exposed wants to stay out of the blast radius, not jump into it.
Oh come on, uninsured creditors will get back at least 90c on the dollar when the dust has settled. Likely 100c. So yes, they can absolutely use the IOU to cover short term expenses.
Dude. Could you please tell us how much money the thousands of depositors (both individuals and companies) who were above the FDIC limits at IndyMac Bank lost in total, when the bank was taken over by FDIC in 2008?
And lessons were learned! This is not 2008 repeating itself. SVB is unusual in how much exposure they have on interest rates, on both sides of the balance sheet. There is no contagion, and the bank is still an asset worth many billions.
The liquidity problem gets solved by merging this bank with a bigger and more liquid bank. The insolvency problem is solved by wiping out the stockholders and bond holders will get a haircut. I get why people panic, but the issues here can be resolved cleanly and speedily.
Wiping out stockholders has no effect on solvency, since stockholders only have a claim on residual assets. Bondholders getting a haircut or being wiped out addresses solvency, stockholders getting wiped out is just a side effect of dissolution without surplus assets.
Technically true, but when a distressed bank gets sold where does the money go that's paid by acquiring party? Stock holders are last in line. Employees who are due wages are first in line. We can guesstimate how large the hole is and how much SVB is worth. The money that would otherwise go to stockholders during an acquisition will now be used to fix the balance sheet.
Yup. And that was even after the FDIC limit was raised from $100k to $250k, and amazingly was even made retroactive back to January 1, 2008, to try to help those poor people out.
They're going to send out some money this week, but the value of the IOUs will depend on how much they can sell the bank's assets for. Certainly less than face value. It's going to be hard to borrow against that.
Their assets were higher than their liabilities. This is a liquidity problem, not a solvency problem. Everyone got their money from Lehman Brothers, and everyone will get their money from SVB. But not everyone is going to get it right away, because it is invested.
the ious are actually receiver's certificates, and as i understand it, borrowing against receiver's certificates is a commonplace thing to do in cases like this
> Anybody with the financial means to walk away because payroll has been missed is someone with the financial means to ride out a few weeks waiting to be paid.
I agree with the rest of your comment, but not the implication of this sentence. Riding out not getting payed is extremely risky with very low to no reward. Those that could ride it out are much better off quitting and making use of their time for interviewing - or anything but working for free.
Yep. I didn't get paid for a month once and road it out. I did get paid eventually, but in retrospect, I should've just left. There were bigger troubles down the line.
This. A company being unable to make payroll, even only one time, is a pretty huge flashing warning light that the company is very close to the edge of a cliff.
Yeah, I have years worth of runway and could probably retire if I wanted to live a more frugal lifestyle, but I don't work if I'm not getting paid period.
>> Anybody with the financial means to walk away because payroll has been missed is someone with the financial means to ride out a few weeks waiting to be paid.
Everyone should maintain the ability to miss a few paychecks. And everyone should know to start a job search the moment a company misses payroll or even looks like it might.
Sure, and everyone knows that their favourite person in the world could just run them over in a car and kill them in seconds, but if your best friend says to you, “you know, I could drive my car into you and you would die… your life could be snuffed out with a moments notice” you may start to question your friendship.
Well, the big difference is that the bank CEO's statement doesn't suggest that he will or could do something awful himself.
It is indeed quite common to hear aphorisms like "live every day like it's your last" which make the same point as your analogy, but remove the suggestion that the speaker could be a murderer and are thus much more analogous to the bank CEO's statement.
The relevant similarity is the *act of making* the statement is what’s problematic. In both cases the statement is true, but the act of making the true statement raises concerns.
Obviously there are important differences between the scenarios, but that critical aspect is what‘a relevant in this context.
Perhaps a dumb question but container breakouts are a problem for all sorts of services which have been addressed in different ways. Since your goal is not to prevent container breakouts but rather securely run third-party code, why did you choose to use EC2 over something like ECS or Lambda or Google Cloud Run which is already dealing with the security aspect on your behalf? Virtual machines seem less secure and less convenient.
Good question. Our goal is not just to run arbitrary code but to run it fast and cache rework. We are a CI service and speed is important. Brandon may be able to jump in with why not various options but it's hard to beat giving users powerful cloud machines to run their builds on.
I myself did try to run buildkit in a Lambda as I think that would be low cost option. But I found it you couldn't make gRPC calls against a lambda and that is a hard requirement for us.
Some of the reason we went with EC2 over something like ECS is that we would need to run the container in privileged mode for some of our features to work. We also considered options like gVisor, but ultimately the EC2 route was a simple enough implementation that made it easy to manage the user's cache volumes, etc. We're also hoping to use Firecracker VMs in the near future.
Security is layered. A backup code is only useful with the password, and your password is only useful with a second factor. You can be fairly liberal with storing your backup codes: make a couple of copies, keep them in secure places (one at home, one in your office). I agree that backup codes aren’t perfect but they’re pretty robust.
The site has been pretty unstable recently. The headcount cost reduction is worth much less than the additional cost of lost ad revenue + interest payments. Twitter was break even pre-Elon and is now down billions per year.
Severely is overselling it.