Re: Ledger supply chain attack.
A friend @bitpunk.fm is typing was talking about exactly this supply chain attack 8 years ago at CCC:
https://www.youtube.com/watch?v=Y1OBIGslgGM
They downplayed him that he was "too James Bond". Well, the bounty increased and apparently "too James Bond" is an economical thing to do.
The seller of the company got lots of shit for selling the company, but I think this is wrong. It is Ledger's job to verify the supply chain (and keep things like notification of ownership change in the contract). It's not the previous owners' job. The contract is with the supplier, not with the owners.
Personal storytime:
There’s nothing wrong with selling a company - sure, you are selling the users, but nothing in the world forces you to own a company forever. Many entrepreneurs are building a "bankable business" (something you can sell - in contrast with "lifestyle business" - which pays the bills). And what happens to the company afterward really isn’t their problem anymore.
When I was selling my company, a friend did this nice little exercise with me. We were really stressing about who would buy it and whether it would be cool. He talked about valuation — there’s some research where you have an IKEA cup worth $2 and you’re asked whether you’d buy it. If they gave that cup to someone for a month and then had them sell it, they valued it higher (something like $4, I don’t remember the exact numbers), because it was no longer just a “random IKEA cup” — they had to part with *their* cup.
He explained to us that what we are doing is a rational transaction: we don’t want the company anymore, we want money instead, so we sell it, and then it’s not ours. What the new owner does with it has absolutely nothing to do with us. Whether the employees and customers stay happy is their problem, and we bear zero responsibility for whatever happens to the company afterward. The "due diligence" goes usually one way - the buyer wants to know about the company they are buying. The only thing you want to know about the seller is if they'll pay agreed amount.
So that reseller — in my view, basically didn’t do anything wrong. Ledger should have had this covered in the contract and properly vetted those suppliers, continuously. Ledger had a contract with a legal entity and didn’t bother checking at all whether they were up to no good.
I don't think it is possible to check the supply chain well though.
Anyway, Josh was right again. Listen to bitpunk.fm and you'll realise he's very often right.
A friend @bitpunk.fm is typing was talking about exactly this supply chain attack 8 years ago at CCC:
https://www.youtube.com/watch?v=Y1OBIGslgGM
They downplayed him that he was "too James Bond". Well, the bounty increased and apparently "too James Bond" is an economical thing to do.
The seller of the company got lots of shit for selling the company, but I think this is wrong. It is Ledger's job to verify the supply chain (and keep things like notification of ownership change in the contract). It's not the previous owners' job. The contract is with the supplier, not with the owners.
Personal storytime:
There’s nothing wrong with selling a company - sure, you are selling the users, but nothing in the world forces you to own a company forever. Many entrepreneurs are building a "bankable business" (something you can sell - in contrast with "lifestyle business" - which pays the bills). And what happens to the company afterward really isn’t their problem anymore.
When I was selling my company, a friend did this nice little exercise with me. We were really stressing about who would buy it and whether it would be cool. He talked about valuation — there’s some research where you have an IKEA cup worth $2 and you’re asked whether you’d buy it. If they gave that cup to someone for a month and then had them sell it, they valued it higher (something like $4, I don’t remember the exact numbers), because it was no longer just a “random IKEA cup” — they had to part with *their* cup.
He explained to us that what we are doing is a rational transaction: we don’t want the company anymore, we want money instead, so we sell it, and then it’s not ours. What the new owner does with it has absolutely nothing to do with us. Whether the employees and customers stay happy is their problem, and we bear zero responsibility for whatever happens to the company afterward. The "due diligence" goes usually one way - the buyer wants to know about the company they are buying. The only thing you want to know about the seller is if they'll pay agreed amount.
So that reseller — in my view, basically didn’t do anything wrong. Ledger should have had this covered in the contract and properly vetted those suppliers, continuously. Ledger had a contract with a legal entity and didn’t bother checking at all whether they were up to no good.
I don't think it is possible to check the supply chain well though.
Anyway, Josh was right again. Listen to bitpunk.fm and you'll realise he's very often right.
129❤️14👀2👍2:eyes:1🤗1🤙1
