Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Svalbard, Have I Been Pwned and its ongoing independence

troyhunt.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#51

Post by snowwrestler »

I don’t think he actually wanted to sell HIBP. He was way more focused on providing detailed constraints for the future of how it should be run, than in listing its assets and how those might benefit the future owner.

I think what Troy actually wanted was resources and support and management for his vision of the future HIBP. That’s not usuallY what a sale is, and it sounds like he paid a lot to learn that lesson.

It seems to me like Troy treats HIBP as a mission, not a business, and in the US at least, a nonprofit would be an option to organize financial resources around a mission. As a private company, he could seek investment from like-minded folks with deep pockets, but that would likely come with external pressure to show a profit.

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#52

Post by peterburkimsher »

notlukesky wrote: post #42

Anyone have a clue who the potential acquirer was? Just curious as to whether they wanted the brand of Troy Hunt as the databases are public and most technically savvy organizations can put one together.

My personal guess is Mozilla (not sure whether Corporation or Foundation). Their mission and vision seem to align well with Troy's views on privacy and security, but for reasons unrelated to HIBP, they're cutting costs.

https://techcrunch.com/2020/01/15/mozilla-lays-off-70-as-it-...

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#53

Post by 345218435 »

nreilly wrote: post #45
notlukesky wrote: post #42

Anyone have a clue who the potential acquirer was? Just curious as to whether they wanted the brand of Troy Hunt as the databases are public and most technically savvy organizations can put one together.

My guess is PIA

pakistan international airlines?

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#54

Post by Thorentis »

Sorry but, how is Have I Been Pwned anything but a text search of data that is already publicly available?

Normally a company is valuable because of some kind of value add. Either they generate data nobody else can, or they do something with that data nobody else can. HIBP does neither of those things. It literally searches one column of a database, and tells you if there was a match. You could run HIBP using a total of 1 SQL query, with a fancy template in front. It's essentially just a hobby project of a software dev. who wants something to do on the side. It is infinitely more valuable to Troy as a resume booster than to any company.

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#56

Post by tomschlick »

mike_d wrote: post #31

I appreciate what HIBP does, but I believe it serves Troy's personal brand more than it would any corporate owner. The biggest issue is the data is super stale. Things regularly pop up in SpyCloud 6-12 months before HIBP, and as a result they are a much more attractive acquisition target. There is also an unreasonable dependency on CloudFlare kool-aid for HIBP and his other services. I reached out to Troy about spons…

> There is also an unreasonable dependency on CloudFlare kool-aid for HIBP and his other services.

How it is unreasonable? Do you criticize the hosting platform / cdn of every service you use?

CF has been a huge help to Troy with optimizing caching and helping him with the k-anonymity setup to make the scale of HIBP possible with less infrastructure. Their network is top notch (sub 10ms for most population centers) and they are trying to give back to the broader community by donating the bandwidth and cache to greater good projects like this.

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#57

Post by peterkelly »

westmeal wrote: post #9
LennyWhiteJr wrote: post #8

Damn that sounds like an incredibly exhausting experience, and all he got out of it was... a hugely expensive bill. All I can say is props to him to keeping his principles, I really hope he's be able to grow HIBP into a sustainable gig for himself and a small core team.

Seeing people hold onto their principles is pretty damn rare nowadays.

The world needs more people like Troy.

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#58

Post by peterkelly »

Thorentis wrote: post #54

Sorry but, how is Have I Been Pwned anything but a text search of data that is already publicly available? Normally a company is valuable because of some kind of value add. Either they generate data nobody else can, or they do something with that data nobody else can. HIBP does neither of those things. It literally searches one column of a database, and tells you if there was a match. You could run HIBP using a total…

From the article:

"Anyone can cobble together a website with some APIs and load in a ton of data breaches, but establishing trust is a whole different story. Trust in the way I run the service is an absolutely pivotal part of HIBP and it's something I built organically rather than setting out to earn it, now here I was with big companies putting a value on it."

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#59

Post by web007 »

airstrike wrote: post #22

Sorry, but the more I read this, the more I feel like KPMG is the main reason for the failed process... > And so in September, we granted exclusivity to a bidder. (...) And so began the extensive due diligence. KPMG had warned me about this phase right at the beginning of the process and from memory, the word they used was something akin to "onerous". You're supposed to have your ducks in a row before you launch the…

I'm curious if Mr. Hunt has ever been through either side of a diligence process.

Everything in his list sounds like what you need to check the audit and compliance boxes at any "real" company. I've been through a dozen audits from prospective _customers_ that are worse than his description, even apart from our internal audits, so if someone was going to buy a company I'd expect essentially a superset of BS from all of those different inquiries. You sometimes answer the audit optimistically, then use that as your framework to write the policies and figure out how you're going to implement them before you submit your response. "How do you sanitize media for disposal?" "Oh shit, I guess we need a document that says how we dispose of media." - problem solved!

Yeah, it's rough. KPMG should have done their own diligence to see that he wasn't serious - if you're not willing to jump through some of those hoops then you're not ready for a big-boy company.

Re: Project Svalbard, Have I Been Pwned and its ongoing independence

#60

Post by pgodzin »

armitron wrote: post #36
illumin8 wrote: post #24

Earlier quoted context omitted.

Yeah, all I can say is "ouch." I went through a very similar courtship process with a large tech unicorn and luckily my outcome was good, but halfway through the process I basically had to ask them to give me 5 figures in legal fees because I was paying a huge bill to attorneys and the power dynamics between single person startup and unicorn are huge. They were spending 6 figures on attorney fees and I was spending a…

It’s a database with public data. Let’s not get carried away.

> I kid you not, was in a meeting at [big tech company] HQ in [HQ location] and a comment was made to the effect that "there is only one service they trust as a white hat (Troy and HIBP) and I'm like "fuck how does one guy corner the market on trust?"

That's invaluable

Post reply on HN