WEBVTT CUE - 1 00:00:00.000 --> 00:00:07.000 And if you're in the loop about last week's dispute, the backend of platforms like OnlyFans and Privacy is problematic. CUE - 2 00:00:07.000 --> 00:00:18.000 Hold on, Paul Dawon. It wasn't me who said that, it was the famous influencer Mayumi. CUE - 3 00:00:18.000 --> 00:00:24.000 And it's from this premise she promised a new platform called Kippu. CUE - 4 00:00:24.000 --> 00:00:29.000 And you know what the problem is? The backend of this new platform got worse CUE - 5 00:00:29.000 --> 00:00:35.000 than when your mom calls you handsome. The idea was good, a more advantageous model for content creators. CUE - 6 00:00:35.000 --> 00:00:43.000 The premise, a disappointment. The competitor's backend is bad. And its execution was a disaster. CUE - 7 00:00:43.000 --> 00:00:50.000 And to begin with, if you're going to create a competing product, the premise should never be to have a better backend. CUE - 8 00:00:50.000 --> 00:00:55.000 Imagine calling an investor and saying: "Our fund is better than the competitor's." CUE - 9 00:00:55.000 --> 00:01:01.000 Firstly, complexity is hard to measure. What can be demonstrated is the side effect. CUE - 10 00:01:01.000 --> 00:01:08.000 Stability over the last x months, incidents, uptime, ability to operate under load. CUE - 11 00:01:08.000 --> 00:01:13.000 And I'm still wondering if this alone is a differentiator. CUE - 12 00:01:13.000 --> 00:01:18.000 But my talk here is not about complexity, it's about the size of the problem. CUE - 13 00:01:18.000 --> 00:01:26.000 Shortly after launch, a bunch of critics appeared. I love Brazilians, CUE - 14 00:01:26.000 --> 00:01:32.000 who smelled the controversy and came with that humorous criticism. 15 minutes were enough. CUE - 15 00:01:32.000 --> 00:01:39.000 A lot of threads appeared on Twitter, screenshots and memes about the security flaws of this new platform. CUE - 16 00:01:39.000 --> 00:01:44.000 This is because the premise was precisely a better backend. CUE - 17 00:01:44.000 --> 00:01:49.000 The point is that the dispute happened because the discourse was not well aligned with reality. CUE - 18 00:01:49.000 --> 00:01:56.000 She said in her video that she was joining with a lot of talented people, and right there people felt that CUE - 19 00:01:56.000 --> 00:01:58.000 vibe of pretension. CUE - 20 00:01:58.000 --> 00:02:02.000 By defect, the system failed in the basics of basics, authentication and authorization. CUE - 21 00:02:02.000 --> 00:02:06.000 And here I'm going to open a quick parenthesis, without giving a lesson. CUE - 22 00:02:06.000 --> 00:02:10.000 Do you know how many lectures I've given on this? CUE - 23 00:02:10.000 --> 00:02:15.000 How many texts I've written, this past weekend I lectured on this topic. CUE - 24 00:02:15.000 --> 00:02:18.000 This impactful news, it's to end the pressure from VE. CUE - 25 00:02:18.000 --> 00:02:20.000 Go for no-code, it's a new normal. CUE - 26 00:02:20.000 --> 00:02:24.000 The more you go no-code, the more you need to understand programming. CUE - 27 00:02:24.000 --> 00:02:28.000 Which aids in fast building and also helps you make mistakes quickly. CUE - 28 00:02:28.000 --> 00:02:32.000 Then, an adult around is a machine-gun of concepts. CUE - 29 00:02:32.000 --> 00:02:34.000 And given the size of this confusion, look... CUE - 30 00:02:34.000 --> 00:02:37.000 Backend is complicated, you can't fix it, it's not just no-code. CUE - 31 00:02:37.000 --> 00:02:42.000 To fix this mess, you need to take the kids out of the room and bring the adults. CUE - 32 00:02:42.000 --> 00:02:43.000 There's no miracle. CUE - 33 00:02:43.000 --> 00:02:46.000 Projects like this often turn into cursed works. CUE - 34 00:02:46.000 --> 00:02:49.000 You fix one side, another breaks. CUE - 35 00:02:49.000 --> 00:02:51.000 You're going to have to rebuild this bomb from scratch. CUE - 36 00:02:51.000 --> 00:02:56.000 And if you want more on themes of authentication, authorization, and cryptography, comment below. CUE - 37 00:02:56.000 --> 00:03:00.000 If there aren't at least a thousand comments, I won't make a video. CUE - 38 00:03:00.000 --> 00:03:02.000 Because I clearly don't want to talk about this here on the channel. CUE - 39 00:03:02.000 --> 00:03:04.000 It doesn't generate views, it doesn't generate likes. CUE - 40 00:03:04.000 --> 00:03:08.000 And as I didn't ask my mother, I just want an engagement number. CUE - 41 00:03:08.000 --> 00:03:10.000 So, Mané, let me ask you something. CUE - 42 00:03:10.000 --> 00:03:12.000 Do you already know Vera? CUE - 43 00:03:12.000 --> 00:03:15.000 Vera is a training platform for those who want to work as a dev, CUE - 44 00:03:15.000 --> 00:03:18.000 or intend to level up in the front-end field, right? CUE - 45 00:03:18.000 --> 00:03:23.000 We have over a thousand lessons with many exercises, tests, and a focus on what the market really demands. CUE - 46 00:03:23.000 --> 00:03:25.000 And most importantly, it's a living platform. CUE - 47 00:03:25.000 --> 00:03:29.000 We're always updating content with market news and changes. CUE - 48 00:03:29.000 --> 00:03:33.000 It's not a course for you to collect just for LinkedIn junk. CUE - 49 00:03:33.000 --> 00:03:36.000 It's for you to evolve in your career. CUE - 50 00:03:36.000 --> 00:03:38.000 Now we go to the part nobody likes. CUE - 51 00:03:38.000 --> 00:03:44.000 This problem isn't solved with a pretty interface, nor with talented engineers, as she said in the pitch. CUE - 52 00:03:44.000 --> 00:03:49.000 When the situation exploded publicly, that basic containment kit came. CUE - 53 00:03:49.000 --> 00:03:51.000 that everyone only discovers in the first incident. CUE - 54 00:03:51.000 --> 00:03:55.000 They postponed launches, indemnified those who paid, and erased leaked data. CUE - 55 00:03:55.000 --> 00:03:57.000 to reduce the risk of us being affected. CUE - 56 00:03:57.000 --> 00:04:02.000 And the promise, oh, delightful, remained that they will communicate later CUE - 57 00:04:02.000 --> 00:04:04.000 about what happened. CUE - 58 00:04:04.000 --> 00:04:07.000 And let's face it. I doubt they'll keep that promise. CUE - 59 00:04:07.000 --> 00:04:11.000 And here comes a boring detail that the hype crowd ignores. CUE - 60 00:04:11.000 --> 00:04:14.000 Incident communication is not an apology text with emojis. CUE - 61 00:04:14.000 --> 00:04:18.000 Incident communication is damage reduction so the problem doesn't worsen. CUE - 62 00:04:18.000 --> 00:04:23.000 You don't win a narrative with tweets, you win with efficiency, CUE - 63 00:04:23.000 --> 00:04:27.000 clear timeline, and concrete action with a bit of consistency. CUE - 64 00:04:27.000 --> 00:04:29.000 The right measure is usually without glamour. CUE - 65 00:04:29.000 --> 00:04:33.000 Suspend registration, block payments, revoke tokens, CUE - 66 00:04:33.000 --> 00:04:37.000 if necessary erase what's been exposed, remove, CUE - 67 00:04:37.000 --> 00:04:40.000 if it was exposed, register everything that happened and prepare a post-mortem. CUE - 68 00:04:40.000 --> 00:04:44.000 And given the quality of those renowned engineers, CUE - 69 00:04:44.000 --> 00:04:48.000 I doubt there's going to be a post-mortem or if they know what it is. CUE - 70 00:04:48.000 --> 00:04:50.000 And let's go, the public may even forget this, CUE - 71 00:04:50.000 --> 00:04:53.000 but the public doesn't forgive being treated like fools. CUE - 72 00:04:53.000 --> 00:04:56.000 And here comes the part nobody talks about production systems. CUE - 73 00:04:56.000 --> 00:05:01.000 Raising a platform is not the same as operating a platform. CUE - 74 00:05:01.000 --> 00:05:05.000 In production, the system not only faces load, it faces people. CUE - 75 00:05:05.000 --> 00:05:09.000 Curious people, malicious people, people trying to bypass the scheme, CUE - 76 00:05:09.000 --> 00:05:13.000 people automating the attempt to exploit something, CUE - 77 00:05:13.000 --> 00:05:18.000 that exploits any gap where your authorization became a timid ornament. CUE - 78 00:05:18.000 --> 00:05:21.000 And when the product involves personal data and payment, CUE - 79 00:05:21.000 --> 00:05:25.000 you're not building a site, you're building a target this big. CUE - 80 00:05:25.000 --> 00:05:27.000 And she forgot a detail in the pitch. CUE - 81 00:05:27.000 --> 00:05:33.000 They also don't mention that companies like Privacy and OnlyFans seem slow with the bad backend CUE - 82 00:05:33.000 --> 00:05:35.000 because they've also taken hits. CUE - 83 00:05:35.000 --> 00:05:40.000 They have layers and layers of protection because someone at some point paid dearly CUE - 84 00:05:40.000 --> 00:05:44.000 to do pentests, review permissions, audits, monitoring, CUE - 85 00:05:44.000 --> 00:05:49.000 rate limit, alerts, incident responses, refund processes, CUE - 86 00:05:49.000 --> 00:05:51.000 internal data access control, CUE - 87 00:05:51.000 --> 00:05:55.000 all this is the price of reality and the final irony is simple. CUE - 88 00:05:55.000 --> 00:05:58.000 In production, a bug is not just a bug. CUE - 89 00:05:58.000 --> 00:06:02.000 A bug is an event with cost, impact, and minimal traceability. CUE - 90 00:06:02.000 --> 00:06:06.000 Thinking that having pasta, post-mortem, is making the product attractive, CUE - 91 00:06:06.000 --> 00:06:11.000 is completely different from having a secure platform, a robust infrastructure CUE - 92 00:06:11.000 --> 00:06:16.000 and well-done tests. This is for adults and not for kids with good intentions and willpower. CUE - 93 00:06:16.000 --> 00:06:21.000 I work here with clients who go through serious audits, with clients, CUE - 94 00:06:21.000 --> 00:06:25.000 who process payment volumes in the hundreds of millions per hour, CUE - 95 00:06:25.000 --> 00:06:28.000 with operations that do not tolerate amateurism. CUE - 96 00:06:28.000 --> 00:06:31.000 And when I see a piece of news like this, it's at least sad, CUE - 97 00:06:31.000 --> 00:06:35.000 because people buy into a shallow narrative, buy marketing, buy this fanfic, CUE - 98 00:06:35.000 --> 00:06:40.000 and the reality is usually less fun and doesn't tolerate improvisation. CUE - 99 00:06:40.000 --> 00:06:45.000 And just to not become that "uncle" against innovation, who's allergic to new things, CUE - 100 00:06:45.000 --> 00:06:50.000 the problem isn't the "no-code" itself, the problem is that feeling of "wow, CUE - 101 00:06:50.000 --> 00:06:55.000 how quick," and this no-code speed quickly turns into "wow, CUE - 102 00:06:55.000 --> 00:06:59.000 disaster." And it's not the villain, it accelerates. CUE - 103 00:06:59.000 --> 00:07:04.000 Only there's people using this accelerator in a car without brakes, without a seatbelt, without a rearview mirror, CUE - 104 00:07:04.000 --> 00:07:07.000 thinking the destination is this beautiful MVP. CUE - 105 00:07:07.000 --> 00:07:11.000 No-code fails when it becomes an excuse to skip the boring parts CUE - 106 00:07:11.000 --> 00:07:14.000 that support in review, authorization validation, CUE - 107 00:07:14.000 --> 00:07:18.000 access tests, threat analysis, logs, monitoring, CUE - 108 00:07:18.000 --> 00:07:22.000 and mainly someone asking: "Does this make sense a month from now?" CUE - 109 00:07:22.000 --> 00:07:25.000 And look, all this I talked about requires, CUE - 110 00:07:25.000 --> 00:07:28.000 at the very least, a technical team at the forefront of this project. CUE - 111 00:07:28.000 --> 00:07:32.000 But given the way the flaws appeared, I'm left with a question, CUE - 112 00:07:32.000 --> 00:07:35.000 was it even a dev? Because an unprotected endpoint, CUE - 113 00:07:35.000 --> 00:07:39.000 talks about a college freshman, and even then, well... CUE - 114 00:07:39.000 --> 00:07:41.000 And then, you know the script. CUE - 115 00:07:41.000 --> 00:07:44.000 It helps you set up a registration flow in minutes, CUE - 116 00:07:44.000 --> 00:07:46.000 overcoming resistance in an afternoon. CUE - 117 00:07:46.000 --> 00:07:50.000 Integrate payment in two hours and if you lack criteria, CUE - 118 00:07:50.000 --> 00:07:53.000 it helps you make the most predictable mistake in the universe, CUE - 119 00:07:53.000 --> 00:07:56.000 confusing authentication with authorization, the logged-in user, CUE - 120 00:07:56.000 --> 00:07:58.000 so they can do everything? Of course they can, right? CUE - 121 00:07:58.000 --> 00:07:59.000 Without such care. CUE - 122 00:07:59.000 --> 00:08:02.000 Production is not a playground, the logged-in user is not, CUE - 123 00:08:02.000 --> 00:08:04.000 a green light for permission. CUE - 124 00:08:04.000 --> 00:08:07.000 If the backend doesn't check access for that resource CUE - 125 00:08:07.000 --> 00:08:10.000 in every request, people become explorers, CUE - 126 00:08:10.000 --> 00:08:13.000 without knowing, they'll become a profile there on social media. CUE - 127 00:08:13.000 --> 00:08:16.000 And it's no use blaming the speed then, CUE - 128 00:08:16.000 --> 00:08:18.000 because the speed only exposes what was already there. CUE - 129 00:08:18.000 --> 00:08:20.000 People, without a basis, are insufficient. CUE - 130 00:08:20.000 --> 00:08:25.000 But once it goes live, and some influencer with millions of followers CUE - 131 00:08:25.000 --> 00:08:28.000 announces this product, the reputation goes down the drain. CUE - 132 00:08:28.000 --> 00:08:30.000 And I'm not even going to comment about the influencer's reputation CUE - 133 00:08:30.000 --> 00:08:32.000 because the internet is already talking about it. CUE - 134 00:08:32.000 --> 00:08:34.000 After all, I'm indifferent to it. CUE - 135 00:08:34.000 --> 00:08:36.000 And I find it important to point out: CUE - 136 00:08:36.000 --> 00:08:39.000 No-code is great for prototypes, for taking risks, experimenting, CUE - 137 00:08:39.000 --> 00:08:42.000 to test an idea, but when going into production, CUE - 138 00:08:42.000 --> 00:08:45.000 it needs something else: responsibility. CUE - 139 00:08:45.000 --> 00:08:48.000 In the end, it wasn't destiny, it wasn't internet hype, CUE - 140 00:08:48.000 --> 00:08:52.000 nor the evil internet, it was the old classic, CUE - 141 00:08:52.000 --> 00:08:55.000 the urge to launch quickly and cut corners. CUE - 142 00:08:55.000 --> 00:08:59.000 Is it really that expensive to hire a professional to evaluate, CUE - 143 00:08:59.000 --> 00:09:02.000 to contract an audit? I know doing a pentest, CUE - 144 00:09:02.000 --> 00:09:04.000 with a company costs a fortune. CUE - 145 00:09:04.000 --> 00:09:07.000 But these decisions define whether this no-code, CUE - 146 00:09:07.000 --> 00:09:10.000 as it was done, that accelerated this delivery. CUE - 147 00:09:10.000 --> 00:09:12.000 Perhaps this perception was missing, CUE - 148 00:09:12.000 --> 00:09:15.000 this team may have saved tens of thousands of dollars. CUE - 149 00:09:15.000 --> 00:09:18.000 How much does it cost to google or ask an expert? CUE - 150 00:09:18.000 --> 00:09:20.000 I'm going to launch a SaaS. CUE - 151 00:09:20.000 --> 00:09:23.000 How to know if it's mature and what kind of company CUE - 152 00:09:23.000 --> 00:09:25.000 to hire to evaluate the operation's security? CUE - 153 00:09:25.000 --> 00:09:28.000 If they had done this, they would know if the product was good. CUE - 154 00:09:28.000 --> 00:09:32.000 And if you liked this chat, subscribe and share. CUE - 155 00:09:32.000 --> 00:09:33.000 If not, do the same. CUE - 156 00:09:33.000 --> 00:09:35.000 But your comment, I'll delete. CUE - 157 00:09:35.000 --> 00:09:39.000 I'll be here, drink water, eat fruits, and respect your parents.