Smyte

» see smyte.com as it lived, on the wayback machine

~ the last words ~

Twitter's announcement that it had acquired Smyte went out at about six o'clock on the morning of 21 June 2018, California time. Half an hour later Smyte's API stopped accepting requests. The customers on the other end of that API were running fraud and abuse checks inside their own signup and payment flows, which meant that for several of them the acquisition announcement and a production outage arrived as the same event.

npm's Laurie Voss wrote it down in public while it was happening: a vendor had notified them of an acquisition at 6am and shut down its APIs thirty minutes later. Another customer said they had received seven minutes of notice. Somebody else had a three-year contract. The phone calls that went out were not warnings, they were calls placed as the service was already going dark, offering to connect people with alternative providers.

Smyte was four years old. Pete Hunt had been on the original React team at Facebook, Julian Tempelsman had worked on anti-abuse for Gmail and Google Wallet, and Josh Yudaken came out of Instagram's infrastructure group. They sold what they called trust and safety as a service: a single API that scored signups and payments for fraud and harassment so that a marketplace or a crowdfunding site did not have to build its own. It raised $6.25 million in total, with a $4 million Series A led by Avalon Ventures in March 2017.

~ the record ~

~ who was behind the api ~

The client logos on smyte.com in its last year read like a census of the mid-2010s consumer internet: npm, GoFundMe, Indiegogo, Meetup, Musical.ly, OLX, Quora, TaskRabbit, Teespring, ThredUp, 99designs, Carousell. Most of those companies never mentioned Smyte to their own users, because that is how infrastructure works. The fake campaign that never collected money and the account takeover that got stopped at the door do not carry a brand.

Which is also why the shutdown made the news at all. For one morning the invisible layer became visible, by failing.

~ the apology ~

Mike Montano, Twitter's vice president of engineering, said on 22 June that the company could have done better and was learning from the experience. Twitter had told reporters before the deal closed that it would be winding Smyte's business down with existing clients, which is a phrase that implies weeks. What the customers got was measured in minutes.

The purchase itself made sense for Twitter. Abuse was the company's defining unsolved problem in 2018, and buying a team that had spent four years on exactly that was a reasonable move. The acquisition was never the controversy. The off switch was.

~ the dependency lesson ~

This is the part that lands for anyone who ships software, wherever they sit. I write code for a living in Ankara and the stack I depend on is full of services like this, bought from small companies whose roadmap I do not control and whose investors I will never meet. Nothing about being in Turkey changes that exposure, and nothing about being in San Francisco protected npm.

smyte.com today is a WordPress site put up by somebody else in 2024, unrelated to any of this, with the brand name still in the page title.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »