Michael_Murray

With that mindset, you’ll have a few million dead people (who are not contributing to the economy) by Christmas.

Nobody who’s talking “reopening” is thinking about the drain on our society that so many dead will be.

This is not a mutually exclusive choice, but “YOLO” isn’t a good risk management theory.

We have talked about “pull off the bandaid”- to have 200M people get the disease means we’re going to lose somewhere between 1-2M people (just in the US).

Doing that quickly means hospitals and morgues overflowing with dead from COVID.

We HAVE talked about this from the beginning - this is the point of “flattening the curve”. If we let a million Americans die in a short time, it’ll tank the economy and overwhelm our healthcare system and ability to treat not only this disease but all others at the same time.

It’d be one thing if we were testing and tracing to try and limit. But this YOLO strategy is a recipe for complete chaos.

Even more inportantly: we don’t understand the long term impacts for those who survive. What is the 5-year mortality rate from complications? The US DOD has already decided that COVID infection disqualifies you for future military service (ostensibly because of the lung complications, but they haven’t said why formally yet).

The YOLO strategy that some folks are proposing is insane given how much we don’t know about this disease. It would be like proposing in 1982 that we get everyone infected with AIDS so we had “herd immunity”. Think about how that would have worked out for us... and then tell me that it’s a good idea to do it this time.

There may be a time when we know enough to make smart risk decisions about this disease, but less than 6 months after emergence isn’t it.

That's actually an incredibly short-sighted risk calculation that intentionally weighs some unknowns as higher value than others.

For example, I can make the same kind of argument in the opposite direction: if UBI creates a disincentive within inner cities for fewer kids to become drug dealers, which creates less opportunities for violence, leading to significantly less deaths in the inner city, I think that you are making "an incredibly unfair and callous assessment" as well.

Saying that any plan that transfers risk from the current state to a different state that is potentially net better for all is to miss the point that we've already chosen a system that disadvantages SOMEONE... and to change it will probably disadvantage someone different.

This. Every guy on the planet should have to understand the deep meaning of this when relating to women.

I have no inside information, but the pattern suggests to me a plausible explanation. And I'm typing on my phone, so I might not explain fully.

Suppose I were wanting to overinflated the value of my business to show to investors or for another reason - I could create an account that had within it a large additional amount of fiat (by entering that value in the DB).

Then, I have an idea... Using that fake deposit, I can start buying BTC. And, as long as the price of BTC is going up, I'm actually printing money and making real fiat out of the initial fake deposit.

This works as long as the price continues to increase and people continue to trade - if either of those factors trends down, the fake fiat will be noticed.

Unwinding this becomes tricky - if you sell too fast, you cause the price decrease. And if anybody gets wind of it, they'll abandon ship.

In some ways, this has an analogue in what happened at Lehman and AIG. The CDO market worked as long as the default assumptions were right and the value of the underlying assets continued to appreciate - as soon as they didn't, the margin requirements wiped out all of their reserve capital.

It also reminds me a bit of QE - the "printed" fiat was inserted in to the market and used to purchase assets in a way that supported the market. When he easing stops, if the value of the assets can't be supported by continuing market pressure, the market for those assets crashes.

Some of the other stories on the topic seem to indicate the most likely indicator here - calls to 911 are automatically matters involving "law enforcement", and are shared between countries.

It's actually something I hadn't considered before - if you call 911 for an ambulance, that info goes in to police records/databases related to your name even if not about an arrest.

The lesson here isn't about secret sharing - it's that if you (or someone you care about) has an issue that may be used against you later, do everything in your power to go to the hospital yourself rather than calling 911.

It depresses me to think I just wrote that.

Thanks. I watched my partners struggle with wives and kids. Me, I only had a wife and cats... which made it easier in some ways, and harder in others....

I was in the same spot a few months ago....

http://railsapps.github.io/rails-prelaunch-signup/

I'm on my 5th company. The first 3 failed so miserably that there's not even a crater from where they imploded. The fourth had one of the founders usurp control and steal >$1M from the rest of the team and we were left exactly where you are - tapping 401Ks, taking our savings to $0 (and in some cases <<<< $0) and with terrified wives/kids/families/pets.

The 5th hit $10M in revenue in 3 years (completely bootstrapped).

Everyone else has great advice here - I just wanted you to know that there are others who have been where you are.

Much as everyone else expressed... if there's anything I can do, please reach out. mmurray / at / MAD Security.

As my high school calc teacher explained to me...

"Infinity isn't a number. Infinity is a process".

Of course this happens the week after I submit my sample.... ;-)

This is one of the funniest things I've read in forever. Some of those lines need posters.

"You can’t just place a LISP book on top of an x86 chip and hope that the hardware learns about lambda calculus by osmosis."

IDS was only one example.

When technology evolves, we tend to break the things that we used to work around the limitations in the previous technologies.

There's a whole suite of technologies in security that rely on the idea that we can look at packets as they travel to figure out if anything malicious is going on - Intrusion Detection Systems, Data Loss/Leak Prevention, Deep Packet Inspection Firewalls, Web Content Filters, etc. Each of those systems relies on the ability to see the unencrypted traffic - to "spy" on users, as someone else so snarkily put it.

As SSL has become more prevalent, we have turned to (as someone else pointed out) terminating the encrypted traffic once it's on a "trusted" network so we can do that - but, if HTTP/2 is ONLY over SSL, there will be no "termination" - it will be encrypted from one end to the other.

That means that all of the traditional security technologies will be completely blind to anything that happens in that communication stream.

I wasn't bemoaning progress - I think this is a good step. But it's also a step toward a temporary lack of security as the organizations catch up. It's because the security industry is a trailing industry (by definition) - you can't build a product that fixes security issues until you know: a) what the issues are, and b) how to fix them.

So, for a while, the early adopters of HTTP/2 are going to fly without a net somewhat.

(FYI - this same set of discussion points applies to IPv6 adoption)

This made me sigh.

Don't get me wrong... As a lifelong time security guy, I'm happy to see more encryption. But implementing more security at one layer adversely impacts security at other layers. (e.g. IDS)

We're really bad (as a species) at unintended consequences....

Lots of us working on this problem. We're focused on the insight and machine learning pieces.

https://www.fitoop.com

Send me a note for an invite.

Flight booked. Can't wait.

I entirely agree on the large number of companies who do crappy work in the infosec industry... there's a lot of them, especially in the penetration testing realm.

We're not one of them. Nor were any of my previous teams whether they were at my companies or at companies I worked for (whose names you definitely know).

"Prominent name" is a marketing thing as much as anything... I'd be willing to put the accomplishments of our teams up against most. Hitting $10M in revenue in under 3 years building a security firm with no investment and no debt isn't something I'm going to feel too bad about, even if we don't spend a lot of time making a big deal about that.

You're making the classic mistake of thinking that a company that makes a lot of noise is the same as a company that does great work.... those venn diagrams sometimes overlap. And sometimes they don't.

I'm not saying that's the only step in design... In my attempt at brevity, I lost the nuance.

The point I was trying to make is that if you're taking the view that your users need to have a significantly higher than average the level of knowledge in a domain area (i.e. equivalent to the knowledge of the domain area that the product designer has), you're going to end up with an un-usable product for the left end of the bell curve of your user population.

That left end of the bell curve is relative (as you point out) to your user population, but exists nonetheless - an "idiot" radiological engineer is not an idiot in relation to the general population, but is one in relation to the 99th percentile best radiological engineer (and, hopefully, in relation to the radiological engineer building your product).

What I was trying to say is that a well-designed UX requires that the 1% "idiot" of your target user population still knows what to do...

A co-worker sent this one to me... I wouldn't say those are my favorite 3 (though I've read them all).

1. The Goal - Goldratt 2. The Phoenix Project - Gene Kim 3. Lean Startup - Eric Reis

Actually, that's backwards... You know that something is well designed precisely by pretending to be an idiot, and asking yourself if you still know what to do...

Just re-read and saw this: ".... if I were going to jump into....recruiting startups, I would try to make it look as much like personal network hiring as possible..."

Funny about that: I started exactly that with a friend at a Startup Weekend a while ago... we didn't go anywhere with it: http://www.findexpert.co/

We also found that these guys did the same thing: https://ooomf.com/

Great thoughts in this one, but missing what I think is the biggest key to hiring correctly in the startups I've been part of is what Paul DePodesta said in Moneyball - ""What gets me really excited about a guy is when he has warts... and the warts just don't matter."

I've always thought that hiring in a startup is really like what the A's had to do in Moneyball - you don't have the advantages in terms of money, facilities, and even equity value of some of your much better funded competition for talent.

In that situation, you have really only three levers to pull - 1) give up more than you want (which is what I've seen too many people do); 2) sell the benefits of the startup life and your mission; and 3) find talent that can perform at a similar level that's undervalued.

The place that I've seen startup hiring really add value is when someone can be incredibly effective at #2 (which the author talks about) and they can develop a process that effectively hires for #3.

I've built my last couple of companies in the information security space and #3 is especially important, because there's a significant premium paid for high-value talent in our space. So, finding talent who can perform at an extremely high level whose "warts" don't matter has been a life-or-death matter for creating a company that can compete with those in the space that have more money (either through funding or scale).

What was that article the other day about "Stealing Traction" from an established player in an adjunct space?

Well played, HoneyDocs... Well played.

That was the sound of Linus dropping the mic.