Latacora: Security Programs For Startups
latacora.com
latacora.com
<!-- You can't know whether I'm exploiting a bias in the crappy JS -->
<!-- RNG to make my name first more often. Hah-hah. -->
document.addEventListener("DOMContentLoaded", function(event) {
var names = ["Erin Ptacek", "Thomas Ptacek", "Jeremy Rauch"].
sort(function(x, y) { return 1 - Math.ceil(Math.random() * 100) % 3; });
for(var i = 0; i < 3; i++) {
document.getElementById("n_" + i).textContent = names[i];
}
});
Good luck with the company, I hope you can also beat the RNG that makes or breaks a startup :)
If the function returns > 0, the first param should be sorted to a higher index than the second.
If the function returns < 0, the first param should be sorted to a lower index than the second.
If the function returns exactly zero, the parameters are left as they are.
So what we've got is a 1/3 of Erin 'winning', 1/3 of Thomas 'winning' and a 1/3 chance of a tie which leaves Erin ahead. So she's got a 2/3 chance of being first.
Additionally (but not in any consequential fashion), generating a random number between 1 and 100 (inclusive) gives you 100 possibilities (duh). With three outcomes:
100 / 3 = 33.333333333333336
Here's a Python solution showing it's not just JS:
link: http://paste.ubuntu.com/23222240/
results:
{
'Erin Ptacek': 6523,
'Thomas Ptacek': 1951,
'Jeremy Rauch': 1526
}
Even after changing the code to multiply by 99 instead of 100, the results don't change very much at all.
{ '0': 340364, '1': 330093, '-1': 329543 }
AHA, repro'd in Chrome latest: http://jsbin.com/cefuqi/edit?js,console
Also repros in node. Fascinating. There goes my afternoon...
Instead giving each name a distinct value (between 0 and 1) and sort based on those values.
It just so happens that in V8, the built-in sort uses an unstable quicksort for large arrays but a stable insertion sort for small ones, so the rest of your analysis is correct.
MS took advantage of this when selecting a random browser for the browser ballot years ago.
http://www.robweir.com/blog/2010/02/microsoft-random-browser...
> compareFunction(a, b) must always return the same value when given a specific pair of elements a and b as its two arguments. If inconsistent results are returned then the sort order is undefined.
It doesn't really matter what Math.random() is producing when the sort algorithm is undefined.
Some of the challenges I faced in trying to help startups: I needed to be paid in real money, which is tough for a startup. I didn't market myself at all (not even a webpage) which is just neglectful. And finally, surprisingly: frankly I found startups to have the worst legal advice and contracts. All of them went to their lawyers and came back with contracts that looked like employment agreements and frankly included worse terms than most employment agreements. I had my own agreement, but it didn't help much. I had a surprising number of deals fall through because of this. Part of it is I clearly allowed incorrect expectations, and part of it is, I think is if people haven't heard of you they just assume you'll be unrepresented and shocked when you don't just sign their standard "we put whatever we thought would be best for our client" contract and instead asked for a version for a lawyer to redline.
So frustrating. And for real, most startups didn't need that much of my time, so it became not worth it.
Instead I had a much better experience with a lot less pain (and frankly more interesting work) working on multibillion dollar public infrastructure contracts (train systems mostly) and focused on those instead. Go figure.
You'd expect startups to do better in this area than larger companies.
Thankfully Thomas is well known on the Internet, which I think will help a lot with startups. And it's a better model than what I was doing.
Anyway! Thanks for doing this! It's a huge unfilled area. Someone needed to and I hope it works well!
I don't know anything about Matasano, apart from seeing the name on HN frequently, but I was wondering if you already had a successful security consultancy and sold it, why set up another one? I guess this answers that question.
I am also curious: do you plan to value options when you accept those at whatever valuation is current and let other investors determine the rate? Or do you plan to try and determine option valuation yourself? How VC-like do you intend to get here? :)
We spent a few years working with lots of young startups at Matasano and we had the obvious learning experience: none of them, even the ones with traction, can afford the kind of security work that larger companies get. That's a problem we're hoping to address, at least for a small number of clients.
A seasoned security team would also be able to effectively avoid snake oil security consultants (no, you really don't need to encrypt the user's password with JavaScript before transmitting it to the server), which are all the more tempting to hire as they're generally cheap (run Nessus, print and deliver report...).
The next thing I'm actually shipping is the first batch of post-Starfighter challenges.
The next thing I'm actually writing is "what happened with Starfighter".
That's the critical final selling point for me. Great, you've taken security off my plate in a small business. But now I'm disengaged from the security side of things when it comes time to find the first full time security hire.
Very cool though. Good luck!
There's a weird adolescence that happens between those two points where we see people struggling to staff effectively.
We think we can get companies to a point where they've built a solid security program and run it for months before hiring for security --- and that the net result is that you're hiring that role more like how Jason Fried from Basecamp would say you should hire: when you understand the role so well that you know exactly why and how you should hire for it.
We could always be wrong.
I would apply.
Just asking out of curiosity, I've been dabbling in web/app security for the past couple years and know it's a very broad and deep field. I know about protecting against XSS, CSRF, SQL injection, and the basics of OWASP Top 10, but not sure what you'd be doing and how you would provide me service. Would it be an ongoing contract or a one time or as-needed service?
As a side note: http://lcamtuf.coredump.cx/tangled/ makes me feel like I've never considered the possibilities of anything thoroughly.
I should add, though, that I think a lot, maybe even most, startups don't need this, or dedicated security of any kind.
The second sentence sounds weird for me. Maybe I didn't understand because I don't speak English natively and I missed some kind of humor.
Good team for this. The prior experience will help them iterate more effectively into a model that works. Then others can copy it. Or they might even franchise it.
With a few good references and strong VC/Accelerator connections, this boutique consulting business should do fine. The question for me is how much pain is there on the board/founder (the key influencers/buyers of the service) compared to the cost of the services... or the risk of doing nothing.
On the flip side: we have the bandwidth for only a few clients (we're doing a lot of work here), so mutual selectivity is a win. :)
Question: Are you part of a fracturing of this? That people could hire you for security, postlight for front end, someone else for ecommerce / payments etc. I think I am asking is the postlight model distrusted, is hiring your style of team easier to fit around a growing team. What is the gap in the market you are seeing?
I like this idea, and hopefully it's self selecting. People who won't listen to good advice won't hire you in the first place !
Why is the birth of this particular (small) security consulting firm more newsworthy (in contrast to all of the others that have popped up)?
2. I don't know.
2. https://news.ycombinator.com/leaders (read #1)