65 karma · joined July 4, 2013
Nobody who’s talking “reopening” is thinking about the drain on our society that so many dead will be.
This is not a mutually exclusive choice, but “YOLO” isn’t a good risk management theory.
Doing that quickly means hospitals and morgues overflowing with dead from COVID.
We HAVE talked about this from the beginning - this is the point of “flattening the curve”. If we let a million Americans die in a short time, it’ll tank the economy and overwhelm our healthcare system and ability to treat not only this disease but all others at the same time.
It’d be one thing if we were testing and tracing to try and limit. But this YOLO strategy is a recipe for complete chaos.
Even more inportantly: we don’t understand the long term impacts for those who survive. What is the 5-year mortality rate from complications? The US DOD has already decided that COVID infection disqualifies you for future military service (ostensibly because of the lung complications, but they haven’t said why formally yet).
The YOLO strategy that some folks are proposing is insane given how much we don’t know about this disease. It would be like proposing in 1982 that we get everyone infected with AIDS so we had “herd immunity”. Think about how that would have worked out for us... and then tell me that it’s a good idea to do it this time.
There may be a time when we know enough to make smart risk decisions about this disease, but less than 6 months after emergence isn’t it.
For example, I can make the same kind of argument in the opposite direction: if UBI creates a disincentive within inner cities for fewer kids to become drug dealers, which creates less opportunities for violence, leading to significantly less deaths in the inner city, I think that you are making "an incredibly unfair and callous assessment" as well.
Saying that any plan that transfers risk from the current state to a different state that is potentially net better for all is to miss the point that we've already chosen a system that disadvantages SOMEONE... and to change it will probably disadvantage someone different.
Suppose I were wanting to overinflated the value of my business to show to investors or for another reason - I could create an account that had within it a large additional amount of fiat (by entering that value in the DB).
Then, I have an idea... Using that fake deposit, I can start buying BTC. And, as long as the price of BTC is going up, I'm actually printing money and making real fiat out of the initial fake deposit.
This works as long as the price continues to increase and people continue to trade - if either of those factors trends down, the fake fiat will be noticed.
Unwinding this becomes tricky - if you sell too fast, you cause the price decrease. And if anybody gets wind of it, they'll abandon ship.
In some ways, this has an analogue in what happened at Lehman and AIG. The CDO market worked as long as the default assumptions were right and the value of the underlying assets continued to appreciate - as soon as they didn't, the margin requirements wiped out all of their reserve capital.
It also reminds me a bit of QE - the "printed" fiat was inserted in to the market and used to purchase assets in a way that supported the market. When he easing stops, if the value of the assets can't be supported by continuing market pressure, the market for those assets crashes.
It's actually something I hadn't considered before - if you call 911 for an ambulance, that info goes in to police records/databases related to your name even if not about an arrest.
The lesson here isn't about secret sharing - it's that if you (or someone you care about) has an issue that may be used against you later, do everything in your power to go to the hospital yourself rather than calling 911.
It depresses me to think I just wrote that.
The 5th hit $10M in revenue in 3 years (completely bootstrapped).
Everyone else has great advice here - I just wanted you to know that there are others who have been where you are.
Much as everyone else expressed... if there's anything I can do, please reach out. mmurray / at / MAD Security.
"Infinity isn't a number. Infinity is a process".
"You can’t just place a LISP book on top of an x86 chip and hope that the hardware learns about lambda calculus by osmosis."
When technology evolves, we tend to break the things that we used to work around the limitations in the previous technologies.
There's a whole suite of technologies in security that rely on the idea that we can look at packets as they travel to figure out if anything malicious is going on - Intrusion Detection Systems, Data Loss/Leak Prevention, Deep Packet Inspection Firewalls, Web Content Filters, etc. Each of those systems relies on the ability to see the unencrypted traffic - to "spy" on users, as someone else so snarkily put it.
As SSL has become more prevalent, we have turned to (as someone else pointed out) terminating the encrypted traffic once it's on a "trusted" network so we can do that - but, if HTTP/2 is ONLY over SSL, there will be no "termination" - it will be encrypted from one end to the other.
That means that all of the traditional security technologies will be completely blind to anything that happens in that communication stream.
I wasn't bemoaning progress - I think this is a good step. But it's also a step toward a temporary lack of security as the organizations catch up. It's because the security industry is a trailing industry (by definition) - you can't build a product that fixes security issues until you know: a) what the issues are, and b) how to fix them.
So, for a while, the early adopters of HTTP/2 are going to fly without a net somewhat.
(FYI - this same set of discussion points applies to IPv6 adoption)
Don't get me wrong... As a lifelong time security guy, I'm happy to see more encryption. But implementing more security at one layer adversely impacts security at other layers. (e.g. IDS)
We're really bad (as a species) at unintended consequences....
Send me a note for an invite.
We're not one of them. Nor were any of my previous teams whether they were at my companies or at companies I worked for (whose names you definitely know).
"Prominent name" is a marketing thing as much as anything... I'd be willing to put the accomplishments of our teams up against most. Hitting $10M in revenue in under 3 years building a security firm with no investment and no debt isn't something I'm going to feel too bad about, even if we don't spend a lot of time making a big deal about that.
You're making the classic mistake of thinking that a company that makes a lot of noise is the same as a company that does great work.... those venn diagrams sometimes overlap. And sometimes they don't.
The point I was trying to make is that if you're taking the view that your users need to have a significantly higher than average the level of knowledge in a domain area (i.e. equivalent to the knowledge of the domain area that the product designer has), you're going to end up with an un-usable product for the left end of the bell curve of your user population.
That left end of the bell curve is relative (as you point out) to your user population, but exists nonetheless - an "idiot" radiological engineer is not an idiot in relation to the general population, but is one in relation to the 99th percentile best radiological engineer (and, hopefully, in relation to the radiological engineer building your product).
What I was trying to say is that a well-designed UX requires that the 1% "idiot" of your target user population still knows what to do...
1. The Goal - Goldratt 2. The Phoenix Project - Gene Kim 3. Lean Startup - Eric Reis
Funny about that: I started exactly that with a friend at a Startup Weekend a while ago... we didn't go anywhere with it: http://www.findexpert.co/
We also found that these guys did the same thing: https://ooomf.com/
I've always thought that hiring in a startup is really like what the A's had to do in Moneyball - you don't have the advantages in terms of money, facilities, and even equity value of some of your much better funded competition for talent.
In that situation, you have really only three levers to pull - 1) give up more than you want (which is what I've seen too many people do); 2) sell the benefits of the startup life and your mission; and 3) find talent that can perform at a similar level that's undervalued.
The place that I've seen startup hiring really add value is when someone can be incredibly effective at #2 (which the author talks about) and they can develop a process that effectively hires for #3.
I've built my last couple of companies in the information security space and #3 is especially important, because there's a significant premium paid for high-value talent in our space. So, finding talent who can perform at an extremely high level whose "warts" don't matter has been a life-or-death matter for creating a company that can compete with those in the space that have more money (either through funding or scale).
Well played, HoneyDocs... Well played.
And the idea of "piggybacking" on other services that you know that users want isn't really new either... It's why Coke is the only cola you can get at certain baseball stadiums - Coke knows that people will come to the stadium and buy drinks, and they're "piggybacking" on that to drive demand in general.
It goes back to the design of DES - the NSA influenced small design changes in the SBoxes that had implications that only they understood. This gave an advantage, even though the algorithms were completely "open source".
http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...
In that case, they made the encryption STRONGER. But they certainly showed how that type of influence could happen.
I don't happen to be enough of a conspiracy theorist to believe that they're messing with Tor - there are better ways, especially when a vast majority of the traffic isn't through Tor.