Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Encryption Security

Saga Of TriStrata 46

Posted by Hemos from the fun-with-company-start-ups dept.
dav writes: "Fortune is running an article which provides an inside narrative on the trials of the infamous encryption software company TriStrata. Featuring venture capitalist follies, Bruce Schneier, International CEO hopping and more. "
This discussion has been archived. No new comments can be posted.

Saga Of TriStrata More

Saga Of TriStrata

Comments Filter:
  • Barksdale managed to eeke out a little something from Netscape. A billion here, a billion there, pretty soon you're talking about real money...
  • And analyses like this still don't get read by wannabe Crypto-millionaires. Checkout Ciphile [ciphile.com] for the latest in unsubstantiated claims and mixed-up terms. There is an eerie similarity in the misuse of OTP and faith in the product's PRNG.
  • unfortunately this is an all too common scenario. theres are plenty of startups where the management are generally clueless fuckheads and the engineers /coders have to take all the heat from the generally incompetent idiots who run the place. and then they get stabbed in the back by clueless salespeople. The reason the company failed was not because of bad technology per se since a lot of companies exist providing crap, but because the CTO left. Lack of good technical guidance can make or break companies and this is one that broke. Lets face it - this was a fairly decent project and one which could have sold reasonably in the market, if it had been completed & executed properly.
  • i agree with you on this, more or less, but it should also be noted that there are plenty of startups (more, perhaps, than your example) which are started on the basis of a cool technical idea that has no reasonable revenue model. you've not only got to have a product to sell, but also people to sell it to.

    i don't like sales guys any more than the next engineer, but sales and marketing are a crucial part of the long term success of a company.
  • The mentioned Bruce Schneider review of TriStrata's system is here [counterpane.com].

    --

  • The story isn't about Company A v. Company B. Its a story about how Company B failed, why it failed, and the personalities involved. That is fascinating stuff.

    Rant all you want about how of-course-someone-has-to-win. But read the story for the interesting parts, not the parts that give you diarrhea of the keyboard.
  • Beirne said: "Now, I've marketed a lot of things that people said were stupid--Netscape was one of them."

    Yikes! Clark and Barksdale made out ok fer trying a "stupid idea".
    ~`~`~`~`~`~`~`~`~`

  • This story seemed to be all about the people, so halfway through I decided to "jump to the end" and go see who exactly is running TriStrata right now.

    Low and behold, look what happened when I tried:

    TriStrata's Management Team [tristrata.com]
    http://www.tristrata.com/corporate/team.htm

    Is it just me, or are there a bunch of non-existant pictures on that page? It looks like they are changing people so fast, they don't even have time to updates the links. The only constant is Mr. Atalla, who will probably still be on that page the day TriStrata files for Chapter 11 bankruptcy protection.

    Sad.

    - JoeShmoe

    -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-
  • I think you're right about the stock challenge theory, but you may have been mislead by the first part or two of the article focussing on the choice the VC had to make.

    Yes, there was an element of, "this man can't live with himself because the company he didn't invest in made millions", but it's not the main story.

    The story is about some interesting personalities in venture capital and in cryptography. It's much more focused on venture capital though, especially how you know when your investment is lost and it's time to leave and move on. A difficult decision we have all had to make in different areas of our lives.

    I thought it was interesting because I used to be an avid lurker in sci.crypt.* and I heard about this when it happened. But I heard the technical, scientific side of it. i.e. why a psuedo-OTP is not any kind of OTP at all. I did not get to see the financial/investment side of it, meet any of the players involved.

    The bit about the man being upset at his wrong choice was really a throwaway at the end of a really good story.
  • IANAVC, but my impression from the article is that this is not, "how things are done", but more of a warning of what can happen if they are done that way. If you recall from the article, the other partners were very concerned about completing due diligence before investing. That they changed their minds, of course, means they weren't concerned enough.

    The story painted the other partners as much more mature and more analytical, but they got sold, and they got burned. Don't get sold, don't get burned.

    Oh, and when companies do due diligence it's usaully accompanied by a hoarde of lawyers to make sure no one feels any incentive to take the information/business plan/whatever & go start something new up.
  • P.S. I forgot to point out that the author should have known better, since Randall E. Stross both the article in question and the book I quoted from! ;-)
  • There are apparently a *lot* of lemming investors out there. priceline.com (PCLN) lost 6.99/share and has a P/E ration of 0 still. They're still building their business by leveraging their ridiculous "reverse auction" patents so their not making a profit yet is not that alarming. I wonder what's going to happen when a competitor challenges their patents? That's really all they have is their "intellectual" property. Has the motley fool [fool.com] done a writeup on PCLN? I'd be interested in their thoughts.

    Priceline.com stock quote [siliconinvestor.com]

    I'd have to agree--software industry has lots of vapor-ware--stock market has even more "vapor-share" ;-)

    -core
  • Where are mod points when you need them.
    This is so subtle, yet so brilliant.

    Good work!
    Be thankful you are not my student. You would not get a high grade for such a design :-)

  • You've got to be suspicous of someone whose main claim to fame is inventing PIN numbers.

    Lets see:-

    Maybe our customers need a password for the ATM so people who steal thier cards can't clean out thier accounts.

    We can only afford to put numeric keypads on the ATMs so we can't have a proper password like we have on our other computers.

    GEE why don't we have a passnumber instead!

    Great idea but "passnumber" sounds dorky. Lets put is through our TLA generator.

    BINGO we have a PIN!

    ___@ö

  • There are signal processing techniques (essentially a FFT, adding the encrypted data there, IFT+phase shift) that let you add information to a noisy channel such as a radio such that the transformed channel is statistically indistinguishable from a normal noisy channel as long as you don't add too much information, in a certain precise sense.
  • really thats interesting...do you or someone else have a link?
  • No, what I was proposing was that it is impossible to diffrentiate from noise. For instance take a naturally noisy channel such as radio can you add information to such a channel in a way that the additional signal is only reasonably detectable by a party which possesses a secret key.

    I imagine it is common for companies/governments to wish to communicate but do not wish others to know they are communicating. Broadcasting an encrypted message would certainly draw sucsipicion but if instead they could add their signal to radio noise on an unused frequency the other party possessing the secret key could then recover the message with no one else being the wiser.
  • As to your other point most encryptions are very easy to diffrentiate from true noise. For instance they possess headers well deliminated start and stops of messages etc..

    Moreover there is no necesity that encryption is undectable as such. While patterns in the output are *usually* indications of weakness in the crypto this is by no means a guarantee. I could modify DES by making its output 1128 bits with every other bit a 0 with no loss in its security. In fact it may be the case (I don't know if anyone else has superior knowledge please tell me) that it is possible to distingush the output of say DES and Blowfish without having any knowledge of the key or secret message.
  • ... some blow it.

    The good thing is - more chances come later on. No matter what walk of life you are on: Business, Technology, everything. People make billions in Food (Philip Morris anyone?). People make billions in Tobacco (Philip Morris again?). People make billions in other industries besides technology. All of them have opportunities to make it big.

    Didn't anyone ever teach you not to kick yourself when you're down? It only keeps you from catching that second opportunity, and then you only kick yourself even harder.
  • To my knowledge, "perfect security" means that without the key, you cannot decrypt the message. So far, the only encryption scheme that meets that criterion is the One Time Pad scheme.

    Here's a quick description of how it works. (I've changed the implementation to be more computer-friendly. It was originally stated in terms of a pad of random letters used to generate alphabet rotations.)
    It requires that Alice have a big pool of random (not pseudo-random) bytes. Alice and Bob (the person she is communicating with) have the same sequence of random bytes. Alice XOR's the first byte of her message with the first byte of her random pool. She then XOR's the second byte with the second byte from the random pool. She continues until the message is encrypted. She now sends the ciphertext to Bob who can then XOR the first byte from his random pool (same as Alice's) and recover the first byte. In this manner, Bob can read the entire message.

    Eve (the nasty evesdropper) can intercept the ciphertext, but without the key, the ciphertext could mean anything. Every possible message can be encoded as the same ciphertext given the appropriate key.

    Of course, few people use this scheme because it is insanely impractical. Distributing huge amounts of truly random data is difficult at best and dangerous at worst. (Eve could just start stealing your keys if you have to ship them all over the place.)

    However, the original point of this thread (I think) was to discuss actually hiding the data so that one would not even be sure data was transmitted. Intelligence agencies can get a lot of data from just traffic analysis, so steganography is still an important part of transmitting secret messages, but technically not part of the definition of "cryptographic security."

  • this idea has actually been practiced before. dont ever trust stuff you hear on the net or on the business channel or even those "buy" or "hold" or "sell" ratings the big guys put out. they always make such statements to benefit themselves- ie they tell people to "buy" when they already own lots of shares, so they can sell at a peak. there is a limit to how much they do this, but its really more common than a lot of people think.

    you hear those stock brokers doing this kind of thing a lot. they dont care about whether you win or lose money, they just make commission off every trade. so they stir up the market a bit by giving people advice. its called "churning". its pretty evil.

    unc_
  • Right, but claiming and having are two different things. TriStrata [tristrata.com] made a claim but offered no substantial proof on which to rely. When was the last time you took Microsoft seriously when they claimed their NT Servers are "extremely secure"? Same thing here, more or less.
    ---
    icq:2057699
    seumas.com
  • And even things that really are stupid aren't necessarily poor investments. Witness eBay and Amazon and any of another thousand sites that have IPO'd.
    ---
    icq:2057699
    seumas.com
  • Now that deserves an IPO!
    ---
    icq:2057699
    seumas.com
  • If you think this is funny (it is) then you should read Start Up, a book by Jerry Kaplan.

    In short, Kaplan and the founder Lotus had a brilliant insight one day: that pen-based computing was the way of the future. Kaplan started GO corporation; attracted millions of dollars in venture capital; employed hundreds of people; produced a product; got crushed by Microsoft, IBM, and their own business partners; got taken over by AT and then the product got shelved and everyone got fired. The end.

    It's not the best writing in the world, and I doubt the authenticity of the reconstructed conversations, but it's worth a hundred Microserfs. You should read it.
  • There seems nothing which makes it impossible to embed a signal in some predetermined sort of noise which is computationally extremly difficult to extract without the proper key (i.e. it resembles noise very very closely). If a company patented such a technique there seems to be no reason they couldn't make money on it.

    Resembles noise very very closely, and can't be extracted without the proper key?

    You've just described *ALL* strong encryption.

    That's exactly why Steganography isn't "secure". Strongly-encrypted data looks like random. The more secure it is, the more it looks like random.

    When you stick random noise into something that has patterns (which is what Stegangraphing some ciphertext is) it is easy to detect, unless the "something" is really really huge with lots of places in it where randomness can occur and be replaced easily.

  • As to your other point most encryptions are very easy to diffrentiate from true noise. For instance they possess headers well deliminated start and stops of messages etc..

    That's not the encryption, that's the delivery system.

    PGP adds headers, for instance; but PGP isn't an encryption algorithm, it's an encryption PROGRAM. IDEA is an encryption algorithm. It's largely indistinguishable from random noise.

    I could modify DES by making its output 1128 bits with every other bit a 0 with no loss in its security.

    Yes, it's certainly possible to modify an encryption algorithm to insert pointless data that has nothing to do with the encryption, and is there simply to make it identifiable.

    But since we were talking about trying to *HIDE* information, why would anyone in his right mind do that?

    I mean, you could also print the ciphertext out, and write "DES ENCRYPTED" in 3-inch purple letters across the top. To then try to stick that stack of paper into another stack and say "I hope nobody notices that part's encrypted" is asinine.

    A more effective technique would be to stick a GIF header at the beginning of the data, and then claim it must have gotten corrupted. That's called "lying", and it's a very effective security technique. :-)

  • Also, you can't tell what algorithm was used given a data stream and nothing else.

    The Japanese diplomatic cipher "Purple" was broken with access only to the ciphertext. This was a far more spectacular feat than the breaking of Enigma because Purple was a lot more advanced as well as the algorithm being unknown. It hasn't gotten the same attention as Enigma though, probably because the impact on the war was not as great.

    Determining what algorithm was used to produce a data stream is a problem in the same class as the halting problem. Such problems are not always unsolvable- there are many easy instances. In practice all algorithms get implemented on finite-state machines in which case the problem is never truely unsolvable, but can be intractable.

  • The U.S. military has been doing this for years. All that you need is a CDMA spread spectrum system with a high chip rate driven by a cryptographically secure PN sequence generator. Cesium beam atomic clocks are used to synchronize the transmitter and receiver.
  • As to your other point most encryptions are very easy to diffrentiate from true noise. For instance they possess headers well deliminated start and stops of messages etc..

    Most ciphers don't have headers (can't think of any that do). The output of a cipher is indistinguishable from noise. The only reason for headers is to make it recognizable on purpose (such as in pgp).

    Moreover there is no necesity that encryption is undectable as such. While patterns in the output are *usually* indications of weakness in the crypto this is by no means a guarantee. I could modify DES by making its output 1128 bits with every other bit a 0 with no loss in its security. In fact it may be the case (I don't know if anyone else has superior knowledge please tell me) that it is possible to distingush the output of say DES and Blowfish without having any knowledge of the key or secret message.


    You lost me there, but if you modify DES it wouldn't be DES anymore. Also, you can't tell what algorithm was used given a data stream and nothing else. Essential, the person would have to attempt brute force the stream using all known algorithms. The block size might be able to be detected if the stream has a lot of repeating data - but assuming the data was compressed first you will not be able to determine anything.

  • From reading the story, it sounds like their problems stemmed from the fact they invested quickly in something they had no clue about. They did not take the time to consult with technical people, nor did they consult with customers who might have purchased the product.

    1. Consulting with technical people would have told them two things:

    a. one time pads are not possible without key management issues which makes their system the same as what is already out there (from what I gather from the article).

    b. Even if they invented some sort of holy-grail of encryption AND somehow everyone agreed it was 100% secure, people wouldn't pay money for it when good solutions are exist for free or very low cost. Call up the patent owners of IDEA, and ask them if they've made $100 million licensing their product.

    2. So where is the money being made from encryption? RSA, and Verisign, Certicon. Why? Because of the browsers. If you've got the greatest thing in the world, it's not going to be integrated into the majority of browsers until many years from now. Until then, no one gives a damn. Web sites want seamless usage for everyone, not some fancy thing that is just going to confuse people.

    Other uses of crypto: Selling VPN hardware, smart cards, etc. In my opinion the VPN market is already served well by existing algorithms. Chips for doing 3DES are cheap and trusted. The one place were a faster/easier to implement algorithm would be adopted is smart cards - where price per unit out weighs licensing cost. From my talking with smart card makers this is a very niche market still and there is more talk than money floating around.

    Not too long ago some researchers at IBM discovered an encryption algorithm that had some properties you could prove. It was neat stuff, and it made a big splash in the press for a few days and we never heard of it again - because there is no market for new crypto algorithms.

    But, hey... what do I know... I STILL think priceline.com is a bad idea.

  • Beirne said: "Now, I've marketed a lot of things that people said were stupid--Netscape was one of them."

    Yikes! Clark and Barksdale made out ok fer trying a "stupid idea".

    Um, that was the point. Just because the "experts" say that something is "stupid", doesn't mean that it isn't worth investing in. Of course, that doesn't automatically make it worth investing in either.
  • For instance despite all this talk about steganography no one seems to have come up with a mathematically secure algorithm for hiding the existance of data.

    Wrong. It depends on the specifics of your problem. We have very good plausable deniability algorithms (i.e. yes mr. police man it's encrypted.. here's my key.. snicker snicker I gave you the wrong key and you can never prove I did not) which are provably correct. I do not know about more traditional steganography, but I assume there are some information theoretic and statistical results which are useful for making "mostly" correct algorithms. Specifically, I would expect that near maximal compression would remove almost all statistical information from the data. You could encrypt the compressed data with an algorithm which preserves maximal information (i.e. dose not make the message any longer). Finally, you would use hide result as physicaly reasonable perterbations. Now this last step is a scientific step and not a mathematical one. This means someone who dose better experements on the physical effect you are simulating might notice. We should not expect this last step to be mathematically correct. We should expect it to be physically reasonable.
  • When will people figure out you can't make money from crypto anymore (at least not the kind TriStrata tried to sell)? Sure, RSADSI did, but that's because they had a monopoly on public key crypto. Yeah, people will make money selling PGP, B-SAFE, and what-have-you, but it won't be because you have technology the other guy doesn't. Because all of it is in the public domain. Nobody uses IDEA (except for PGP, and I think most people would agree that was a mistake on PRZ's part). Why? Because it's patented and good alternatives exist. And that is the case for basically everything cryptographically related now (with the exception of some protocols like digital cash, and RSA, which is public domain in September).

    And anyway, even the digicash stuff, RSA, IDEA, whatever, is peer reviewed. TriStrata refused to release any real details about their scheme. And in crypto, that's about equivalent to admitting "it's insecure".
  • If a company patented such a technique there seems to be no reason they couldn't make money on it.

    Of course. But if such company had a technique which was actually insecure (or at best no more secure than any other commonly available scheme), then claimed it had, in fact, was so secure that it was impossible to break, would that be very responsible? That's just what TriStrata did.
  • There is one blatent error in this article:
    "It marked a milestone: a $100 million valuation for a company that had yet to collect a penny of revenue."

    This is not true. This milestone was first reached in late 1986-early 1987, when H. Ross Perot put up $20 for a 16% stake in NeXT, putting their total valuation at $126 million. See Randall Stross' Steve Jobs & The NeXT Big Thing. (The Stross book is quite informative, but very one-sided and incomplete book. I though about doing a review here, but I've got other irons in the fire right now, and I'm not sure how much interest there would be in reviewing a book nearly a decade out of date of more interest to business majors than programmers...)

    - Lawrence Person
  • I have to chime in here and agree that it is quite amazing.

    I mean, this 75 year old guy who thought it'd be great to use just a measly four digit number (the PIN number) to protect my bank account comes up and says he's got impenetrable encryption software? And they buy into it?!?!

    Heck, my name being Doug, I had to make sure my PIN is not 3684 (or 3604), etc, lest someone getting access to my finance information by spelling my name on a phone-dial pad. Other things you have to make sure your PIN is not are the 2-digit month and 2-digit day of your birth, the 4 digit year of your birth, the year you graduated (or will graduate) from HS, etc. It's no good to have all four digits be the same, etc. Guidelines, guidelines, guidelines. All this stuff whittles down from the 10,000 PINs I can choose from.

    I personally HATE the fact that my liquid assets are protected by a lousy 4-digit number. This is the guy I'm gonna trust with the security of my Fortune x00 company (well, if I had one, that is )?

    For example, I choose my Linux passwords carefully enough so I know a dictionary attack or a couple days of brute-force wouldn't figure them out. But you can (if you go through my garbage or somehow obtain my bank account numbers) figure out my PIN in less than 10,000 attempts.

    It seems to me that this VC was either starstruck or just plain stupid.

    He should look at investing in Telecommunications Products, Inc. next! They have no product, two 71-year-old employees (Mr. & Mrs. Ranninger) and they're supposedly pushing Infrared data communications up to 6 km at OC3 speeds. Ha ha ha ha ha! Check it out at http://biz.yahoo.com/p/t/tlcre.ob.html (for a good laugh, anyway...). (HINT: this, err, "company" is obviously some kind of tax haven, so don't run out and invest in it until you do your own due dilligence.)

  • There seems nothing which makes it impossible to embed a signal in some predetermined sort of noise which is computationally extremly difficult to extract without the proper key (i.e. it resembles noise very very closely).

    It sounds like you are looking for something like spread spectrum [ncafe.com] technology. In terms of transmission via radio, traditionally we use narrowband methods. FM 102.1 has a big bunch of energy that is easily visible around 102.1 MHz. Even if you encrypt it you know something is there.

    Spread spectrum [tapr.org] disperses the signal across a larger bandwidth so unless you know where to look, it appears that there is only background noise. It appears there is no data at all. The receiver needs a code that matches the transmitter so the receiver can know where to find the transmitted signal.

    This is the technology that is used in CDMA [qualcomm.com] - Code division multiple access. The method that Qualcomm uses for PCS. There are a lot of interesting advantages that this method has over TDMA and FDMA (Time, Frequency).

  • If the encrypted output of DES and Blowfish could be distinguished without knowledge of the key, the algorithms would be deeply flawed, since that would imply that internal structure of the algorithm was leaking into the ciphertext. A classical analogy would be the Enigma system: no letter could ever encrypt to itself, making it possible to distinguish Enigma ciphertext from random gibberish. In general, the existence of a distinguishing attack usually means that that a true attack on the underlying security of the algorithm is possible.

  • Tristrata... (Score:3)

    by Anonymous Coward on Saturday April 08, 2000 @02:57PM (#1143607)
    as in three strata. That's three, not one, not two. Five is right out as the correct number is three. Three is the number of strata, and the number of strata is three.

  • question from the clueless (Score:3)

    by unc_onnected ( 6084 ) on Saturday April 08, 2000 @07:42PM (#1143608)
    after reading the article im completely flabbergasted. is this the way venture capital really works? do these guys really have no idea what it is they are putting their money into?

    i mean honestly, its hard for me to believe. these guys are throwing hundreds of millions, collectively throwing in billions, of dollars into investments- technology- promises they dont seem to understand?

    i dont know, man. i mean, if you need to hire a consultant to tell you what the product is, maybe you dont have a good enough understanding to do a deal, y'know?

    the other thing that surprised me was the due diligence thing. considering the competitiveness of the business, the way these v-c are jumping around looking for the next rocket up the nasdaq, and the way that every good idea in the business has probably been thought of by at least 3 different people, would i really want to let people see my business plan **before** getting a commitment from them?

    i mean, seriously, thats just no good. maybe im too conservative and not cut out to be an internet millionaire, but id be really scared of making myself that vulnerable to someone who does not even necessarily have any loyalty to me or what i want to do. theres nothing to prevent the company from saying no politely and then taking your ideas to someone else who will give them a bigger cut or a better deal.

    please, someone enlighten me. this stuff just doesnt make any sense.

    unc_

  • Not Someone to Fight For (Score:3)

    by SPrintF ( 95561 ) on Saturday April 08, 2000 @03:39PM (#1143609) Homepage
    I loved this quote:

    Smart guy. He's not someone I would fight for, except that all the engineers are there because of this guy, and he's got all the knowledge in his head.
    Hmmm... let's see. The Chief Technology Officer understands the product. The guys in the know, the engineers, work for him because they respect him. He and his "worker bees" are the only reason that TriStrata has a product but he's not someone to fight for!

    TriStrata convinced Benchmark to invest in the cryptographic equivalent of a perpetual motion machine, and no amount of input from the folks who actually understood the technology could divert them.

    It frightens me, sometimes, realizing that the reigns of the "New Economy" are held by clueless wonders who imagine that every problem can be solved by handing out free pens and a warm handshake.

  • Re:question from the clueless (Score:3)

    by boojum_uc ( 122395 ) on Saturday April 08, 2000 @09:50PM (#1143610)
    You seem to be laboring under an assumption that I used to have before I started working for corporate clients-- namely, that they have even the smallest clue what they're doing in regards to technology.

    Remember, everyone in the business world is suddenly in the technology business as IT becomes part of everyone's core competancy. Worse, there aren't enough people with skills (particularly in the corporate/money sector) to give them any reasonable advice about what the best choices to make are. I'm constantly terrified because I work as an advisor on a pretty high level, and while most of my advice (except in the tiny areas where I really am a subject matter expert) boils down to "find someone who knows what they're on about", many of the people I meet doing a similar thing give advice on things with which they have absolutely no experience. Best example was that I recently met a consultant engaged on generating a report for an investor on a possible architecture-component-of-networks business. Six months ago, this guy was in medical school, but now he felt that he didn't need any subject matter expert to assist him in writing his recommendation on whether to invest because he 'knew the consulting methodology'. He was from a name brand consulting firm who you'd all recognize and who is often called in to provide advice in the due diligence phase of investments. It's really frightening.

    And, you're right, there are serious drawbacks to taking VC money. They're going to expect to have a say in your company and god help you if you don't have someone who's strong enough in sales to sell your vision to the people who are funding you. There's a good article in FindLaw [findlaw.com] that summarizes some of these issues.

  • I don't think its impossible for acompany to make money on crypto...just not on conventional forms of cryptography.

    For instance despite all this talk about steganography no one seems to have come up with a mathematically secure algorithm for hiding the existance of data. With existing steganographic software it is relatively easy to scan the low bits of a jpeg or etc.. to pull out the data. Or determine that two companies are sending data back and forth.

    There seems nothing which makes it impossible to embed a signal in some predetermined sort of noise which is computationally extremly difficult to extract without the proper key (i.e. it resembles noise very very closely). If a company patented such a technique there seems to be no reason they couldn't make money on it.
  • I'll admit that I did not actually read the article very carefully... mostly because my first reaction was so strongly "So what!"

    As far as I can tell, the story is that some guy said that he wanted to invest in X, wound up investing in Y; X made a bunch of money and Y lost money... and the guy has sour grapes (but still wants to toot his own horn). Of course, some *other* investor *did* invest in Priceline, and now they want to convince you they have a crystal ball into the "new economy".

    Y'know I *could have* invested in VA Linux the day of the IPO, and made a zillion dollars. In fact, I even mentioned to a couple friends that I thought it was worth watching... but in real life, I didn't buy that, and I'm no more precient than the next guy.

    Actually, it's kinda like the birthday paradox, and other cognitive limits that people seem to suffer about large numbers, groups, and probabilities.

    Here's two related examples. I was having a talk recently where these came up. Someone suggested that I should play one of those "online investment games"; the idea of such is that each "player" gets a certain amount of make-believe money, and for a certain time each player makes imaginary stock trades. At the end of a period of time, the player with the most make-believe money "wins". Of course, what they win isn't all the real money, but just gloating rights... or maybe in a few cases a token prize like some free trades on an online brokerage that sponsors the game.

    My observation is that it will *ALWAYS* be an extremely high-risk investor who wins these contests. The reason is simple. Say 100 players join the contest. 20 of those might take extremely high-risk strategies. The other 80 take comparatively low-risk strategies. Of the 20 high-riskers, 19 do worse than the overall average, probably half of them actually wind up losing (make-believe) money. But still, one of the high-risk choices proves right. At the end of the "game" the winner is always a high-risk players... but the "winningness" of a high-risk strategy is still probably less than that of a low-risk one. The result of the game really doesn't show you anything about what is best to do with real money... although a lot of people will be lulled into thinking it does.

    My conversant pointed out a old scam related to this principle. Here's the scam (don't actually do it, it's illegal and wrong... but it does show the way people misunderstand the groups they belong to and their probabilities). (e)Mail a predication to a sufficiently large group of people. Could be a stock pick, could be a racetrack result, something where picking the right answer could actually make money. But don't mail the same prediction to the whole group, instead split the prediction by subgroups. For simplicity, say your group is 4096 people (easy with all those spam email lists), and your prediction is just Stock X goes up or Stock X goes down. You've just emailed 2048 people the wrong predication, and they think you're an idiot. OK, fine. Now take the 2048 people you "predicted" the right thing for, and repeat the procedure: 1024 get one prediction, the other 1024 get the opposite. Same thing again. Whittle down as you go.

    Now let's say you do ten runs of this. The remaining 4 people have just seen you make an accurate prediction *TEN* times in a row. That's quite a record for something hard to predict, no?! Now you need a story about your secret method that outwits the economists/horse-racers/whatever, and is sure to keep picking the right results. But sadly, all your money is tied up right now in blah-blah-blah (all the winnings from the previous rounds). So you really just need some people to invest in your next round of prediction, and you will take only a small cut of the big winnings.

    Now take the money and disappear. Hope the cops don't catch you. People want to believe certain things, especially when it's a way to get money for nothing (you should see me filtered-spam archive with hundreds of similar offers... or look at your own INBOX, most likely). And surely anyone who can make *TEN* successful predictions without fail must be on to *something*.

    In other words, a stopped clock is right twice a day.

  • Encryption analysis (Score:4)

    by SEWilco ( 27983 ) on Saturday April 08, 2000 @04:44PM (#1143613) Journal
    The Fortune article refers to concern about Bruce Schneider's Counterpane [counterpane.com] references to TriStrata and his TriStrata encryption analysis [counterpane.com].

    Interesting analysis. And the central servers which had to be secure were running NT...

Slashdot Top Deals

Always draw your curves, then plot your reading.

Close