10 ms·

I was just discussing this idea with friends the other day. It's definitely going to become big business, especially once these funds can take leveraged short p

I was just discussing this idea with friends the other day. It's definitely going to become big business, especially once these funds can take leveraged short positions. This is also a good way to finance very expensive investigative journalism. Just short the companies' you've found dirt on. Any idea why these models aren't huge already?

beachstartup 10y ago
> Any idea why these models aren't huge already? because successful traders don't tend to advertise their winning strategies. by the time some outfit like bloomberg is doing stories on it, rest assured it's already huge.
- tptacek 10y ago
  How could it be huge without continuous media stories tying major vulnerabilities to stock price drops? This is the first such story anyone I know directly has been involved in. Also: in 20 years of working with companies on vulnerabilities, never once has this ever come up.
- deleted 10y ago
  [deleted]
joe_the_user 10y ago
Well, There's a reason journalists have a code of (supposed) ethics. Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism (but hey, if this kind of business took off, things might be worth it).
- loeg 10y ago
  What is the ethical implication here?
  - _asummers 10y ago
    Presumably that one might opportunistically look for and find dirt that might not actually be there due to financial motivations to do so. I think this could be mitigated by being really careful with what you find and how you craft that narrative, but that concern is there. If the story is really there, though, I don't see much of an ethical dilemma.
    - cylinder 10y ago
      Where's the line drawn -- what if press releases don't get any attention? "Let's let the vulnerability continue until someone dies, then we'll explain why they died and get more attention." Or even worse, intentionally kill someone with the vulnerability to gain attention. What we need is some sort of qui tam lawsuit capability where a third party can sue device manufacturers when they have not suffered direct damages from the flawed device, and perhaps the government joins in, and then the third party receives a portion of the damages awarded. This already happens with Medicare fraud.
      - maxerickson 10y ago
        Murdering corporate officers would be a good short strategy for people comfortable with murder. How often do we think that happens?
    - tomp 10y ago
      That's highly illegal though ("stock market manipulation"), so I don't see a problem at all.
- hackuser 10y ago
  > Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism News organizations and journalists are desperate for viable funding models. Many have already violated long-standing ethics, such as by eliminating the 'firewall' between advertising and editorial, native advertising, etc.
fitzwatermellow 10y ago
Just ask Bill Ackman how well his activist naked short in Herbalife is going ;) http://www.bloomberg.com/news/articles/2016-08-27/icahn-mocks-ackman-s-obsession-after-raising-herbalife-stake http://www.bloomberg.com/news/articles/2016-08-27/icahn-mock...
- staticautomatic 10y ago
  Ackman is genuinely right about Herbalife. His mistake was thinking he could convince the fed to go after it and/or otherwise get it shut down.
  - rattray 10y ago
    Exactly
  - tptacek 10y ago
    Yes, and that is a case where he's right in an obvious, academic way that is clear from the numbers to pretty much anyone who seriously works in the markets (ie: the kinds of people who made decisions about the macro trades that really set prices in the market). But we're meant to believe that some doofus with an SQLI in some backend component is going to send GM tumbling? I am, let's be clear, prepared to be wrong about this. But I'm happy to give clear voice to the opposing viewpoint on this hack-and-short meme.
- Jefro118 10y ago
  While he didn't succeed in getting the FTC to sue them (which would almost inevitability lead to the company being shut down), they did end up passing reforms that will cripple the business if it is indeed a pyramid scheme. Not sure how it affects them outside the US but I think HLF is going to die over the next few years within if it can't make much revenue from recruiting.
- vostok 10y ago
  Do you have any evidence that he was naked short? I can't think of a way how this would be acceptable from a regulatory perspective. I think a lot of his short exposure was through derivatives rather than cash anyway.
Eridrus 10y ago
> Any idea why these models aren't huge already? People have looked at stock price impact from breaches & vulnerability disclosure before and found only very mild connections that revert themselves quickly. The only reason it seems to be working now is concentrated media attention, which doesn't seem like a repeatable strategy when the whole medical device sector is a tire fire when it comes to security. After the first few times the stock market should stop reacting to this sort of news.
- jhchen 10y ago
  Is there a study you can point to? I'd be curious to know the severity of the vulnerabilities. In the past companies have also been able to successfully cover up breaches. The media attention as you point out makes this more challenging, but in the post-Snowden era people are more aware and and concerned about security and privacy and researchers are getting better at explaining/marketing their discoveries (ex. Heartbleed). I can see breaches continue enjoying heightened attention across industries.
- dsfyu404ed 10y ago
  Tire fire as in it won't stop burning or tire fire as in nobody bothers trying to put it out?
- blazespin 10y ago
  If they are options expiry it just has to be short term to,make large, leveraged gains. The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
  - pliny 10y ago
    >The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down? >The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue? That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime. What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.
maxerickson 10y ago
Big short sellers do tend to try to get themselves in the media, and they certainly aren't going to shy away from investigating companies they believe provide opportunities (and then opportunistically sharing the results of those investigations).
jbuzbee 10y ago
"The Market Can Remain Irrational Longer Than You Can Remain Solvent" Attributed to economist John Maynard Keynes: http://quoteinvestigator.com/2011/08/09/remain-solvent/ http://quoteinvestigator.com/2011/08/09/remain-solvent/
- rz2k 10y ago
  People like to misinterpret Keynes, so it is worth stressing the "can" does not mean that it will in a strict sense. Similarly, "We're all dead in the long run," does not mean that whatever long run effect being discussed will wait until after we are dead either.
beambot 10y ago
There's precedence for this already in the form of Lumber Liquidators. But to use a more-prominent example: the researchers who disclosed VW's diesel efficiency issues could've made $1B+ from that investigation: http://www.travisdeyle.com/musings/volkswagen.html http://www.travisdeyle.com/musings/volkswagen.html
- jessaustin 10y ago
  They would have had to have been careful to do so in untraceable fashion. VW would have been all too happy to divert attention to the researchers' "greed" rather than VW's if there had been a whiff of impropriety.
mtgx 10y ago
> It's definitely going to become big business I almost hope that's going to happen. Why? Because absolute security catastrophes seem to be the only way for companies to start taking security seriously enough. And I'm not just talking about your random IoT/medical device company here. I mean big companies like Google and Microsoft, too. Google became more serious about security and encryption when it got hacked by the Chinese government. Then against after it discovered that NSA was inside its internal networks. And then upped its game for Android once Stagefright vulnerabilities came to light. And how many millions of viruses did it take to convince Microsoft to move to at least a security model/architecture like they built in Windows Vista/7? So perhaps others profiting big from discovering vulnerabilities in companies' products, and then shorting their stock is what's needed for these companies to significantly increase their security across the board. Is it ideal? Of course not. But if that's what it takes, then so be it. They could go nuts on the security front today, but they don't. They're waiting for the security disasters to happen first.
- emn13 10y ago
  Security catastrophes are unlikely to be sufficient to make companies take security seriously. After all, the PR damage seems limited (it's hard to blame someone for not understanding something you don't understand yourself), and the damage is often largely to third parties (i.e: customers). The people taking the risks aren't the ones paying the costs. And those paying the costs can't really tell who's taking the risks, nor judge well how it impacts them. It sort of reminds me of CO2 emmisions - and look how brilliantly that battle is going. This shorting is much better, actually - it impacts metrics companies actually optimize for, so it may actually affect behavior. Not only that, it allocates money to security research, creating a virtuous circle. But it's not all roses: it's only going to work as long as there's a stock market impact; and that's eventually dependent on security risks actually affecting the choices buyers make. That is uncertain. Most successful software has almost no competitors; software (well, and IP law) makes it trivial to create lock-in and software is trivial to mass-produce, so underdogs have a terrible time. For example: if you can effectively choose only between iOS and android, then you're likely to make that choice based on just a few of your top priorities (in CS terms: there's at most 1 bit of entropy here). Security may matter, but it's not going to have as much impact as it would in an actual proper market where there's sufficient choice for real competition to emerge.
cloudjacker 10y ago
"The Art of Short Selling" written by Kathryn Staley in 1997 should be in your book collection. Its been a business model all the way back to the 1850s. Software engineers are just late to the field, and now are much closer to the mechanisms that affect the market in many different industries.
- Inthenameofmine 10y ago
  Thank you so much! I was looking for some good reading material of this sort!
tptacek 10y ago
Is it? It's long been an article of faith among security pundits that short positions will (or even are, routinely) being used to liquidate security knowledge. But there aren't that many verticals in which vulnerability disclosures are really material to a company's underlying business. How many fewer iPhones would Apple sell if someone found a way to "jailbreak" the SEP? The difference would be a rounding error. How many fewer Jeeps will get sold if a new remote OTA car-crasher is discovered? What if Fiat Chrysler needs to do a product recall? Guess what: they already have to do those, all the time. Software vulnerabilities, however, can usually themselves be fixed OTA. Companies deployed hundreds of thousands of RF and GSM-connected smart meters. Almost all of them had massive OTA vulnerabilities. How likely were any of them to mess with smart meter deployment? Pretty much not at all. What we see with St. Jude is two cases in which vulnerability discoveries seemingly can have a material impact: * In medical devices, where the markets are already tuned into and ready to vigorously punish product recalls. * In M&A situations in regulated industries --- but then, that case is situational: you have to time your disclosure with an acquisition, and the flaw(s) you've found have to be so serious that they might delay the acquisition. I'm generally kind of skeptical that hack-and-short is going to be all that lucrative.
- blazespin 10y ago
  Sony hack sends stock down 10% in past week. Time that on option expiry, make zillions. Disclosing vulns, though, I,agree not a stock shorting business. http://money.cnn.com/2014/12/15/investing/sony-stock-hack/ http://money.cnn.com/2014/12/15/investing/sony-stock-hack/
  - tptacek 10y ago
    For that scheme to work, it has to actually work: you need an attack that can damage the fundamentals of a business. Most trades aren't made by randos reacting to the news: they're allocation decisions made by pension funds and endowments and mutual fund firms, all of whom are run by people who understand that if they dump a position when it's down 10% because of the news cycle, they are going to look stupid and potentially lose their job when it turns out that the news cycle had nothing to do with the fundamentals of the company and the stock recovers --- probably not from the hack, but from whatever macro trend is jostling the market that week.
retube 10y ago
Because it's massively risky. There's no guarantee your "dirt" will cause the stock to drop.

beachstartup 10y ago

> Any idea why these models aren't huge already? because successful traders don't tend to advertise their winning strategies. by the time some outfit like bloomberg is doing stories on it, rest assured it's already huge.

tptacek 10y ago
How could it be huge without continuous media stories tying major vulnerabilities to stock price drops? This is the first such story anyone I know directly has been involved in. Also: in 20 years of working with companies on vulnerabilities, never once has this ever come up.
deleted 10y ago
[deleted]

joe_the_user 10y ago

Well, There's a reason journalists have a code of (supposed) ethics. Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism (but hey, if this kind of business took off, things might be worth it).

loeg 10y ago
What is the ethical implication here?
- _asummers 10y ago
  Presumably that one might opportunistically look for and find dirt that might not actually be there due to financial motivations to do so. I think this could be mitigated by being really careful with what you find and how you craft that narrative, but that concern is there. If the story is really there, though, I don't see much of an ethical dilemma.
  - cylinder 10y ago
    Where's the line drawn -- what if press releases don't get any attention? "Let's let the vulnerability continue until someone dies, then we'll explain why they died and get more attention." Or even worse, intentionally kill someone with the vulnerability to gain attention. What we need is some sort of qui tam lawsuit capability where a third party can sue device manufacturers when they have not suffered direct damages from the flawed device, and perhaps the government joins in, and then the third party receives a portion of the damages awarded. This already happens with Medicare fraud.
    - maxerickson 10y ago
      Murdering corporate officers would be a good short strategy for people comfortable with murder. How often do we think that happens?
  - tomp 10y ago
    That's highly illegal though ("stock market manipulation"), so I don't see a problem at all.
hackuser 10y ago
> Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism News organizations and journalists are desperate for viable funding models. Many have already violated long-standing ethics, such as by eliminating the 'firewall' between advertising and editorial, native advertising, etc.

fitzwatermellow 10y ago

Just ask Bill Ackman how well his activist naked short in Herbalife is going ;) http://www.bloomberg.com/news/articles/2016-08-27/icahn-mocks-ackman-s-obsession-after-raising-herbalife-stake http://www.bloomberg.com/news/articles/2016-08-27/icahn-mock...

staticautomatic 10y ago
Ackman is genuinely right about Herbalife. His mistake was thinking he could convince the fed to go after it and/or otherwise get it shut down.
- rattray 10y ago
  Exactly
- tptacek 10y ago
  Yes, and that is a case where he's right in an obvious, academic way that is clear from the numbers to pretty much anyone who seriously works in the markets (ie: the kinds of people who made decisions about the macro trades that really set prices in the market). But we're meant to believe that some doofus with an SQLI in some backend component is going to send GM tumbling? I am, let's be clear, prepared to be wrong about this. But I'm happy to give clear voice to the opposing viewpoint on this hack-and-short meme.
Jefro118 10y ago
While he didn't succeed in getting the FTC to sue them (which would almost inevitability lead to the company being shut down), they did end up passing reforms that will cripple the business if it is indeed a pyramid scheme. Not sure how it affects them outside the US but I think HLF is going to die over the next few years within if it can't make much revenue from recruiting.
vostok 10y ago
Do you have any evidence that he was naked short? I can't think of a way how this would be acceptable from a regulatory perspective. I think a lot of his short exposure was through derivatives rather than cash anyway.

Eridrus 10y ago

> Any idea why these models aren't huge already? People have looked at stock price impact from breaches & vulnerability disclosure before and found only very mild connections that revert themselves quickly. The only reason it seems to be working now is concentrated media attention, which doesn't seem like a repeatable strategy when the whole medical device sector is a tire fire when it comes to security. After the first few times the stock market should stop reacting to this sort of news.

jhchen 10y ago
Is there a study you can point to? I'd be curious to know the severity of the vulnerabilities. In the past companies have also been able to successfully cover up breaches. The media attention as you point out makes this more challenging, but in the post-Snowden era people are more aware and and concerned about security and privacy and researchers are getting better at explaining/marketing their discoveries (ex. Heartbleed). I can see breaches continue enjoying heightened attention across industries.
dsfyu404ed 10y ago
Tire fire as in it won't stop burning or tire fire as in nobody bothers trying to put it out?
blazespin 10y ago
If they are options expiry it just has to be short term to,make large, leveraged gains. The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
- pliny 10y ago
  >The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down? >The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue? That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime. What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.

maxerickson 10y ago

Big short sellers do tend to try to get themselves in the media, and they certainly aren't going to shy away from investigating companies they believe provide opportunities (and then opportunistically sharing the results of those investigations).

jbuzbee 10y ago

"The Market Can Remain Irrational Longer Than You Can Remain Solvent" Attributed to economist John Maynard Keynes: http://quoteinvestigator.com/2011/08/09/remain-solvent/ http://quoteinvestigator.com/2011/08/09/remain-solvent/

rz2k 10y ago
People like to misinterpret Keynes, so it is worth stressing the "can" does not mean that it will in a strict sense. Similarly, "We're all dead in the long run," does not mean that whatever long run effect being discussed will wait until after we are dead either.

beambot 10y ago

There's precedence for this already in the form of Lumber Liquidators. But to use a more-prominent example: the researchers who disclosed VW's diesel efficiency issues could've made $1B+ from that investigation: http://www.travisdeyle.com/musings/volkswagen.html http://www.travisdeyle.com/musings/volkswagen.html

jessaustin 10y ago
They would have had to have been careful to do so in untraceable fashion. VW would have been all too happy to divert attention to the researchers' "greed" rather than VW's if there had been a whiff of impropriety.

mtgx 10y ago

> It's definitely going to become big business I almost hope that's going to happen. Why? Because absolute security catastrophes seem to be the only way for companies to start taking security seriously enough. And I'm not just talking about your random IoT/medical device company here. I mean big companies like Google and Microsoft, too. Google became more serious about security and encryption when it got hacked by the Chinese government. Then against after it discovered that NSA was inside its internal networks. And then upped its game for Android once Stagefright vulnerabilities came to light. And how many millions of viruses did it take to convince Microsoft to move to at least a security model/architecture like they built in Windows Vista/7? So perhaps others profiting big from discovering vulnerabilities in companies' products, and then shorting their stock is what's needed for these companies to significantly increase their security across the board. Is it ideal? Of course not. But if that's what it takes, then so be it. They could go nuts on the security front today, but they don't. They're waiting for the security disasters to happen first.

emn13 10y ago
Security catastrophes are unlikely to be sufficient to make companies take security seriously. After all, the PR damage seems limited (it's hard to blame someone for not understanding something you don't understand yourself), and the damage is often largely to third parties (i.e: customers). The people taking the risks aren't the ones paying the costs. And those paying the costs can't really tell who's taking the risks, nor judge well how it impacts them. It sort of reminds me of CO2 emmisions - and look how brilliantly that battle is going. This shorting is much better, actually - it impacts metrics companies actually optimize for, so it may actually affect behavior. Not only that, it allocates money to security research, creating a virtuous circle. But it's not all roses: it's only going to work as long as there's a stock market impact; and that's eventually dependent on security risks actually affecting the choices buyers make. That is uncertain. Most successful software has almost no competitors; software (well, and IP law) makes it trivial to create lock-in and software is trivial to mass-produce, so underdogs have a terrible time. For example: if you can effectively choose only between iOS and android, then you're likely to make that choice based on just a few of your top priorities (in CS terms: there's at most 1 bit of entropy here). Security may matter, but it's not going to have as much impact as it would in an actual proper market where there's sufficient choice for real competition to emerge.

cloudjacker 10y ago

"The Art of Short Selling" written by Kathryn Staley in 1997 should be in your book collection. Its been a business model all the way back to the 1850s. Software engineers are just late to the field, and now are much closer to the mechanisms that affect the market in many different industries.

Inthenameofmine 10y ago
Thank you so much! I was looking for some good reading material of this sort!

tptacek 10y ago

Is it? It's long been an article of faith among security pundits that short positions will (or even are, routinely) being used to liquidate security knowledge. But there aren't that many verticals in which vulnerability disclosures are really material to a company's underlying business. How many fewer iPhones would Apple sell if someone found a way to "jailbreak" the SEP? The difference would be a rounding error. How many fewer Jeeps will get sold if a new remote OTA car-crasher is discovered? What if Fiat Chrysler needs to do a product recall? Guess what: they already have to do those, all the time. Software vulnerabilities, however, can usually themselves be fixed OTA. Companies deployed hundreds of thousands of RF and GSM-connected smart meters. Almost all of them had massive OTA vulnerabilities. How likely were any of them to mess with smart meter deployment? Pretty much not at all. What we see with St. Jude is two cases in which vulnerability discoveries seemingly can have a material impact: * In medical devices, where the markets are already tuned into and ready to vigorously punish product recalls. * In M&A situations in regulated industries --- but then, that case is situational: you have to time your disclosure with an acquisition, and the flaw(s) you've found have to be so serious that they might delay the acquisition. I'm generally kind of skeptical that hack-and-short is going to be all that lucrative.

blazespin 10y ago
Sony hack sends stock down 10% in past week. Time that on option expiry, make zillions. Disclosing vulns, though, I,agree not a stock shorting business. http://money.cnn.com/2014/12/15/investing/sony-stock-hack/ http://money.cnn.com/2014/12/15/investing/sony-stock-hack/
- tptacek 10y ago
  For that scheme to work, it has to actually work: you need an attack that can damage the fundamentals of a business. Most trades aren't made by randos reacting to the news: they're allocation decisions made by pension funds and endowments and mutual fund firms, all of whom are run by people who understand that if they dump a position when it's down 10% because of the news cycle, they are going to look stupid and potentially lose their job when it turns out that the news cycle had nothing to do with the fundamentals of the company and the stock recovers --- probably not from the hack, but from whatever macro trend is jostling the market that week.

retube 10y ago

Because it's massively risky. There's no guarantee your "dirt" will cause the stock to drop.