4 ms·

The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid. Assuming you were in a TV show, and offered two op

The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid. Assuming you were in a TV show, and offered two options: Spin wheel 1 with a 95% chance of winning $5M, or spin wheel 2 with a 50% chance of winning $50M, which one are you going to spin? The EV is higher on the second one, sure, but taking the near-certain 5M may still be a better choice - a bird in the hand is worth two in the bush. Additionally, this group is said to do its research and adjust ransoms accordingly, so it seems likely that the ransom amount was a carefully thought out choice.

p1necone 5y ago
The difference in actual value between the two for me at least is much smaller than the difference in numerical value. Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) . This is the same reason that people who decry spending money on lottery tickets as a stupid thing to do based on the EV alone are thinking far too simplistically.
- tgsovlerkhgsel 5y ago
  > The difference in actual value between the two for me at least is much smaller than the difference in numerical value. That was exactly one of the reasons why I showed that example. While this may be different for a gang that has to split the money N ways, the "bird in the hand" might still be worth the two (or ten) in the bush, due to this or other factors.
- femto 5y ago
  Off topic, but I'm curious: What do you want to build and why can't you start building it now?
  - p1necone 5y ago
    Mostly software - games and related tooling, learning more about type systems and applying it in a homebrew language. I can start building it now. But after already spending 40 hours a week writing code at my day job and having those problems swimming around in my head all the time it's hard to find the motivation to do more, even when what I do for my day job isn't as creatively fulfilling.
- deleted 5y ago
  [deleted]
IgorPartola 5y ago
Re. this group doing its research: one of my past employers got hit by a patent troll C&D demand, threatening to sue. It was clearly bogus but also clearly enough of a hassle that the company didn’t want to pick the fight if one could be avoided. Our clients were actually throwing their support behind us fighting it, offering their legal resources. But at the end of the day what the higher ups told us is that this patent troll was “very professional. They did their research on us and know exactly how much we can afford or pay them without going out of business.” So we ended up paying and I guess it all worked out ok from there.
- tbihl 5y ago
  Yeah, unfortunately the games that go into extortion mean that fighting back only makes sense (a) on such a long time scale that no one is considering it while being extorted, or (b) because it's the right thing to do.
- myrandomcomment 5y ago
  When I was young my father had a new company in a industry that was known for lawsuits. The first came came in and I looked at it and said settle. He said no F’ing way. We won. Even with winning the legal fees, the cost in manhours was more then settling. Then the next one hit. Did not settle and won……and so on. After about 3 years no more lawsuits. His reputation was never settle and the trolls moved on. Never negotiate with terrorist. As long as they feel there is a chance they will get paid it never stops. Burn it to the ground, but do not give in.
  - raverbashing 5y ago
    You're correct This lesson should have been learned at school. If you give in to the bully you get exploited more. Sure it's more work to fight. But it makes sure you're not abused so much.
deleted 5y ago
[deleted]
bumbledraven 5y ago
Which option maximizes the long-term rate of growth of your wealth depends on how much money you already have. The Kelly Criterion takes this into account and handles a wide range of situations including this one. Example: Say you have $10⁵, and you have the option to play game 1, which offers a 95% chance of a $5×10⁶ prize, or game 2, which offers a 50% chance of a $5×10⁷ prize. By the Kelly Criterion, the value of a scenario is the expected value of the logarithm of your wealth under that scenario: • not playing at all = lg[10⁵] = 5 • game 1 = 95%×lg[10⁵ + 5×10⁶] + 5%×lg[10⁵ + 0] ≈ 6.6 • game 2 = 50%×lg[10⁵ + 5×10⁷] + 50%×lg[10⁵ + 0] ≈ 6.3 So game 1 is the best option if you have only $10⁵. On the other hand, if you have, say, $10⁶, then game 2 is the best option.
- RyanHamilton 5y ago
  Great example. It is worth emphasising your model will capture the game from the ransom attackers perspective since for them it is repeated many times. It won't give the EV for the attacked as their number of ransom incidents will hopefully be very small rather than tend to infinity. Which likely means the EV will be based on their own personal utility function.
  - bumbledraven 5y ago
    The Kelly Criterion can be used to analyze the options from the defender’s point of view, e.g.: • pay for security that prevents attacks = lg[company value – cost of security] • don’t pay for security = attack probability × lg[company value – cost of dealing with attack] + (1 – attack probability) × lg[company value]

p1necone 5y ago

The difference in actual value between the two for me at least is much smaller than the difference in numerical value. Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) . This is the same reason that people who decry spending money on lottery tickets as a stupid thing to do based on the EV alone are thinking far too simplistically.

tgsovlerkhgsel 5y ago
> The difference in actual value between the two for me at least is much smaller than the difference in numerical value. That was exactly one of the reasons why I showed that example. While this may be different for a gang that has to split the money N ways, the "bird in the hand" might still be worth the two (or ten) in the bush, due to this or other factors.
femto 5y ago
Off topic, but I'm curious: What do you want to build and why can't you start building it now?
- p1necone 5y ago
  Mostly software - games and related tooling, learning more about type systems and applying it in a homebrew language. I can start building it now. But after already spending 40 hours a week writing code at my day job and having those problems swimming around in my head all the time it's hard to find the motivation to do more, even when what I do for my day job isn't as creatively fulfilling.
deleted 5y ago
[deleted]

IgorPartola 5y ago

Re. this group doing its research: one of my past employers got hit by a patent troll C&D demand, threatening to sue. It was clearly bogus but also clearly enough of a hassle that the company didn’t want to pick the fight if one could be avoided. Our clients were actually throwing their support behind us fighting it, offering their legal resources. But at the end of the day what the higher ups told us is that this patent troll was “very professional. They did their research on us and know exactly how much we can afford or pay them without going out of business.” So we ended up paying and I guess it all worked out ok from there.

tbihl 5y ago
Yeah, unfortunately the games that go into extortion mean that fighting back only makes sense (a) on such a long time scale that no one is considering it while being extorted, or (b) because it's the right thing to do.
myrandomcomment 5y ago
When I was young my father had a new company in a industry that was known for lawsuits. The first came came in and I looked at it and said settle. He said no F’ing way. We won. Even with winning the legal fees, the cost in manhours was more then settling. Then the next one hit. Did not settle and won……and so on. After about 3 years no more lawsuits. His reputation was never settle and the trolls moved on. Never negotiate with terrorist. As long as they feel there is a chance they will get paid it never stops. Burn it to the ground, but do not give in.
- raverbashing 5y ago
  You're correct This lesson should have been learned at school. If you give in to the bully you get exploited more. Sure it's more work to fight. But it makes sure you're not abused so much.

deleted 5y ago

[deleted]

bumbledraven 5y ago

Which option maximizes the long-term rate of growth of your wealth depends on how much money you already have. The Kelly Criterion takes this into account and handles a wide range of situations including this one. Example: Say you have $10⁵, and you have the option to play game 1, which offers a 95% chance of a $5×10⁶ prize, or game 2, which offers a 50% chance of a $5×10⁷ prize. By the Kelly Criterion, the value of a scenario is the expected value of the logarithm of your wealth under that scenario: • not playing at all = lg[10⁵] = 5 • game 1 = 95%×lg[10⁵ + 5×10⁶] + 5%×lg[10⁵ + 0] ≈ 6.6 • game 2 = 50%×lg[10⁵ + 5×10⁷] + 50%×lg[10⁵ + 0] ≈ 6.3 So game 1 is the best option if you have only $10⁵. On the other hand, if you have, say, $10⁶, then game 2 is the best option.

RyanHamilton 5y ago
Great example. It is worth emphasising your model will capture the game from the ransom attackers perspective since for them it is repeated many times. It won't give the EV for the attacked as their number of ransom incidents will hopefully be very small rather than tend to infinity. Which likely means the EV will be based on their own personal utility function.
- bumbledraven 5y ago
  The Kelly Criterion can be used to analyze the options from the defender’s point of view, e.g.: • pay for security that prevents attacks = lg[company value – cost of security] • don’t pay for security = attack probability × lg[company value – cost of dealing with attack] + (1 – attack probability) × lg[company value]