4 ms·

Hello, author here. The main point is that it's not a financially rational decision to ditch Microsoft. There's just no real alternative for businesses, as mos

Hello, author here. The main point is that it's not a financially rational decision to ditch Microsoft. There's just no real alternative for businesses, as most use AD, Teams, Outlook/Exchange and couple others.

lmm 1y ago
I don't think expected value is the right way to evaluate this. All insurance is negative expected value (that's how insurance companies make a profit), but businesses find it rational to buy insurance. Also I'd say your risk of getting cut off is much more than 1 in 2 million, because there's nothing to say this can only be done to one company at a time. What if Trump adds e.g. a whole country to the sanction list, and tells Microsoft to cut that country off?
- ArcHound 1y ago
  That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution. The risk of getting cut off is the most random variable on the list. I agree with your point, but I have no data to back it up with.
  - lmm 1y ago
    > That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution. Right but that's clearly not the right way to think about it; if you did that you'd never buy insurance (and probably never do any security work tbh, since very little of it can be justified in expected value terms). The impact of catastrophic damage is nonlinear.
    - ArcHound 1y ago
      Yes, at the end of the article I come to the conclusion that this method has flaws. But the general insurance can be modelled with ROSI. Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you.
      - lmm 1y ago
        > Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you. But in the real world those numbers are backwards - otherwise insurance companies would go bankrupt! Your insurance for that will cost, like, 70k/year, your ROSI will be 80%, and you'll still buy the insurance, and you'll be right to do so.
        ArcHound 1y ago
        Of course it was an oversimplified example. All I wanted to show that ROSI can make a compelling argument for buying insurance. Now you're arguing that insurance is too cheap.
        lmm 1y ago
        > All I wanted to show that ROSI can make a compelling argument for buying insurance. But it can't! In the real world, insurance will always be a bad idea in expected value terms (unless being sold by an insurance company with bad pricing that's about to go bankrupt). Your model doesn't work and the only way you can pretend it works is by making up unrealistic fake numbers.
        ArcHound 1y ago
        Sorry, I don't follow then. Of course insurance companies will try to make a profit. The core of the method can be used to compare insurances and technically anything above zero is a good investment. I will reply no further here.
      - IsTom 1y ago
        That's like saying that you can make profit off credit card debt if rates are negative. It's not a real-world case and nobody is going to offer that, it's not an analysis of any insurance that actually happens.

lmm 1y ago

I don't think expected value is the right way to evaluate this. All insurance is negative expected value (that's how insurance companies make a profit), but businesses find it rational to buy insurance. Also I'd say your risk of getting cut off is much more than 1 in 2 million, because there's nothing to say this can only be done to one company at a time. What if Trump adds e.g. a whole country to the sanction list, and tells Microsoft to cut that country off?

ArcHound 1y ago
That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution. The risk of getting cut off is the most random variable on the list. I agree with your point, but I have no data to back it up with.
- lmm 1y ago
  > That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution. Right but that's clearly not the right way to think about it; if you did that you'd never buy insurance (and probably never do any security work tbh, since very little of it can be justified in expected value terms). The impact of catastrophic damage is nonlinear.
  - ArcHound 1y ago
    Yes, at the end of the article I come to the conclusion that this method has flaws. But the general insurance can be modelled with ROSI. Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you.
    - lmm 1y ago
      > Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you. But in the real world those numbers are backwards - otherwise insurance companies would go bankrupt! Your insurance for that will cost, like, 70k/year, your ROSI will be 80%, and you'll still buy the insurance, and you'll be right to do so.
      - ArcHound 1y ago
        Of course it was an oversimplified example. All I wanted to show that ROSI can make a compelling argument for buying insurance. Now you're arguing that insurance is too cheap.
        lmm 1y ago
        > All I wanted to show that ROSI can make a compelling argument for buying insurance. But it can't! In the real world, insurance will always be a bad idea in expected value terms (unless being sold by an insurance company with bad pricing that's about to go bankrupt). Your model doesn't work and the only way you can pretend it works is by making up unrealistic fake numbers.
      - ArcHound 1y ago
        Sorry, I don't follow then. Of course insurance companies will try to make a profit. The core of the method can be used to compare insurances and technically anything above zero is a good investment. I will reply no further here.
    - IsTom 1y ago
      That's like saying that you can make profit off credit card debt if rates are negative. It's not a real-world case and nobody is going to offer that, it's not an analysis of any insurance that actually happens.