==Phrack Inc.==

                Volume 0x10, Issue 0x47, Phile #0x11 of 0x11

|=-----------------------------------------------------------------------=|
|=-----------------------=[ Calling All Hackers ]=-----------------------=|
|=-----------------------------------------------------------------------=|
|=--------------------------=[ cts (@gf_256) ]=--------------------------=|
|=-----------------------------------------------------------------------=|

--[ Table of Contents

0 - Preamble
1 - About the Author
2 - The Birth of a Shitcoin
3 - How Money Works
    3.1 - Fixed Income
    3.2 - Equities
    3.3 - Shareholder Value
4 - Startup Blues
5 - Takeaways
6 - Thanks
7 - References
8 - Appendix

--[ 0 - Preamble

Hi. 

I'm cts, also known as gf_256, ephemeral, or a number of other handles.
I am a hacker and now a small business owner and CEO. In this article, 
I would like to share my experience walking these two different paths.

A hacker is someone who understands how the world works. It's about 
knowing what happens when you type "google.com" and press Enter. It's 
about knowing how your computer turns on, about memory training, A20, 
all of that. It's about modern processors, their caches, and their side 
channels. It's about DSi bootloaders and how the right electromagnetic 
faults can be used to jailbreak them. And it's about how Spotify and 
Widevine and AES and SGX work so you can free your music from the 
shackles of DRM.

But being a hacker is so much more than these things. It's about knowing 
where to find things. Like libgen and Sci-Hub and nyaa. Or where to get 
into the latest IDA Pro group buy. Or which trackers have what and how 
to get into them.

It's about knowing how to bypass email verification. How to bypass SMS 
verification. How to bypass that stupid fucking verification where you 
hold your driver's license up to a webcam (thank you, OBS virtual camera!) 
Having an actual threat model not just paranoia. Knowing that you're not 
worth burning a 0day on, but reading indictments to learn from others' 
mistakes.

It's about knowing where to buy estradiol valerate on the internet and how 
to compound injections. Or the "bodybuilder method" to order your own 
blood tests when your state requires a script to do so. It's about knowing 
which shipments give the US CBP a bad vibe and which don't.

It's about knowing what happens when you open Robinhood and giga long NVDA 
FDs. I mean the actual market microstructure, not "Ken Griffin PFOF bad". 
Then using that microstructure to find an infinite money glitch (high 
Sharpe!). It's about knowing how to get extra passports and reading the
tax code. 

It's about knowing how to negotiate your salary (or equity). It's about 
knowing why things at the supermarket cost what they do. Or how that awful 
shitcoin keeps pumping. And why that dogshit startup got assigned that 
insane valuation. And understanding who really pays for it in the end 
(hint: it's you).

My point is, it is not just about computers. It's about understanding how 
the world works. The world is made up of people. As much as machines keep 
society running, those machines are programmed by people--people with 
managers, spouses, and children; with wants, needs, and dreams. And it is 
about using that knowledge to bring about the change you want to see.

That is what being a hacker is all about.


--[ 1 - About the Author

I have been a hacker for 13 years. Prior to founding Zellic, I helped
start a CTF team called perfect blue (lately Blue Water). We later became
the number one ranked CTF team in the world. We've played in DEF CON CTF.
We've won GoogleCTF, PlaidCTF, and HITCON. It's like that scene from
Mr. Robot but not cringe.

In 2021, we decided to take that hacker friend circle and form a security 
firm. It turned out that crypto paid well, so we worked with a lot of 
crypto clients. In the process, we encountered insane, hilarious, and 
depressingly sobering bullshit. In this article, I will tell some stories 
about what that bullshit taught me, so you can benefit from the same 
lessons as I have.

Markets are computers; they compute prices, valuations, and the allocation 
of resources in our society. Hackers are good at computers. Let's learn 
more about it.


--[ 2 - The Birth of a Shitcoin

I can't think of a better example than shitcoins. Let's look at the
crypto markets in action.

First, let's talk about tokens. What is their purpose? The purpose of a 
token is to go up. There is no other purpose. Token go up. This is 
important, remember this point.

Now the question is, how do we make the token go up? In crypto, there are 
two main kinds of token deals. Let's call them the Asian Arrangement and 
the Western Way.

The Asian Arrangement is a fairly straightforward pump and dump. It's a 
rectangle between the VC, the Market Maker, the Crypto Exchange, and the 
Token Project Founder.

1. The exchange's job is to list the token, bringing in investors. They 
   get paid in a mix of tokens and cold, hard cash. Their superpower is 
   owning the customer relationships with the retail users, and the 
   naming rights to sports arenas.

2. The market maker provides liquidity so the market looks really 
   healthy and well-traded so it is easy to buy the token. In good 
   deals, they are paid in in-the-money call options on the tokens, 
   so they are incentivized to help the token trade well. Their 
   superpower is having a lot of liquidity to deploy, and people 
   on PagerDuty.

3. The founder's job is to pump the token and shill it on Twitter. 
   They are the hype man, and it's their job to drum up the narrative 
   and pump everyone's bags. Their unique power is they can print more 
   tokens out of thin air, and this is in large part how they get paid 
   in this arrangement.

4. Lastly, the VC gets paid to organize the deal. They give the founders 
   some money, who in return give a pinky promise that they will give 
   the VC a lot of tokens once the tokens actually exist. This is known 
   as a Simple Agreement for Future Tokens, or SAFT. Their superpower is 
   dressing up the founders and project so it seems like the Next Big 
   Thing instead of a Ponzi scheme.

Everyone gets paid a ton of token exposure (directly or indirectly), 
and when it lists, it pumps. Then the insiders dump and leave with a 
fat stack. Except retail, they end up with the bag. 

Sometimes the listing doesn't go well for the organizers, in which case, 
better luck next time. But retail always loses.


  wtf???   LFG!!! to the moon   
       ,o  \oXo/\o/          
       /v   | |  |
      /\   / X\ / \

    crypto investors
        ^ |
        | |
        | v
    +----------+                provides liquidity          +--------+
    |  Crypto  |  <---------------------------------------  | Market |
    | Exchange |  ----------------------------------------> | Maker  |
    +----------+                   maker fees               +--------+
        ^ |                                                    ^     
  fees, | | listing                                    options |     
 tokens | |                                            / fees  |      
        | |  +-------------------------------------------------+
        | v  |                                                        
    +---------+       tokens / SAFT / token warrants       +---------+
    |  Token  |  --------------------------------------->  | Venture |
    | Project |  <---------------------------------------  | Capital |
    +---------+     cash , intros to CEX / MM, shilling    +---------+


This machine worked exceptionally well in 2017, especially before China 
banned crypto. All those ICO shitcoins? Asian Arrangement. And it still 
works well to this day, except people are more wary of lockups and vesting 
schedules and so on.

Now let's discuss the Western Way. The Asian Arrangement? That old pump 
and dump? No sir, we are civilized people. Instead, our VCs *add value* 
to their investments by telling the world "how disruptive the tech is" 
and how the "team are incredible outliers". And they will not blatantly 
PnD the token, but instead they will fund "projects in the ecosystem" so 
it appears there is real activity happening on the platform. 

This is to hype up metrics (like TPS or TVL) to inflate the next round 
valuation. Anyways, then they dump. Or maybe the VC is also a market 
maker so they market make their portfolio company tokens. Overall it's 
the same shit (Ponzi) but dressed up in a nicer outfit.

Asian Arrangement or Western Way--either way, if you're the token founder, 
your main priority is to just GO TO MARKET NOW and LAUNCH THE TOKEN. This 
is so you can collect your sweet bag and dump some secondary before 
someone else steals the narrative or the hype cycle moves on.

This is one of the reasons there are so many hacks in crypto. The code is 
all shitty because it's rushed out as fast as possible by 20-something-
year-old software engineers formerly writing Typescript and Golang at
Google. Pair that with some psycho CEO product manager. Remember, it is
not about WRITING SECURE CODE, it is about SHIPPING THE FUCKING PRODUCT.
Good luck rewriting it in Rust!

All of this worked well until Luna, then 3AC, Genesis, and FTX imploded in 
2022. It still works, but you have to be less blatant now.

Shitcoins do serve an essential need. They are an answer to financial 
nihilism. Many people are working dead-end wage slave jobs that are not 
enough to "make it". They feel trapped and forced to work at jobs they 
fucking hate and waste their life doing pointless shit to generate 
shareholder value. This kind of life feels unacceptable, yet there are 
few avenues out. So what is the only "attainable" solution left? Gamble 
it on shitcoins, and if you lose...maybe next paycheck will be better.

But enough about crypto, let's talk about securities.


--[ 3 - How Money Works

----[ 3.1 - Fixed Income

First, let's start with fixed income. I'm talking boring, old-fashioned
bonds, like Treasury bonds. A lot of people are introduced nowadays to 
finance through equities (stocks) and tokens. In my opinion, this is 
only half of the story. Fixed income is the bedrock of finance. It has 
fundamental value. It provides a prototypical asset that all assets can 
be benchmarked based on.

Fixed income assets, like bonds, boil down to borrowing and lending. A 
bond is basically an IOU for someone to pay you in the future. It is more 
useful to have a dollar today than in a year, so lenders charge a fee for 
access to money today. This fee is known as interest, and how it is baked 
into the equation varies from asset-to-asset. Some bonds come with 
interest payments, whereas other bonds are zero-coupon. The most important 
thing is to remember that bonds are essentially an IOU to pay $X in the 
future.

Here is an example. Let's say you would like to borrow $100 to finance an 
upcoming project. The interest rate will be 5% per year. To borrow money, 
you would issue (mint) a bond (an IOU) for $X+5 dollars to be repaid 1 
year in the future. In exchange for this fresh IOU, the lender will give 
you $X dollars now. 

On the lender's balance sheet, they will be less $X dollars worth of cash, 
but will also have gained ($X+5) dollars worth of an asset (your IOU), 
creating $5 of equity. In contrast, you would have $X more cash in assets, 
but also an ($X+5) liability, creating -$5 of equity. 

This example also works for depositing money at a bank. Here, you are the 
lender, and the bank is the borrower. Your deposits would be liabilities 
on their balance sheet, as they are liable to pay you back the deposit if 
you choose to withdraw it.

     Lender's Balance Sheet               Borrower's Balance Sheet   
   ===========================          ===========================  
    Assets:                              Assets:
      IOU-----------------X+5              Cash------------------X
                                         
    Liabilities:                         Liabilities:
      Cash----------------(X)              IOU-----------------X+5
                                         
    Equity:                              Equity:
      Equity----------------5              Equity--------------(5)

Fixed income assets are extremely simple. There are various risks (credit 
risk, interest rate risk, etc.), but excluding these factors, you 
essentially get what you pay for. Unlike a token or stock, the bond is not 
going to suddenly evaporate or crash. (In theory.) Because of this, they
can be modeled in a straightforward way; a way so straightforward even
a high school student can understand it.

Let's say I have $X today. Suppose the prevailing (risk-free) interest 
rate is 5%. What is the value of this $X in a year? Obviously, it would be 
no less than $X*1.05, as I can just lend it out for 5% interest and get 
$X*1.05 back in a year. If you gave me the opportunity to invest in any 
asset yielding less than 5%, this would be a bad deal for me, since I 
could just lend it out myself to get 5% yield.

Now, let's analyze the same scenario, but in reverse. Let's take that IOU 
from earlier. What is the value *today* of a (risk-free) $X IOU, due in 1 
year? It would be worth no more than $X/1.05. This is because with $X/1.05 
dollars today, I could lend it out and collect 5% interest to end up with 
$X again in the future. If I pay more than $X/1.05, I am getting a bad 
deal, since I am locking up my money with you when it would be more 
capital efficient to just lend it out myself.

You can probably see where I am going with this. The present value of an 
$X IOU at some time *t* in the future is $X/(1+r)^t, where *r* is the 
discount rate. The discount rate describes the "decay" of the value over 
time, due to interest but also factors like potential failure of the asset 
(for example, if the asset is a company, business failure of the company). 

Now, if we have some asset which pays a series of future cash flows 
*f(t)*, we can model this asset as a bundle of IOUs with values f(t) due 
in time 1, 2, 3, and so on. Then the present value of this asset is the 
geometric series sum of the discounted future cash flows. This is called 
discounted cash flows (DCF). Congrats, now you can do better modeling than 
what goes into many early-stage venture deals.

   +------+-----+-----+---------+---------+---------+-------+---------+
   | Year |  0  |  1  |    2    |    3    |    4    |  ...  |    t    |
   +------+-----+-----+---------+---------+---------+-------+---------+
   | Cash | CF1 | CF2 |   CF3   |   CF4   |   CF5   |  ...  |  CF_t   |
   | Flow |     |     |         |         |         |       |         |
   +------+-----+-----+---------+---------+---------+-------+---------+
   | Disc.| CF1 |_CF2_| __CF3__ | __CF4__ | __CF5__ |  ...  | _CF_t__ |
   | Val  |     | 1+r | (1+r)^2 | (1+r)^3 | (1+r)^4 |       | (1+r)^t |
   +------+-----------+---------+---------+---------+-------+---------+
           IOU 1 IOU 2   IOU 3     IOU 4     IOU 5     ...     IOU n

         inf
          _   f(t)                                               1
   DCF = \  ------- = (assume constant annual cash flow x) = --------- x
         /_ (1+r)^t                                          1-1/(1+r)
         t=0
   
       = (1/r + 1) x
   
   Cash flow multiple = (value) / (annual cash flow) ~= 1/r

(The astute reader might also find that they can go backwards from 
valuations to estimate first, second, ... Nth derivatives of the cash 
flow or the year-to-year survival chances of a company. And these can be 
compared with...going outside and touching grass to see if the valuation 
actually makes sense.)

At this point, you're probably wondering why I'm boring you with all of 
this dry quant finance 101 shit. Well, it's a useful thing to know about 
how the world works.

First, interest rates affect you directly and personally. You may have 
heard of the term "zero interest rate environment". In a low interest rate 
environment, cash flow becomes irrelevant. Why? Consider the DCF geometric 
series sum if the interest rate r = 0. The present value approaches 
infinity. If the benchmark hurdle rate we're trying to beat is 0%, 
literally ANYTHING is a better investment than holding onto cash. 

Now do you see why VCs were slamming hundreds of millions into blatantly 
bad deals and shit companies during Covid? Cash flow and profitability 
didn't matter, because you could simply borrow more money from the money 
printer.

Here's a more concrete example. Do you remember a few years ago when Uber 
rides were so cheap, that they were clearly losing money on each ride? 

This is known as Customer Acquisition Cost, or CAC. CAC is basically the 
company paying you to use their app, go to their store, subscribe to the 
thing, ... whatever. The strategy is well-known: burn money to acquire 
users until everyone else dies and you become a monopoly. Then raise the 
prices. 

But here is the key point: this only works in a low-interest rate 
environment. In such an environment, discounting is low, and thus, future 
growth potential is valued over profitability and fundamentals at present. 
It doesn't need to make sense *today* as long as it works 10 years from 
now. For now, we can keep borrowing more money to sustain the burn.

Of course, when rates go back up, the free money machine turns off and 
the effects ripple outward. You are the humble CAC farmer, farming CAC 
from various unprofitable consumer apps like ride share, food delivery, 
whatever. These apps raise their money from their investors, VC and 
growth equity funds. These funds in turn raise their money from *their* 
investors, their limited partners. These LPs might be institutional 
capital like pension funds, sovereign wealth funds, or family offices. 

At the end of the day, all of that wealth is generated somewhere 
throughout the economy by ordinary people. So when some VC-backed 
founders throw an extravagant party on a boat with fundraised dollars, 
in some sense, you are the one paying for it.

And when the money machine turns off, anyone who had gotten complacent 
under ZIRP is now left scrambling. Companies will overhire during ZIRP 
only to do layoffs when rates go up.


                         +=========================+                       
                         |   THE LIQUIDITY CYCLE   |                       
                         +=========================+                       
                                                                           
                                                                           
                                             VENTURE CAPITAL               
                   _______________      ,.-^=^=^=^=^=^=^=^=^=^;,           
                 ,;===============>>   E^ a16z   LSVP    Tiger '^3.        
               .;^                    E^       FF    Social Cap. '^3       
              //  condensation       .E    Bain   SoftBank  Accel 3^       
             /|^                     ^E  KP          Benchmark    :^       
             ||                       ^;:   YC    Greylock   GC  ;3'       
     ,.^-^-^-^-^-^-^-^-^-^-^;,          ^.=.=_=_=_=_=_=_=_=_=_=_=^         
    E^ endowments    family '^:.            \\\\\\\\\\\\\\\\\\\\           
   E^                offices  '^3            \\\\\\\\\\\\\\\\\\\\          
  E'  pension                  ^3. SOURCE     \\\ precipitation \\         
  ^;   funds       sovereign   3.' CAPITAL     \\\\\\\\\\\\\\\\\\\\        
   E;:           wealth funds ,3^  (LPs)        \\\\\\\\\\\\\\\\\\\\       
    ^;._.._._._._._._._._._._,^                  \\\\\\\\\\\\\\\\\\\\      
                                                               /\          
      ^ ^ ^ ^ ^ ^ ^ ^                      gamefi   /\  /\  uber eats      
      | | | | | | | |                     shitcoins/::\/::\  /::::\   /\   
      | evaporation |                             / doordash/^^^^^^\ /^^\  
      | | | | | | | |         ____________       /      \  /     hello   \ 
                             (poggers desu)     /_____ lime ____ fresh ___\
    \o/ \oXo/\oXoXo/  o       '=========='       UNPROFITABLE CONSUMER APPS
     |   | |  | | |  /|\         Oo._ /\_/\                 ,///           
  __/_\_/_X_\/_X_X_\_/_\__ /_________(@'w'@)_____________.,://'            
          SOCIETY          \''''''''  -...-''''''''''''''''' surface       
                                    THE HUMBLE               runoff        
                                    CAC FARMER                             

Second, credit is not inherently a bad thing if used responsibly. Take for 
example those Buy Now, Pay Later loans. Now that you are equipped with the 
concept of capital efficiency, wouldn't it technically better than paying 
cash to take an interest-free BNPL loan and temporarily stick the freed 
cash into an investment? (Barring other side effects, etc.)

Third, the concept of net present value--i.e., credit--is the killer app 
of finance. It allows you to transport value from the future into today. 
Of course, that debt must be repaid in the future, unless you can figure 
out a way to kick the can down the road forever.

For now, let's get back to stocks.

----[ 3.2 - Equities

Now we have seen both sides of the coin. Asset value is twofold: 
speculative and fundamental.

First, we saw speculative value as illustrated by crypto meme coins. Then, 
on the other hand, we examined fundamental value as illustrated by, e.g. a 
US Treasury. These two lie on two extremes of a spectrum. Some sectors and 
stocks are more speculative than others; Nvidia is practically a meme coin 
at this point, whereas something like Coca-Cola is like fixed income for 
boomers (NFA BTW). Most assets have a blend of both.

Thinking about stocks, they (usually) have some fundamental value. 
Equities represent ownership of some asset, like a business. The business 
in theory generates dividends for shareholders, and this cash flow (or the 
net present value of future ones) represents the fundamental value of the 
business. As we've seen, assets with better cash flows are more valuable.

In practice, buybacks can be used to create what is effectively a 
shareholder dividend in a more tax-advantaged way. Whereas with dividends, 
they are taxed as income, and this is realized immediately. With buybacks, 
they are taxed as capital gains, but crucially the gains are not realized 
until the asset is sold. This could be indefinitely far in the future, so 
it's more capital efficient. It has the added benefit that it helps pump 
the token, and imo this is kind of cute because it marries both the 
fundamental and speculative aspects.

Meanwhile, like tokens, stocks are also supposed to go up. Here's an 
example: imagine a generic meme coin. Apart from Go Up, what does it do? 
Nothing. Even if it's a Governance Token, who cares when the founders and 
VCs hold all the voting power? Anyways, I'm describing Airbnb Class A
Common Stock. Here's an excerpt from their S-1 [1] [2]:

> We have four series of common stock, Class A, Class B, Class C, and 
> Class H common stock (collectively, our "common stock"). The rights of 
> holders of Class A, Class B, Class C, and Class H common stock are 
> identical, except voting and conversion rights ... Each share of Class A 
> common stock is entitled to one vote, each share of Class B common stock 
> is entitled to 20 votes and is convertible at any time into one share of 
> Class A common stock ... Holders of our outstanding shares of Class B
> common stock will beneficially own 81.7% of our outstanding capital 
> stock and represent 99.0% of the voting power of our outstanding capital 
> stock immediately following this offering, ...


                   Name of             |  Class B   |   %   | % of Vot-
              Beneficial Owner         |   Shares   |       | ing Power
  -------------------------------------+------------+-------+-----------
    Brian Chesky                       | 76,407,686 | 29.1% |  27.1%
    Nathan Blecharczyk                 | 64,646,713 | 25.3% |  23.5%
    Joseph Gebbia                      | 58,023,452 | 22.9% |  21.4%
    Entities Affil. w/ Sequoia Capital | 51,505,045 | 20.3% |  18.9%     


Why do people buy tech stocks with inflated valuations? Some may because 
they believe that they will go up, that they will be more dominant, 
important, and valuable in the future. Like tokens, a large part of 
stocks' value is speculative. They are expressing their opinion on the 
future fundamentals. Others may simply because they believe others will 
believe that it is more valuable. Not fundamentals, this is an opinion 
about *pumpamentals*.

Importantly, unlike fundamental value, speculative value can be created 
out of thin air. It is minted by *fiat*. Fundamental value is difficult 
to create, whereas speculative value can be created through hype and 
psychology alone.

----[ 3.3 - Shareholder Value

For stocks, there are usually laws in place to protect investors, pushing 
the balance between "speculation" and "fundamentals" towards the latter. 
As a result, firms are generally legally obligated to act in their 
shareholders' best interests. This is good because normal people will be 
able to participate in the wealth generated by companies. And obviously, 
companies should not defraud their investors.

However, the biggest *stake* holders in a business, are usually (in order):

1. The employees.  No matter what, no one else is spending 8 hours a day, 
   or ~33% of their total waking lifespan at this place. Whatever it is, 
   I guarantee you the employees feel it the most.

2. The customers.  The customers are the reason the business is able to 
   exist in the first place. Non-profits are not exempt: their customers 
   are their donors.

3. The local community / local environment / ecosystem.  The business
   doesn't exist in a vacuum. The business has externalities, and those 
   externalities affect most the immediate surrounding environment.

4. And in last place, the shareholders.  They do not really do anything 
   except contribute capital and hold the stock. Of course capital is 
   important but they are not spending 8 hours a day here, they are not 
   the reason the business exists, and in fact they might even live in a 
   totally different country.

For large, publicly-listed companies, the shareholders have one more 
unique difference from the other three stakeholders: liquidity. This 
difference is critical.

Liquidity describes how easy it is to buy and sell an asset. A dollar 
bill is liquid. Bitcoin is liquid. A house is relatively illiquid. Stock 
in large, publicly-listed companies is also liquid. A shareholder can buy 
a stock one day and sell it the next. As a result, the relationship is 
non-commital and opens the opportunity for short-term thinking. 

There are many things a company could do which would benefit shareholders 
short term, while harming the other three stakeholders long term. While a 
shareholder can simply dump their position and leave, the mess created is 
left for the employees, customers, and community to clean up.

(The SPAC boom was a pretty good example of this. Not all SPACs are bad, 
but a lot of pretty shit businesses publicly listed through SPACs then 
crashed. This is sad to me because some of that is early investors and 
founders dumping on retail like a crypto shitcoin, but dressed up because
it's NYSE or NASDAQ. Get liquidity then bail.)

Now, it is a misconception that stock companies must solely paperclip-
maximize short-term shareholder value. However, this is how it often 
plays out due to fucked up shit in the public markets, like annoying 
activist hedge funds or executive compensation tied to stock price. And 
it is true that employees can be shareholders. And that is usually a good 
thing! But few public companies are truly employee-owned.

Thinking about it from this perspective, the concept of maximizing 
shareholder value seems somewhat backwards. But *why* would one make 
this system where the priorities are seemingly inverted?

One benefit is that it would make your currency extremely valuable. 
Suppose you want to do some shit on Ethereum (speculating on some animal 
token?), you will need to have native ETH to do that transaction. 
Similarly, if you want to invest in US securities you at some point need
US Dollars. If you want to get a piece of that sweet $NVDA action, you
need dollars. People want to buy American stocks. American companies
perform well: they're innovative; they're not too heavily regulated;
it's a business friendly environment. (Shareholder value comes first!)
The numbers go up.

Remember the token founder from earlier in the Asian Arrangement? Suppose 
you are a *country* in the situation above, with a valuable currency. Not 
only is your currency in demand and valuable, you are the issuing/minting 
authority for that token. Similar to the token founder, you can print 
valuable money and pay for things with it.

And speaking of being a founder, let's talk about that!


--[ 4 - Startup Blues

Based on what we've set up so far, I will discuss some of the problems I 
see with many startups today and with startup culture.

Much of the problems stem from misalignment between shareholders and the 
other stakeholders (employees, etc). A lot of this comes from the 
fundamentals of venture capital. VC is itself an asset class, like fixed 
income and equities. VCs pitch this to their limited partners, at some 
level, based on the premise that their VC fund will generate yield for 
them. The strategy is to identify stuff that will become huge and buy it 
while it's still small and really cheap. Like trading shitcoins, it's
about finding what's going to moon and getting in early.

In a typical VC fund, a small handful of the investments will comprise the 
entire returns of the fund, with all of the other investments being 0's. 
The distribution is very power law. This means we are not looking for 1x, 
2x, or 3x outcomes; these may even be seen as failure modes. We are only 
interested in 20x, 50x, 100x, etc. outcomes. This is because anything 
less will be insufficient to make up for all the bad investments that 
get written down to zero.

For the same reason, it only makes sense for VCs to invest in certain 
types of companies. Have you ever heard this one? "We invest in SOFTWARE 
companies!...How is this SCALABLE? What do the VENTURE SCALE OUTCOMES look 
like here?" This is because these kinds of companies are the ones with the 
potential to 100x. They want you to deliver a 100x. Or how about this one? 
"We invest in CATEGORY-DEFINING companies". At least in security, 
"category-defining" means a shiny new checkbox in the compliance / cyber 
insurance questionnaire. In other words, a new kind of product that people 
MUST purchase. 

The market is incentivized to deliver a product that meets the minimum bar 
to meet that checkbox, while being useless. I invite you to think of your 
favorite middleware or EDR vendors here. For passionate security founders 
considering raising venture, remember that this is what your "success" is 
being benchmarked against.
         
                      _.,------------------------------_ 
                   .%'                                 '&.  
                  .;'    We  partner  with  founders     ^;
                  !      building  category-defining      ;!
                  ;   companies at the earliest stages   _;
                   ^;                                  _.^
                     ''-.______________    __________.-' 
                                      /   /
                                     /  /^
                                    / /^
                                   /;^
                                  /' 
                   _________                           _________           
                _-'         '.                      _-'         '.         
              ,^             '^_                  ,^             '^_       
             /'               '"'                /'               '"'      
            ^'                 ^\^              ^'                 ^\^     
            :                   ^|              :                   ^|     
            :       .       .   |)              :       .       .   |)     
            :           \       |)              :           \       |)     
             :         __\     ,;                :         __\     ,;      
              "   !            ;                  "   !            ;       
              "   ^\  _____  /'                   "   ^\  _____  /'        
              '| | ^\      _/^                    '| | ^\      _/^         
               |    ^'====='                       |    ^'====='           
               | .   |   |                         | .   |   |             
             _'          |^__                    _'          |^__          
 ---------_-'        U       '--_ -------------_-'        U       '--_ -----  
 ._   _.-'                       '-._     _.-'                       '-    
   ':.'  \            ;         /     ': .'  \            ;         /    [4]

It's due to the thirst for 100x that there are painful dynamics. A 
fledgling startup may have founders they really like, but the current 
business may be unscalable. Bad VCs will push founders towards strategies, 
bets, models that have a 1% chance of working, but pay out 200x if they 
do. 

In the process they destroy a good business--one which has earned the 
trust of dutiful employees and loyal customers--all for a lottery ticket 
to build a unicorn. They will throw 100 darts at the dartboard and maybe 5 
will land, but what is it like to be the dart? You may have good expected 
value, but all of that EV is from spikes super far away from the origin. 
Is it pleasant betting everything on this distribution?

VC's want founders to be cult leaders. Have you ever heard this line? "We 
invest in great storytellers." Like what we saw with stocks and tokens, 
much of the easily-unlockable potential upside in assets is speculative. 
In essence, value can be created through narrative. Narrative *IS* value. 
Bad VC's will push founders to raise more capital at ever higher 
valuations (higher val = markup = fees), using narrative as fuel for the 
fire. Storytelling means "pump the token", and the job of the CEO is to 
(1) be the hype man and to raise (2) cash and (3) eyeballs. For this 
reason, Sam Altman and Elon are fine CEOs, regardless of other factors, 
because they are great at all three.

Much to the detriment of founders' and their employees' psyche, investors 
expect founders to be this legendary hype man. This requires a religiosity 
of belief that is borderline delusional. Have you ever tried to convince 
one of those Silicon Valley YC-type founder/CEOs that they are wrong? They 
will never listen to you because they have been socialized to be this way. 
It is what is expected of them, and it is easy to fall into this trap 
without even becoming aware of it. But if you think about it, does it make 
sense that to be a business owner, you need to be a religious leader? Of 
course not.

All of these reasons are why so many startup founders are young. They have 
little to lose, so gambling it all is OK. Being a cult leader may be 
traumatizing, but they have time (and the neuroplasticity) to heal. And 
lastly, they do not have the life experience to have a mature personal 
identity beyond "I am a startup founder". All of this makes it easy to 
accept the external pressures to build a company this or that way. And 
perhaps not the way they would have wanted to, relying instead on their 
personal values. The true irony is that the latter is what creates true, 
enduring company culture and not the made-up Mad Libs-tier Company Culture 
Notion Page shit that so many startups have. And of course, good VCs are 
self-aware of all of the issues and strive to prevent them. But the 
overall problem remains.

One last externality is for communities based around an industry. When you 
add billions of venture dollars into an industry, it becomes cringe. 
It's saddening to me seeing the state of certain cybersecurity conferences 
which are now dominated by..."COME TO OUR BOOTH, YOU CAN BE A HACKER. 
PLEASE VIEW OUR AI GENERATED GRAPHICS OF FIGURES CLAD IN DARK HOODIES 
STATIONED BEHIND LAPTOPS". Here I would use the pensive emoji U+1F614 
to describe my feelings about the appropriation of hacker culture but 
Phrack is 7-bit ASCII, so please have this: :c u_u . _.

--[ 5 - Takeaways

The point is, all of this made me feel very small and powerless after I 
realized the sheer size of the problems I was staring at. Nowadays, to 
me it's about creating good jobs for my friends, helping our customers, 
and taking care of the community. Importantly, I realized that this is 
still making a bigger positive impact than what I could have done alone 
just as an individual hacker or engineer.

To me, businesses are economic machines that can create positive (or 
negative) impact in a consistent, self-sustaining way. There are many 
people who are talented, kind, and thoughtful but temporarily unlucky. 
Having a company let me help these friends monetize their abilities and be 
rewarded fairly for them. And in that way I helped make their life better. 
Despite a lot of the BS involved in running a business, this is one thing 
that is very meaningful to me.

You can understand computers and science and math as much as you want, but 
you will not be able to fix the bigger issues by yourself. The systems 
that run the world are much bigger than what we can break on our laptops 
and lab benches.

But like those familiar systems, if we want to change things for the 
better, we have to first understand those systems. Knowledge is power. 
Understanding is the first step towards change. If you do not like the 
system as it is, then it is your duty to help fix it.

Do not swallow blackpills. It's easy to get really cynical and think 
things are doomed (to AGI apocalypse, to environmental disaster, to 
techno/autocratic dystopia, whatever). I want to see a world where 
thoughtful hackers learn these systems and teach each other about them. 
That generation of hackers will wield that apparatus, NOT THE OTHER WAY 
AROUND.

Creating leverage for yourself.  Hackers should not think of themselves as 
"oh I am this little guy fighting Big Corporation" or whatever. This is 
low agency behavior. Instead become the corporation and RUN IT THE WAY YOU 
THINK IT SHOULD BE RUN. Keep it private and closely held, so no one can 
fuck it up. Closely train up successors, so in your absence it will 
continue to be run in a highly principled way that is aligned with your 
values and morals. Give employees ownership, as it makes everyone aligned 
with the machine's long-term success, not just you.

Raising capital.  Many things do really need capital, but raise in a 
responsible way that leaves you breathing room and the freedom to operate 
in ways that are aligned with your values. Never compromise your values or 
integrity. Stay laser focused on cash flows and sustainability, as these 
grant you the freedom to do the things right.

HACKERS SHOULDN'T BE AFRAID TO TOUCH THE CAPITAL MARKETS.  Many hackers 
assume "oh that fundraising stuff is for charismatic business types". I 
disagree. It's probably better for the world if good thoughtful hackers 
raise capital. Giving them leverage to change the world is better than 
giving that leverage to some psycho founder drinking the Kool-Aid. I 
deeply respect many of the authors in Phrack 71, and I would trust them to 
do a better job taking care of things than an amorphous amalgam of angry 
and greedy shareholders.

For all things that don't need capital, do not raise. Stay bootstrapped 
for as long as possible. REMEMBER THAT VALUATION IS A VANITY METRIC. Moxie 
Marlinspike wrote on his blog [3] that we are often guilty of always
trying to quantify success. But what is success? You can quantify net
worth, but can you quantify the good you have brought to others lives?

For personal goals, think long term. People tend to overestimate what they 
can do in 1 year, but underestimate what they can do in 10. DO NOT start a 
company thinking you can get your hands clean of it in 2-3 years. If you 
do a good job, you will be stuck with it for 5-10+ years. Therefore, DO 
NOT start a company until you are sure that is what you want to do with 
your life, or at least, your twenties/thirties (depending on when you 
start). A common lament among founders, even successful ones, is: 
"Sometimes I feel like I'm wasting my twenties". There's an easy Catch-22 
here: you may not know what you really want until you do the company; but 
once you do the company, you won't really be able to get out of it. Be 
wary of that.

Creating value.  This is one of those meaningless phrases that I dislike. 
Value is what you define it to be. Remember to work on things that have 
TAMs, but remember that working on art is valuable too! It is not all 
about the TAM monster--doing cool things that are NOT ECONOMICALLY 
VALUABLE, but ARTISTICALLY VALUABLE, is equally important. There is not 
much economic value in a beautiful polyglot file, but it is artistically 
delightful. This is part of why people hate AI art: it may be economically 
valuable, but it is often artistically bankrupt. (Some people do use 
generative tools in actually original and artistic ways, but this is the 
exception not the norm currently.)

Founders vs Investors.  Here is my advice: Ignore any pressure from 
investors to make company "scalable" or whatever. Make sure your investors 
have no ability to fire you or your co-founder(s). Make sure you and 
co-founder are always solid and trust each other more than investors. You 
and your cofounders need to be BLOOD BROTHERS (/sisters/w.e). If an 
investor is trying to play politics with one of you to go against the 
other cofounder, cut that investor out immediately and stop listening to 
them.

Any investor who pushes for scalability over what you think is the best 
interest of the company is not aligned with you. High-quality investors 
will not push for this because they are patient and in it for the long 
game. If you are patient, you can make a very successful company, even if
it is not that scalable. High-quality investors will bet on founders and
are committed; only bad ones will push for this kind of shit.

I'm going to avoid giving more generic startup advice here. Go read Paul 
Graham's essays. But remember that any investor's perspective will not be
the perspective of you and your employees. Pivoting 5 times in 24 months
is not a fun experience to work at: your employees will resign while your
investors celebrate your "coming of age journey"--unless everyone signed
up for that terrifying emotional rollercoaster from the start.

They say that "hacker" is a dying identity. Co-opted by annoying VC-backed 
cybersecurity companies that culturally appropriate the identity, the term 
is getting more polluted and diluted by the day. Meanwhile, computers are 
getting more secure, and they are rewriting everything in Rust with 
pointers-as-capability machines and memory tagging. Is it over?

I disagree. As long as the hacker *ethos* is alive, regardless of any 
particular scene, the identity will always exist. However, now is a 
crucible moment as a diaspora of hackers, young and old, venture out into 
the world. 

Calling all hackers: never forget who you are, who you will become, and 
the mark you leave.


--[ 6 - Thanks

Greetz (in no particular order):
 * ret2jazzy, Sirenfal, ajvpot, rose4096, Transfer Learning, samczsun, 
   tjr, claire (aka sport), and psifertex.
 * perfect blue, Blue Water, DiceGang, Shellphish, and all CTF players.
 * NotJan, nspace, xenocidewiki, and the members of pinkchan and Secret Club.
 * Everyone at Zellic, past and present.

Finally, a big thank you to the Phrack staff (shoutout to netspooky and 
richinseattle!) for making this all possible.


--[ 7 - References

[1] https://www.sec.gov/Archives/edgar/data/1559720/000119312520315318/
        d81668d424b4.htm
[2] https://www.sec.gov/Archives/edgar/data/1559720/000119312522115317/
        d278253ddef14a.htm
[3] https://moxie.org/stories/promise-defeat/

[4] https://twitter.com/nikitabier/status/1622477273294336000


--[ 8 - Appendix: Financial institution glossary for hackers

(Not serious! For jokes... :-)

- IB:  Investment Bank. Basically collect fat fees to do up ("advise on") 
       M&As and other transactions. Help match buyers and sellers for your 
       private equity. They are like CYA for your deal.

- PE:  Private Equity. Basically buy not-overly-seriously ("poorly") run 
       companies, fire the management, then run it "professionally" (i.e. 
       make it generally shitty for customers and employees and community 
       for the benefit of shareholders)

- HF:  Hedge Fund. Trade out pricing inefficiencies

- MM:  Market Maker. Basically the same thing

- VC:  Basically gamble on tokens (crypto or stocks) and back cool and/or 
       wacky ideas that the rest of these people find too stinky to invest
       in

- PnD: Pump and Dump.

- TVL: Total Value Locked. Basically how much money is currently in a 
       blockchain or smart contract system.

- TPS: Transactions Per Second. A measure of how scalable or useful a 
       blockchain or database is. An oft-abused metric hacked by vaporware 
       shillers for hype and PnD purposes.

- TAM: Total Addressable ~~Memory~~ Market. Basically how much money a 
       given idea can make.

- NFA: Not finanical advice.

|=[ EOF ]=---------------------------------------------------------------=|