• 0 Posts
  • 41 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle





  • The best description I have seen for single store franchisees is, you’ve paid a lot to give yourself a job. They are not lucrative, and in fact, are capital intensive, and often predatory.

    There is a very high up front cost, and you generally do not own the real estate. This means you are locked into 30 year leases, often with complicated terms that are solely beneficial to the land owner.

    Next, with regards to liquidity, if you don’t own the real estate, you often can’t get multiple business loans with a single franchise, so you must secure the loan with your personal assets, which means you will go personally bankrupt if you hit a rough patch.

    Then, after dealing with the complicated business to business transactions and legal work, you still have to deal with the corporate bullshit, taxes, and supervisory duties, particularly if you do not already have a strong business partner to do this for you.

    Pretty much, unless you are independently wealthy, own the real estate in a high traffic location, or already have multiple other franchises, it’s a losing venture that will kill your soul and eat every dollar you have.



  • What does fairness have to do with it? Compound interest is just math.

    One could trivially make an argument that we should redistribute the wealth among the population, but there is not a clear way how to do this effectively, or it would have been done already.

    The hard part is taking on the appropriate amount of risk in order to actualize those gains; a bank won’t just give you a 10% interest rate, you have to work your ass of for it. An entrepreneur needs to assess the landscape and invest in what the market will want tomorrow, and most people guess suboptimally (3-6%), or end up losing money, whether in fact (negative returns) or relative to inflation (0-3%).

    Even pointing to the S&P 500, as most people do, you still need to make the conscious decision to sell and take profits, FOMO be damned. Or alternatively, taking a perceived loss but actual profit (e.g., you didn’t sell right at the peak, but that’s usually okay). It’s not easy, and most people don’t have the time or stomach for it; these people are best served by long term, government-backed bonds, after which you will come out only slightly ahead of inflation.

    Using the rule of 72, and a 3% bond rate, it would actually take you 24 years to double your money, not seven. And that, my friend, is why you and I are not billionaires.


  • And guess what those business have? Valuations. Stock price is just an aggregate indicator of the valuation for a company, for the given percentage of shares that are publicly traded. But private companies have valuations, too, and even if they’re not tied to a public stock offering, those valuations are used to form these Billionaire lists.

    Same thing with real estate. The value of any asset is based on what someone is willing to pay. Sometimes, you’ll find some crazy billionaire or investment firm who grossly overvalues an asset relative to their peers, and that insane overvaluation does get rolled into those lists.

    But such is the nature of economics. You’ve neither gained nor lost value until someone pays you. Until then, it’s anyone’s guess.












    1. From the title of your article and your executive summary, the premise of your paper is that CVSS is flawed, and CITE is your solution.
    2. From the title of your article, and choice of name, “QHE CVSS Alternative; CITE”. CVSS is a VULNERABILITY Scoring System. CITE, as your propose, is a THREAT evaluation tool. You can see how one could have the impression that they were incorrectly being used interchangeably.

    As you yourself stated, CVSS does exactly what it says on the box. It provides a singular rating for a software vulnerability, in a vacuum. It does not prescribe to do anything more, and it does a good job doing what it sets out to do (including specifically as an input to other quantitative risk calculations).

    Compare what with attack?

    Your methodology heavily relies on “the analysis of cybersecurity experts”, and in particular, frequently references “exploit chains”, mappings which are not clearly defined, and appears to rely on the knowledge of the individual practitioner, rather than existing open frameworks. MITRE ATT&CK and CAPEC already provide such a mapping, as well as a list of threat actor groups leveraging tactics, techniques, and procedures (e.g., exploitation of a given CVE). Here’s a good articlewhich maps similarly to how we operate our cybersecurity program.

    I think there is a lot on the mark in your article about the issues with cybersecurity today, but again, I believe that your premise that CVSS needs replacing is flawed, and I don’t think you provided a compelling case to demonstrate how/why it is flawed. If anything, I think you would agree that if organizations are exclusively using CVSS scores to prioritize remediation, they’re doing it wrong, and fighting an impossible battle. But this means the organization’s approach is wrong, not CVSS itself.

    Your article stands better alone as a proposal for a methodology for quantifying risk and threat to an organization (or society?), rather than as a takedown of CVSS.