I read with interest the comments on the "why are so many applied cryptographers unemployed?" thread. I know a _lot_ of unemployed folks. Or folks looking for more than "part time consulting" work. Lots of issues, lots of possible reasons for the high unemployment rate of applied cryptographers: * The collapse or sale or downsizing of several companies which formerly employed a fair number of Cypherpunks: PGP (used to employ about 6-10 list members that I know of), ZKS (maybe 5-8 active list memmbers, IIRC), C2Net in the 1994-97 years, Counterpane (several list members), and even Netscape (three list members, brothers, represented the "security department" for a while). This kind of collapse or downsizing dumps a lot of the same kind of people on the market. * End to crazy ideas of "let's do a start-up!" * An example. Here's part of an e-mail I received recently from someone who proposed that I give him some money for some kind of start up or charityware project in an area of interest to both of us. I have changed the details for obvious reasons: "I had this vague hope that you might be interested in throwing some money at an interesting problem in FOO to see if something worthwhile might result with a view to seeing if it could produce money later. Nothing so risky as a startup - a startup might make money, whereas what I was thinking of would be absolutely guaranteed a ROI of 0%. No risk there :-) Hopefully a chance of some fun and benefit to humanity though." (This writer, an acquaintance of mine, has been trying for several years to get various projects going. Sad to say, his very words above indicate just how flaky his ideas are. He thinks others will fund projects as a kind of charityware. Given the loaded cost of people these days, even with reduced expectations in this current downturn, it hasn't even been possible for billionaires like Paul Allen to fund projects successfully. Many examples exist, even of some crypto startups, where tens of millions of dollars went into salaries, benefits, perks, facilities, with essentially nothing to show for the expenditures. More on this point later.) *Back in the 1970s and early 80s, high tech start-ups were difficult to do. It took some really good ideas, or at least the departure of a talented group of people who had already developed something. Examples like Sun and Cisco are examples of where the core technology had already been developed (Stanford, in both cases) and where the companies could begin to SELL PRODUCTS almost immediately. * A company formed at about the time the VC industry was transitioning from "hard money" (hard to fund a start up) to "easy money" was RSA Data Security. And though it owned a much more valuable property than most recent crypto startups have owned, it almost went under a couple of times. Read Levy's "Crypto" for some details of how it almost failed in the late 80s and again in the early 90s. * I've seen a bunch of "applied crypto" companies during this recent Internet bubble where the intellectual property is far, far less compelling than "RSA" was. I don't mean to insult any of my friends here, but the notion with a lot of these companies seems to have been "We're young, we're Cypherpunks, let's raise some money, get a nice office space with our espresso bar and hot tub, hire our friends, and become rich." (This is perhaps too harsh a summary. But I'll let it stand as a reference point.) * There are still roles for start ups. But I think some really good ideas are needed. Just "riding the wave" is no longer working...it worked during the bubble years, for a bunch of companies...most of which are now greatly downsized or gone completely. * Don't quit your day job. And if you don't have a day job, get one (assuming you need some money...some folks have independent sources of some amount of money). (Note that during the tough period for RSA, most of the key technical people had other jobs, as professors, etc. I think Rivest took one year off from MIT to consult full-time for RSADSI, but mostly they had other jobs the whole time. Only after the revenues began consistently flowing were a lot of full-time people hired. During the bubble, of course, they staffed up to high levels, expanded, got involved in other ventures, etc. And Bidzos, of course, rode the bubble by co-founding and being Chairman of Verisign.) * Doing things in a garage is more than just a quaint image. It means "doing things without _any_ burn rate." It means having a day job. * The notion that a group will raise ten million bucks, rent expensive facilities, hire their friends, and THEN get to work on product development (or, more often, playing around with potential ideas), is just not plausible any longer. * especially dangerous is the seductive idea that one can take a broad idea, seek funding, be the CEO, and then "hire a bunch of guys like Ian Goldberg." Note: This is NOT directed at ZKS, which actually DID hire a guy like Ian Goldberg! Instead, what I mean is that I've heard more than a few people say that this is what they hope or plan to do with their crypto startups, that they hope (or "hoped," past tense, as they all seem to have abandoned these ideas now) to raise some VC money and THEN hire brilliant applied cryptographers to actually build the product. * Well, this business model ain't likely to work. For lots of reasons. First, product development in a startup has _always_ been an iffy proposition. (I frankly cannot think of any good examples where it has worked. Most successful products were developed by very small groups, or already developed. Yahoo, for example, was already running out of Jerry Yang's bedroom. Netscape was Mosaic was developed by a small group (Marc A. and others) at Fermilab, I've already mentioned Sun and Cisco, and there are other examples. I could make a catalog of what was developed where...left as an exercise for you to think about, or comment on in replies to this thread.) The second reason this business model doesn't seem to work is that there's a major shortage of Ian Goldbergs out there! A lot of "applied cryptography" people are actually not very skilled at coding, it appears. A lot of "applied cryptographers" are what used to be called "systems analysts" (in fact, the parallels are eerie). The third and probably most important reason is that a "good idea" is not enough. Products that people actually pay money for is the raison d'etre of companies. Whether the products are widgets or programs or services (though beware of service companies, as the money is usually not there), a company MUST sell something. A lot of folks seem to think companies are just cool places to play around with ideas at. (Side note: I witnessed a couple of "pre-bubble" companies which, in my opinion, didn't fully understand the importance of getting a product out very early and having real revenues to both fund further development and to act as a sanity check (feedback) on their ideas. They each burned through many millions of dollars in the 1988-93 period and both ultimately vanished. Ironically, they were pursuing ideas which lie at the foundations of modern e-commerce and the Net.) * If I were to fund a company (don't even ask!), I would look for several characteristics: -- a really good idea that could (could, not certainly will, as there is always risk) lead to actual sales of actual products -- a small group of people who have actually demonstrated some form of the product and who may already have a prototype, with money only needed to finalize the product and get it out on the market -- a group of people who are NOT each expecting $120K or more in loaded salaries so they can then begin to think about how to apply their cool ideas to some undefined market or product (high burn rates have killed many of the companies I've alluded to) -- people who have been working for nothing, who have day jobs, who have developed the idea or product with their own money and effort * To reiterate the obvious, the absolute worst approach is to just think that putting a bunch of Cypherpunks or other people together will somehow, miraculously, lead to a product being developed. It didn't work with Chaum, it didn't work with Xanadu, it didn't work with ZKS (in the original form), and it failed completely with Paul Allen's "Interval" project. (The oft-cited example of Xerox PARC is an interesting one to look at. I'll do that in another post, perhaps. I knew a lot of the folks at PARC.) So, I think a whole lot of technical people are unemployed because of the bursting of that crazy bubble we all know about. Not too surprising. And that bubble gave a lot of people the foolish idea that the product cycle is "Raise money, hire friends, spend a couple of years planning a product, do an IPO, retire rich." (One of the reasons for the bubble was related to this: a lot of high tech start-ups were "hollowed-out" by founders and early technical people getting out while the stock was skyrocketing, leaving only the spear carriers behind to try to get a product out the door. One guy I know was a core technical founder of one of the early Internet auction companies--not E-Bay, by the way. He sold his stock in the company in 1998-99, as it was hitting $100 a share and moved to a ranch in Montana with the profits. The company collapsed, for various reasons, was acquired, the acquirer also collapse, the stocks were delisted, and the remaining assets were picked up for small change by another auction company.) * As others in this thread have noted, most corporate "crypto experts" are mostly just product integrators and bug fixers. Anybody in a large company who is the "crypto expert" is probably just the guy shopping for whatever products are out there (we know that homegrown crypto is almost a bad idea anyway, so this is good) and then integrating them with the company's e-mail and Website products. And those products are almost always going to be whatever Microsoft and Verisign and others are selling. Boring, really. To close on a less bleak note, this is a fine time for people to "get back to basics." The world-changing implications of strong crypto are yet to come, and at least some of you will likely be involved in companies which both change the world and which make you very, very rich. Good luck, --Tim May