I used to say, and I continue to say, that most cyber policy experts have never seen a real exploit. Yes, even the news reports of 0days are addictive. They have cool names, like a street drug, they have a shadowy underworld, they have a bodyguard of rumors and insinuations. Literally, as I write this, Kaspersky is at CCC doing a street barker presentation on how much someone thought they were a legitimate target worth throwing down an iOS 0day chain on, which frankly is not something I would brag about as a nominally defensive company. 

Part of the problem is we analyze exploits out of failures. Reverse engineering an exploit does not show you the exploit any more than dissecting a Humboldt squid can show you the terrors of the deep.

Once you've seen an exploit change the world, you are forever stunned. It is impossible to go backwards to your previous life. It is like your first taste of sex or love or the feral inhuman joy of combat. For some people, it's probably better. 

But how exploits really work has shockingly little to do with the circus around exploits on social media or in the news, or press releases from endpoint security companies or government agencies. 

And the same is true with philanthropy. Here we have "Give Miami Day!" where some random billionaire will match your funds if you give to your school, which should be getting all the government funding it needs, but clearly isn't. I don't know if this is at all useful to be honest. It feels more like covering a hole your government put in your school budget on purpose.

I tried buying MEL science kits for entire classes of my local grade school. It worked once, and one of the kids was like "I didn't even know I liked science". But it was largely impossible to get the kits USED by the teachers, who are under levels of logistical stress that would stymie a Marine platoon. So I ended up giving up on this effort.

I supported Project Grapple, which worked well because they have a leader at the top who is focused on the success of a small set of kids in a very personal way. But those kinds of leaders are almost impossible to find. When you find them, it's the best investment you can make if you want to change the world one kid at a time, which might be the only way. And these leaders don't last forever.

A lot of big donors focus on things like FIRST Robotics, which frankly has been a massive success and offers a lifeline for kids in schools where nothing else matters or meets with any success. It's prohibitively tricky to figure out which schools have a local leader that can take money and build a robotics club out of it. It's very much not important that the kids WIN the competitions - which at the top level are between Northrop Grumman, Raytheon, and Lockheed Martin engineering teams doing ad-hoc group apprenticeships. So again, finding these leaders is a constraining problem.

Just like with exploits, what I find is that changing the world with philanthropy is targeted , personal, and more complicated than it looks. I have seen very smart people struggle with finding leverage in this space. Nonprofits are themselves often quite exploitative of their employees or just generally ineffective. 

Anyways, what I'd like to see is the Gulas and Syversons and Alperovitch's and Pollocks and so forth put a Slack channel together to build a bit of a body of work on how to do this correctly. A bugtraq for changing the world with dollars, if you will.

-dave