A self-published author recently reviewed his last two quarters and could not make the numbers add up. He had shipped every book on schedule, finished several ahead of plan, and had a launch team ready to go on each release. Profits still fell. Output went up, and attention went somewhere else. That mismatch is the most useful thing in the story, because it points at a rule that holds far beyond publishing: the work that determines the outcome is almost never the work that is visible while it is being done. Effort is the baseline. Position is the result. Confusing the two is how competent people end up losing to circumstances they never thought to measure.
Call it the output trap. We are taught that consistency equals results, and consistency does not equal results; it equals the floor. Everything above the floor is system. In the author’s case, the variables that actually moved the revenue line were discoverability, review velocity, and the platform algorithm, and he controlled none of them directly. He did his part flawlessly and got paid less for it, which feels like injustice and is really just arithmetic. The market does not reward effort because the market cannot see effort. It sees position, and position is produced by a set of mechanisms most producers never study because studying them feels like a distraction from the real work. The distraction is the real work, or at least half of it.
Why Output Stopped Predicting Profit
What makes the trap durable is that the feedback arrives too late and too blurred to teach anything. A quarter of falling sales does not hand back a diagnosis. It hands back a number, and the number is compatible with a dozen different stories, most of which are more flattering than the true one. The author can conclude the market softened, or that the genre cooled, or that he needs to publish faster, and the last conclusion is the most dangerous because it is actionable. He will work harder along the axis he already controls, because that axis is the only one with a lever attached, and the harder work will not touch the variable that actually moved. Systems that hide their causes reliably train people to over-invest in the visible input.
The same shape shows up inside a company, and the clearest example is the one-on-one. The advice about running them well is almost too simple to take seriously: close the laptop, silence the notifications, and sit with the other person in a room with as few distractions as you can manage. Not because every conversation will be profound, but because attention is the only resource that actually transfers between two people, and it does not transfer partially. Most managers run these meetings with half a mind on the next calendar block, and the person across the table can tell within ninety seconds. The conversation then collapses into status updates, because status updates are what you bring to someone who is not fully present, and the real issue stays unsaid. The cost of that is not one wasted half hour. It is months of missed signals, quiet disengagement, and a team that has learned, correctly, that the thing that matters is not worth raising.
Attention Is the Transfer Mechanism
Now push the same principle down into the infrastructure layer, where the stakes get denominated in money rather than morale. BTCPay Server, the open-source Bitcoin payment processor, is offering a bitcoin bounty after a wallet exploit, up to 3 BTC or roughly $190,000, for help recovering funds that were stolen. The flaw let attackers obtain LND admin macaroons, the credentials that grant broad control over a Lightning Network node, and use them to reach connected wallets. BTCPay had warned users days earlier to upgrade to version 2.4.2 or take their servers offline. The project also donated 0.21 BTC each to the security researchers Craig Raw and the Bitcoin Red Team for disclosing the vulnerability responsibly.
The bounty makes news. The disclosure does not, and the asymmetry is the whole point. Somebody found that flaw by reading code paths almost no user ever opens, following a credential from the place it is issued to every place it can be presented, and asking what happens at each handoff. That work is unglamorous, frequently unpaid, and completely invisible until the moment it turns out not to have been done. BTCPay is trying to price it correctly, and the economics resist pricing. The software is free. The risk is carried by merchants who never read the code. The reward for finding the flaw is a bounty drawn from recovered funds that may never be recovered at all. The project said as much itself, describing its contributions to the researchers as modest but necessary, which is an honest description of a payment that cannot possibly match the value delivered.
The Bounty and the Disclosure
This is a structural problem in open-source infrastructure rather than a failure by any particular project. Payment rails, consensus code, and networking stacks, the pieces that hold value together while everything else is built on top of them, are routinely maintained by small teams on limited budgets. A critical vulnerability in Lightning credentials is not a niche concern. Lightning exists to move Bitcoin quickly and cheaply, and BTCPay is one of the primary self-hosted front ends for merchants who want to avoid custodial risk, which means the people most exposed here are precisely the ones who made the more careful choice. The exploit targeted the seam between node administration and wallet access, and that seam is not unique to this codebase. It exists anywhere a management credential and a spending credential live close enough together for one to reach the other. Finding it requires the kind of deep, patient reading that almost no team can afford to sponsor, because the budget line for it produces nothing measurable in any quarter where it works.
The common thread across all three cases is that the real work happens before the visible outcome, in a place where nobody is watching. The author needs to understand distribution systems, not write faster. The manager needs to protect attention, not fill time. The researcher needs to trace a credential path through code, not patch the symptom after the fact. Systems do not announce where they are fragile; they wait for somebody to look in the right place, and looking in the right place is a skill built from the accumulated habit of looking in a lot of wrong ones.
Urgency Is a Lagging Indicator
What makes this genuinely hard, rather than merely neglected, is that none of the work looks urgent until it is too late for it to help. The author’s sales did not fall because of one bad decision; they fell because several small trends aligned over months while nobody was tracking them. The manager’s team does not disengage on a Tuesday; it erodes through a series of conversations that each seemed fine. The flaw in the Lightning credentials sat in the code, entirely stable and entirely exploitable, until somebody with the wrong intentions got there first. Urgency is a lagging indicator, and organizations that allocate attention by urgency are, by construction, always allocating it to the previous problem.
The bounty is an attempt to change that timing, and it deserves credit as an attempt even where it falls short. By attaching a real number to recovery, BTCPay is trying to make invisible work visible enough to compete with the other things a skilled person could do with a weekend. It will not fix the funding problem, because a bounty is a payment for outcomes and the work in question is a payment for attention. What it does acknowledge is something most projects prefer not to say: the people who find bugs before they become exploits are performing a public service, and a public service with no market signal attached will be supplied in whatever quantity charity happens to produce.
The best systems are built by people who care more than the minimum requires, and the caring is not enthusiasm. It is attention, applied where nobody is checking. They read the code. They notice the drift before it becomes a trend. They show up for the conversation without the phone. The world is crowded with people who want the result, and it is nearly empty in the place where the work that produces it actually happens.
Leave a Reply