Grab bag: learning from users and victims