Thread by @ben__h

OK the deal with Hacker House/Innotech/Jen Arcuri et all

I am not going to deal with any salacious nonsense in this first and foremost, because its boring

But #1 - Hacker House is a UK registered company, and indeed operates in the UK, are some people in the US? Sure, why not

Is this unusual? Not even remotely, how often do you call a utilities company and get UK staff?

"Ahh but there registered office was a house!" Yep, so what? Not a fan of this myself given the PERSEC lapse, but not unusual, a PO box costs and thats money you can use elsewhere

"But they don't have a workforce in the UK...", not needed anymore, hell Estonia twigged onto this and is doing very nicely out of it

"They dont have a VAT #" - they don't need one if they are below the £85K threshold, and there are plenty of completely legal ways to make it so

Hell, any startup making a profit needs to have their CEO and board sacked, that money is better spent growing the business - the tax is paid via NI contributions and all the other fun ways the government has of sucking money out of the economy

"They got £125K in funding..." Peanuts, 15 years ago when the DTI had SMART awards, you could get unlimited £10K grants and a single grant of £100K - for a small company employing 3-6 people, the salary bill would burn through that in 2-3 months

Specifically for Hacker House, I got the feeling they hadn't gotten a clue as to the space they were operating in, lots of buzzwords, no real understanding that pentesting can be as easy as a Nessus scan, or insanely complex - or that most people buying the service have a clue

Jen was targeting big names, and was very, very good at getting access to "Da Bosses", who mostly being men with finance backgrounds in their 50's are going to be idiots when a young blonde starts flirting with them - the conditioned paranoid security teams less so

And it was the segment they were targeting - low tech skills, vulnerable to ego massage and lots of buzzwords - the companies doing it now use words like Blockchain - but have authorisation to spend large sums of money

I'm not going to lie, these are my favourite customers also

For a penetration test, I'd be expecting to spend at least £500/pd per tester, more if there is SAST/DAST occurring, over between 10 - 20 days, normal budget would be £15K per pentest, with a requirement for a minimum of 2 tests per application per year

There is "A LOT" of money in this sector - if you can deliver results, and in fairness to Jen, she was hustling hard to land some very big contracts, and looking at their filings, they haven't

Those looking for dirt - seriously, learn how to read a financial report!

Now on the other front, "The Tech Startup Scene", there is a huge amount of nonsense talked here - mostly because there are two types of companies that are startups

One is a company with a product, working ridiculous hours, the founders paying themselves a pittance

Seriously, I hope few people ever experience the joy of having to use a personal credit card to make payroll

These are companies that have zero interest in pandering to any of the blogs, because all of that nonsense detracts from the day job

The second are those who feed off actual startups or exploit the options available for them, these are pretty easy to spot though - they arrange "events", support "innovation", the staff don't have a clue about any of the underpinning aspects of the tech - nor do they need to

Most councils & central government have a not inconsiderable amount of cash available to support STEM events or similar, especially over the last few years

Do these events have any benefit - not really, at best they are a switchboard connecting people

At worse they are ego projects run by people massively out of their depth - but they have the time to pander to local government apparatchiks to get ahold of this money, which a product focused startup simply does not have time to do

Innotech definitely seemed to be one of the second type, and far, far from the only ones, I remember one group focused on STEM wanting to use some of my other activities as justification for getting a larger slice of funding out of HMG

They were so entitled they were stunned when I told them were to go, ditto the council liaison officer who was offended when I suggested he get his arse to some actual events "My door is open 10-4 and I have a personal life", so do we, and I'm not kowtowing when it suits you

There is zero quality control in this sector - its heavily driven by who you know, not what you know - and again probably why Innotech was moderately more successful than most (I know plenty of people who were envious of them)

However when you are running 3-4 events a year, things get stale quickly - and its not like you are paying people to speak at them (seriously check out how much it costs to hire a venue) and you are desperate to fill the gaps

I know several people who do rather well speaking at events and collecting lumps of perspex in order to promote their own brand or the company thats actually paying them, and it works for a few years, before they too become stale

I've known multiple people win the same award multiple years running, speaking of which we will be hitting that season soon...

Either way that leads us to the flap I've seen most recently about <dramatic music> Milo,

Christ we are in serious conspiracy theory territory here

As @GazTheJourno I'm sure will happily attest, Milo was a in tech journalism way before he found a much more lucrative opportunity

Hell, just look at The Kernel - although I will forever appreciate the roasting he gave to some of the wantrepreneurs when he dared to journey North

Nobody serious would give him the time of day, but there are plenty of people who want the attention...

And this is why he was welcome as a speaker - he filled dead space on a conference roster, nothing more serious than that

The real startup community is tight knit, it exists on contacts, shared struggle, friendly competition and someone having money for a round of drinks

The wantrepreneurs/type 2 community exists on creating the perception with people that have money and insufficient controls/knowledge, that they are the type 1 bunch, problems really arise when they believe they are the type 1's

And in comparison the tech scene is a bastion of good behaviour and practice compared to "wealth management" types - check the fees people, all that money is going up someones nose!

TL:DR - the whole Hacker House/Boris thing is a red herring focused on by people with a political agenda AND DONT KNOW HOW TO READ A FINANCIAL FILING (where the interesting stuff is)

@threadreaderapp unroll please