[wutbrodo]

I learned a long time ago that the default assumption for non-tech-first companies should be deep, deep incompetence, below the level of an undergrad with a decent CS degree, when it comes to basic security practice. Even having your system be Incredibly Important isn't enough to force basic competence: there were plenty of government and bank systems through the 2000s that were apparently designed and maintained by high school kids (looking at you Citibank).

By 2019, a lot of the industries running more critical systems like finance have figured out that you should take your tech seriously (and it only took them twenty years to figure it out...) ,but it's still a pretty good baseline assumption.

[benj111]

"non-tech-first companies"

Is an ISP not tech first?

Bell labs is an off shoot of a phone company, early computing was based on the efforts of phone companies. Phone companies, which ISPs are the modern variant are the original tech companies.

Edit to add: Virgin maintains a fibre optic network so we aren't just talking about a sales front end to someone else's network.

[sipos]

Despite this, they are completely clueless when it comes to technology. I think only a tiny minority of their staff know that they maintain a fiber network, let alone what that means.

[wutbrodo]

Yea I know, I considered that someone would raise the fact that they're a telco. It's difficult to articulate what I mean by tech-first, and I don't want to lean on "I know it when I see it", but I'm describing a cluster in thingspace that I think is clear to pretty much everyone here.

[root]

I’d say that at heart they’re a utility company rather than a tech company.

[JeremyBanks]

Is We a tech-first company?

[wutbrodo]

I don't know enough about We. Aren't they a real estate company?

[mygo]

In their S1 they claim they’re SAAS ( “space-as-a-service” )

eyeroll emoji

[hallihax]

Virgin Media is profit-first, above all else. It's an error to assume that the part of the company that builds out infrastructure is in any way joined up with the part of the company that keeps customers secure (if indeed, they even have people responsible for that, which they apparently don't).

This is why things like GDPR end up being foisted on us. Corporations have proven themselves capable of simply ignoring legislation designed to protect their customers, and simply paying a fine later. They'll secure when it's convenient to them, and not a minute earlier.

[wutbrodo]

This model wouldn't seem to explain why eg Google and Facebook have world-class security. You can think whatever you want about the stuff they do intentionally, but I don't think leaving yourself open to hacking is that sound a business strategy for anyone, and I don't think it's a coincidence that more technically-competent companies also tend to be more secure.

[hallihax]

Google and Facebook both started life as tech companies.

Virgin started life as a one-man job hawking records out of a wheelbarrow.

Virgin is not a tech company. Their model is not centered around technology, but content.